Edit tour

Windows Analysis Report
daw21.exe

Overview

General Information

Sample name:	daw21.exe
Analysis ID:	1579701
MD5:	08d493bfdfa30242a5846dbdef4c1948
SHA1:	f543aa3ad55c4b4fe176bc610c6d90ff278a8b2f
SHA256:	7dccfe6b2eab06663f0b7dac8406252f4bf222fff85dc75c356be422dab0f46e
Tags:	exeStealCuser-lontze7
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Extensive use of GetProcAddress (often used to hide API calls)

Found evasive API chain (date check)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

One or more processes crash

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

daw21.exe (PID: 5256 cmdline: "C:\Users\user\Desktop\daw21.exe" MD5: 08D493BFDFA30242A5846DBDEF4C1948)

WerFault.exe (PID: 940 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5256 -s 1388 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "https:/135.181.65.216/ee45b7c5e4cb75cb.php"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
daw21.exe	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000000.2038269918.0000000000DFB000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2621310462.0000000000B2E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: daw21.exe PID: 5256	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: daw21.exe PID: 5256	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.daw21.exe.dd0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.daw21.exe.dd0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET JA3 Hash - [Abuse.ch] Possible Dridex

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T07:59:13.802979+0100	2028765	3	Unknown Traffic	192.168.2.5	49704	135.181.65.216	443	TCP

Code function: 0_2_00DD56C0 lstrcpy,lstrlenA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,InternetOpenA,StrCmpCA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,InternetConnectA,HttpOpenRequestA,lstrlenA,lstrlenA,GetProcessHeap,HeapAlloc,lstrlenA,memcpy,memcpy,lstrlenA,memcpy,lstrlenA,lstrlenA,memcpy,lstrlenA,HttpSendRequestA,InternetReadFile,lstrlenA,lstrcpy,lstrcatA,lstrcpy,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00DD56C0

Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net
Source: daw21.exe, 00000000.00000002.2621310462.0000000000B2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://135.181.65.216
Source: daw21.exe, 00000000.00000002.2621310462.0000000000B7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://135.181.65.216/
Source: daw21.exe, 00000000.00000002.2621310462.0000000000B7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://135.181.65.216/405117-2476756634-1003
Source: daw21.exe, 00000000.00000002.2621310462.0000000000B7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://135.181.65.216/E
Source: daw21.exe, 00000000.00000002.2621310462.0000000000B2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://135.181.65.216/m-

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: C:\Users\user\Desktop\daw21.exe

Code function: 0_2_00DD97A0 memset,memset,lstrcatA,lstrcatA,lstrcatA,memset,wsprintfA,OpenDesktopA,CreateDesktopA,memset,lstrcatA,lstrcatA,lstrcatA,memset,SHGetFolderPathA,lstrcpy,StrStrA,lstrcpyn,lstrlenA,wsprintfA,lstrcpy,memset,CreateProcessA,Sleep,CloseDesktop,

0_2_00DD97A0

Source: C:\Users\user\Desktop\daw21.exe

Code function: String function: 00DD4980 appears 316 times

Source: C:\Users\user\Desktop\daw21.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5256 -s 1388

Source: daw21.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.evad.winEXE@2/5@0/1

Source: C:\Users\user\Desktop\daw21.exe

Code function: 0_2_00DF46C0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,Process32Next,CloseHandle,

0_2_00DF46C0

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5256

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\fbc4675a-4122-4d42-970c-84b519be0ce2

Jump to behavior

Source: daw21.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\daw21.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: daw21.exe	ReversingLabs: Detection: 57%
Source: daw21.exe	Virustotal: Detection: 56%

Source: unknown	Process created: C:\Users\user\Desktop\daw21.exe "C:\Users\user\Desktop\daw21.exe"
Source: C:\Users\user\Desktop\daw21.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5256 -s 1388

Source: C:\Users\user\Desktop\daw21.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\daw21.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\daw21.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\daw21.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\daw21.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\daw21.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\daw21.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\daw21.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\daw21.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\daw21.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\daw21.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\daw21.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\daw21.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\daw21.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\daw21.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\daw21.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\daw21.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\daw21.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\daw21.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\daw21.exe	Section loaded: schannel.dll	Jump to behavior

Source: C:\Users\user\Desktop\daw21.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: daw21.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\daw21.exe

Code function: 0_2_00DF63C0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00DF63C0

Source: C:\Users\user\Desktop\daw21.exe

0_2_00DF63C0

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\daw21.exe

Evasive API call chain: GetSystemTime,DecisionNodes

graph_0-6079

Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: daw21.exe, 00000000.00000002.2621310462.0000000000B8F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWs
Source: daw21.exe, 00000000.00000002.2621310462.0000000000B5F000.00000004.00000020.00020000.00000000.sdmp, daw21.exe, 00000000.00000002.2621310462.0000000000B8F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: daw21.exe, 00000000.00000002.2621310462.0000000000B2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\daw21.exe

API call chain: ExitProcess graph end node

graph_0-6496

Source: C:\Users\user\Desktop\daw21.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\daw21.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\daw21.exe

Code function: 0_2_00DD4980 VirtualProtect 00000000,00000004,00000100,?

0_2_00DD4980

Source: C:\Users\user\Desktop\daw21.exe

0_2_00DF63C0

Source: C:\Users\user\Desktop\daw21.exe

Code function: 0_2_00DF63C0 mov eax, dword ptr fs:[00000030h]

0_2_00DF63C0

Source: C:\Users\user\Desktop\daw21.exe

0_2_00DD56C0

Source: C:\Users\user\Desktop\daw21.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: daw21.exe PID: 5256, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\daw21.exe

Code function: 0_2_00DF46C0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,Process32Next,CloseHandle,

0_2_00DF46C0

Source: C:\Users\user\Desktop\daw21.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\daw21.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\daw21.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\daw21.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\daw21.exe

Code function: 0_2_00DF3E10 lstrcpy,lstrcpy,GetSystemTime,

0_2_00DF3E10

Source: C:\Users\user\Desktop\daw21.exe

Code function: 0_2_00DF29E0 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_00DF29E0

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: daw21.exe, type: SAMPLE
Source: Yara match	File source: 0.0.daw21.exe.dd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.daw21.exe.dd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2038269918.0000000000DFB000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2621310462.0000000000B2E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: daw21.exe PID: 5256, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: daw21.exe, type: SAMPLE
Source: Yara match	File source: 0.0.daw21.exe.dd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.daw21.exe.dd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2038269918.0000000000DFB000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2621310462.0000000000B2E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: daw21.exe PID: 5256, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 Create Account	11 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	Data from Local System	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	12 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
daw21.exe	58%	ReversingLabs	Win32.Trojan.StealC
daw21.exe	56%	Virustotal		Browse
daw21.exe	100%	Avira	TR/Crypt.ZPACK.Gen
daw21.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https:/135.181.65.216/ee45b7c5e4cb75cb.php	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://135.181.65.216/405117-2476756634-1003	daw21.exe, 00000000.00000002.2621310462.0000000000B7C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://upx.sf.net	Amcache.hve.5.dr	false	high
https://135.181.65.216/E	daw21.exe, 00000000.00000002.2621310462.0000000000B7C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://135.181.65.216/m-	daw21.exe, 00000000.00000002.2621310462.0000000000B2E000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://135.181.65.216/	daw21.exe, 00000000.00000002.2621310462.0000000000B7C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://135.181.65.216	daw21.exe, 00000000.00000002.2621310462.0000000000B2E000.00000004.00000020.00020000.00000000.sdmp	true	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
135.181.65.216	unknown	Germany		24940	HETZNER-ASDE	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579701
Start date and time:	2024-12-23 07:58:17 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	daw21.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@2/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 92% Number of executed functions: 17 Number of non-executed functions: 42
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.20, 13.107.246.63, 20.109.210.53, 40.126.53.12
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus15.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:00:06	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	gVKsiQIHqe.exe	Get hash	malicious	Vidar	Browse	94.130.188.57
	trZG6pItZj.exe	Get hash	malicious	Vidar	Browse	94.130.188.57
	9EI7wrGs4K.exe	Get hash	malicious	Vidar	Browse	94.130.188.57
	AmsterdamCryptoLTD.exe	Get hash	malicious	LummaC, DarkComet, LummaC Stealer, Vidar	Browse	94.130.188.57
	Loader.exe	Get hash	malicious	RHADAMANTHYS	Browse	213.239.239.164
	GoldenContinent.exe	Get hash	malicious	Vidar	Browse	94.130.188.57
	https://cpanel05wh.bkk1.cloud.z.com/~cp197720/open/DD/	Get hash	malicious	HTMLPhisher	Browse	135.181.58.223
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	94.130.188.57
	https://gogvo.com/redir.php?url=https://atratejarat.com/wp-content/red/DhmgvV	Get hash	malicious	Unknown	Browse	136.243.5.53
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.130.188.57

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_daw21.exe_2c487d58c69cb0e118b9a9eeb0a7207e9965bed0_a4ef3901_87578f33-870a-4c2d-8de0-32f2624e2657\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9489641572063066
Encrypted:	false
SSDEEP:	192:LUF+3wxu0BU/AjvYZrRtwzuiFUZ24IO8EwV:4F+3wxVBU/AjeCzuiFUY4IO8EwV
MD5:	438F3D43FA5C7E32D41C263E2E51297C
SHA1:	E5FC39CD08ACEB17B934C5582D49DF3ADBD19047
SHA-256:	5E5B7A275EB22684E23924E2C6B7F689FE21114C92EBE6DA7474D1B37DCEDB86
SHA-512:	AD22CB94AD6062E458C99853637FB3754D78D00E8FDE59879760650E92BE953DEEC090F432D35ABADE5A6D8BF553C73FD89D5176F398667B4D4F56316C06B43C
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.4.1.0.7.7.2.4.9.3.2.2.5.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.4.1.0.7.7.3.3.5.2.6.0.3.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.7.5.7.8.f.3.3.-.8.7.0.a.-.4.c.2.d.-.8.d.e.0.-.3.2.f.2.6.2.4.e.2.6.5.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.a.e.4.0.e.2.e.-.5.7.1.a.-.4.7.8.1.-.b.d.7.e.-.7.e.5.e.c.8.6.3.9.9.1.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.d.a.w.2.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.4.8.8.-.0.0.0.1.-.0.0.1.4.-.2.6.c.9.-.b.7.2.9.0.8.5.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.9.9.8.4.3.7.e.7.9.c.6.8.e.3.b.9.7.9.c.3.1.8.6.e.8.1.5.4.e.5.5.0.0.0.0.f.f.f.f.!.0.0.0.0.f.5.4.3.a.a.3.a.d.5.5.c.4.b.4.f.e.1.7.6.b.c.6.1.0.c.6.d.9.0.f.f.2.7.8.a.8.b.2.f.!.d.a.w.2.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC60B.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Dec 23 06:59:32 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	121090
Entropy (8bit):	1.5889177336125118
Encrypted:	false
SSDEEP:	384:BzBQqeE1iz5rSx8O04/P7ZOMnFSMMD6cM6dwqk:1KqeE1iVvuNOMFQ6cR
MD5:	7D3C4736EEC3B7485385B5546A4360EA
SHA1:	76257C1782C8C718218924AE3850B0554201ACE1
SHA-256:	53B672E9DCE76C1B65E255E7EA9311423E839694538F9E5F42CAFBABED26C832
SHA-512:	894D3811CACAF5A3EBB85856D6CFC3BFE658F5A5ECD3AA20D345F92C689E8DE0D4CF5B88F94B009ECDEA093F6388C1D0C6AB8FBF04382D9AB0236FE1DF4AE75C
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......T.ig.........................................B..........T.......8...........T............6..j.......................................................................................................eJ......\ ......GenuineIntel............T...........<.ig.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC725.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8326
Entropy (8bit):	3.6998370740910076
Encrypted:	false
SSDEEP:	192:R6l7wVeJkn6O9CC6YEIBSU9GegmfM65prB89b35sfCg29m:R6lXJM6O9CC6YE+SU9GegmfM6q3SfCgt
MD5:	71614711D124185C6BA44DABD6528D34
SHA1:	9B7ABF8E4A8BACB1594CC69722BF2083D1A18E2B
SHA-256:	BF3B9CB9B5283287B09740AEEF2904B4144DE523BD95170FF5A627EA972B1C78
SHA-512:	BF6E7B825091ADADB9796D6E514BA908789C49551223CE81931C26A9ACC1D5B3E8FA7C89FD5E171E40D53182D83D740F86D1793D968D43ED01DD0F066E34A0B0
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.2.5.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC784.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4558
Entropy (8bit):	4.442725259921341
Encrypted:	false
SSDEEP:	48:cvIwWl8zsnAtJg77aI9x4F/WpW8VY2YYm8M4J7NeF5+q85+d1Y/Rd:uIjfnGI7g07VhJ7gkK1Y/Rd
MD5:	0455CD1E170B68BA40757A6461C282AA
SHA1:	46777FB8B4FE8DD4B92D3101E633424113A4EFAA
SHA-256:	792777555BA513D5D0B08CEDB6BD11BD3387EBAD2A5A132F56BAC50EBD8772E7
SHA-512:	5A9C66A732EFA76F475BDD5CB185C3824E25208F4E54D41DAC5B5E9C87351704D948AF9C644A07DD3AAAB5CEA83CB6121FBBF50699CB2AC909E304ED5BEF9648
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="643562" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421334128150206
Encrypted:	false
SSDEEP:	6144:TSvfpi6ceLP/9skLmb0OTMWSPHaJG8nAgeMZMMhA2fX4WABlEnNd0uhiTw:evloTMW+EZMM6DFy703w
MD5:	CE92C583E25316A9C3665582170BE305
SHA1:	2E15C35F61A6FE5D296DDE5B3548F745AD38B37B
SHA-256:	9F0E9358881DDFF3737667888CF20767636CCF7E6C2C4F0AE39EE5153E6FB531
SHA-512:	B434F14379E1B05B506843D1001141BD9253EF02ABA85EC02AA75CFE3C493ED66552D0926F5FA908A2E6B45F47AD9C636A19E7B380A26A7BCF9DE1308226C4C6
Malicious:	false
Reputation:	low
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm6..7.U..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.574581381719375
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	daw21.exe
File size:	245'760 bytes
MD5:	08d493bfdfa30242a5846dbdef4c1948
SHA1:	f543aa3ad55c4b4fe176bc610c6d90ff278a8b2f
SHA256:	7dccfe6b2eab06663f0b7dac8406252f4bf222fff85dc75c356be422dab0f46e
SHA512:	8bd248437528fa40cd23fa3240c2378c701c4ede8278ce4ec9bf7e55483c176c42b222ed90bae8252008602de212126cdba69d298de5387ff10a9b319dcb6047
SSDEEP:	3072:shv0eu6ZJlctXwLISyqlsxfKPkAck1gD1l567pGDUJ42EnTC2RReHeP3KqX+n:eMeNRFLIu5ckeHgFGD+jsC2zeot+
TLSH:	F8341925EF40443FEE12867CD6B963D5B22669A46312D8D333CC25198DF40E32D7E6AB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d...d...d.....s.\|.....F.i.....r.^...m.[.g...m.K.b.......g...d.........w.w.....E.e...Richd...........PE..L....6hg...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x421bd0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67683602 [Sun Dec 22 15:53:38 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	d071ac95ea1d6b0ed6ec53017449901f

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 34h
push ebx
push esi
push edi
call 00007F257C7DFD07h
call 00007F257C803722h
xor ebx, ebx
cmp byte ptr [0042D014h], bl
je 00007F257C7FEF4Fh
lea ecx, dword ptr [ecx+00h]
inc ebx
cmp byte ptr [ebx+0042D014h], 00000000h
jne 00007F257C7FEF38h
lea eax, dword ptr [ebx+01h]
call 00007F257C7DFB83h
mov dword ptr [ebp-10h], eax
test eax, eax
je 00007F257C7FEF4Eh
push 0042D014h
push eax
call dword ptr [00639134h]
call dword ptr [006390E4h]
movzx eax, ax
add eax, FFFFFBE7h
cmp eax, 2Ah
jnbe 00007F257C7FEF58h
movzx eax, byte ptr [eax+00421E54h]
jmp dword ptr [00421E4Ch+eax*4]
push 00000000h
call dword ptr [0063901Ch]
call 00007F257C7FFD72h
mov ecx, dword ptr [00638D40h]
call 00007F257C8010A7h
test eax, eax
jne 00007F257C7FEF5Dh
call 00007F257C7FFCCEh
mov ecx, dword ptr [00638E1Ch]
call 00007F257C801093h
test eax, eax
jne 00007F257C7FEF49h
push eax
call dword ptr [0063901Ch]
mov edi, dword ptr [00638D40h]
push edi
call dword ptr [00638FACh]
lea esi, dword ptr [ebx+eax]
lea eax, dword ptr [esi+01h]
call 00007F257C7DFB00h
mov ebx, eax
mov dword ptr [ebp-34h], ebx
test ebx, ebx
je 00007F257C7FEF5Dh
mov eax, dword ptr [ebp-10h]
test eax, eax
je 00007F257C7FEF56h
test edi, edi

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3664c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24a000	0x3c7c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x104	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2951a	0x29600	b4874e90ee0ee483a541371023527a0f	False	0.40295742069486407	data	6.3775660830573315	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0xbbac	0xbc00	7385cc66718c659bfcf4179908561ee1	False	0.5965134640957447	OpenPGP Secret Key	6.670254113234216	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x37000	0x212bec	0xc00	f7d82f3649bd5266c892c8c1b457e92b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x24a000	0x5d00	0x5e00	3aaf8fa46dd3fc3e2cea297379ccf4c1	False	0.5251828457446809	data	5.249844058590275	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

msvcrt.dll

rand, strncpy, ??_V@YAXPAX@Z, strtok, memchr, strtok_s, ??_U@YAPAXI@Z, strcpy_s, vsprintf_s, memmove, strlen, malloc, free, memcmp, ??2@YAPAXI@Z, memset, memcpy, __CxxFrameHandler3, _except_handler3

KERNEL32.dll

InitializeCriticalSectionAndSpinCount, GetStringTypeW, MultiByteToWideChar, LCMapStringW, IsValidCodePage, GetOEMCP, GetACP, lstrlenA, HeapAlloc, GetProcessHeap, VirtualProtect, CreateProcessA, lstrcatA, VirtualQueryEx, OpenProcess, ReadProcessMemory, WriteFile, GetCPInfo, WideCharToMultiByte, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EncodePointer, DecodePointer, TerminateProcess, GetCurrentProcess, LeaveCriticalSection, EnterCriticalSection, RtlUnwind, GetProcAddress, GetModuleHandleW, ExitProcess, Sleep, GetStdHandle, GetModuleFileNameW, GetLastError, LoadLibraryW, TlsGetValue, TlsSetValue, InterlockedIncrement, SetLastError, GetCurrentThreadId, InterlockedDecrement, RaiseException

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-23T07:59:13.802979+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49704	135.181.65.216	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 07:59:09.092545986 CET	49704	443	192.168.2.5	135.181.65.216
Dec 23, 2024 07:59:09.092575073 CET	443	49704	135.181.65.216	192.168.2.5
Dec 23, 2024 07:59:09.096487999 CET	49704	443	192.168.2.5	135.181.65.216
Dec 23, 2024 07:59:09.110738039 CET	49704	443	192.168.2.5	135.181.65.216
Dec 23, 2024 07:59:09.110759020 CET	443	49704	135.181.65.216	192.168.2.5
Dec 23, 2024 07:59:13.802838087 CET	443	49704	135.181.65.216	192.168.2.5
Dec 23, 2024 07:59:13.802978992 CET	49704	443	192.168.2.5	135.181.65.216
Dec 23, 2024 07:59:13.806602955 CET	49704	443	192.168.2.5	135.181.65.216
Dec 23, 2024 07:59:13.806623936 CET	443	49704	135.181.65.216	192.168.2.5
Dec 23, 2024 07:59:13.829894066 CET	49705	443	192.168.2.5	135.181.65.216
Dec 23, 2024 07:59:13.829948902 CET	443	49705	135.181.65.216	192.168.2.5
Dec 23, 2024 07:59:13.830092907 CET	49705	443	192.168.2.5	135.181.65.216
Dec 23, 2024 07:59:13.830262899 CET	49705	443	192.168.2.5	135.181.65.216
Dec 23, 2024 07:59:13.830279112 CET	443	49705	135.181.65.216	192.168.2.5
Dec 23, 2024 07:59:18.523478985 CET	443	49705	135.181.65.216	192.168.2.5
Dec 23, 2024 07:59:18.523647070 CET	49705	443	192.168.2.5	135.181.65.216
Dec 23, 2024 07:59:18.524873972 CET	49705	443	192.168.2.5	135.181.65.216
Dec 23, 2024 07:59:18.524895906 CET	443	49705	135.181.65.216	192.168.2.5
Dec 23, 2024 07:59:18.525799990 CET	49706	443	192.168.2.5	135.181.65.216
Dec 23, 2024 07:59:18.525850058 CET	443	49706	135.181.65.216	192.168.2.5
Dec 23, 2024 07:59:18.525938988 CET	49706	443	192.168.2.5	135.181.65.216
Dec 23, 2024 07:59:18.526151896 CET	49706	443	192.168.2.5	135.181.65.216
Dec 23, 2024 07:59:18.526186943 CET	443	49706	135.181.65.216	192.168.2.5
Dec 23, 2024 07:59:18.526246071 CET	49706	443	192.168.2.5	135.181.65.216

Target ID:	0
Start time:	01:59:08
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\daw21.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\daw21.exe"
Imagebase:	0xdd0000
File size:	245'760 bytes
MD5 hash:	08D493BFDFA30242A5846DBDEF4C1948
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000000.2038269918.0000000000DFB000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2621310462.0000000000B2E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:59:32
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5256 -s 1388
Imagebase:	0x1000000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	19.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	24.9%
Total number of Nodes:	1315
Total number of Limit Nodes:	38

Executed Functions

Function 00DD4B80 Relevance: 116.3, APIs: 61, Strings: 5, Instructions: 807stringnetworkCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 00DD4BAF
lstrcpy.KERNEL32(00000000,00DFD014), ref: 00DD4C02
lstrcpy.KERNEL32(00000000,00DFD014), ref: 00DD4C35
lstrcpy.KERNEL32(00000000,00DFD014), ref: 00DD4C65
lstrcpy.KERNEL32(00000000,00DFD014), ref: 00DD4CA3
lstrcpy.KERNEL32(00000000,00DFD014), ref: 00DD4CD6
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00DD4CE6

Strings

LP, xrefs: 00DD50F8
LP, xrefs: 00DD518E
", xrefs: 00DD5154, 00DD5242
LP, xrefs: 00DD51E6
------, xrefs: 00DD4E0C, 00DD4E39, 00DD50BB, 00DD51AC

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: lstrcpy$InternetOpen
String ID: "$------$LP$LP$LP
API String ID: 2041821634-2504685677
Opcode ID: 5b07d49727cebb4614462e235744c22d78d7503193e091a76591e65ed3bd5479
Instruction ID: 545ff9c4ec3136abe882359b61a4fb8193b9a8f6f92fbb92dd6f09221fc9a102
Opcode Fuzzy Hash: 5b07d49727cebb4614462e235744c22d78d7503193e091a76591e65ed3bd5479
Instruction Fuzzy Hash: C2526D31A016199FDB21EFB4D849AAE7BB9EF44300F198026F945A7355DB34ED42CBB0

Function 00DD56C0 Relevance: 105.7, APIs: 51, Strings: 9, Instructions: 734
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(00000000,?), ref: 00DD56EF
lstrlenA.KERNEL32(?), ref: 00DD5742
lstrcpy.KERNEL32(00000000,00DFD014), ref: 00DD5784
lstrcpy.KERNEL32(00000000,00DFD014), ref: 00DD57C3
lstrcpy.KERNEL32(00000000,00DFD014), ref: 00DD57F3
lstrcpy.KERNEL32(00000000,00DFD014), ref: 00DD5828

Strings

LP, xrefs: 00DD5CCC
------, xrefs: 00DD5929, 00DD5956
", xrefs: 00DD5BA4, 00DD5C92, 00DD5D80
LP, xrefs: 00DD5D24
--, xrefs: 00DD598F, 00DD59B7
LP, xrefs: 00DD5C36
LP, xrefs: 00DD5BDE
------, xrefs: 00DD5B0B, 00DD5BFC, 00DD5CEA
LP, xrefs: 00DD5B48

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID: ------$"$--$------$LP$LP$LP$LP$LP
API String ID: 367037083-905720104
Opcode ID: 871b0fb4908d0a8d4bf44bb26befd73086b7db17bf88e7dff4ab7345c5c65a36
Instruction ID: c661ee0942af813ace08a5e601c22a36ca4787554a7b047c37afd1e0cd3c8e51
Opcode Fuzzy Hash: 871b0fb4908d0a8d4bf44bb26befd73086b7db17bf88e7dff4ab7345c5c65a36
Instruction Fuzzy Hash: 85423E71E006199FCB21EBB4D845AAE77B5EF44310F198025FA49A7356DB34EE068BF0

Function 00DD4980 Relevance: 61.4, APIs: 34, Strings: 1, Instructions: 115
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00DD4994
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00DD499B
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00DD49A2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00DD49A9
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00DD49B0
GetProcessHeap.KERNEL32(00000000,?), ref: 00DD49BB
RtlAllocateHeap.NTDLL(00000000), ref: 00DD49C2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00DD49D2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00DD49D9
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00DD49E0
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00DD49E7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00DD49EE
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00DD49F9
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00DD4A00
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00DD4A07
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00DD4A0E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00DD4A15
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00DD4A2B
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00DD4A32
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00DD4A39
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00DD4A40
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00DD4A47
strlen.MSVCRT ref: 00DD4A4F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00DD4A73
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00DD4A7A
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00DD4A81
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00DD4A88
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00DD4A8F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00DD4A9F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00DD4AA6
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00DD4AAD
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00DD4AB4
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00DD4ABB
VirtualProtect.KERNEL32(00000000,00000004,00000100,?), ref: 00DD4AD0

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00DD498F, 00DD4996, 00DD499D, 00DD49A4, 00DD49AB, 00DD49CA, 00DD49D4, 00DD49DB, 00DD49E2, 00DD49E9, 00DD49F0, 00DD49FB, 00DD4A02, 00DD4A09, 00DD4A10, 00DD4A26, 00DD4A2D, 00DD4A34, 00DD4A3B, 00DD4A42, 00DD4A63, 00DD4A75, 00DD4A7C, 00DD4A83, 00DD4A8A, 00DD4A9A, 00DD4AA1, 00DD4AA8, 00DD4AAF, 00DD4AB6

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-3329630956
Opcode ID: 5a710236c893eea6757a01826fb93a62ee466b3de8b05347751ec0d0081699f3
Instruction ID: 3e340017adcbf9dc1817f7f78e97059144b3fbd4bd0a8829d098eb5c6e5ab4e6
Opcode Fuzzy Hash: 5a710236c893eea6757a01826fb93a62ee466b3de8b05347751ec0d0081699f3
Instruction Fuzzy Hash: E931F6E0F8032E76C6247BAE8D4AD5E7ED4DF857E0B297053B618661C0C9F054A5CEB2

Function 00DF63C0 Relevance: 58.0, APIs: 32, Strings: 1, Instructions: 218
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,00B316F8), ref: 00DF6419
GetProcAddress.KERNEL32(75900000,00B319B0), ref: 00DF6432
GetProcAddress.KERNEL32(75900000,00B318A8), ref: 00DF644A
GetProcAddress.KERNEL32(75900000,00B317A0), ref: 00DF6462
GetProcAddress.KERNEL32(75900000,00B31250), ref: 00DF647B
GetProcAddress.KERNEL32(75900000,00B2AC20), ref: 00DF6493
GetProcAddress.KERNEL32(75900000,00B2AD40), ref: 00DF64AB
GetProcAddress.KERNEL32(75900000,00B319C8), ref: 00DF64C4
GetProcAddress.KERNEL32(75900000,00B316E0), ref: 00DF64DC
GetProcAddress.KERNEL32(75900000,00B31710), ref: 00DF64F4
GetProcAddress.KERNEL32(75900000,00B31758), ref: 00DF650D
GetProcAddress.KERNEL32(75900000,00B2AC60), ref: 00DF6525
GetProcAddress.KERNEL32(75900000,00B31770), ref: 00DF653D
GetProcAddress.KERNEL32(75900000,00B317B8), ref: 00DF6556
GetProcAddress.KERNEL32(75900000,00B2ADA0), ref: 00DF656E
GetProcAddress.KERNEL32(75900000,00B317D0), ref: 00DF6586
GetProcAddress.KERNEL32(75900000,00B31800), ref: 00DF659F
GetProcAddress.KERNEL32(75900000,00B2ACC0), ref: 00DF65B7
GetProcAddress.KERNEL32(75900000,00B31A10), ref: 00DF65CF
GetProcAddress.KERNEL32(75900000,00B2AC80), ref: 00DF65E8
LoadLibraryA.KERNEL32(00B319E0,?,?,?,00DF1BE3), ref: 00DF65F9
LoadLibraryA.KERNEL32(00B31A40,?,?,?,00DF1BE3), ref: 00DF660B
LoadLibraryA.KERNEL32(00B31AA0,?,?,?,00DF1BE3), ref: 00DF661D
LoadLibraryA.KERNEL32(00B31A58,?,?,?,00DF1BE3), ref: 00DF662E
LoadLibraryA.KERNEL32(00B31A70,?,?,?,00DF1BE3), ref: 00DF6640
GetProcAddress.KERNEL32(75070000,00B319F8), ref: 00DF665D
GetProcAddress.KERNEL32(75FD0000,00B31A88), ref: 00DF6679
GetProcAddress.KERNEL32(75FD0000,00B31A28), ref: 00DF6691
GetProcAddress.KERNEL32(75A50000,00B31B78), ref: 00DF66AD
GetProcAddress.KERNEL32(74E50000,00B2ADC0), ref: 00DF66C9
GetProcAddress.KERNEL32(76E80000,00B31260), ref: 00DF66E5
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 00DF66FC

Strings

NtQueryInformationProcess, xrefs: 00DF66F1

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 995d332382451e8a4549bb979bc8b029f4a50bf634f80e4650fa33e33146a833
Instruction ID: bfbb54cdece74990d494a373f13f712de5157cd69a8e2b019468445aa64b927e
Opcode Fuzzy Hash: 995d332382451e8a4549bb979bc8b029f4a50bf634f80e4650fa33e33146a833
Instruction Fuzzy Hash: 5DA184B5A116009FD776DF64E448A2637B9F788348B04891AFAC9C334ED77EA940DF60

Function 00DF29E0 Relevance: 4.5, APIs: 3, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,00000000), ref: 00DF2A0F
HeapAlloc.KERNEL32(00000000), ref: 00DF2A16
GetUserNameA.ADVAPI32(00000000,00000104), ref: 00DF2A2A

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: cf2c63bc678b7600acdbae6f0f632352e2c15b37b82390c714a2093cf4ddcfa0
Instruction ID: eab89935e4461bba05ce332b390c6f2f51e7f4e59ae573ada2478fa21d36e0ce
Opcode Fuzzy Hash: cf2c63bc678b7600acdbae6f0f632352e2c15b37b82390c714a2093cf4ddcfa0
Instruction Fuzzy Hash: 1BF0B4B1A40608AFC710DF98DD49BAABBBCF744B25F000226FA18E3680D7B9190487A1

Function 00DF6710 Relevance: 210.7, APIs: 115, Strings: 5, Instructions: 696
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,00B37E38), ref: 00DF6725
GetProcAddress.KERNEL32(75900000,00B37E78), ref: 00DF673D
GetProcAddress.KERNEL32(75900000,00B31D10), ref: 00DF6756
GetProcAddress.KERNEL32(75900000,00B31B60), ref: 00DF676E
GetProcAddress.KERNEL32(75900000,00B31C80), ref: 00DF6786
GetProcAddress.KERNEL32(75900000,00B31C98), ref: 00DF679F
GetProcAddress.KERNEL32(75900000,00B39FA8), ref: 00DF67B7
GetProcAddress.KERNEL32(75900000,00B31E78), ref: 00DF67CF
GetProcAddress.KERNEL32(75900000,00B31E18), ref: 00DF67E8
GetProcAddress.KERNEL32(75900000,00B31EA8), ref: 00DF6800
GetProcAddress.KERNEL32(75900000,00B31E90), ref: 00DF6818
GetProcAddress.KERNEL32(75900000,00B37C98), ref: 00DF6831
GetProcAddress.KERNEL32(75900000,00B37C58), ref: 00DF6849
GetProcAddress.KERNEL32(75900000,00B37E58), ref: 00DF6861
GetProcAddress.KERNEL32(75900000,00B37E98), ref: 00DF687A
GetProcAddress.KERNEL32(75900000,00B31E30), ref: 00DF6892
GetProcAddress.KERNEL32(75900000,00B31DE8), ref: 00DF68AA
GetProcAddress.KERNEL32(75900000,00B3A020), ref: 00DF68C3
GetProcAddress.KERNEL32(75900000,00B37CF8), ref: 00DF68DB
GetProcAddress.KERNEL32(75900000,00B31E00), ref: 00DF68F3
GetProcAddress.KERNEL32(75900000,00B31E48), ref: 00DF690C
GetProcAddress.KERNEL32(75900000,00B31E60), ref: 00DF6924
GetProcAddress.KERNEL32(75900000,00B41678), ref: 00DF693C
GetProcAddress.KERNEL32(75900000,00B37EB8), ref: 00DF6955
GetProcAddress.KERNEL32(75900000,00B41588), ref: 00DF696D
GetProcAddress.KERNEL32(75900000,00B41498), ref: 00DF6985
GetProcAddress.KERNEL32(75900000,00B413F0), ref: 00DF699E
GetProcAddress.KERNEL32(75900000,00B414B0), ref: 00DF69B6
GetProcAddress.KERNEL32(75900000,00B41618), ref: 00DF69CE
GetProcAddress.KERNEL32(75900000,00B41510), ref: 00DF69E7
GetProcAddress.KERNEL32(75900000,00B41690), ref: 00DF69FF
GetProcAddress.KERNEL32(75900000,00B416A8), ref: 00DF6A17
GetProcAddress.KERNEL32(75900000,00B41450), ref: 00DF6A30
GetProcAddress.KERNEL32(75900000,00B34608), ref: 00DF6A48
GetProcAddress.KERNEL32(75900000,00B415E8), ref: 00DF6A60
GetProcAddress.KERNEL32(75900000,00B41420), ref: 00DF6A79
GetProcAddress.KERNEL32(75900000,00B37ED8), ref: 00DF6A91
GetProcAddress.KERNEL32(75900000,00B41570), ref: 00DF6AA9
GetProcAddress.KERNEL32(75900000,00B37EF8), ref: 00DF6AC2
GetProcAddress.KERNEL32(75900000,00B41438), ref: 00DF6ADA
GetProcAddress.KERNEL32(75900000,00B416C0), ref: 00DF6AF2
GetProcAddress.KERNEL32(75900000,00B37F18), ref: 00DF6B0B
GetProcAddress.KERNEL32(75900000,00B37F38), ref: 00DF6B23
LoadLibraryA.KERNEL32(00B41468,00DF067A), ref: 00DF6B35
LoadLibraryA.KERNEL32(00B41600), ref: 00DF6B46
LoadLibraryA.KERNEL32(00B41480), ref: 00DF6B58
LoadLibraryA.KERNEL32(00B41648), ref: 00DF6B6A
LoadLibraryA.KERNEL32(00B415D0), ref: 00DF6B7B
LoadLibraryA.KERNEL32(00B41408), ref: 00DF6B8D
LoadLibraryA.KERNEL32(00B414C8), ref: 00DF6B9F
LoadLibraryA.KERNEL32(00B414E0), ref: 00DF6BB0
GetProcAddress.KERNEL32(75FD0000,00B38058), ref: 00DF6BCC
GetProcAddress.KERNEL32(75FD0000,00B414F8), ref: 00DF6BE4
GetProcAddress.KERNEL32(75FD0000,00B3EEC8), ref: 00DF6BFD
GetProcAddress.KERNEL32(75FD0000,00B41540), ref: 00DF6C15
GetProcAddress.KERNEL32(75FD0000,00B381D8), ref: 00DF6C2D
GetProcAddress.KERNEL32(6FDB0000,00B3A3E0), ref: 00DF6C4D
GetProcAddress.KERNEL32(6FDB0000,00B38258), ref: 00DF6C65
GetProcAddress.KERNEL32(6FDB0000,00B3A098), ref: 00DF6C7E
GetProcAddress.KERNEL32(6FDB0000,00B41630), ref: 00DF6C96
GetProcAddress.KERNEL32(6FDB0000,00B41660), ref: 00DF6CAE
GetProcAddress.KERNEL32(6FDB0000,00B38158), ref: 00DF6CC7
GetProcAddress.KERNEL32(6FDB0000,00B381F8), ref: 00DF6CDF
GetProcAddress.KERNEL32(6FDB0000,00B415B8), ref: 00DF6CF7
GetProcAddress.KERNEL32(763B0000,00B38078), ref: 00DF6D13
GetProcAddress.KERNEL32(763B0000,00B38198), ref: 00DF6D2B
GetProcAddress.KERNEL32(763B0000,00B41528), ref: 00DF6D44
GetProcAddress.KERNEL32(763B0000,00B413D8), ref: 00DF6D5C
GetProcAddress.KERNEL32(763B0000,00B38178), ref: 00DF6D74
GetProcAddress.KERNEL32(750F0000,00B3A408), ref: 00DF6D94
GetProcAddress.KERNEL32(750F0000,00B3A070), ref: 00DF6DAC
GetProcAddress.KERNEL32(750F0000,00B41558), ref: 00DF6DC5
GetProcAddress.KERNEL32(750F0000,00B382B8), ref: 00DF6DDD
GetProcAddress.KERNEL32(750F0000,00B38318), ref: 00DF6DF5
GetProcAddress.KERNEL32(750F0000,00B3A340), ref: 00DF6E0E
GetProcAddress.KERNEL32(75A50000,00B415A0), ref: 00DF6E2E
GetProcAddress.KERNEL32(75A50000,00B382F8), ref: 00DF6E46
GetProcAddress.KERNEL32(75A50000,00B3EE98), ref: 00DF6E5F
GetProcAddress.KERNEL32(75A50000,00B41708), ref: 00DF6E77
GetProcAddress.KERNEL32(75A50000,00B41780), ref: 00DF6E8F
GetProcAddress.KERNEL32(75A50000,00B380B8), ref: 00DF6EA8
GetProcAddress.KERNEL32(75A50000,00B38238), ref: 00DF6EC0
GetProcAddress.KERNEL32(75A50000,00B41738), ref: 00DF6ED8
GetProcAddress.KERNEL32(75A50000,00B41720), ref: 00DF6EF1
GetProcAddress.KERNEL32(75A50000,CreateDesktopA), ref: 00DF6F07
GetProcAddress.KERNEL32(75A50000,OpenDesktopA), ref: 00DF6F1E
GetProcAddress.KERNEL32(75A50000,CloseDesktop), ref: 00DF6F35
GetProcAddress.KERNEL32(75070000,00B38358), ref: 00DF6F51
GetProcAddress.KERNEL32(75070000,00B41768), ref: 00DF6F69
GetProcAddress.KERNEL32(75070000,00B416D8), ref: 00DF6F82
GetProcAddress.KERNEL32(75070000,00B41798), ref: 00DF6F9A
GetProcAddress.KERNEL32(75070000,00B41750), ref: 00DF6FB2
GetProcAddress.KERNEL32(74E50000,00B38338), ref: 00DF6FCE
GetProcAddress.KERNEL32(74E50000,00B38398), ref: 00DF6FE6
GetProcAddress.KERNEL32(75320000,00B38038), ref: 00DF7002
GetProcAddress.KERNEL32(75320000,00B416F0), ref: 00DF701A
GetProcAddress.KERNEL32(6F060000,00B381B8), ref: 00DF703A
GetProcAddress.KERNEL32(6F060000,00B37FF8), ref: 00DF7052
GetProcAddress.KERNEL32(6F060000,00B38218), ref: 00DF706B
GetProcAddress.KERNEL32(6F060000,00B419A8), ref: 00DF7083
GetProcAddress.KERNEL32(6F060000,00B38098), ref: 00DF709B
GetProcAddress.KERNEL32(6F060000,00B380D8), ref: 00DF70B4
GetProcAddress.KERNEL32(6F060000,00B382D8), ref: 00DF70CC
GetProcAddress.KERNEL32(6F060000,00B380F8), ref: 00DF70E4
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 00DF70FB
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 00DF7112
GetProcAddress.KERNEL32(74E00000,00B418B8), ref: 00DF712E
GetProcAddress.KERNEL32(74E00000,00B3EF08), ref: 00DF7146
GetProcAddress.KERNEL32(74E00000,00B41858), ref: 00DF715F
GetProcAddress.KERNEL32(74E00000,00B41870), ref: 00DF7177
GetProcAddress.KERNEL32(74DF0000,00B38118), ref: 00DF7193
GetProcAddress.KERNEL32(6E330000,00B41900), ref: 00DF71AF
GetProcAddress.KERNEL32(6E330000,00B38138), ref: 00DF71C7
GetProcAddress.KERNEL32(6E330000,00B419C0), ref: 00DF71E0
GetProcAddress.KERNEL32(6E330000,00B41A80), ref: 00DF71F8

Strings

HttpQueryInfoA, xrefs: 00DF7107
InternetSetOptionA, xrefs: 00DF70F0
CloseDesktop, xrefs: 00DF6F2A
CreateDesktopA, xrefs: 00DF6F01
OpenDesktopA, xrefs: 00DF6F13

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: CloseDesktop$CreateDesktopA$HttpQueryInfoA$InternetSetOptionA$OpenDesktopA
API String ID: 2238633743-3468015613
Opcode ID: 57508b57c1d1238786da8de97f83410d98125107cb735efc0feaec6f04af65d8
Instruction ID: eeaa40c24379db867736c70c9d691f164305462706df02f2254150a5fe557275
Opcode Fuzzy Hash: 57508b57c1d1238786da8de97f83410d98125107cb735efc0feaec6f04af65d8
Instruction Fuzzy Hash: 366254B5A106009FD776DF64E888A2637B9F788345B14891AFAD9C334ED77E9840DF20

Function 00DEF300 Relevance: 102.7, APIs: 57, Strings: 1, Instructions: 1164stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00DFD014,00000001,00000000,00000000), ref: 00DEF32E
lstrcpy.KERNEL32(00000000,00DFD014), ref: 00DEF34C
lstrlenA.KERNEL32(00DFD014), ref: 00DEF357
lstrcpy.KERNEL32(00000000,00DFD014), ref: 00DEF371
lstrlenA.KERNEL32(00DFD014), ref: 00DEF37C
lstrcpy.KERNEL32(00000000,00DFD014), ref: 00DEF396
lstrcpy.KERNEL32(00000000,00E05560), ref: 00DEF3BE
lstrcpy.KERNEL32(00000000,00DFD014), ref: 00DEF3EC
lstrcpy.KERNEL32(00000000,00DFD014), ref: 00DEF422
lstrcpy.KERNEL32(00000000,00DFD014), ref: 00DEF454
lstrlenA.KERNEL32(00B37C38), ref: 00DEF476
lstrcpy.KERNEL32(00000000,?), ref: 00DEF506
lstrcpy.KERNEL32(00000000,00000000), ref: 00DEF52B
lstrcpy.KERNEL32(00000000,00000000), ref: 00DEF5E2
StrCmpCA.SHLWAPI(?,ERROR), ref: 00DEF894
lstrlenA.KERNEL32(00B3EF48), ref: 00DEF8C2
lstrcpy.KERNEL32(00000000,00B3EF48), ref: 00DEF8EF
lstrcpy.KERNEL32(00000000,00000000), ref: 00DEF912
lstrcpy.KERNEL32(00000000,?), ref: 00DEF966
lstrcpy.KERNEL32(00000000,00B3EF48), ref: 00DEFA28
lstrcpy.KERNEL32(00000000,00B3EEB8), ref: 00DEFA58
lstrcpy.KERNEL32(00000000,?), ref: 00DEFAB7
StrCmpCA.SHLWAPI(?,ERROR), ref: 00DEFBD5
lstrlenA.KERNEL32(00B3EE78), ref: 00DEFC03
lstrcpy.KERNEL32(00000000,00B3EE78), ref: 00DEFC30
lstrcpy.KERNEL32(00000000,00000000), ref: 00DEFC53
lstrcpy.KERNEL32(00000000,?), ref: 00DEFCA7

Strings

ERROR, xrefs: 00DEF788, 00DEF88E, 00DEFB30, 00DEFBCF, 00DEFE70, 00DEFF0F

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID: ERROR
API String ID: 367037083-2861137601
Opcode ID: 4e4412c0a1347e91b4724b9e726bff54c4fdd228ab1b6577aea038d649f7470e
Instruction ID: 8503d8d5a659bd46ef84c109215221408a11e0b0a1a3e65da36eddb8adae944a
Opcode Fuzzy Hash: 4e4412c0a1347e91b4724b9e726bff54c4fdd228ab1b6577aea038d649f7470e
Instruction Fuzzy Hash: C6A23D70A013819FC725EF26C448A2ABBE5EF44314F18857EE489CB366DB35DC42CB61

Function 00DD6B80 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 229
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(00000000,?), ref: 00DD6BAF
lstrcpy.KERNEL32(00000000,00DFD014), ref: 00DD6C02
InternetOpenA.WININET(00DFD014,00000001,00000000,00000000,00000000), ref: 00DD6C15
StrCmpCA.SHLWAPI(?,00B3EC68), ref: 00DD6C2D
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00DD6C55
HttpOpenRequestA.WININET(00000000,GET,?,00B42A48,00000000,00000000,-00400100,00000000), ref: 00DD6C90
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00DD6CB7
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00DD6CC6
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00DD6CE5
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00DD6D3F
lstrcpy.KERNEL32(00000000,?), ref: 00DD6D9B
InternetReadFile.WININET(?,00000000,000007CF,?), ref: 00DD6DBD
InternetCloseHandle.WININET(00000000), ref: 00DD6DCE
InternetCloseHandle.WININET(?), ref: 00DD6DD8
InternetCloseHandle.WININET(00000000), ref: 00DD6DE2
lstrcpy.KERNEL32(00000000,00000000), ref: 00DD6E03

Strings

GET, xrefs: 00DD6C8A
ERROR, xrefs: 00DD6CF2

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$CloseHandleHttp$FileOpenReadRequest$ConnectInfoOptionQuerySend
String ID: ERROR$GET
API String ID: 3687753495-3591763792
Opcode ID: 180a866bf9372cc282c5c545dedaa2449bd2971a912e68f1eb736d7d45b188dd
Instruction ID: dbddd88e3f0e3b02782ec9ba8234c73d0c326721d7256b8c8c96e43d27ea814e
Opcode Fuzzy Hash: 180a866bf9372cc282c5c545dedaa2449bd2971a912e68f1eb736d7d45b188dd
Instruction Fuzzy Hash: 2A817F71A41219ABEB20DFA4DC45BAE77B9EF04700F14406AFA44E7381DB74EE458BB0

Function 00DF26E0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 93
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,?,00B31C38), ref: 00DF271B
GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00DFA470,00000000,00000000,00000000,00000000,?,00B31C38), ref: 00DF274C
GetProcessHeap.KERNEL32(00000000,00000104,?,00B31C38), ref: 00DF27AF
HeapAlloc.KERNEL32(00000000,?,00B31C38), ref: 00DF27B6
wsprintfA.USER32 ref: 00DF27DB

Strings

:\, xrefs: 00DF2735
C, xrefs: 00DF2725

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowswsprintf
String ID: :\$C
API String ID: 1325379522-3309953409
Opcode ID: 13ea9f62488167a650be3005fa2dc92b8c3706af165ab6c21be5a5b981f8d41c
Instruction ID: 0924d3c64a0168bc63e1a536e962c733efb6140f761e679413a933f7d6a5e30b
Opcode Fuzzy Hash: 13ea9f62488167a650be3005fa2dc92b8c3706af165ab6c21be5a5b981f8d41c
Instruction Fuzzy Hash: 0A3161B1D482499FCB15DFB899859FFBFB8FF58700F11416AE645E7640E2348A008BB1

Function 00DD5570 Relevance: 12.1, APIs: 8, Instructions: 112
networkmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00DD5589
RtlAllocateHeap.NTDLL(00000000), ref: 00DD5590
InternetOpenA.WININET(00DFD014,00000000,00000000,00000000,00000000), ref: 00DD55A6
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,04000100,00000000), ref: 00DD55C1
InternetReadFile.WININET(?,?,00000400,00000001), ref: 00DD55EC
KiUserExceptionDispatcher.NTDLL(00000000,?,00000001), ref: 00DD5611
InternetCloseHandle.WININET(?), ref: 00DD562B
InternetCloseHandle.WININET(00000000), ref: 00DD5632

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateDispatcherExceptionFileProcessReadUser
String ID:
API String ID: 1337183907-0
Opcode ID: 75b1e9cdd60440e0495054e29e68e9dd2c36665aaa06e6a2de94b591fc389a3d
Instruction ID: 07602b1179752825afe6b4835a9869bcb0caaccd38429eab16bd56630d68fd5d
Opcode Fuzzy Hash: 75b1e9cdd60440e0495054e29e68e9dd2c36665aaa06e6a2de94b591fc389a3d
Instruction Fuzzy Hash: AC418E70A00604AFDB25CF54D848FAAB7B4FF48308F5880AAE6489B395D776D941CFA4

Function 00DF1BD0 Relevance: 12.1, APIs: 8, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 42c4a568ed3f031132aa0bfca3d7f91b27c513a33eaad1d8e9eca624a44940fe
Instruction ID: 2adefc7d93a8ebd0dc957245d2a05bcad1bff640ff2886d374968343982b4ccb
Opcode Fuzzy Hash: 42c4a568ed3f031132aa0bfca3d7f91b27c513a33eaad1d8e9eca624a44940fe
Instruction Fuzzy Hash: C831703194060A9BCB21ABB4CC8567F76AAEF10740F098026B645E7256DB35ED058BB1

Function 00DD4AE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT(00000800,00B3EE68), ref: 00DD4B17
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00DD4B21
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00DD4B2B
lstrlenA.KERNEL32(?,00000000,?), ref: 00DD4B3F
InternetCrackUrlA.WININET(?,00000000), ref: 00DD4B47

Strings

<, xrefs: 00DD4B07

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: ??2@$CrackInternetlstrlen
String ID: <
API String ID: 1683549937-4251816714
Opcode ID: b0b094d9c6bb63a1d35614d3ad734e85fa15043f5eb99fa4b1ba375fffa7a8c6
Instruction ID: c1ca5cc55756b04c74f04d7c7daad8b1308a759fdb388ca3244978f3587aa586
Opcode Fuzzy Hash: b0b094d9c6bb63a1d35614d3ad734e85fa15043f5eb99fa4b1ba375fffa7a8c6
Instruction Fuzzy Hash: 6C012D71D00218ABDB14DFA8E845B9EBBB8EB08360F00812AF954E7390DB7459058FD4

Function 00DF28B0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00DF28C5
HeapAlloc.KERNEL32(00000000), ref: 00DF28CC
RegOpenKeyExA.KERNEL32(80000002,00B3B5F0,00000000,00020119,00DF2849), ref: 00DF28EB
RegQueryValueExA.KERNEL32(00DF2849,CurrentBuildNumber,00000000,00000000,00000000,000000FF), ref: 00DF2905
RegCloseKey.ADVAPI32(00DF2849), ref: 00DF290F

Strings

CurrentBuildNumber, xrefs: 00DF28FF

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: fef0c9cc2508ea384d8a66a1f5f212a6dff87e70e0ca3d2917a9c540ca520c04
Instruction ID: 82a5c4b84cfcdcd53c8d554c51aac72fc14bbdcd798aa02f11850b0a4aece624
Opcode Fuzzy Hash: fef0c9cc2508ea384d8a66a1f5f212a6dff87e70e0ca3d2917a9c540ca520c04
Instruction Fuzzy Hash: 50012475A40318AFD321CBA0DC58EFB7BBCEB08705F108099FF85D7285EA7259048BA0

Function 00DF2820 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00DF2835
HeapAlloc.KERNEL32(00000000), ref: 00DF283C

Part of subcall function 00DF28B0: GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00DF28C5
Part of subcall function 00DF28B0: HeapAlloc.KERNEL32(00000000), ref: 00DF28CC
Part of subcall function 00DF28B0: RegOpenKeyExA.KERNEL32(80000002,00B3B5F0,00000000,00020119,00DF2849), ref: 00DF28EB
Part of subcall function 00DF28B0: RegQueryValueExA.KERNEL32(00DF2849,CurrentBuildNumber,00000000,00000000,00000000,000000FF), ref: 00DF2905
Part of subcall function 00DF28B0: RegCloseKey.ADVAPI32(00DF2849), ref: 00DF290F

RegOpenKeyExA.KERNEL32(80000002,00B3B5F0,00000000,00020119,?), ref: 00DF2871
RegQueryValueExA.KERNEL32(?,00B41BD0,00000000,00000000,00000000,000000FF), ref: 00DF288C
RegCloseKey.ADVAPI32(?), ref: 00DF2896

Strings

Windows 11, xrefs: 00DF2850

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: 6459e0886bd614b6910f95a28ceefa5598bdddd4b4f64a7f2b6994126f440c17
Instruction ID: 9a8a0e04882c556f03ec4934ef689c1f865bcfc3e7f8d3fd72f2313f298f2da4
Opcode Fuzzy Hash: 6459e0886bd614b6910f95a28ceefa5598bdddd4b4f64a7f2b6994126f440c17
Instruction Fuzzy Hash: 6A01A271A0020CBFD720DBA4AC49EBB777CEB44715F008159FF48D6285D67559408BA0

Function 00DEEFE0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(00000000,?), ref: 00DEF013
StrCmpCA.SHLWAPI(?,ERROR,?,?,?,?,?,?,?,?,?,00DEF54D), ref: 00DEF02E
lstrcpy.KERNEL32(00000000,ERROR), ref: 00DEF08F

Strings

ERROR, xrefs: 00DEF028, 00DEF089

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: ERROR
API String ID: 3722407311-2861137601
Opcode ID: d66ce3a2a8c6be6e49636bd444eb3959e35304d59f3fec7abff8c320720bd23a
Instruction ID: 92918235000bde68e2650f1e810aaa3113885b7a8d216c75ef25f30be3ad1ad8
Opcode Fuzzy Hash: d66ce3a2a8c6be6e49636bd444eb3959e35304d59f3fec7abff8c320720bd23a
Instruction Fuzzy Hash: D0211D71A502869BCB24BF79D8567AF37A4EF14300F444529B88DDB353EA30DE518BB0

Function 00DF2A70 Relevance: 4.5, APIs: 3, Instructions: 44
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 00DF2A9F
HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00DF2AA6
GetComputerNameA.KERNEL32(00000000,00000104), ref: 00DF2ABA

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 96bf909a6722fe00259684bea0b26dfd707b30b741bd666a929d72e02524e611
Instruction ID: 126bd7bab7b66e8dcaa6a0179ee3cd60bc85787213eb5bb665e62eee9fcf5df2
Opcode Fuzzy Hash: 96bf909a6722fe00259684bea0b26dfd707b30b741bd666a929d72e02524e611
Instruction Fuzzy Hash: 9A01D672A44648AFD720CF99EC45BAAF7BCF744B25F00426AFA19E3780D779190487A1

Function 00DEEF30 Relevance: 1.3, APIs: 1, Instructions: 50stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 00DEEF62

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 04067088f38f6ce22f5c14a89d714d1f0c7b86391b9fdd6fe78d782fe65b5b0d
Instruction ID: 7a6a95fa429edc4af1fea5e2d52517d89fc95b9f2db5d99a4b33c87cf73f149d
Opcode Fuzzy Hash: 04067088f38f6ce22f5c14a89d714d1f0c7b86391b9fdd6fe78d782fe65b5b0d
Instruction Fuzzy Hash: CE11C0706601499BDB24FF79DC96AEE37A4EF54340F804125B8888B352DA34EE558BF1

Non-executed Functions

Function 00DD6000 Relevance: 128.6, APIs: 68, Strings: 5, Instructions: 817stringnetworkCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 00DD602F
lstrcpy.KERNEL32(00000000,00DFD014), ref: 00DD6082
lstrcpy.KERNEL32(00000000,00DFD014), ref: 00DD60B5
lstrcpy.KERNEL32(00000000,00DFD014), ref: 00DD60E5
lstrcpy.KERNEL32(00000000,00DFD014), ref: 00DD6120
lstrcpy.KERNEL32(00000000,00DFD014), ref: 00DD6153
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00DD6163

Strings

LP, xrefs: 00DD6601
", xrefs: 00DD65C7, 00DD66B5
LP, xrefs: 00DD656B
------, xrefs: 00DD6289, 00DD62B6, 00DD652E, 00DD661F
LP, xrefs: 00DD6659

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: lstrcpy$InternetOpen
String ID: "$------$LP$LP$LP
API String ID: 2041821634-2504685677
Opcode ID: 50fa73f80ec6d84585a1eee73139d021f1e98f9f51a13f178f20e97acb4bb461
Instruction ID: 5320c1eb8311a638a41d0ceeba661c2a8ff4d53d2418d36e5fa2f3ea263b7086
Opcode Fuzzy Hash: 50fa73f80ec6d84585a1eee73139d021f1e98f9f51a13f178f20e97acb4bb461
Instruction Fuzzy Hash: 33523E71A002159FDB21AFB4DC49AAE77B9EF44304F198026F945A7356DB35ED028BF0

Function 00DD97A0 Relevance: 47.5, APIs: 24, Strings: 3, Instructions: 235stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00DD97C4
lstrcatA.KERNEL32(?,?), ref: 00DD97D8
lstrcatA.KERNEL32(?,?), ref: 00DD97ED
lstrcatA.KERNEL32(?, --remote-debugging-port=9229 --profile-directory="), ref: 00DD9800
memset.MSVCRT ref: 00DD9815

Part of subcall function 00DF3E10: lstrcpy.KERNEL32(00000000,00DFD014), ref: 00DF3E45
Part of subcall function 00DF3E10: lstrcpy.KERNEL32(00000000,00B34638), ref: 00DF3E6F
Part of subcall function 00DF3E10: GetSystemTime.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,00DD4D2A,?,00000014), ref: 00DF3E79

wsprintfA.USER32 ref: 00DD9846
OpenDesktopA.USER32(?,00000000,00000001,10000000), ref: 00DD9869
CreateDesktopA.USER32(?,00000000,00000000,00000000,10000000,00000000), ref: 00DD9888
memset.MSVCRT ref: 00DD98A6
lstrcatA.KERNEL32(?,?,?,00000000,00000103), ref: 00DD98BB
lstrcatA.KERNEL32(?,?), ref: 00DD98CD
lstrcatA.KERNEL32(?,00E05120), ref: 00DD98DD
memset.MSVCRT ref: 00DD98F2
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00DD991A
lstrcpy.KERNEL32(00000000,?), ref: 00DD9950
StrStrA.SHLWAPI(?,00B41F00), ref: 00DD9965
lstrcpyn.KERNEL32(010093D0,?,00000000), ref: 00DD9982
lstrlenA.KERNEL32(?), ref: 00DD9996
wsprintfA.USER32 ref: 00DD99A6
lstrcpy.KERNEL32(?,?), ref: 00DD99BD
memset.MSVCRT ref: 00DD99D3

Strings

%s%s, xrefs: 00DD99A0
--remote-debugging-port=9229 --profile-directory=", xrefs: 00DD97F3
D, xrefs: 00DD99EA

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: lstrcat$memset$lstrcpy$Desktopwsprintf$CreateFolderOpenPathSystemTimelstrcpynlstrlen
String ID: --remote-debugging-port=9229 --profile-directory="$%s%s$D
API String ID: 3051782728-1862457068
Opcode ID: 24fa888cedf39cc7c77df764ab2060d25c520fae5b9bd9d0ea66c18ca84be311
Instruction ID: d982caefa5d94a113a69c137f73039233ad6c739370aa646d8d3a79468d1b942
Opcode Fuzzy Hash: 24fa888cedf39cc7c77df764ab2060d25c520fae5b9bd9d0ea66c18ca84be311
Instruction Fuzzy Hash: FE917271614340AFE721EF74DC45FAB77E8EF88704F10891DB68987281DB75AA048BB6

Function 00DF46C0 Relevance: 13.6, APIs: 9, Instructions: 54processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 00DF46D9
Process32First.KERNEL32(00000000,00000128), ref: 00DF46E9
Process32Next.KERNEL32(00000000,00000128), ref: 00DF46FB
StrCmpCA.SHLWAPI(?,?), ref: 00DF470D
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00DF4722
TerminateProcess.KERNEL32(00000000,00000000), ref: 00DF4731
CloseHandle.KERNEL32(00000000), ref: 00DF4738
Process32Next.KERNEL32(00000000,00000128), ref: 00DF4746
CloseHandle.KERNEL32(00000000), ref: 00DF4751

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: Process32$CloseHandleNextProcess$CreateFirstOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 3836391474-0
Opcode ID: 9244ce046102b287f64632f761df8685c5b3f9081fafea73cc3ae7fdaa0bffb6
Instruction ID: ab380c7ac04a3cfb68582d9b8db931036bf19cfe5dc424a46cdc099956bdd613
Opcode Fuzzy Hash: 9244ce046102b287f64632f761df8685c5b3f9081fafea73cc3ae7fdaa0bffb6
Instruction Fuzzy Hash: 7901A1315011186BE732AB609C8CFFB377CAB45B41F048199FA8995184EF7999818BB0

Function 00DD7690 Relevance: 7.6, APIs: 5, Instructions: 52memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00DD769E
HeapAlloc.KERNEL32(00000000), ref: 00DD76A5
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00DD76CD
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000400,00000000,00000000), ref: 00DD76ED
LocalFree.KERNEL32(?), ref: 00DD76F7

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: Heap$AllocByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 3657800372-0
Opcode ID: 7434553a11e9a450663165e176acda182c19b58e3324636137ebea65e0030a20
Instruction ID: ab2a180a66618947b9a5bf79e2dc1d28a217ee7a1c50b5e05e448f85cdd09b92
Opcode Fuzzy Hash: 7434553a11e9a450663165e176acda182c19b58e3324636137ebea65e0030a20
Instruction Fuzzy Hash: 3D012575B403087FEB20DB94DC4AFAA7778EB44B15F108155FB49EB2C4D6B59900C7A0

Function 00DF4090 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?,?,?,?,?,?), ref: 00DF40AD
GetProcessHeap.KERNEL32(00000000,?,?,?), ref: 00DF40BC
HeapAlloc.KERNEL32(00000000,?,?,?), ref: 00DF40C3
CryptBinaryToStringA.CRYPT32(?,?,40000001,?,?,?,?,?,?), ref: 00DF40F3

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: BinaryCryptHeapString$AllocProcess
String ID:
API String ID: 3939037734-0
Opcode ID: 863ea78739d59a2d3230347994b2d23b4c62d2c009fb7f64c33f3aa49e2b19e7
Instruction ID: 73a5cfa366c4648f4f3c5d7257c1884ff006bb263b53ee7d924eda73a03f9433
Opcode Fuzzy Hash: 863ea78739d59a2d3230347994b2d23b4c62d2c009fb7f64c33f3aa49e2b19e7
Instruction Fuzzy Hash: 54011A70600209ABDB20DFA5DC89BABBBADEF85315F108069BE4987240DA759D408B60

Function 00DD9BE0 Relevance: 6.0, APIs: 4, Instructions: 43memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00DD9BFF
LocalAlloc.KERNEL32(00000040,?), ref: 00DD9C13
memcpy.MSVCRT(00000000,?), ref: 00DD9C2A
LocalFree.KERNEL32(?), ref: 00DD9C37

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: 6c81be1517a2a3e5cea9a578572044636fde364b79a22a85a0f3e71e559da163
Instruction ID: 0b9da6c2000cc9f4f024e34d5af8ad58481387685553798a966f4140f0985fda
Opcode Fuzzy Hash: 6c81be1517a2a3e5cea9a578572044636fde364b79a22a85a0f3e71e559da163
Instruction Fuzzy Hash: 1701FB75A41309ABD7109BA4DC55BAAB778EB44700F104159FA04AB384D7B59A00CBE0

Function 00DD9B80 Relevance: 6.0, APIs: 4, Instructions: 42encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00DD9B9B
LocalAlloc.KERNEL32(00000040,00000000,?,00000000,00000001,00000000,?,00000000,00000000), ref: 00DD9BAA
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00DD9BC1
LocalFree.KERNEL32(?,?,00000000,00000001,00000000,?,00000000,00000000,?,00000000,00000001,00000000,?,00000000,00000000), ref: 00DD9BD0

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 10a217fbd58deb283ba692d5b12f40aab30dd52af6fc8abadca61f2dfc9c3416
Instruction ID: cc0ff1094ec71f2992cf4ca442d3befa8122e2e54cbf2ef23fdb31d5cd6cfc89
Opcode Fuzzy Hash: 10a217fbd58deb283ba692d5b12f40aab30dd52af6fc8abadca61f2dfc9c3416
Instruction Fuzzy Hash: 04F030703403126FF7315F24AC59FA77BA8EF04B50F260415FA49EA2C4D7BA9840CBA4

Function 00DF3E10 Relevance: 4.6, APIs: 3, Instructions: 124stringtimeCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,00DFD014), ref: 00DF3E45
lstrcpy.KERNEL32(00000000,00B34638), ref: 00DF3E6F
GetSystemTime.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,00DD4D2A,?,00000014), ref: 00DF3E79

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: lstrcpy$SystemTime
String ID:
API String ID: 684065273-0
Opcode ID: c6342352f8bc2866b7aabc8c3f1a8483df7a028f066ffdae21bf237c4b2bfd16
Instruction ID: f773308ee0c40dcfab2a124cf949419b52152692f33afd132eee98a4029cc139
Opcode Fuzzy Hash: c6342352f8bc2866b7aabc8c3f1a8483df7a028f066ffdae21bf237c4b2bfd16
Instruction Fuzzy Hash: 33415B70E012499FDB25CF29C484666BBA5FF08314F0AC4AEE989DB352C676DD42CB60

Function 00DD1070 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 278stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00DD108A

Part of subcall function 00DD1000: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00DD1015
Part of subcall function 00DD1000: HeapAlloc.KERNEL32(00000000), ref: 00DD101C
Part of subcall function 00DD1000: RegOpenKeyExA.ADVAPI32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,?), ref: 00DD1039
Part of subcall function 00DD1000: RegQueryValueExA.ADVAPI32(?,wallet_path,00000000,00000000,00000000,000000FF), ref: 00DD1053
Part of subcall function 00DD1000: RegCloseKey.ADVAPI32(?), ref: 00DD105D

lstrcatA.KERNEL32(?,00000000), ref: 00DD10A0
lstrlenA.KERNEL32(?), ref: 00DD10AD
lstrcatA.KERNEL32(?,.keys), ref: 00DD10C8
lstrcpy.KERNEL32(00000000,00DFD014), ref: 00DD10FF
lstrlenA.KERNEL32(00B3EBB8), ref: 00DD110D
lstrcpy.KERNEL32(00000000,?), ref: 00DD1131
lstrcatA.KERNEL32(00000000,00B3EBB8), ref: 00DD1139
lstrlenA.KERNEL32(\Monero\wallet.keys), ref: 00DD1144
lstrcpy.KERNEL32(00000000,00000000), ref: 00DD1168
lstrcatA.KERNEL32(00000000,\Monero\wallet.keys), ref: 00DD1174
lstrcpy.KERNEL32(00000000,00000000), ref: 00DD119A
lstrcpy.KERNEL32(00000000,00DFD014), ref: 00DD11DF
lstrlenA.KERNEL32(00B41888), ref: 00DD11EE
lstrcpy.KERNEL32(00000000,?), ref: 00DD1215
lstrcatA.KERNEL32(00000000,?), ref: 00DD121D
lstrcpy.KERNEL32(00000000,00000000), ref: 00DD1258
lstrcatA.KERNEL32(00000000), ref: 00DD1265
lstrcpy.KERNEL32(00000000,00000000), ref: 00DD128C
CopyFileA.KERNEL32(?,?,00000001), ref: 00DD12B5
lstrcpy.KERNEL32(00000000,?), ref: 00DD12E1
lstrcpy.KERNEL32(00000000,?), ref: 00DD131D

Part of subcall function 00DEEF30: lstrcpy.KERNEL32(00000000,?), ref: 00DEEF62

DeleteFileA.KERNEL32(?), ref: 00DD1351
memset.MSVCRT ref: 00DD136E

Strings

.keys, xrefs: 00DD10BC
\Monero\wallet.keys, xrefs: 00DD113F, 00DD116E

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$FileHeapmemset$AllocCloseCopyDeleteOpenProcessQueryValue
String ID: .keys$\Monero\wallet.keys
API String ID: 2734118222-3586502688
Opcode ID: 61f77ddd743c7c93ce789da3d68679c94fefe825f7fcae6958d28d40acc5d6ed
Instruction ID: 8c7e9885406cfa74f0aa0bb0c3c311c84250e36f700aa8ab2d3b239e7e3bcefa
Opcode Fuzzy Hash: 61f77ddd743c7c93ce789da3d68679c94fefe825f7fcae6958d28d40acc5d6ed
Instruction Fuzzy Hash: 81A17F75A01205ABCB21EFB4DC4AAAE7BB9EF44300F484026F945E7356DB35DE458BB0

Function 00DD92E0 Relevance: 42.4, APIs: 19, Strings: 5, Instructions: 365stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DD90F0: InternetOpenA.WININET(00DFD014,00000001,00000000,00000000,00000000), ref: 00DD910F
Part of subcall function 00DD90F0: InternetOpenUrlA.WININET(00000000,http://localhost:9229/json,00000000,00000000,80000000,00000000), ref: 00DD912C
Part of subcall function 00DD90F0: InternetCloseHandle.WININET(00000000), ref: 00DD9139
Part of subcall function 00DD90F0: strlen.MSVCRT ref: 00DD9155

strlen.MSVCRT ref: 00DD9311
strlen.MSVCRT ref: 00DD932A

Part of subcall function 00DE7EB0: memchr.MSVCRT ref: 00DE7EEF
Part of subcall function 00DE7EB0: memcmp.MSVCRT(00000000,?,?,?,"webSocketDebuggerUrl":,00000000), ref: 00DE7F09
Part of subcall function 00DE7EB0: memchr.MSVCRT ref: 00DE7F28

Part of subcall function 00DD89B0: std::_Xinvalid_argument.LIBCPMT ref: 00DD89C6

memset.MSVCRT ref: 00DD9371
lstrcatA.KERNEL32(?,ws://localhost:9229), ref: 00DD938C
lstrcatA.KERNEL32(?,00000000), ref: 00DD93A2
strlen.MSVCRT ref: 00DD93C9
strlen.MSVCRT ref: 00DD9416
memcmp.MSVCRT(?,00DFD014,?), ref: 00DD943B
memset.MSVCRT ref: 00DD9562
lstrcatA.KERNEL32(?,cookies), ref: 00DD9577
lstrcatA.KERNEL32(?,00E01D5C), ref: 00DD9589
lstrcatA.KERNEL32(?,?), ref: 00DD959A
lstrcatA.KERNEL32(?,00E05158), ref: 00DD95AC
lstrcatA.KERNEL32(?,?), ref: 00DD95BD
lstrcatA.KERNEL32(?,.txt), ref: 00DD95CF
lstrlenA.KERNEL32(?), ref: 00DD95E6
lstrlenA.KERNEL32(?), ref: 00DD960B
lstrcpy.KERNEL32(00000000,?), ref: 00DD9644
memset.MSVCRT ref: 00DD968C

Strings

ws://localhost:9229, xrefs: 00DD9380
/devtools, xrefs: 00DD9325, 00DD9330
cookies, xrefs: 00DD956B
.txt, xrefs: 00DD95C3
localhost, xrefs: 00DD92FA, 00DD9318

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: lstrcat$strlen$Internetmemset$Openlstrlenmemchrmemcmp$CloseHandleXinvalid_argumentlstrcpystd::_
String ID: .txt$/devtools$cookies$localhost$ws://localhost:9229
API String ID: 2819545660-3542011879
Opcode ID: e0bc7acb4988941ffeafd2a7c5d8bcda35a8f4049e9220ff24961aba128ed716
Instruction ID: 8423bb88a2c67ad4648a46f55930a64607b29cf8c43cf2164eaedc4506993bb6
Opcode Fuzzy Hash: e0bc7acb4988941ffeafd2a7c5d8bcda35a8f4049e9220ff24961aba128ed716
Instruction Fuzzy Hash: A4E10771E10218EFDF14DFA8C894AEEBBB5BF48310F50446AE549A7341DB35AA45CFA0

Function 00DF1800 Relevance: 37.8, APIs: 25, Instructions: 269stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,00DFD014), ref: 00DF182F
lstrlenA.KERNEL32(00B2FAE0,00000000,00000000,?,?,00DF1B61), ref: 00DF1840
lstrcpy.KERNEL32(00000000,00000000), ref: 00DF1867
lstrcatA.KERNEL32(00000000,00000000), ref: 00DF1872
lstrcpy.KERNEL32(00000000,00000000), ref: 00DF18A1
lstrlenA.KERNEL32(00E05560,?,?,00DF1B61), ref: 00DF18B3
lstrcpy.KERNEL32(00000000,00000000), ref: 00DF18D4
lstrcatA.KERNEL32(00000000,00E05560,?,?,00DF1B61), ref: 00DF18E0
lstrcpy.KERNEL32(00000000,00000000), ref: 00DF190F
lstrlenA.KERNEL32(00B26660,?,?,00DF1B61), ref: 00DF1925
lstrcpy.KERNEL32(00000000,00000000), ref: 00DF194C
lstrcatA.KERNEL32(00000000,00000000), ref: 00DF1957
lstrcpy.KERNEL32(00000000,00000000), ref: 00DF1986
lstrlenA.KERNEL32(00E05560,?,?,00DF1B61), ref: 00DF1998
lstrcpy.KERNEL32(00000000,00000000), ref: 00DF19B9
lstrcatA.KERNEL32(00000000,00E05560,?,?,00DF1B61), ref: 00DF19C5
lstrcpy.KERNEL32(00000000,00000000), ref: 00DF19F4
lstrlenA.KERNEL32(00B32FC8,?,?,00DF1B61), ref: 00DF1A0A
lstrcpy.KERNEL32(00000000,00000000), ref: 00DF1A31
lstrcatA.KERNEL32(00000000,00000000), ref: 00DF1A3C
lstrcpy.KERNEL32(00000000,00000000), ref: 00DF1A6B
lstrlenA.KERNEL32(00B32FD8,?,?,00DF1B61), ref: 00DF1A81
lstrcpy.KERNEL32(00000000,00000000), ref: 00DF1AA8
lstrcatA.KERNEL32(00000000,00000000), ref: 00DF1AB3
lstrcpy.KERNEL32(00000000,00000000), ref: 00DF1AE2

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcatlstrlen
String ID:
API String ID: 1049500425-0
Opcode ID: 6e64140a374f632d1c6e46b845587deb37fa692a5f4db765abd21a464d24ca5e
Instruction ID: 536682431428d735f2055f793e7f2bcffed757fb7c9fe49e4cff13221aa4ad9b
Opcode Fuzzy Hash: 6e64140a374f632d1c6e46b845587deb37fa692a5f4db765abd21a464d24ca5e
Instruction Fuzzy Hash: 68917DB4600307EBD721AFB5C898A37B7EDEF14344F19882AA9D5C3252DB79D9418B70

Function 00DE8D00 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 174stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,block,?,?,?,?,00DF081F), ref: 00DE8D1A
ExitProcess.KERNEL32 ref: 00DE8D27
strtok_s.MSVCRT ref: 00DE8D39

Strings

block, xrefs: 00DE8D0B

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID: block
API String ID: 3407564107-2199623458
Opcode ID: 05560509b05bebb1fabedfbafceb59844418d5e365da55212f2ab58d1d17f674
Instruction ID: 4a19bcffabe9376291859cd27166e6e6efc0341f6a636053bf043b03bab7fc67
Opcode Fuzzy Hash: 05560509b05bebb1fabedfbafceb59844418d5e365da55212f2ab58d1d17f674
Instruction Fuzzy Hash: 6B517DB15087819FC721AF76D884A2BBBF5FF04704B00481EF48AD2661DF79D941AB71

Function 00DD90F0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 161networkstringfileCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(00DFD014,00000001,00000000,00000000,00000000), ref: 00DD910F
InternetOpenUrlA.WININET(00000000,http://localhost:9229/json,00000000,00000000,80000000,00000000), ref: 00DD912C
InternetCloseHandle.WININET(00000000), ref: 00DD9139
strlen.MSVCRT ref: 00DD9155
InternetReadFile.WININET(?,?,?,00000000), ref: 00DD9196
InternetReadFile.WININET(00000000,?,00001000,?), ref: 00DD91C7
InternetCloseHandle.WININET(00000000), ref: 00DD91D2
InternetCloseHandle.WININET(00000000), ref: 00DD91D9
strlen.MSVCRT ref: 00DD91EA
strlen.MSVCRT ref: 00DD921D
strlen.MSVCRT ref: 00DD925E

Part of subcall function 00DE7EB0: memchr.MSVCRT ref: 00DE7EEF
Part of subcall function 00DE7EB0: memcmp.MSVCRT(00000000,?,?,?,"webSocketDebuggerUrl":,00000000), ref: 00DE7F09
Part of subcall function 00DE7EB0: memchr.MSVCRT ref: 00DE7F28

strlen.MSVCRT ref: 00DD927C

Part of subcall function 00DD89B0: std::_Xinvalid_argument.LIBCPMT ref: 00DD89C6

Strings

"ws://, xrefs: 00DD9259, 00DD9264
http://localhost:9229/json, xrefs: 00DD9126
"webSocketDebuggerUrl":, xrefs: 00DD91E5, 00DD91F0

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: Internet$strlen$CloseHandle$FileOpenReadmemchr$Xinvalid_argumentmemcmpstd::_
String ID: "webSocketDebuggerUrl":$"ws://$http://localhost:9229/json
API String ID: 4166274400-2144369209
Opcode ID: 332cafc9a42e5e027aef000924bfca927381f2ed7fe953cc887a509ba2856312
Instruction ID: 4f23821d3531a96f69ed3cf9ef91ecb4313242a4a29615a13695dc46bc5aca3a
Opcode Fuzzy Hash: 332cafc9a42e5e027aef000924bfca927381f2ed7fe953cc887a509ba2856312
Instruction Fuzzy Hash: F351A871A00305ABDB20DBA8DC45BEEF7F9DB48710F14416AF605E3380DBB5A9458BB5

Function 00DD7710 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 202stringregistrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00DD7745
RegEnumValueA.ADVAPI32(80000001,00000000,?,?,00000000,?,?,?,?,00000000,00020019,?), ref: 00DD778A
strlen.MSVCRT ref: 00DD77BE
StrStrA.SHLWAPI(?,Password), ref: 00DD77F8
strlen.MSVCRT ref: 00DD788D

Part of subcall function 00DD7690: GetProcessHeap.KERNEL32(00000008,00000400), ref: 00DD769E
Part of subcall function 00DD7690: HeapAlloc.KERNEL32(00000000), ref: 00DD76A5
Part of subcall function 00DD7690: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00DD76CD
Part of subcall function 00DD7690: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000400,00000000,00000000), ref: 00DD76ED
Part of subcall function 00DD7690: LocalFree.KERNEL32(?), ref: 00DD76F7

strcpy_s.MSVCRT ref: 00DD7821
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00DD782C
HeapFree.KERNEL32(00000000), ref: 00DD7833
strlen.MSVCRT ref: 00DD7840
strcpy_s.MSVCRT ref: 00DD786A
strlen.MSVCRT ref: 00DD78B4
RegEnumValueA.ADVAPI32(80000001,00000000,?,000000FF,00000000,00000003,?,?,80000001), ref: 00DD7975

Strings

Password, xrefs: 00DD77EC

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: Heapstrlen$EnumFreeProcessValuestrcpy_s$AllocByteCharCryptDataLocalMultiOpenUnprotectWide
String ID: Password
API String ID: 3893107980-3434357891
Opcode ID: 7749e20cadf00195f19e6939985875b2919aff54a3bdfa4bfcf6a0920b4a8f47
Instruction ID: 4fdc3d6cf584d047c55e6a6cefa12d00124e282a4c056776ee8e18c0ddbd61e5
Opcode Fuzzy Hash: 7749e20cadf00195f19e6939985875b2919aff54a3bdfa4bfcf6a0920b4a8f47
Instruction Fuzzy Hash: 2781FFB1D0021DAFDB10DF94D8849EEB7B9FF48310F1485AAE509E7250EB359A85CFA1

Function 00DEF100 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 163stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 00DEF134
lstrcpy.KERNEL32(00000000,?), ref: 00DEF162
StrCmpCA.SHLWAPI(00000000,ERROR,?,?,?,?,?,?,?,?,?,?,?,?,00DEF67A), ref: 00DEF176
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00DEF67A), ref: 00DEF185
LocalAlloc.KERNEL32(00000040,00000001,?,?,?,?,?,?,?,?,?,?,?,?,00DEF67A), ref: 00DEF1A3
StrStrA.SHLWAPI(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00DEF67A), ref: 00DEF1D1
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00DEF67A), ref: 00DEF1E4
strtok.MSVCRT(00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,00DEF67A), ref: 00DEF1F6
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00DEF67A), ref: 00DEF202
lstrcpy.KERNEL32(00000000,ERROR), ref: 00DEF24F
lstrcpy.KERNEL32(00000000,ERROR), ref: 00DEF28F

Strings

ERROR, xrefs: 00DEF170, 00DEF20F, 00DEF249, 00DEF289

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$AllocLocalstrtok
String ID: ERROR
API String ID: 2137491262-2861137601
Opcode ID: c9d7c465f2ffeb22d4d9b8451fb890c1f0cdaa8e5b5b28d6cad54396fa5ed68c
Instruction ID: 94a2909421089ed532cbf749f2d702cda25c45f8a90118eb3c8f6417f4fd4436
Opcode Fuzzy Hash: c9d7c465f2ffeb22d4d9b8451fb890c1f0cdaa8e5b5b28d6cad54396fa5ed68c
Instruction Fuzzy Hash: 04517D359102859FCB21BB75C849A7F77A5EF54304F09406AF989DB312DB34DD028BB0

Function 00DDA070 Relevance: 18.3, APIs: 12, Instructions: 251stringlibraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00B3EEA8,01009BD8,0000FFFF), ref: 00DDA086
lstrcpy.KERNEL32(00000000,00DFD014), ref: 00DDA0B3
lstrlenA.KERNEL32(01009BD8), ref: 00DDA0C0
lstrcpy.KERNEL32(00000000,01009BD8), ref: 00DDA0EA
lstrlenA.KERNEL32(00E0520C), ref: 00DDA0F5
lstrcpy.KERNEL32(00000000,00000000), ref: 00DDA112
lstrcatA.KERNEL32(00000000,00E0520C), ref: 00DDA11E
lstrcpy.KERNEL32(00000000,00000000), ref: 00DDA144
lstrcatA.KERNEL32(00000000,00000000), ref: 00DDA14F
lstrcpy.KERNEL32(00000000,00000000), ref: 00DDA174
SetEnvironmentVariableA.KERNEL32(00B3EEA8,00000000), ref: 00DDA18F
LoadLibraryA.KERNEL32(00B42548), ref: 00DDA1A3

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID:
API String ID: 2929475105-0
Opcode ID: ab2dddcd6b197137b91636a2ccdbec23b958b2895f927ce1145d23343f096a78
Instruction ID: 3baafcf26e99fd9a99c980efda15efe48b66e01262535688e8ca7038d9154f09
Opcode Fuzzy Hash: ab2dddcd6b197137b91636a2ccdbec23b958b2895f927ce1145d23343f096a78
Instruction Fuzzy Hash: 9891D231A00B009FD7319FA8D844A7637B6FB54704F48C52BE9458B356EB7ADD818BB2

Function 00DDBCE9 Relevance: 18.2, APIs: 12, Instructions: 249stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,00DFD014), ref: 00DDBD0F
lstrlenA.KERNEL32(00000000), ref: 00DDBD42
lstrcpy.KERNEL32(00000000,00000000), ref: 00DDBD6C
lstrcatA.KERNEL32(00000000,00000000), ref: 00DDBD74
lstrcpy.KERNEL32(00000000,00000000), ref: 00DDBD9C
lstrlenA.KERNEL32(00E05094), ref: 00DDBE13

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: fa9b2f03074fd5c688bc0a5995411fc9fbe212d5d3327d5d48a3e4d9c4a4b456
Instruction ID: cf424406dbc4084ba0b44699991f9950682f08e168abf904e9bed1683f8eb5db
Opcode Fuzzy Hash: fa9b2f03074fd5c688bc0a5995411fc9fbe212d5d3327d5d48a3e4d9c4a4b456
Instruction Fuzzy Hash: 16A16F70A01204CFCB25DF28C959AAEB7B5EF44318F59806BE4499B366DB36DD42CB70

Function 00DE8240 Relevance: 18.2, APIs: 12, Instructions: 173stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00DE8263
lstrlenA.KERNEL32(00000000), ref: 00DE829C
lstrcpy.KERNEL32(00000000,00000000), ref: 00DE82D3
lstrlenA.KERNEL32(00000000), ref: 00DE82F0
lstrcpy.KERNEL32(00000000,00000000), ref: 00DE8327
lstrlenA.KERNEL32(00000000), ref: 00DE8344
lstrcpy.KERNEL32(00000000,00000000), ref: 00DE837B
lstrlenA.KERNEL32(00000000), ref: 00DE8398
lstrcpy.KERNEL32(00000000,00000000), ref: 00DE83C7
lstrlenA.KERNEL32(00000000), ref: 00DE83E1
lstrcpy.KERNEL32(00000000,00000000), ref: 00DE8410
strtok_s.MSVCRT ref: 00DE842A

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$strtok_s
String ID:
API String ID: 2211830134-0
Opcode ID: 82b413ee082698f95979cab9b3a60e6957ea39488f6a7199477aa57d60e522a2
Instruction ID: 3c7db3230b535125a39037a8f168690e6b9a3c17713a25afbf3483e0d1b4eabd
Opcode Fuzzy Hash: 82b413ee082698f95979cab9b3a60e6957ea39488f6a7199477aa57d60e522a2
Instruction Fuzzy Hash: 91513C71A006129BDB15EF79D858AAABBE9EF04300F148115EC4ADB385DB34ED51DBF0

Function 00DD6A10 Relevance: 16.6, APIs: 11, Instructions: 127networkfilestringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 00DD6A3F
InternetOpenA.WININET(00DFD014,00000001,00000000,00000000,00000000), ref: 00DD6A6C
StrCmpCA.SHLWAPI(?,00B3EC68), ref: 00DD6A8A
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,-00800100,00000000), ref: 00DD6AAA
CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00DD6AC8
InternetReadFile.WININET(00000000,?,00000400,?), ref: 00DD6AE1
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00DD6B06
InternetReadFile.WININET(00000000,?,00000400,?), ref: 00DD6B30
CloseHandle.KERNEL32(00000000), ref: 00DD6B50
InternetCloseHandle.WININET(00000000), ref: 00DD6B57
InternetCloseHandle.WININET(?), ref: 00DD6B61

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: Internet$File$CloseHandle$OpenRead$CreateWritelstrcpy
String ID:
API String ID: 2500263513-0
Opcode ID: 54aa9085f729b5c3c148103c6e8e7791a27cffff465fcbd6cd50e33de338ed50
Instruction ID: 52a57c62a81f3653061fde8d73da24949fdeb042ef5dae19b0e8889e6f160c8f
Opcode Fuzzy Hash: 54aa9085f729b5c3c148103c6e8e7791a27cffff465fcbd6cd50e33de338ed50
Instruction Fuzzy Hash: 9B419E71A00219ABDB20DF64DC45FAE77B8EB04704F14846AFA45E7281DB74EE048BB4

Function 00DD79A0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 109stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DD7710: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00DD7745
Part of subcall function 00DD7710: RegEnumValueA.ADVAPI32(80000001,00000000,?,?,00000000,?,?,?,?,00000000,00020019,?), ref: 00DD778A
Part of subcall function 00DD7710: strlen.MSVCRT ref: 00DD77BE
Part of subcall function 00DD7710: StrStrA.SHLWAPI(?,Password), ref: 00DD77F8
Part of subcall function 00DD7710: strcpy_s.MSVCRT ref: 00DD7821
Part of subcall function 00DD7710: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00DD782C
Part of subcall function 00DD7710: HeapFree.KERNEL32(00000000), ref: 00DD7833
Part of subcall function 00DD7710: strlen.MSVCRT ref: 00DD7840

lstrcatA.KERNEL32(00000000,00E05094), ref: 00DD79D0
lstrcatA.KERNEL32(00000000,?), ref: 00DD79FD
lstrcatA.KERNEL32(00000000, : ), ref: 00DD7A0F
lstrcatA.KERNEL32(00000000,?), ref: 00DD7A30
wsprintfA.USER32 ref: 00DD7A50
lstrcpy.KERNEL32(00000000,?), ref: 00DD7A79
lstrcatA.KERNEL32(00000000,00000000), ref: 00DD7A87
lstrcatA.KERNEL32(00000000,00E05094), ref: 00DD7AA0

Strings

: , xrefs: 00DD7A09

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: lstrcat$Heapstrlen$EnumFreeOpenProcessValuelstrcpystrcpy_swsprintf
String ID: :
API String ID: 2460923012-3653984579
Opcode ID: d4b6b847f11433a399606e52f159684a29025b1ceac733b5846dffb9b6395623
Instruction ID: a62a89b9fe5adcc75ddae5f51a281425777415e37a120b447c3c14e50d2996dd
Opcode Fuzzy Hash: d4b6b847f11433a399606e52f159684a29025b1ceac733b5846dffb9b6395623
Instruction Fuzzy Hash: 2D319372A04214EFCB21DB68D8449AFB7B9FB84304F14555AF58E93345EB35AE41CBB0

Function 00DE80E0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 112stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00DE8105
lstrlenA.KERNEL32(00000000,?,?,?,?,?,00DF093B), ref: 00DE814B
lstrcpy.KERNEL32(00000000,00000000), ref: 00DE817A
StrCmpCA.SHLWAPI(00000000,00E051FC,?,?,?,?,?,00DF093B), ref: 00DE8192
lstrlenA.KERNEL32(00000000,?,?,?,?,?,00DF093B), ref: 00DE81D0
lstrcpy.KERNEL32(00000000,00000000), ref: 00DE81FF
strtok_s.MSVCRT ref: 00DE820F

Strings

fplugins, xrefs: 00DE80E6

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlenstrtok_s
String ID: fplugins
API String ID: 3280532728-38756186
Opcode ID: 3e364b5607349d8f7296cdab937e722a8c45a34d394e422099515f708a512f56
Instruction ID: de2e12d996f04771ae065e3dd68f9c085fdaf05ed21e05a73dedbde740937f54
Opcode Fuzzy Hash: 3e364b5607349d8f7296cdab937e722a8c45a34d394e422099515f708a512f56
Instruction Fuzzy Hash: 8C418C71A002469BCB21EFB9D948BAABBB4EF44700F15811DE89DD7244EB34D941DBA0

Function 00DD9E40 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 182memorystringCOMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,v20,00000003), ref: 00DD9E64
memcmp.MSVCRT(?,v10,00000003), ref: 00DD9EA2
memset.MSVCRT ref: 00DD9ECF
LocalAlloc.KERNEL32(00000040), ref: 00DD9F07

Part of subcall function 00DF7210: lstrcpy.KERNEL32(00000000,ERROR), ref: 00DF722E

lstrcpy.KERNEL32(00000000,00E05208), ref: 00DDA012

Strings

v10, xrefs: 00DD9E9C
@, xrefs: 00DD9EE8
v20, xrefs: 00DD9E5E

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: lstrcpymemcmp$AllocLocalmemset
String ID: @$v10$v20
API String ID: 3420379846-278772428
Opcode ID: d4680776d8f7d4a83e1f55b84016764618c7b8f1335a881249cbc67cc7645c6e
Instruction ID: 3d41937b56cc9912ee6019aaa00a567fc45f3640baaf8812016288fca0507fbc
Opcode Fuzzy Hash: d4680776d8f7d4a83e1f55b84016764618c7b8f1335a881249cbc67cc7645c6e
Instruction Fuzzy Hash: D3517E72A40209ABDB10EFA4CC55BAEB7A4EF14314F154026F949EB352DA71EE458BF0

Function 00DD1000 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 37registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00DD1015
HeapAlloc.KERNEL32(00000000), ref: 00DD101C
RegOpenKeyExA.ADVAPI32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,?), ref: 00DD1039
RegQueryValueExA.ADVAPI32(?,wallet_path,00000000,00000000,00000000,000000FF), ref: 00DD1053
RegCloseKey.ADVAPI32(?), ref: 00DD105D

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00DD102F
wallet_path, xrefs: 00DD104D

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: SOFTWARE\monero-project\monero-core$wallet_path
API String ID: 3466090806-4244082812
Opcode ID: 824aa1ad7fe93935d61f5340b55d5bd77570618758b2f88d30182fe4173ddc70
Instruction ID: afdc456fade1d1cff983a3a01abd690ba7315f7e9b586b4176f0a848933257a0
Opcode Fuzzy Hash: 824aa1ad7fe93935d61f5340b55d5bd77570618758b2f88d30182fe4173ddc70
Instruction Fuzzy Hash: 71F09075A40309BFD720ABA09C4DFBB7B3CEB04715F104055FE48E6285D6B55A4487A0

Function 00DF4760 Relevance: 12.1, APIs: 8, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,?), ref: 00DF4779
Process32First.KERNEL32(00000000,00000128), ref: 00DF4789
Process32Next.KERNEL32(00000000,00000128), ref: 00DF479B
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00DF47BC
TerminateProcess.KERNEL32(00000000,00000000), ref: 00DF47CB
CloseHandle.KERNEL32(00000000), ref: 00DF47D2
Process32Next.KERNEL32(00000000,00000128), ref: 00DF47E0
CloseHandle.KERNEL32(00000000), ref: 00DF47EB

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: Process32$CloseHandleNextProcess$CreateFirstOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 3836391474-0
Opcode ID: 1bb46e048c5aed60184b709fe897cf5bcdeeda87d46cfc552ac6a4a7c5d2e6b8
Instruction ID: 0fc685a6ff744159ebdacbf945a013c257815c957858520c520727163cc97d84
Opcode Fuzzy Hash: 1bb46e048c5aed60184b709fe897cf5bcdeeda87d46cfc552ac6a4a7c5d2e6b8
Instruction Fuzzy Hash: 9A01D231A012186FE732AB309C88FFB777CEB08741F048195FA4991085EB798D908BA0

Function 00DD7130 Relevance: 10.6, APIs: 7, Instructions: 141memorylibraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 00DD717E
GetProcessHeap.KERNEL32(00000008,00000010), ref: 00DD71B9
HeapAlloc.KERNEL32(00000000), ref: 00DD71C0
memcpy.MSVCRT(00000000,?), ref: 00DD71ED
GetProcessHeap.KERNEL32(00000000,?), ref: 00DD7203
HeapFree.KERNEL32(00000000), ref: 00DD720A
GetProcAddress.KERNEL32(00000000,?), ref: 00DD7269

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeLibraryLoadProcmemcpy
String ID:
API String ID: 1745114167-0
Opcode ID: 7036b71a34fc243257ba998dc7e718e1d8b56c7492b6c5e339b8debf1eaf8c68
Instruction ID: bfa675757ba4f91a234ae4b77ad4bd0240c9b1442246016c220250d6779f3a3c
Opcode Fuzzy Hash: 7036b71a34fc243257ba998dc7e718e1d8b56c7492b6c5e339b8debf1eaf8c68
Instruction Fuzzy Hash: 12415D71B047459BEB20CFA9D884BAAB7F8FB84315F1845AAEC5DC7305E735E9008B64

Function 00DD9CD0 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 123memorystringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000), ref: 00DD9D08
LocalAlloc.KERNEL32(00000040,?), ref: 00DD9D3A
StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00DD9D63
memcmp.MSVCRT(?,DPAPI,00000005), ref: 00DD9D9C

Strings

, xrefs: 00DD9DC5
DPAPI, xrefs: 00DD9D96
"encrypted_key":", xrefs: 00DD9D5D

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: AllocLocallstrcpymemcmp
String ID: $"encrypted_key":"$DPAPI
API String ID: 4154055062-738592651
Opcode ID: 4eb60ad60c39b58e801d6c7246ace078c8b53eb515d3b303c93e381ae62d0e82
Instruction ID: 78b61f4b768fd0f3f9861f1fd3c217315562b75e3e54b21e442b6fd258f965e7
Opcode Fuzzy Hash: 4eb60ad60c39b58e801d6c7246ace078c8b53eb515d3b303c93e381ae62d0e82
Instruction Fuzzy Hash: DC41A231A002099BDB10EFA8CCA16AFB7B5EF54300F094167F994A7352DA31EE05CBB0

Function 00DE7F60 Relevance: 10.6, APIs: 7, Instructions: 118stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00DE7F84
lstrlenA.KERNEL32(00000000), ref: 00DE7FB1
lstrcpy.KERNEL32(00000000,00000000), ref: 00DE7FE0
strtok_s.MSVCRT ref: 00DE7FF1
StrCmpCA.SHLWAPI(00000000,00E051FC), ref: 00DE8025
StrCmpCA.SHLWAPI(00000000,00E051FC), ref: 00DE8053
StrCmpCA.SHLWAPI(00000000,00E051FC), ref: 00DE8087

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: f7a1f01b6f77e4c69a1d17b4b258c408b586d168cbb081744a89504137e7c5c7
Instruction ID: b7de60cfc62baa40b438c18e5c31e176aea3fe44ab2542ddc0daf4d84f4ec272
Opcode Fuzzy Hash: f7a1f01b6f77e4c69a1d17b4b258c408b586d168cbb081744a89504137e7c5c7
Instruction Fuzzy Hash: D441E370A0460ADFCB20EF19D480EAE77B4FF44300F114089E809AB355EB31EA66CFA1

Function 00DE7DC0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00DE7DD8

Part of subcall function 00DFA1F0: std::exception::exception.LIBCMT ref: 00DFA205
Part of subcall function 00DFA1F0: __CxxThrowException@8.LIBCMT ref: 00DFA21A

std::_Xinvalid_argument.LIBCPMT ref: 00DE7DF6
std::_Xinvalid_argument.LIBCPMT ref: 00DE7E11
memcpy.MSVCRT(?,?,?,00000000,?,?,00DE7CFA,00000000,?,?,00000000,?,00DD91B6,?), ref: 00DE7E74

Strings

invalid string position, xrefs: 00DE7DD3
string too long, xrefs: 00DE7DF1, 00DE7E0C

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$Exception@8Throwmemcpystd::exception::exception
String ID: invalid string position$string too long
API String ID: 702443124-4289949731
Opcode ID: 7bd605bd5a383791b48166e43466ae2b8471c1eb69cc389513dd40d3e2789c3e
Instruction ID: d0eb2460c8658e707e9b9ff00bf1fd7b667f43cae4d6aca189889b48570e8082
Opcode Fuzzy Hash: 7bd605bd5a383791b48166e43466ae2b8471c1eb69cc389513dd40d3e2789c3e
Instruction Fuzzy Hash: 2D21D2323047818BD764EE6DD880A2AB7E5EF91B10F244AAEF4968B281D770DC4187B1

Function 00DD9AE0 Relevance: 9.1, APIs: 6, Instructions: 67filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,00DD12EE), ref: 00DD9AFA
GetFileSizeEx.KERNEL32(00000000,?,?,?,?,00DD12EE), ref: 00DD9B10
LocalAlloc.KERNEL32(00000040,?,?,?,?,00DD12EE), ref: 00DD9B27
ReadFile.KERNEL32(00000000,00000000,?,00DD12EE,00000000,?,?,?,00DD12EE), ref: 00DD9B40
LocalFree.KERNEL32(?,?,?,?,00DD12EE), ref: 00DD9B60
CloseHandle.KERNEL32(00000000,?,?,?,00DD12EE), ref: 00DD9B67

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: d55227a90313a31c22b8707fca4148deeab9113d6b26a282644258595ae54916
Instruction ID: 549e83b0480ccc2264e390d5971fd30be595e73c690dc8f8406298c84e061313
Opcode Fuzzy Hash: d55227a90313a31c22b8707fca4148deeab9113d6b26a282644258595ae54916
Instruction Fuzzy Hash: 5C115E71600209AFE721DFA4ECD4ABBB36CEB04704F16415BF9049B280EB36ED008B74

Function 00DD89B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00DD89C6

Part of subcall function 00DFA1F0: std::exception::exception.LIBCMT ref: 00DFA205
Part of subcall function 00DFA1F0: __CxxThrowException@8.LIBCMT ref: 00DFA21A

std::_Xinvalid_argument.LIBCPMT ref: 00DD89FD

Part of subcall function 00DFA1A3: std::exception::exception.LIBCMT ref: 00DFA1B8
Part of subcall function 00DFA1A3: __CxxThrowException@8.LIBCMT ref: 00DFA1CD

memcpy.MSVCRT(?,00000000,?,00000000,?,?,00DD8800,?,00000000,00DD77D7), ref: 00DD8A5B

Strings

invalid string position, xrefs: 00DD89C1
string too long, xrefs: 00DD89F8

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: Exception@8ThrowXinvalid_argumentstd::_std::exception::exception$memcpy
String ID: invalid string position$string too long
API String ID: 2202983795-4289949731
Opcode ID: ed7aaa94ced57e086d9a84428448dc553735bf42381193d6d990bc8248407a2e
Instruction ID: 76c137b5a9785b2096803a15aa4969f07442cfc79246f50b95c0c2a9ee57af7c
Opcode Fuzzy Hash: ed7aaa94ced57e086d9a84428448dc553735bf42381193d6d990bc8248407a2e
Instruction Fuzzy Hash: A021D3723006508BC7229A6CE840A6AF7E9EBA1761B15093FF192CB381DB71DC41D7F5

Function 00DF1B00 Relevance: 7.6, APIs: 5, Instructions: 66timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00DF1E28), ref: 00DF1B52

Part of subcall function 00DF1800: lstrcpy.KERNEL32(00000000,00DFD014), ref: 00DF182F
Part of subcall function 00DF1800: lstrlenA.KERNEL32(00B2FAE0,00000000,00000000,?,?,00DF1B61), ref: 00DF1840
Part of subcall function 00DF1800: lstrcpy.KERNEL32(00000000,00000000), ref: 00DF1867
Part of subcall function 00DF1800: lstrcatA.KERNEL32(00000000,00000000), ref: 00DF1872
Part of subcall function 00DF1800: lstrcpy.KERNEL32(00000000,00000000), ref: 00DF18A1
Part of subcall function 00DF1800: lstrlenA.KERNEL32(00E05560,?,?,00DF1B61), ref: 00DF18B3
Part of subcall function 00DF1800: lstrcpy.KERNEL32(00000000,00000000), ref: 00DF18D4
Part of subcall function 00DF1800: lstrcatA.KERNEL32(00000000,00E05560,?,?,00DF1B61), ref: 00DF18E0
Part of subcall function 00DF1800: lstrcpy.KERNEL32(00000000,00000000), ref: 00DF190F

sscanf.NTDLL ref: 00DF1B7A
SystemTimeToFileTime.KERNEL32(?,?), ref: 00DF1B96
SystemTimeToFileTime.KERNEL32(?,?), ref: 00DF1BA6
ExitProcess.KERNEL32 ref: 00DF1BC3

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: Timelstrcpy$System$Filelstrcatlstrlen$ExitProcesssscanf
String ID:
API String ID: 3040284667-0
Opcode ID: 443fe50b8955a96dd34915b5e12694bcf11457c0e5d7ca78ad94df67c850fd1e
Instruction ID: 2e71770145ace2f4a984981a8a864f79640533b7765cb0680de810f4d54ee7f5
Opcode Fuzzy Hash: 443fe50b8955a96dd34915b5e12694bcf11457c0e5d7ca78ad94df67c850fd1e
Instruction Fuzzy Hash: 6921DEB5518305EFC350EF69D88486BBBF8EEC8214F408A1EF699C3214E73596048BA2

Function 00DD6E30 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,00000040), ref: 00DD6E40
memcpy.MSVCRT(?,00005A4D,000000F8), ref: 00DD6E7C
GetProcessHeap.KERNEL32(00000008,?), ref: 00DD6EB4
HeapAlloc.KERNEL32(00000000), ref: 00DD6EBB

Strings

@, xrefs: 00DD6E30

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: Heapmemcpy$AllocProcess
String ID: @
API String ID: 1643994569-2766056989
Opcode ID: 18523bcc8f498ed66590986e842d5491ccb4cccd59a22b833bf5aae6b5cef67b
Instruction ID: ed1fa3208ddff6b30054fa2af010b2acc46cb848396ff2b5e76061cc4e24da36
Opcode Fuzzy Hash: 18523bcc8f498ed66590986e842d5491ccb4cccd59a22b833bf5aae6b5cef67b
Instruction Fuzzy Hash: 50116170640B119BDB218B61DC84BB677E4EF41705F08843AF946CB784FB74D940CBA1

Function 00DE7CA0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00DE7D14
std::_Xinvalid_argument.LIBCPMT ref: 00DE7D2F
memcpy.MSVCRT(?,?,?,00000000,?,00000000,?,00DD91B6,?,?,?,?,00000000,?,00001000,?), ref: 00DE7D84

Part of subcall function 00DE7DC0: std::_Xinvalid_argument.LIBCPMT ref: 00DE7DD8
Part of subcall function 00DE7DC0: std::_Xinvalid_argument.LIBCPMT ref: 00DE7DF6
Part of subcall function 00DE7DC0: std::_Xinvalid_argument.LIBCPMT ref: 00DE7E11
Part of subcall function 00DE7DC0: memcpy.MSVCRT(?,?,?,00000000,?,?,00DE7CFA,00000000,?,?,00000000,?,00DD91B6,?), ref: 00DE7E74

Strings

string too long, xrefs: 00DE7D0F, 00DE7D2A

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$memcpy
String ID: string too long
API String ID: 2304785028-2556327735
Opcode ID: 24ecfab76af7349ee0ff4a5af17f8aec43a24f8f029ffd5aec89c6a617fe3448
Instruction ID: 821e0636e08930187509dd9069bed2121ab69c0858a0e1b2a4f8127da9f65719
Opcode Fuzzy Hash: 24ecfab76af7349ee0ff4a5af17f8aec43a24f8f029ffd5aec89c6a617fe3448
Instruction Fuzzy Hash: 0D310672308690CBD760EE6DEC80A7AF7E9EF91760B244A2AF1428B641C7719C4187B4

Function 00DD8880 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 89COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00DD88B3

Part of subcall function 00DFA1A3: std::exception::exception.LIBCMT ref: 00DFA1B8
Part of subcall function 00DFA1A3: __CxxThrowException@8.LIBCMT ref: 00DFA1CD

Strings

vector<T> too long, xrefs: 00DD88AE
yxxx, xrefs: 00DD88BD
yxxx, xrefs: 00DD890A

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: Exception@8ThrowXinvalid_argumentstd::_std::exception::exception
String ID: vector<T> too long$yxxx$yxxx
API String ID: 2884196479-1517697755
Opcode ID: a3c19d8762247f9e257303a0478ccc973033cbd8d6c85ac02e0a67a2d6b40b32
Instruction ID: 2f6ca9fbcacceecb1810d8feebecd9897c0d8d2bc267a35c24bc5b17670851dc
Opcode Fuzzy Hash: a3c19d8762247f9e257303a0478ccc973033cbd8d6c85ac02e0a67a2d6b40b32
Instruction Fuzzy Hash: 67318BB5E005159FCB04DF58C89166DB7B6EB88310F14C269E915AF345DB30AD01CBE1

Function 00DD8740 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00DD8767

Part of subcall function 00DFA1A3: std::exception::exception.LIBCMT ref: 00DFA1B8
Part of subcall function 00DFA1A3: __CxxThrowException@8.LIBCMT ref: 00DFA1CD

Strings

vector<T> too long, xrefs: 00DD8762
yxxx, xrefs: 00DD8771
yxxx, xrefs: 00DD8749

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: Exception@8ThrowXinvalid_argumentstd::_std::exception::exception
String ID: vector<T> too long$yxxx$yxxx
API String ID: 2884196479-1517697755
Opcode ID: b7c97408ad5b41a4e63f3efdf8009835ac625083bc02d4664fabd2df77fbffcb
Instruction ID: 78aff5b645960ccc5fa0eb5628663c096404dbb73e0ac8ed75938afb76b13bb5
Opcode Fuzzy Hash: b7c97408ad5b41a4e63f3efdf8009835ac625083bc02d4664fabd2df77fbffcb
Instruction Fuzzy Hash: FFF09027F100212B8355A53E9D8509EA94796E439033ED722E94AEF389EC30EC82A1F0

Function 00DD87B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00DD880C
memcpy.MSVCRT(?,?,00000000,00000000,00DD77D7), ref: 00DD8852

Part of subcall function 00DD89B0: std::_Xinvalid_argument.LIBCPMT ref: 00DD89C6

Strings

string too long, xrefs: 00DD8807

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$memcpy
String ID: string too long
API String ID: 2304785028-2556327735
Opcode ID: d10b8f9834eda2446f9f12c51ebb7db7318b093825555b2c084b5eb30fc17282
Instruction ID: c550f509f8dbc1685491a0960119bddf509867d8d9bd6e7d37eaf377c28deb58
Opcode Fuzzy Hash: d10b8f9834eda2446f9f12c51ebb7db7318b093825555b2c084b5eb30fc17282
Instruction Fuzzy Hash: 912183717007509BDB378E6C9880A2AB7EAEF85B01B64091BF492C7781DFA1DC44B7B5

Function 00DD8A90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00DD8AA5

Part of subcall function 00DFA1A3: std::exception::exception.LIBCMT ref: 00DFA1B8
Part of subcall function 00DFA1A3: __CxxThrowException@8.LIBCMT ref: 00DFA1CD

memcpy.MSVCRT(?,?,?), ref: 00DD8AEF

Strings

string too long, xrefs: 00DD8AA0

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: Exception@8ThrowXinvalid_argumentmemcpystd::_std::exception::exception
String ID: string too long
API String ID: 2475949303-2556327735
Opcode ID: bc636abccf76eb47364ddc50a30c638748d0541805a9040ba283416ff36e22f0
Instruction ID: dfb1988a5d53f7a664bd6da8546abf11da2dc5a4b347431330efa375a6f1a0e3
Opcode Fuzzy Hash: bc636abccf76eb47364ddc50a30c638748d0541805a9040ba283416ff36e22f0
Instruction Fuzzy Hash: D22107727047049BE721CE6DDC40A6EB7EAEBD5320F198A1BE895C3380DF70994597B0

Function 00DD8BB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00DD8BBF

Part of subcall function 00DFA1F0: std::exception::exception.LIBCMT ref: 00DFA205
Part of subcall function 00DFA1F0: __CxxThrowException@8.LIBCMT ref: 00DFA21A

memmove.MSVCRT(?,?,?,?,?,00DD89E2,00000000,?,?,00DD8800,?,00000000,00DD77D7), ref: 00DD8BF5

Strings

invalid string position, xrefs: 00DD8BBA

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: Exception@8ThrowXinvalid_argumentmemmovestd::_std::exception::exception
String ID: invalid string position
API String ID: 655285616-1799206989
Opcode ID: 0eb8c7890f877ef61aadb973b5e8b04a6d2eafe5cf9f8253ad4e654b9c5a8941
Instruction ID: f214d1798cab486fb1fe7f53a6e50ab574967b1c50b5eb5137c30eafb6aace0a
Opcode Fuzzy Hash: 0eb8c7890f877ef61aadb973b5e8b04a6d2eafe5cf9f8253ad4e654b9c5a8941
Instruction Fuzzy Hash: 6601A7B13047409BD3268E7CEC9492BB7E6DBC4704B29491ED092C7749DB70DC819770

Function 00DF1550 Relevance: 5.1, APIs: 4, Instructions: 81stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000), ref: 00DF1581
lstrcpy.KERNEL32(00000000,?), ref: 00DF15B9
lstrcpy.KERNEL32(00000000,?), ref: 00DF15F1
lstrcpy.KERNEL32(00000000,?), ref: 00DF1629

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 8a559ace942127cf0ac3562c7d6bb6f1d07b935e524eddb74702f1ae5054ff37
Instruction ID: 889a78c86591a4c1cbc27186e9314e7d295c396936bad99816d334c825880fd4
Opcode Fuzzy Hash: 8a559ace942127cf0ac3562c7d6bb6f1d07b935e524eddb74702f1ae5054ff37
Instruction Fuzzy Hash: 1821EC78601B069BD728DF2AC454A27B7F5EF54700B098A1DA88AC7B41DB34E801CBB0

Function 00DD1410 Relevance: 5.1, APIs: 4, Instructions: 81stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DD1510: lstrcpy.KERNEL32(00000000), ref: 00DD152D
Part of subcall function 00DD1510: lstrcpy.KERNEL32(00000000,?), ref: 00DD154F
Part of subcall function 00DD1510: lstrcpy.KERNEL32(00000000,?), ref: 00DD1571
Part of subcall function 00DD1510: lstrcpy.KERNEL32(00000000,?), ref: 00DD1593

lstrcpy.KERNEL32(00000000,?), ref: 00DD1437
lstrcpy.KERNEL32(00000000,?), ref: 00DD1459
lstrcpy.KERNEL32(00000000,?), ref: 00DD147B
lstrcpy.KERNEL32(00000000,?), ref: 00DD14DF

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 6a4c71ba3f1238c9eeff8d8c6f7d3a4a7fc999c387a0bcfecaa9506aa0258c9d
Instruction ID: 0ab4a3e2ed7a763edcec1bedf374f0bc75a8db5287586971b1f6c67af44dbfc6
Opcode Fuzzy Hash: 6a4c71ba3f1238c9eeff8d8c6f7d3a4a7fc999c387a0bcfecaa9506aa0258c9d
Instruction Fuzzy Hash: C531CA78A01B42AFD729DF7AD544956BBF5FF48704704492EA996C3B10DB34F811CBA0

Function 00DD6E32 Relevance: 5.1, APIs: 4, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,00000040), ref: 00DD6E40
memcpy.MSVCRT(?,00005A4D,000000F8), ref: 00DD6E7C
GetProcessHeap.KERNEL32(00000008,?), ref: 00DD6EB4
HeapAlloc.KERNEL32(00000000), ref: 00DD6EBB

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: Heapmemcpy$AllocProcess
String ID:
API String ID: 1643994569-0
Opcode ID: 22136f78fe6ea4b578e9bd1c8c524cb20bc62df9d8a59337c6f4add1b2ee84b4
Instruction ID: 9240471a588c590206c4d13453a7852b39c844b1723f84ee87321787544d7624
Opcode Fuzzy Hash: 22136f78fe6ea4b578e9bd1c8c524cb20bc62df9d8a59337c6f4add1b2ee84b4
Instruction Fuzzy Hash: 4E218E70640A119BDB208B34DC84BB673E8EB40704F488469F986CB784FB78E941CBA0

Function 00DD1510 Relevance: 5.1, APIs: 4, Instructions: 57stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000), ref: 00DD152D
lstrcpy.KERNEL32(00000000,?), ref: 00DD154F
lstrcpy.KERNEL32(00000000,?), ref: 00DD1571
lstrcpy.KERNEL32(00000000,?), ref: 00DD1593

Memory Dump Source

Source File: 00000000.00000002.2621522699.0000000000DD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00DD0000, based on PE: true

Associated: 00000000.00000002.2621508055.0000000000DD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621550250.0000000000DFB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621566443.0000000000E07000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E08000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000E9D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EAA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000ED7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000EF2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F2D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000000F50000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2621579553.0000000001008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2622378710.000000000101A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dd0000_daw21.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: e7d98f7ccddbebe5702c2a249556f11df4f53ca43bd74b2fb871a9564685be1d
Instruction ID: b4e130e414f35b46e0a1c59ebd927a53e7d52daf0d334a122de4e4cc97a8776c
Opcode Fuzzy Hash: e7d98f7ccddbebe5702c2a249556f11df4f53ca43bd74b2fb871a9564685be1d
Instruction Fuzzy Hash: DD11E278A01742ABDB249F75E458927B7F9FF49701704452EA497C7B50DB38E901CB70

Source: C:\Users\user\Desktop\daw21.exe	Code function: 0_2_00DD4B80 lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,InternetOpenA,StrCmpCA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,InternetConnectA,HttpOpenRequestA,lstrcpy,lstrlenA,lstrlenA,HttpSendRequestA,InternetReadFile,lstrlenA,lstrcpy,lstrcatA,lstrcpy,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,	0_2_00DD4B80
Source: C:\Users\user\Desktop\daw21.exe	Code function: 0_2_00DD7690 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00DD7690
Source: C:\Users\user\Desktop\daw21.exe	Code function: 0_2_00DF4090 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	0_2_00DF4090
Source: C:\Users\user\Desktop\daw21.exe	Code function: 0_2_00DD6000 lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,InternetOpenA,StrCmpCA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,InternetConnectA,HttpOpenRequestA,lstrlenA,lstrlenA,GetProcessHeap,HeapAlloc,lstrlenA,memcpy,lstrlenA,lstrlenA,memcpy,lstrlenA,HttpSendRequestA,InternetReadFile,lstrlenA,lstrcpy,lstrcatA,lstrcpy,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,	0_2_00DD6000
Source: C:\Users\user\Desktop\daw21.exe	Code function: 0_2_00DD9BE0 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	0_2_00DD9BE0
Source: C:\Users\user\Desktop\daw21.exe	Code function: 0_2_00DD9B80 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00DD9B80

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report daw21.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Networking

Protection of GUI

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_daw21.exe_2c487d58c69cb0e118b9a9eeb0a7207e9965bed0_a4ef3901_87578f33-870a-4c2d-8de0-32f2624e2657\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC60B.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC725.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC784.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Windows Analysis Report
daw21.exe

Function 00DD56C0 Relevance: 105.7, APIs: 51, Strings: 9, Instructions: 734
stringCOMMON

Function 00DD4980 Relevance: 61.4, APIs: 34, Strings: 1, Instructions: 115
stringmemoryCOMMON

Function 00DF63C0 Relevance: 58.0, APIs: 32, Strings: 1, Instructions: 218
libraryloaderCOMMON

Function 00DF6710 Relevance: 210.7, APIs: 115, Strings: 5, Instructions: 696
libraryloaderCOMMON

Function 00DD6B80 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 229
networkstringfileCOMMON

Function 00DF26E0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 93
memoryCOMMON

Function 00DD5570 Relevance: 12.1, APIs: 8, Instructions: 112
networkmemoryfileCOMMON

Function 00DF1BD0 Relevance: 12.1, APIs: 8, Instructions: 106
COMMON

Function 00DD4AE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50
stringnetworkCOMMON

Function 00DF28B0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49
registrymemoryCOMMON

Function 00DF2820 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47
registrymemoryCOMMON

Function 00DEEFE0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
stringCOMMON

Function 00DF2A70 Relevance: 4.5, APIs: 3, Instructions: 44
memoryCOMMON