Edit tour

Windows Analysis Report
MT Eagle Asia 11.exe

Overview

General Information

Sample name:	MT Eagle Asia 11.exe
Analysis ID:	1579944
MD5:	421c6f53652413a316da7e7e0c7f99ad
SHA1:	3c7cbca25c2d74a9df7eeda6ea76d999357dd7ad
SHA256:	40aa4321d9c06e4d3b35fe22feabb2da29d4375f5848fc895bda33bf0eeeb587
Tags:	exeSnakeKeyloggeruser-smica83
Infos:

Detection

Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Snake Keylogger

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

AI detected suspicious sample

Injects a PE file into a foreign processes

Machine Learning detection for sample

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

MT Eagle Asia 11.exe (PID: 4436 cmdline: "C:\Users\user\Desktop\MT Eagle Asia 11.exe" MD5: 421C6F53652413A316DA7E7E0C7F99AD)

MT Eagle Asia 11.exe (PID: 5956 cmdline: "C:\Users\user\Desktop\MT Eagle Asia 11.exe" MD5: 421C6F53652413A316DA7E7E0C7F99AD)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "frankichong@yulifertilizer.com.my", "Password": "Ayfc931319*", "Host": "mail.yulifertilizer.com.my", "Port": "25", "Version": "5.1"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.4518039393.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.4518039393.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000002.00000002.4518039393.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14a31:$a1: get_encryptedPassword 0x14d1d:$a2: get_encryptedUsername 0x1483d:$a3: get_timePasswordChanged 0x14938:$a4: get_passwordField 0x14a47:$a5: set_encryptedPassword 0x160c0:$a7: get_logins 0x16023:$a10: KeyLoggerEventArgs 0x15c8e:$a11: KeyLoggerEventArgsEventHandler
00000002.00000002.4518039393.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x18294:$x1: $%SMTPDV$ 0x182fa:$x2: $#TheHashHere%& 0x1997b:$x3: %FTPDV$ 0x19a6f:$x4: $%TelegramDv$ 0x15c8e:$x5: KeyLoggerEventArgs 0x16023:$x5: KeyLoggerEventArgs 0x1999f:$m2: Clipboard Logs ID 0x19bbf:$m2: Screenshot Logs ID 0x19ccf:$m2: keystroke Logs ID 0x19fa9:$m3: SnakePW 0x19b97:$m4: \SnakeKeylogger\
00000002.00000002.4519807660.0000000002DAB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.4521447023.0000000003B29000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.4521447023.0000000003B29000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.4521447023.0000000003B29000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf4241:$a1: get_encryptedPassword 0x114e71:$a1: get_encryptedPassword 0x135891:$a1: get_encryptedPassword 0xf452d:$a2: get_encryptedUsername 0x11515d:$a2: get_encryptedUsername 0x135b7d:$a2: get_encryptedUsername 0xf404d:$a3: get_timePasswordChanged 0x114c7d:$a3: get_timePasswordChanged 0x13569d:$a3: get_timePasswordChanged 0xf4148:$a4: get_passwordField 0x114d78:$a4: get_passwordField 0x135798:$a4: get_passwordField 0xf4257:$a5: set_encryptedPassword 0x114e87:$a5: set_encryptedPassword 0x1358a7:$a5: set_encryptedPassword 0xf58d0:$a7: get_logins 0x116500:$a7: get_logins 0x136f20:$a7: get_logins 0xf5833:$a10: KeyLoggerEventArgs 0x116463:$a10: KeyLoggerEventArgs 0x136e83:$a10: KeyLoggerEventArgs
00000000.00000002.4521447023.0000000003B29000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xf7aa4:$x1: $%SMTPDV$ 0x1186d4:$x1: $%SMTPDV$ 0x1390f4:$x1: $%SMTPDV$ 0xf7b0a:$x2: $#TheHashHere%& 0x11873a:$x2: $#TheHashHere%& 0x13915a:$x2: $#TheHashHere%& 0xf918b:$x3: %FTPDV$ 0x119dbb:$x3: %FTPDV$ 0x13a7db:$x3: %FTPDV$ 0xf927f:$x4: $%TelegramDv$ 0x119eaf:$x4: $%TelegramDv$ 0x13a8cf:$x4: $%TelegramDv$ 0xf549e:$x5: KeyLoggerEventArgs 0xf5833:$x5: KeyLoggerEventArgs 0x1160ce:$x5: KeyLoggerEventArgs 0x116463:$x5: KeyLoggerEventArgs 0x136aee:$x5: KeyLoggerEventArgs 0x136e83:$x5: KeyLoggerEventArgs 0xf91af:$m2: Clipboard Logs ID 0xf93cf:$m2: Screenshot Logs ID 0xf94df:$m2: keystroke Logs ID
00000002.00000002.4519807660.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: MT Eagle Asia 11.exe PID: 4436	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MT Eagle Asia 11.exe PID: 4436	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: MT Eagle Asia 11.exe PID: 4436	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xaf96d:$a1: get_encryptedPassword 0xafbb8:$a2: get_encryptedUsername 0xaf79c:$a3: get_timePasswordChanged 0xaf87e:$a4: get_passwordField 0xaf983:$a5: set_encryptedPassword 0xb1856:$a7: get_logins 0xb17d7:$a10: KeyLoggerEventArgs 0xb1545:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: MT Eagle Asia 11.exe PID: 4436	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xb1545:$x5: KeyLoggerEventArgs 0xb17d7:$x5: KeyLoggerEventArgs 0xb1d46:$x5: KeyLoggerEventArgs 0xb20a7:$x5: KeyLoggerEventArgs 0xb3921:$m2: Clipboard Logs ID 0xb3a18:$m2: Screenshot Logs ID 0xb3a6e:$m2: keystroke Logs ID 0xb3ba3:$m3: SnakePW 0xb3a04:$m4: \SnakeKeylogger\
Process Memory Space: MT Eagle Asia 11.exe PID: 5956	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MT Eagle Asia 11.exe PID: 5956	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: MT Eagle Asia 11.exe PID: 5956	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2f124:$a1: get_encryptedPassword 0x2f406:$a2: get_encryptedUsername 0x2ef3a:$a3: get_timePasswordChanged 0x2f035:$a4: get_passwordField 0x2f13a:$a5: set_encryptedPassword 0x31614:$a7: get_logins 0x31577:$a10: KeyLoggerEventArgs 0x311e2:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: MT Eagle Asia 11.exe PID: 5956	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x311e2:$x5: KeyLoggerEventArgs 0x31577:$x5: KeyLoggerEventArgs 0x31b44:$x5: KeyLoggerEventArgs 0x31ea5:$x5: KeyLoggerEventArgs 0x3380c:$m2: Clipboard Logs ID 0x33903:$m2: Screenshot Logs ID 0x33959:$m2: keystroke Logs ID 0x33a8e:$m3: SnakePW 0x338ef:$m4: \SnakeKeylogger\
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.MT Eagle Asia 11.exe.3c29240.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.MT Eagle Asia 11.exe.3c29240.4.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.MT Eagle Asia 11.exe.3c29240.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12e31:$a1: get_encryptedPassword 0x1311d:$a2: get_encryptedUsername 0x12c3d:$a3: get_timePasswordChanged 0x12d38:$a4: get_passwordField 0x12e47:$a5: set_encryptedPassword 0x144c0:$a7: get_logins 0x14423:$a10: KeyLoggerEventArgs 0x1408e:$a11: KeyLoggerEventArgsEventHandler
0.2.MT Eagle Asia 11.exe.3c29240.4.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a779:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x199ab:$a3: \Google\Chrome\User Data\Default\Login Data 0x19dde:$a4: \Orbitum\User Data\Default\Login Data 0x1ae1d:$a5: \Kometa\User Data\Default\Login Data
0.2.MT Eagle Asia 11.exe.3c29240.4.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x13a09:$s1: UnHook 0x13a10:$s2: SetHook 0x13a18:$s3: CallNextHook 0x13a25:$s4: _hook
0.2.MT Eagle Asia 11.exe.3c29240.4.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x16694:$x1: $%SMTPDV$ 0x166fa:$x2: $#TheHashHere%& 0x17d7b:$x3: %FTPDV$ 0x17e6f:$x4: $%TelegramDv$ 0x1408e:$x5: KeyLoggerEventArgs 0x14423:$x5: KeyLoggerEventArgs 0x17d9f:$m2: Clipboard Logs ID 0x17fbf:$m2: Screenshot Logs ID 0x180cf:$m2: keystroke Logs ID 0x183a9:$m3: SnakePW 0x17f97:$m4: \SnakeKeylogger\
0.2.MT Eagle Asia 11.exe.3c08610.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.MT Eagle Asia 11.exe.3c08610.3.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.MT Eagle Asia 11.exe.3c08610.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12e31:$a1: get_encryptedPassword 0x1311d:$a2: get_encryptedUsername 0x12c3d:$a3: get_timePasswordChanged 0x12d38:$a4: get_passwordField 0x12e47:$a5: set_encryptedPassword 0x144c0:$a7: get_logins 0x14423:$a10: KeyLoggerEventArgs 0x1408e:$a11: KeyLoggerEventArgsEventHandler
0.2.MT Eagle Asia 11.exe.3c08610.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a779:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x199ab:$a3: \Google\Chrome\User Data\Default\Login Data 0x19dde:$a4: \Orbitum\User Data\Default\Login Data 0x1ae1d:$a5: \Kometa\User Data\Default\Login Data
0.2.MT Eagle Asia 11.exe.3c08610.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x13a09:$s1: UnHook 0x13a10:$s2: SetHook 0x13a18:$s3: CallNextHook 0x13a25:$s4: _hook
0.2.MT Eagle Asia 11.exe.3c08610.3.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x16694:$x1: $%SMTPDV$ 0x166fa:$x2: $#TheHashHere%& 0x17d7b:$x3: %FTPDV$ 0x17e6f:$x4: $%TelegramDv$ 0x1408e:$x5: KeyLoggerEventArgs 0x14423:$x5: KeyLoggerEventArgs 0x17d9f:$m2: Clipboard Logs ID 0x17fbf:$m2: Screenshot Logs ID 0x180cf:$m2: keystroke Logs ID 0x183a9:$m3: SnakePW 0x17f97:$m4: \SnakeKeylogger\
2.2.MT Eagle Asia 11.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.MT Eagle Asia 11.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.MT Eagle Asia 11.exe.400000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
2.2.MT Eagle Asia 11.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14c31:$a1: get_encryptedPassword 0x14f1d:$a2: get_encryptedUsername 0x14a3d:$a3: get_timePasswordChanged 0x14b38:$a4: get_passwordField 0x14c47:$a5: set_encryptedPassword 0x162c0:$a7: get_logins 0x16223:$a10: KeyLoggerEventArgs 0x15e8e:$a11: KeyLoggerEventArgsEventHandler
2.2.MT Eagle Asia 11.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c579:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b7ab:$a3: \Google\Chrome\User Data\Default\Login Data 0x1bbde:$a4: \Orbitum\User Data\Default\Login Data 0x1cc1d:$a5: \Kometa\User Data\Default\Login Data
2.2.MT Eagle Asia 11.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15809:$s1: UnHook 0x15810:$s2: SetHook 0x15818:$s3: CallNextHook 0x15825:$s4: _hook
2.2.MT Eagle Asia 11.exe.400000.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x18494:$x1: $%SMTPDV$ 0x184fa:$x2: $#TheHashHere%& 0x19b7b:$x3: %FTPDV$ 0x19c6f:$x4: $%TelegramDv$ 0x15e8e:$x5: KeyLoggerEventArgs 0x16223:$x5: KeyLoggerEventArgs 0x19b9f:$m2: Clipboard Logs ID 0x19dbf:$m2: Screenshot Logs ID 0x19ecf:$m2: keystroke Logs ID 0x1a1a9:$m3: SnakePW 0x19d97:$m4: \SnakeKeylogger\
0.2.MT Eagle Asia 11.exe.3c29240.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.MT Eagle Asia 11.exe.3c29240.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.MT Eagle Asia 11.exe.3c29240.4.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.MT Eagle Asia 11.exe.3c29240.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14c31:$a1: get_encryptedPassword 0x35651:$a1: get_encryptedPassword 0x14f1d:$a2: get_encryptedUsername 0x3593d:$a2: get_encryptedUsername 0x14a3d:$a3: get_timePasswordChanged 0x3545d:$a3: get_timePasswordChanged 0x14b38:$a4: get_passwordField 0x35558:$a4: get_passwordField 0x14c47:$a5: set_encryptedPassword 0x35667:$a5: set_encryptedPassword 0x162c0:$a7: get_logins 0x36ce0:$a7: get_logins 0x16223:$a10: KeyLoggerEventArgs 0x36c43:$a10: KeyLoggerEventArgs 0x15e8e:$a11: KeyLoggerEventArgsEventHandler 0x368ae:$a11: KeyLoggerEventArgsEventHandler
0.2.MT Eagle Asia 11.exe.3c29240.4.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c579:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3cf99:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b7ab:$a3: \Google\Chrome\User Data\Default\Login Data 0x3c1cb:$a3: \Google\Chrome\User Data\Default\Login Data 0x1bbde:$a4: \Orbitum\User Data\Default\Login Data 0x3c5fe:$a4: \Orbitum\User Data\Default\Login Data 0x1cc1d:$a5: \Kometa\User Data\Default\Login Data 0x3d63d:$a5: \Kometa\User Data\Default\Login Data
0.2.MT Eagle Asia 11.exe.3c29240.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15809:$s1: UnHook 0x36229:$s1: UnHook 0x15810:$s2: SetHook 0x36230:$s2: SetHook 0x15818:$s3: CallNextHook 0x36238:$s3: CallNextHook 0x15825:$s4: _hook 0x36245:$s4: _hook
0.2.MT Eagle Asia 11.exe.3c29240.4.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x18494:$x1: $%SMTPDV$ 0x38eb4:$x1: $%SMTPDV$ 0x184fa:$x2: $#TheHashHere%& 0x38f1a:$x2: $#TheHashHere%& 0x19b7b:$x3: %FTPDV$ 0x3a59b:$x3: %FTPDV$ 0x19c6f:$x4: $%TelegramDv$ 0x3a68f:$x4: $%TelegramDv$ 0x15e8e:$x5: KeyLoggerEventArgs 0x16223:$x5: KeyLoggerEventArgs 0x368ae:$x5: KeyLoggerEventArgs 0x36c43:$x5: KeyLoggerEventArgs 0x19b9f:$m2: Clipboard Logs ID 0x19dbf:$m2: Screenshot Logs ID 0x19ecf:$m2: keystroke Logs ID 0x3a5bf:$m2: Clipboard Logs ID 0x3a7df:$m2: Screenshot Logs ID 0x3a8ef:$m2: keystroke Logs ID 0x1a1a9:$m3: SnakePW 0x3abc9:$m3: SnakePW 0x19d97:$m4: \SnakeKeylogger\
0.2.MT Eagle Asia 11.exe.3c08610.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.MT Eagle Asia 11.exe.3c08610.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.MT Eagle Asia 11.exe.3c08610.3.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.MT Eagle Asia 11.exe.3c08610.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14c31:$a1: get_encryptedPassword 0x35861:$a1: get_encryptedPassword 0x56281:$a1: get_encryptedPassword 0x14f1d:$a2: get_encryptedUsername 0x35b4d:$a2: get_encryptedUsername 0x5656d:$a2: get_encryptedUsername 0x14a3d:$a3: get_timePasswordChanged 0x3566d:$a3: get_timePasswordChanged 0x5608d:$a3: get_timePasswordChanged 0x14b38:$a4: get_passwordField 0x35768:$a4: get_passwordField 0x56188:$a4: get_passwordField 0x14c47:$a5: set_encryptedPassword 0x35877:$a5: set_encryptedPassword 0x56297:$a5: set_encryptedPassword 0x162c0:$a7: get_logins 0x36ef0:$a7: get_logins 0x57910:$a7: get_logins 0x16223:$a10: KeyLoggerEventArgs 0x36e53:$a10: KeyLoggerEventArgs 0x57873:$a10: KeyLoggerEventArgs
0.2.MT Eagle Asia 11.exe.3c08610.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c579:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3d1a9:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x5dbc9:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b7ab:$a3: \Google\Chrome\User Data\Default\Login Data 0x3c3db:$a3: \Google\Chrome\User Data\Default\Login Data 0x5cdfb:$a3: \Google\Chrome\User Data\Default\Login Data 0x1bbde:$a4: \Orbitum\User Data\Default\Login Data 0x3c80e:$a4: \Orbitum\User Data\Default\Login Data 0x5d22e:$a4: \Orbitum\User Data\Default\Login Data 0x1cc1d:$a5: \Kometa\User Data\Default\Login Data 0x3d84d:$a5: \Kometa\User Data\Default\Login Data 0x5e26d:$a5: \Kometa\User Data\Default\Login Data
0.2.MT Eagle Asia 11.exe.3c08610.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15809:$s1: UnHook 0x36439:$s1: UnHook 0x56e59:$s1: UnHook 0x15810:$s2: SetHook 0x36440:$s2: SetHook 0x56e60:$s2: SetHook 0x15818:$s3: CallNextHook 0x36448:$s3: CallNextHook 0x56e68:$s3: CallNextHook 0x15825:$s4: _hook 0x36455:$s4: _hook 0x56e75:$s4: _hook
0.2.MT Eagle Asia 11.exe.3c08610.3.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x18494:$x1: $%SMTPDV$ 0x390c4:$x1: $%SMTPDV$ 0x59ae4:$x1: $%SMTPDV$ 0x184fa:$x2: $#TheHashHere%& 0x3912a:$x2: $#TheHashHere%& 0x59b4a:$x2: $#TheHashHere%& 0x19b7b:$x3: %FTPDV$ 0x3a7ab:$x3: %FTPDV$ 0x5b1cb:$x3: %FTPDV$ 0x19c6f:$x4: $%TelegramDv$ 0x3a89f:$x4: $%TelegramDv$ 0x5b2bf:$x4: $%TelegramDv$ 0x15e8e:$x5: KeyLoggerEventArgs 0x16223:$x5: KeyLoggerEventArgs 0x36abe:$x5: KeyLoggerEventArgs 0x36e53:$x5: KeyLoggerEventArgs 0x574de:$x5: KeyLoggerEventArgs 0x57873:$x5: KeyLoggerEventArgs 0x19b9f:$m2: Clipboard Logs ID 0x19dbf:$m2: Screenshot Logs ID 0x19ecf:$m2: keystroke Logs ID
0.2.MT Eagle Asia 11.exe.3b77f70.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.MT Eagle Asia 11.exe.3b77f70.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.MT Eagle Asia 11.exe.3b77f70.2.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.MT Eagle Asia 11.exe.3b77f70.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xa52d1:$a1: get_encryptedPassword 0xc5f01:$a1: get_encryptedPassword 0xe6921:$a1: get_encryptedPassword 0xa55bd:$a2: get_encryptedUsername 0xc61ed:$a2: get_encryptedUsername 0xe6c0d:$a2: get_encryptedUsername 0xa50dd:$a3: get_timePasswordChanged 0xc5d0d:$a3: get_timePasswordChanged 0xe672d:$a3: get_timePasswordChanged 0xa51d8:$a4: get_passwordField 0xc5e08:$a4: get_passwordField 0xe6828:$a4: get_passwordField 0xa52e7:$a5: set_encryptedPassword 0xc5f17:$a5: set_encryptedPassword 0xe6937:$a5: set_encryptedPassword 0xa6960:$a7: get_logins 0xc7590:$a7: get_logins 0xe7fb0:$a7: get_logins 0xa68c3:$a10: KeyLoggerEventArgs 0xc74f3:$a10: KeyLoggerEventArgs 0xe7f13:$a10: KeyLoggerEventArgs
0.2.MT Eagle Asia 11.exe.3b77f70.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0xa5ea9:$s1: UnHook 0xc6ad9:$s1: UnHook 0xe74f9:$s1: UnHook 0xa5eb0:$s2: SetHook 0xc6ae0:$s2: SetHook 0xe7500:$s2: SetHook 0xa5eb8:$s3: CallNextHook 0xc6ae8:$s3: CallNextHook 0xe7508:$s3: CallNextHook 0xa5ec5:$s4: _hook 0xc6af5:$s4: _hook 0xe7515:$s4: _hook
0.2.MT Eagle Asia 11.exe.3b77f70.2.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xa8b34:$x1: $%SMTPDV$ 0xc9764:$x1: $%SMTPDV$ 0xea184:$x1: $%SMTPDV$ 0xa8b9a:$x2: $#TheHashHere%& 0xc97ca:$x2: $#TheHashHere%& 0xea1ea:$x2: $#TheHashHere%& 0xaa21b:$x3: %FTPDV$ 0xcae4b:$x3: %FTPDV$ 0xeb86b:$x3: %FTPDV$ 0xaa30f:$x4: $%TelegramDv$ 0xcaf3f:$x4: $%TelegramDv$ 0xeb95f:$x4: $%TelegramDv$ 0xa652e:$x5: KeyLoggerEventArgs 0xa68c3:$x5: KeyLoggerEventArgs 0xc715e:$x5: KeyLoggerEventArgs 0xc74f3:$x5: KeyLoggerEventArgs 0xe7b7e:$x5: KeyLoggerEventArgs 0xe7f13:$x5: KeyLoggerEventArgs 0xaa23f:$m2: Clipboard Logs ID 0xaa45f:$m2: Screenshot Logs ID 0xaa56f:$m2: keystroke Logs ID
Click to see the 34 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T16:31:08.496101+0100	2803305	3	Unknown Traffic	192.168.2.5	49710	104.21.67.152	443	TCP
2024-12-23T16:31:11.895725+0100	2803305	3	Unknown Traffic	192.168.2.5	49713	104.21.67.152	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T16:31:03.523512+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49706	193.122.130.0	80	TCP
2024-12-23T16:31:06.867274+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49706	193.122.130.0	80	TCP
2024-12-23T16:31:10.195393+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49712	193.122.130.0	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: MT Eagle Asia 11.exe

Avira: detected

Found malware configuration

Source: 00000002.00000002.4518039393.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "frankichong@yulifertilizer.com.my", "Password": "Ayfc931319*", "Host": "mail.yulifertilizer.com.my", "Port": "25", "Version": "5.1"}

Multi AV Scanner detection for submitted file

Source: MT Eagle Asia 11.exe

ReversingLabs: Detection: 76%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: MT Eagle Asia 11.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: MT Eagle Asia 11.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.21.67.152:443 -> 192.168.2.5:49708 version: TLS 1.0

Source: MT Eagle Asia 11.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: C:\Users\GT350\source\repos\UpdatedRunpe\UpdatedRunpe\obj\x86\Debug\AQipUvwTwkLZyiCs.pdb source: MT Eagle Asia 11.exe, 00000000.00000002.4519619574.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000000.00000002.4522982466.0000000005190000.00000004.08000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 4x nop then jmp 0112F055h	2_2_0112EE68
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 4x nop then jmp 0112F9DFh	2_2_0112EE68
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	2_2_0112E388
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	2_2_0112E9BB
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	2_2_0112EB9B
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 4x nop then jmp 06838945h	2_2_06838608
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 4x nop then jmp 06836171h	2_2_06835EC8
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 4x nop then jmp 068358C1h	2_2_06835618
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 4x nop then jmp 06836A21h	2_2_06836778
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 4x nop then jmp 06830741h	2_2_06830498
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 4x nop then jmp 06837751h	2_2_068374A8
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 4x nop then jmp 06830FF1h	2_2_06830D48
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 4x nop then jmp 06838001h	2_2_06837D58
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 4x nop then jmp 06835D19h	2_2_06835A70
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	2_2_068333A8
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	2_2_068333B8
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 4x nop then jmp 06836E79h	2_2_06836BD0
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 4x nop then jmp 068365C9h	2_2_06836320
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 4x nop then jmp 06830B99h	2_2_068308F0
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 4x nop then jmp 068302E9h	2_2_06830040
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 4x nop then jmp 068372FAh	2_2_06837050
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 4x nop then jmp 06835441h	2_2_06835198
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 4x nop then jmp 06838459h	2_2_068381B0
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 4x nop then jmp 06837BA9h	2_2_06837900

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 2.2.MT Eagle Asia 11.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MT Eagle Asia 11.exe.3c29240.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MT Eagle Asia 11.exe.3c08610.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MT Eagle Asia 11.exe.3b77f70.2.raw.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.67.152 104.21.67.152
Source: Joe Sandbox View	IP Address: 193.122.130.0 193.122.130.0

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49712 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49706 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49713 -> 104.21.67.152:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49710 -> 104.21.67.152:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 104.21.67.152:443 -> 192.168.2.5:49708 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D6F000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002DAB000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D54000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002CB2000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D8A000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D04000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D6F000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002DAB000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D54000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: MT Eagle Asia 11.exe, 00000000.00000002.4521447023.0000000003B29000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4518039393.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002CD9000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D6F000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002DAB000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D04000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D6F000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002DAB000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D54000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: MT Eagle Asia 11.exe, 00000000.00000002.4521447023.0000000003B29000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4518039393.0000000000402000.00000040.00000400.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D04000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D6F000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002DAB000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.MT Eagle Asia 11.exe.3c29240.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.MT Eagle Asia 11.exe.3c29240.4.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.MT Eagle Asia 11.exe.3c29240.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.MT Eagle Asia 11.exe.3c29240.4.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.MT Eagle Asia 11.exe.3c08610.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.MT Eagle Asia 11.exe.3c08610.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.MT Eagle Asia 11.exe.3c08610.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.MT Eagle Asia 11.exe.3c08610.3.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 2.2.MT Eagle Asia 11.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 2.2.MT Eagle Asia 11.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.MT Eagle Asia 11.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 2.2.MT Eagle Asia 11.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.MT Eagle Asia 11.exe.3c29240.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.MT Eagle Asia 11.exe.3c29240.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.MT Eagle Asia 11.exe.3c29240.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.MT Eagle Asia 11.exe.3c29240.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.MT Eagle Asia 11.exe.3c08610.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.MT Eagle Asia 11.exe.3c08610.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.MT Eagle Asia 11.exe.3c08610.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.MT Eagle Asia 11.exe.3c08610.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.MT Eagle Asia 11.exe.3b77f70.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.MT Eagle Asia 11.exe.3b77f70.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.MT Eagle Asia 11.exe.3b77f70.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000002.00000002.4518039393.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000002.00000002.4518039393.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.4521447023.0000000003B29000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.4521447023.0000000003B29000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: MT Eagle Asia 11.exe PID: 4436, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: MT Eagle Asia 11.exe PID: 4436, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: MT Eagle Asia 11.exe PID: 5956, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: MT Eagle Asia 11.exe PID: 5956, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 0_2_010E25D8	0_2_010E25D8
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 0_2_010ED304	0_2_010ED304
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 0_2_050A65B0	0_2_050A65B0
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 0_2_050ABF60	0_2_050ABF60
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 0_2_050A0006	0_2_050A0006
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 0_2_050A0040	0_2_050A0040
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 0_2_050AAD51	0_2_050AAD51
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 0_2_056B9680	0_2_056B9680
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_01126108	2_2_01126108
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_0112C190	2_2_0112C190
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_0112B328	2_2_0112B328
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_0112C470	2_2_0112C470
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_01126730	2_2_01126730
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_0112C752	2_2_0112C752
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_01129858	2_2_01129858
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_0112BBD2	2_2_0112BBD2
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_0112CA32	2_2_0112CA32
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_01124AD9	2_2_01124AD9
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_0112EE68	2_2_0112EE68
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_0112BEB2	2_2_0112BEB2
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_0112E379	2_2_0112E379
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_0112E388	2_2_0112E388
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_01123572	2_2_01123572
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_0112B4F2	2_2_0112B4F2
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_0683B6E8	2_2_0683B6E8
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_06838608	2_2_06838608
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_0683D670	2_2_0683D670
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_0683A408	2_2_0683A408
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_0683BD38	2_2_0683BD38
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_0683AA58	2_2_0683AA58
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_0683C388	2_2_0683C388
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_06838B58	2_2_06838B58
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_0683B0A0	2_2_0683B0A0
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_0683D028	2_2_0683D028
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_068311A0	2_2_068311A0
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_0683C9D8	2_2_0683C9D8
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_06835EB8	2_2_06835EB8
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_06835EC8	2_2_06835EC8
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_0683B6D9	2_2_0683B6D9
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_0683560B	2_2_0683560B
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_06835618	2_2_06835618
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_0683D663	2_2_0683D663
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_06833730	2_2_06833730
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_06836768	2_2_06836768
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_06836778	2_2_06836778
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_06830488	2_2_06830488
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_06837497	2_2_06837497
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_06830498	2_2_06830498
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_068374A8	2_2_068374A8
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_06834430	2_2_06834430
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_068385FC	2_2_068385FC
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_0683BD28	2_2_0683BD28
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_06830D39	2_2_06830D39
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_06830D48	2_2_06830D48
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_06837D48	2_2_06837D48
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_06837D58	2_2_06837D58
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_0683AA48	2_2_0683AA48
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_06835A60	2_2_06835A60
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_06835A70	2_2_06835A70
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_068333A8	2_2_068333A8
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_068333B8	2_2_068333B8
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_06836BC1	2_2_06836BC1
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_06836BD0	2_2_06836BD0
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_0683A3F8	2_2_0683A3F8
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_06836313	2_2_06836313
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_06836320	2_2_06836320
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_0683C378	2_2_0683C378
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_0683B08F	2_2_0683B08F
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_068328B0	2_2_068328B0
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_068308E0	2_2_068308E0
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_068308F0	2_2_068308F0
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_068378F0	2_2_068378F0
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_06830007	2_2_06830007
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_06832807	2_2_06832807
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_06832809	2_2_06832809
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_0683D018	2_2_0683D018
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_06830040	2_2_06830040
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_06837040	2_2_06837040
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_06837050	2_2_06837050
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_0683518B	2_2_0683518B
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_06831191	2_2_06831191
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_06835198	2_2_06835198
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_068381A0	2_2_068381A0
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_068381B0	2_2_068381B0
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_0683C9C8	2_2_0683C9C8
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 2_2_06837900	2_2_06837900

Source: MT Eagle Asia 11.exe, 00000000.00000002.4523126084.00000000053E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameExample.dll0 vs MT Eagle Asia 11.exe
Source: MT Eagle Asia 11.exe, 00000000.00000000.2050086780.00000000006C2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFisa.exe* vs MT Eagle Asia 11.exe
Source: MT Eagle Asia 11.exe, 00000000.00000002.4518351882.0000000000E1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs MT Eagle Asia 11.exe
Source: MT Eagle Asia 11.exe, 00000000.00000002.4519619574.0000000002B21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAQipUvwTwkLZyiCs.dll: vs MT Eagle Asia 11.exe
Source: MT Eagle Asia 11.exe, 00000000.00000002.4519619574.0000000002B21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs MT Eagle Asia 11.exe
Source: MT Eagle Asia 11.exe, 00000000.00000002.4521447023.0000000003B29000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameExample.dll0 vs MT Eagle Asia 11.exe
Source: MT Eagle Asia 11.exe, 00000000.00000002.4521447023.0000000003B29000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs MT Eagle Asia 11.exe
Source: MT Eagle Asia 11.exe, 00000000.00000002.4522982466.0000000005190000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameAQipUvwTwkLZyiCs.dll: vs MT Eagle Asia 11.exe
Source: MT Eagle Asia 11.exe, 00000002.00000002.4518039393.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs MT Eagle Asia 11.exe
Source: MT Eagle Asia 11.exe, 00000002.00000002.4518295517.0000000000CF7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs MT Eagle Asia 11.exe
Source: MT Eagle Asia 11.exe	Binary or memory string: OriginalFilenameFisa.exe* vs MT Eagle Asia 11.exe

Source: MT Eagle Asia 11.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.MT Eagle Asia 11.exe.3c29240.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.MT Eagle Asia 11.exe.3c29240.4.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.MT Eagle Asia 11.exe.3c29240.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.MT Eagle Asia 11.exe.3c29240.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.MT Eagle Asia 11.exe.3c08610.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.MT Eagle Asia 11.exe.3c08610.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.MT Eagle Asia 11.exe.3c08610.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.MT Eagle Asia 11.exe.3c08610.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 2.2.MT Eagle Asia 11.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 2.2.MT Eagle Asia 11.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.MT Eagle Asia 11.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 2.2.MT Eagle Asia 11.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.MT Eagle Asia 11.exe.3c29240.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.MT Eagle Asia 11.exe.3c29240.4.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.MT Eagle Asia 11.exe.3c29240.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.MT Eagle Asia 11.exe.3c29240.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.MT Eagle Asia 11.exe.3c08610.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.MT Eagle Asia 11.exe.3c08610.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.MT Eagle Asia 11.exe.3c08610.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.MT Eagle Asia 11.exe.3c08610.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.MT Eagle Asia 11.exe.3b77f70.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.MT Eagle Asia 11.exe.3b77f70.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.MT Eagle Asia 11.exe.3b77f70.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000002.00000002.4518039393.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000002.00000002.4518039393.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.4521447023.0000000003B29000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.4521447023.0000000003B29000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: MT Eagle Asia 11.exe PID: 4436, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: MT Eagle Asia 11.exe PID: 4436, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: MT Eagle Asia 11.exe PID: 5956, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: MT Eagle Asia 11.exe PID: 5956, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: 0.2.MT Eagle Asia 11.exe.3b77f70.2.raw.unpack, DarkListView.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.MT Eagle Asia 11.exe.53e0000.6.raw.unpack, DarkListView.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.MT Eagle Asia 11.exe.3c29240.4.raw.unpack, --2.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.MT Eagle Asia 11.exe.3c29240.4.raw.unpack, --2.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.MT Eagle Asia 11.exe.3c29240.4.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.MT Eagle Asia 11.exe.3c29240.4.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.MT Eagle Asia 11.exe.3c08610.3.raw.unpack, --2.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.MT Eagle Asia 11.exe.3c08610.3.raw.unpack, --2.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.MT Eagle Asia 11.exe.3c08610.3.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.MT Eagle Asia 11.exe.3c08610.3.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.MT Eagle Asia 11.exe.3b77f70.2.raw.unpack, DarkComboBox.cs	Base64 encoded string: 'Uwm+UuKGd614I69RzLI93aXq8M4plP4Fl8XGnAA54HkS/0jMOBsYAdDU3ufQvFFjYZJP0JeYZcnDYanLTNfb9IJuC/u1be1KdJkORevGYuzVlkHzJtU9FNAhjxyJAuY/'
Source: 0.2.MT Eagle Asia 11.exe.53e0000.6.raw.unpack, DarkComboBox.cs	Base64 encoded string: 'Uwm+UuKGd614I69RzLI93aXq8M4plP4Fl8XGnAA54HkS/0jMOBsYAdDU3ufQvFFjYZJP0JeYZcnDYanLTNfb9IJuC/u1be1KdJkORevGYuzVlkHzJtU9FNAhjxyJAuY/'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/0@2/2

Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe

Mutant created: NULL

Source: MT Eagle Asia 11.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: MT Eagle Asia 11.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: MT Eagle Asia 11.exe, 00000002.00000002.4521506331.0000000003C89000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002E2A000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002E70000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002E7C000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002E3A000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002E48000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: MT Eagle Asia 11.exe

ReversingLabs: Detection: 76%

Source: unknown	Process created: C:\Users\user\Desktop\MT Eagle Asia 11.exe "C:\Users\user\Desktop\MT Eagle Asia 11.exe"
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process created: C:\Users\user\Desktop\MT Eagle Asia 11.exe "C:\Users\user\Desktop\MT Eagle Asia 11.exe"
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process created: C:\Users\user\Desktop\MT Eagle Asia 11.exe "C:\Users\user\Desktop\MT Eagle Asia 11.exe"	Jump to behavior

Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: MT Eagle Asia 11.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: MT Eagle Asia 11.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Data Obfuscation

.NET source code contains potential unpacker

Source: MT Eagle Asia 11.exe, PC.cs

.Net Code: CypherMatic System.Reflection.Assembly.Load(byte[])

Source: MT Eagle Asia 11.exe

Static PE information: 0xF79C3086 [Tue Aug 23 02:46:30 2101 UTC]

Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 0_2_050AB518 pushfd ; iretd		0_2_050AB521
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Code function: 0_2_056BA152 pushad ; iretd		0_2_056BA159

Source: MT Eagle Asia 11.exe

Static PE information: section name: .text entropy: 7.04376618464485

Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Memory allocated: 10E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Memory allocated: 2B20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Memory allocated: 1170000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Memory allocated: 10E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Memory allocated: 2C00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Memory allocated: 4C00000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 599777	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 599655	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 599520	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 599394	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 599275	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 599171	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 599062	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 598953	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 598843	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 598734	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 598625	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 598515	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 598406	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 598296	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 598187	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 597968	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 597859	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 597750	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 597640	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 597531	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 597421	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 597312	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 597093	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 596980	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 596826	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 596714	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 596390	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 596171	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 595952	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 595843	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 595734	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 595624	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 595513	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 595296	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 594965	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 594750	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 594640	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 594530	Jump to behavior

Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Window / User API: threadDelayed 2029			Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Window / User API: threadDelayed 7829			Jump to behavior

Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -35971150943733603s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 3556	Thread sleep count: 2029 > 30	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -599777s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -599655s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 3556	Thread sleep count: 7829 > 30	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -599520s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -599394s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -599275s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -599171s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -599062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -598953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -598843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -598734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -598625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -598515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -598406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -598296s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -598187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -598078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -597968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -597859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -597750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -597640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -597531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -597421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -597312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -597203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -597093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -596980s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -596826s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -596714s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -596609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -596500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -596390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -596281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -596171s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -596062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -595952s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -595843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -595734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -595624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -595513s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -595406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -595296s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -595187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -595078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -594965s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -594859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -594750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -594640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe TID: 728	Thread sleep time: -594530s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 599777	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 599655	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 599520	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 599394	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 599275	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 599171	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 599062	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 598953	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 598843	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 598734	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 598625	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 598515	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 598406	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 598296	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 598187	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 597968	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 597859	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 597750	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 597640	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 597531	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 597421	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 597312	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 597093	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 596980	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 596826	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 596714	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 596390	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 596171	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 595952	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 595843	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 595734	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 595624	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 595513	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 595296	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 594965	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 594750	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 594640	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Thread delayed: delay time: 594530	Jump to behavior

Source: MT Eagle Asia 11.exe, 00000002.00000002.4518773909.0000000000DE7000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 0.2.MT Eagle Asia 11.exe.2d72bd0.1.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 0.2.MT Eagle Asia 11.exe.2d72bd0.1.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 0.2.MT Eagle Asia 11.exe.2d72bd0.1.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs	Reference to suspicious API methods: ReadProcessMemory(processInformation.ProcessHandle, num3 + 8, ref buffer, 4, ref bytesRead)

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe

Memory written: C:\Users\user\Desktop\MT Eagle Asia 11.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe

Process created: C:\Users\user\Desktop\MT Eagle Asia 11.exe "C:\Users\user\Desktop\MT Eagle Asia 11.exe"

Jump to behavior

Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Queries volume information: C:\Users\user\Desktop\MT Eagle Asia 11.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Queries volume information: C:\Users\user\Desktop\MT Eagle Asia 11.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 0.2.MT Eagle Asia 11.exe.3c29240.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MT Eagle Asia 11.exe.3c08610.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MT Eagle Asia 11.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MT Eagle Asia 11.exe.3c29240.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MT Eagle Asia 11.exe.3c08610.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MT Eagle Asia 11.exe.3b77f70.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4518039393.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4519807660.0000000002DAB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4521447023.0000000003B29000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4519807660.0000000002C01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MT Eagle Asia 11.exe PID: 4436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MT Eagle Asia 11.exe PID: 5956, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\MT Eagle Asia 11.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 0.2.MT Eagle Asia 11.exe.3c29240.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MT Eagle Asia 11.exe.3c08610.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MT Eagle Asia 11.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MT Eagle Asia 11.exe.3c29240.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MT Eagle Asia 11.exe.3c08610.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MT Eagle Asia 11.exe.3b77f70.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4518039393.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4521447023.0000000003B29000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MT Eagle Asia 11.exe PID: 4436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MT Eagle Asia 11.exe PID: 5956, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 0.2.MT Eagle Asia 11.exe.3c29240.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MT Eagle Asia 11.exe.3c08610.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MT Eagle Asia 11.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MT Eagle Asia 11.exe.3c29240.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MT Eagle Asia 11.exe.3c08610.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MT Eagle Asia 11.exe.3b77f70.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4518039393.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4519807660.0000000002DAB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4521447023.0000000003B29000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4519807660.0000000002C01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MT Eagle Asia 11.exe PID: 4436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MT Eagle Asia 11.exe PID: 5956, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	111 Process Injection	1 Disable or Modify Tools	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	111 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	1 Data from Local System	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	31 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Software Packing	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
MT Eagle Asia 11.exe	76%	ReversingLabs	ByteCode-MSIL.Trojan.Jalapeno
MT Eagle Asia 11.exe	100%	Avira	HEUR/AGEN.1309847
MT Eagle Asia 11.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	104.21.67.152	true	false	high
checkip.dyndns.com	193.122.130.0	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false		high
https://reallyfreegeoip.org/xml/8.46.123.189	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://reallyfreegeoip.org	MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D04000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D6F000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002DAB000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D54000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002CB2000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D8A000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D04000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D6F000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002DAB000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D54000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D6F000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002DAB000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D54000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/q	MT Eagle Asia 11.exe, 00000000.00000002.4521447023.0000000003B29000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4518039393.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/8.46.123.189$	MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D04000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D6F000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002DAB000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D54000.00000004.00000800.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.org	MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002CD9000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D6F000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002DAB000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002D54000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	MT Eagle Asia 11.exe, 00000000.00000002.4521447023.0000000003B29000.00000004.00000800.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4518039393.0000000000402000.00000040.00000400.00020000.00000000.sdmp, MT Eagle Asia 11.exe, 00000002.00000002.4519807660.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.67.152	reallyfreegeoip.org	United States		13335	CLOUDFLARENETUS	false
193.122.130.0	checkip.dyndns.com	United States		31898	ORACLE-BMC-31898US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579944
Start date and time:	2024-12-23 16:30:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	MT Eagle Asia 11.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/0@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 99% Number of executed functions: 128 Number of non-executed functions: 30
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.218.208.109, 4.175.87.197, 13.107.246.63
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target MT Eagle Asia 11.exe, PID 5956 because it is empty
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: MT Eagle Asia 11.exe

Simulations

Behavior and APIs

Time	Type	Description
10:31:06	API Interceptor	12009187x Sleep call for process: MT Eagle Asia 11.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.67.152	Statement_3029_from_Cross_Traders_and_Logistics_ltd.exe	Get hash	malicious	MassLogger RAT	Browse
	Invoice DHL - AWB 2024 E4001 - 0000731.exe	Get hash	malicious	Snake Keylogger	Browse
	PURCHASE ORDER TRC-090971819130-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	Overheaped237.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	_Company.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	0001.exe	Get hash	malicious	Snake Keylogger	Browse
	Nuevo pedido de cotizaci#U00f3n 663837 4899272.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	87h216Snb7.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
193.122.130.0	Order_12232024.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	rTTSWIFTCOPIES.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	66776676676.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	87h216Snb7.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	dP5z8RpEyQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	pre-stowage.PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	HIROSHIMA STAR - VSL's_DETAILS.docx.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	PURCHASE ORDER TRC-0909718-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	ref_97024130865.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	Order_12232024.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	rTTSWIFTCOPIES.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	Ziraat_Bankasi_Swift_Mesaji_TXB04958T.scr.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	Statement_3029_from_Cross_Traders_and_Logistics_ltd.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	Invoice DHL - AWB 2024 E4001 - 0000731.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Requested Documentation.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	YU SV Payment.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	PURCHASE ORDER TRC-090971819130-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	PAYMENT ADVICE 750013-1012449943-81347-pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	Overheaped237.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
reallyfreegeoip.org	Order_12232024.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	rTTSWIFTCOPIES.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	Ziraat_Bankasi_Swift_Mesaji_TXB04958T.scr.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	Statement_3029_from_Cross_Traders_and_Logistics_ltd.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	Invoice DHL - AWB 2024 E4001 - 0000731.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	YU SV Payment.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	PURCHASE ORDER TRC-090971819130-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	PAYMENT ADVICE 750013-1012449943-81347-pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.177.134
	Overheaped237.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.67.152
	HUSDGHCE23ED.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Payout Receipts.pptx	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	http://tax-com.com	Get hash	malicious	Unknown	Browse	172.67.203.198
	https://www.cocol88.site/l6v3z.php	Get hash	malicious	Unknown	Browse	104.21.63.207
	https://mandrillapp.com/track/click/30363981/app.salesforceiq.com?p=eyJzIjoiQ21jNldfVTIxTkdJZi1NQzQ1SGE3SXJFTW1RIiwidiI6MSwicCI6IntcInVcIjozMDM2Mzk4MSxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2FwcC5zYWxlc2ZvcmNlaXEuY29tXFxcL3I_dD1BRndoWmYwNjV0QlFRSnRiMVFmd1A1dC0tMHZnQkowaF9lYklFcTVLRlhTWHFVWmFpNUo4RlFTd1dycTkzR1FPbEFuczlLREd2VzRJQ2Z2eGo4WjVDSkQxUTlXdDVvME5XNWMwY0tIaXpVQWJ1YnBhT2dtS2pjVkxkaDFZWE8ybklsdFRlb2VQZ2dVTCZ0YXJnZXQ9NjMxZjQyMGVlZDEzY2EzYmNmNzdjMzI0JnVybD1odHRwczpcXFwvXFxcL21haW4uZDNxczBuMG9xdjNnN28uYW1wbGlmeWFwcC5jb21cIixcImlkXCI6XCI5ZTdkODJiNWQ0NzA0YWVhYTQ1ZjkxY2Y0ZTFmNGRiMFwiLFwidXJsX2lkc1wiOltcImY5ODQ5NWVhMjMyYTgzNjg1ODUxN2Y4ZTRiOTVjZjg4MWZlODExNmJcIl19In0	Get hash	malicious	Unknown	Browse	172.67.69.226
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.235
	file.exe	Get hash	malicious	FormBook	Browse	104.21.40.196
	https://mandrillapp.com/track/click/30903880/lamp.avocet.io?p=eyJzIjoiM2NCLS1TMlk4RWF3Nl9vVXV4SHlzRDZ5dmJJIiwidiI6MSwicCI6IntcInVcIjozMDkwMzg4MCxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2xhbXAuYXZvY2V0LmlvXFxcL25ldy11c2VyXCIsXCJpZFwiOlwiMTMxMTQyZmQwMzMxNDA4MWE0YmQyOGYzZDRmYmViYzRcIixcInVybF9pZHNcIjpbXCI0OWFlZTViODJkYzk4NGYxNTg2ZGIzZTYzNGE5ZWUxMDgxYjVmMDY5XCJdfSJ9	Get hash	malicious	Unknown	Browse	104.18.16.155
	https://laimilano.powerappsportals.com/	Get hash	malicious	Unknown	Browse	104.21.22.164
	Order_12232024.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	acronis recovery expert deluxe 1.0.0.132.rarl.exe	Get hash	malicious	LummaC	Browse	104.21.35.89
ORACLE-BMC-31898US	Order_12232024.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	rTTSWIFTCOPIES.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	nshkmips.elf	Get hash	malicious	Mirai	Browse	132.145.36.70
	Ziraat_Bankasi_Swift_Mesaji_TXB04958T.scr.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	Statement_3029_from_Cross_Traders_and_Logistics_ltd.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	nshkarm.elf	Get hash	malicious	Mirai	Browse	140.238.15.102
	nshsh4.elf	Get hash	malicious	Mirai	Browse	140.238.98.44
	Requested Documentation.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	YU SV Payment.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	la.bot.sparc.elf	Get hash	malicious	Mirai	Browse	168.138.95.8

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	Order_12232024.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	rTTSWIFTCOPIES.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	Ziraat_Bankasi_Swift_Mesaji_TXB04958T.scr.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	Statement_3029_from_Cross_Traders_and_Logistics_ltd.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	Browser.Daemon.exe	Get hash	malicious	Unknown	Browse	104.21.67.152
	Browser.Daemon.exe	Get hash	malicious	Unknown	Browse	104.21.67.152
	Invoice DHL - AWB 2024 E4001 - 0000731.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	YU SV Payment.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	PURCHASE ORDER TRC-090971819130-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	PAYMENT ADVICE 750013-1012449943-81347-pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.036717490256744
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	MT Eagle Asia 11.exe
File size:	826'368 bytes
MD5:	421c6f53652413a316da7e7e0c7f99ad
SHA1:	3c7cbca25c2d74a9df7eeda6ea76d999357dd7ad
SHA256:	40aa4321d9c06e4d3b35fe22feabb2da29d4375f5848fc895bda33bf0eeeb587
SHA512:	7b7251e78e91c00163547fe26f14d3f4441eb10bcac369cbf913bd1c892028ac145a143072e48a8983cfe33fd125746aa9efc8da9695f9287197171c8694e201
SSDEEP:	12288:6aMaSzOKy2r7SPNcZoQ1+ssLpdWTDnB75wDR+aPPyA5SnAYKEVotiBVU:5MaSSKy2/SPNw+RLpmnXwRPPyA545/
TLSH:	CD056B483AB048F8C53689F6B8E7863C7934B96162E2D82665CF1E4C7CCDB8145E716F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....0................0.................. ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4cb0ae
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xF79C3086 [Tue Aug 23 02:46:30 2101 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xcb054	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xcc000	0x586	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xce000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xc90b4	0xc9200	7c429d74632c6ef0eddec82c692813e3	False	0.43399432877563704	data	7.04376618464485	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xcc000	0x586	0x600	023f933e236ce25e662698bcb26c192d	False	0.4134114583333333	data	4.009208314844858	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xce000	0xc	0x200	727b93468c891e185699debc43ee745f	False	0.044921875	data	0.09409792566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xcc0a0	0x2fc	data			0.43455497382198954
RT_MANIFEST	0xcc39c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-23T16:31:03.523512+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49706	193.122.130.0	80	TCP
2024-12-23T16:31:06.867274+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49706	193.122.130.0	80	TCP
2024-12-23T16:31:08.496101+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49710	104.21.67.152	443	TCP
2024-12-23T16:31:10.195393+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49712	193.122.130.0	80	TCP
2024-12-23T16:31:11.895725+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49713	104.21.67.152	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 16:31:00.846220970 CET	49706	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:00.965936899 CET	80	49706	193.122.130.0	192.168.2.5
Dec 23, 2024 16:31:00.966106892 CET	49706	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:00.972209930 CET	49706	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:01.091974974 CET	80	49706	193.122.130.0	192.168.2.5
Dec 23, 2024 16:31:02.162868977 CET	80	49706	193.122.130.0	192.168.2.5
Dec 23, 2024 16:31:02.167975903 CET	49706	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:02.288026094 CET	80	49706	193.122.130.0	192.168.2.5
Dec 23, 2024 16:31:03.477791071 CET	80	49706	193.122.130.0	192.168.2.5
Dec 23, 2024 16:31:03.523511887 CET	49706	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:03.841820955 CET	49708	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:03.841913939 CET	443	49708	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:03.842012882 CET	49708	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:03.847681046 CET	49708	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:03.847713947 CET	443	49708	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:05.069184065 CET	443	49708	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:05.069330931 CET	49708	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:05.075145006 CET	49708	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:05.075186968 CET	443	49708	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:05.075666904 CET	443	49708	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:05.117316008 CET	49708	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:05.132313013 CET	49708	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:05.179374933 CET	443	49708	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:05.529436111 CET	443	49708	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:05.529534101 CET	443	49708	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:05.529596090 CET	49708	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:05.536834002 CET	49708	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:05.542115927 CET	49706	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:05.662331104 CET	80	49706	193.122.130.0	192.168.2.5
Dec 23, 2024 16:31:06.823484898 CET	80	49706	193.122.130.0	192.168.2.5
Dec 23, 2024 16:31:06.827384949 CET	49710	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:06.827445984 CET	443	49710	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:06.827533007 CET	49710	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:06.827898979 CET	49710	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:06.827934980 CET	443	49710	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:06.867274046 CET	49706	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:08.039892912 CET	443	49710	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:08.042416096 CET	49710	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:08.042455912 CET	443	49710	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:08.496095896 CET	443	49710	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:08.496153116 CET	443	49710	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:08.496237040 CET	49710	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:08.497271061 CET	49710	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:08.500745058 CET	49706	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:08.502048969 CET	49712	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:08.620623112 CET	80	49706	193.122.130.0	192.168.2.5
Dec 23, 2024 16:31:08.620699883 CET	49706	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:08.621675968 CET	80	49712	193.122.130.0	192.168.2.5
Dec 23, 2024 16:31:08.621788979 CET	49712	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:08.621886969 CET	49712	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:08.741539001 CET	80	49712	193.122.130.0	192.168.2.5
Dec 23, 2024 16:31:10.151771069 CET	80	49712	193.122.130.0	192.168.2.5
Dec 23, 2024 16:31:10.157103062 CET	49713	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:10.157162905 CET	443	49713	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:10.157382011 CET	49713	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:10.160377979 CET	49713	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:10.160407066 CET	443	49713	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:10.195393085 CET	49712	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:11.447217941 CET	443	49713	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:11.449668884 CET	49713	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:11.449752092 CET	443	49713	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:11.895675898 CET	443	49713	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:11.895735025 CET	443	49713	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:11.895859003 CET	49713	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:11.896380901 CET	49713	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:11.905040979 CET	49714	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:12.024724960 CET	80	49714	193.122.130.0	192.168.2.5
Dec 23, 2024 16:31:12.024878979 CET	49714	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:12.025095940 CET	49714	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:12.144773006 CET	80	49714	193.122.130.0	192.168.2.5
Dec 23, 2024 16:31:14.589910030 CET	80	49714	193.122.130.0	192.168.2.5
Dec 23, 2024 16:31:14.591639996 CET	49715	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:14.591716051 CET	443	49715	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:14.591905117 CET	49715	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:14.592262030 CET	49715	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:14.592305899 CET	443	49715	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:14.632939100 CET	49714	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:15.804260969 CET	443	49715	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:15.806169987 CET	49715	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:15.806250095 CET	443	49715	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:16.253882885 CET	443	49715	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:16.253962994 CET	443	49715	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:16.254112005 CET	49715	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:16.254800081 CET	49715	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:16.259483099 CET	49714	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:16.260752916 CET	49719	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:16.379502058 CET	80	49714	193.122.130.0	192.168.2.5
Dec 23, 2024 16:31:16.379791021 CET	49714	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:16.380269051 CET	80	49719	193.122.130.0	192.168.2.5
Dec 23, 2024 16:31:16.380369902 CET	49719	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:16.389028072 CET	49719	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:16.508660078 CET	80	49719	193.122.130.0	192.168.2.5
Dec 23, 2024 16:31:19.327645063 CET	80	49719	193.122.130.0	192.168.2.5
Dec 23, 2024 16:31:19.328777075 CET	49722	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:19.328820944 CET	443	49722	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:19.328915119 CET	49722	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:19.329210043 CET	49722	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:19.329224110 CET	443	49722	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:19.367266893 CET	49719	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:20.548818111 CET	443	49722	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:20.556772947 CET	49722	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:20.556801081 CET	443	49722	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:20.997265100 CET	443	49722	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:20.997333050 CET	443	49722	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:20.997628927 CET	49722	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:20.997886896 CET	49722	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:21.001233101 CET	49719	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:21.002473116 CET	49728	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:21.121257067 CET	80	49719	193.122.130.0	192.168.2.5
Dec 23, 2024 16:31:21.121355057 CET	49719	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:21.122081041 CET	80	49728	193.122.130.0	192.168.2.5
Dec 23, 2024 16:31:21.122158051 CET	49728	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:21.122296095 CET	49728	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:21.241833925 CET	80	49728	193.122.130.0	192.168.2.5
Dec 23, 2024 16:31:22.254785061 CET	80	49728	193.122.130.0	192.168.2.5
Dec 23, 2024 16:31:22.256166935 CET	49735	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:22.256187916 CET	443	49735	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:22.256263018 CET	49735	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:22.256493092 CET	49735	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:22.256508112 CET	443	49735	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:22.304795027 CET	49728	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:23.470674038 CET	443	49735	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:23.481208086 CET	49735	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:23.481229067 CET	443	49735	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:23.922514915 CET	443	49735	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:23.922605038 CET	443	49735	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:23.922657967 CET	49735	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:23.923084974 CET	49735	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:23.927143097 CET	49728	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:23.928029060 CET	49736	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:24.047265053 CET	80	49728	193.122.130.0	192.168.2.5
Dec 23, 2024 16:31:24.047382116 CET	49728	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:24.047564983 CET	80	49736	193.122.130.0	192.168.2.5
Dec 23, 2024 16:31:24.047641993 CET	49736	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:24.047842026 CET	49736	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:24.169321060 CET	80	49736	193.122.130.0	192.168.2.5
Dec 23, 2024 16:31:25.209506035 CET	80	49736	193.122.130.0	192.168.2.5
Dec 23, 2024 16:31:25.211292028 CET	49742	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:25.211383104 CET	443	49742	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:25.211472988 CET	49742	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:25.211755991 CET	49742	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:25.211788893 CET	443	49742	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:25.257975101 CET	49736	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:26.421834946 CET	443	49742	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:26.423739910 CET	49742	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:26.423790932 CET	443	49742	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:26.879523993 CET	443	49742	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:26.879599094 CET	443	49742	104.21.67.152	192.168.2.5
Dec 23, 2024 16:31:26.879709005 CET	49742	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:26.880146027 CET	49742	443	192.168.2.5	104.21.67.152
Dec 23, 2024 16:31:26.883548021 CET	49736	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:26.884670019 CET	49748	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:27.003506899 CET	80	49736	193.122.130.0	192.168.2.5
Dec 23, 2024 16:31:27.003613949 CET	49736	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:27.004282951 CET	80	49748	193.122.130.0	192.168.2.5
Dec 23, 2024 16:31:27.004371881 CET	49748	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:27.004554987 CET	49748	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:31:27.124692917 CET	80	49748	193.122.130.0	192.168.2.5
Dec 23, 2024 16:31:30.969938040 CET	80	49748	193.122.130.0	192.168.2.5
Dec 23, 2024 16:31:31.023623943 CET	49748	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:32:15.162703991 CET	80	49712	193.122.130.0	192.168.2.5
Dec 23, 2024 16:32:15.162810087 CET	49712	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:32:35.852658033 CET	80	49748	193.122.130.0	192.168.2.5
Dec 23, 2024 16:32:35.852739096 CET	49748	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:33:06.883852005 CET	49748	80	192.168.2.5	193.122.130.0
Dec 23, 2024 16:33:07.003585100 CET	80	49748	193.122.130.0	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 16:31:00.703490973 CET	61865	53	192.168.2.5	1.1.1.1
Dec 23, 2024 16:31:00.840415955 CET	53	61865	1.1.1.1	192.168.2.5
Dec 23, 2024 16:31:03.526664019 CET	56835	53	192.168.2.5	1.1.1.1
Dec 23, 2024 16:31:03.840969086 CET	53	56835	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 23, 2024 16:31:00.703490973 CET	192.168.2.5	1.1.1.1	0x9681	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Dec 23, 2024 16:31:03.526664019 CET	192.168.2.5	1.1.1.1	0xddcb	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 23, 2024 16:31:00.840415955 CET	1.1.1.1	192.168.2.5	0x9681	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 16:31:00.840415955 CET	1.1.1.1	192.168.2.5	0x9681	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Dec 23, 2024 16:31:00.840415955 CET	1.1.1.1	192.168.2.5	0x9681	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Dec 23, 2024 16:31:00.840415955 CET	1.1.1.1	192.168.2.5	0x9681	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Dec 23, 2024 16:31:00.840415955 CET	1.1.1.1	192.168.2.5	0x9681	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Dec 23, 2024 16:31:00.840415955 CET	1.1.1.1	192.168.2.5	0x9681	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Dec 23, 2024 16:31:03.840969086 CET	1.1.1.1	192.168.2.5	0xddcb	No error (0)	reallyfreegeoip.org		104.21.67.152	A (IP address)	IN (0x0001)	false
Dec 23, 2024 16:31:03.840969086 CET	1.1.1.1	192.168.2.5	0xddcb	No error (0)	reallyfreegeoip.org		172.67.177.134	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	193.122.130.0	80	5956	C:\Users\user\Desktop\MT Eagle Asia 11.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 16:31:00.972209930 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 23, 2024 16:31:02.162868977 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 15:31:02 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 85b2a1204852c6ffefeb33d4e4fc38c3 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Dec 23, 2024 16:31:02.167975903 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 23, 2024 16:31:03.477791071 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 15:31:03 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8f688d452e4f2fb192fb23e24744b1ee Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Dec 23, 2024 16:31:05.542115927 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 23, 2024 16:31:06.823484898 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 15:31:06 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 83c1c18fe38879c6940d846f9d63b3b3 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49712	193.122.130.0	80	5956	C:\Users\user\Desktop\MT Eagle Asia 11.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 16:31:08.621886969 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 23, 2024 16:31:10.151771069 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 15:31:09 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: addbc7c7d4b3cb3258c5a8b2379b2f6c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49714	193.122.130.0	80	5956	C:\Users\user\Desktop\MT Eagle Asia 11.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 16:31:12.025095940 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 23, 2024 16:31:14.589910030 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 15:31:14 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 3a7acb9460dedafa64c8d4fa4a62778d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49719	193.122.130.0	80	5956	C:\Users\user\Desktop\MT Eagle Asia 11.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 16:31:16.389028072 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 23, 2024 16:31:19.327645063 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 15:31:19 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c7ee2b31858c6cbe3f244229f3db568f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49728	193.122.130.0	80	5956	C:\Users\user\Desktop\MT Eagle Asia 11.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 16:31:21.122296095 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 23, 2024 16:31:22.254785061 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 15:31:22 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 6a0aefd2ed76d3bd042edbbe9e3ec98a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49736	193.122.130.0	80	5956	C:\Users\user\Desktop\MT Eagle Asia 11.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 16:31:24.047842026 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 23, 2024 16:31:25.209506035 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 15:31:25 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f13666e88cddadd1b1001043331e29cf Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49748	193.122.130.0	80	5956	C:\Users\user\Desktop\MT Eagle Asia 11.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 16:31:27.004554987 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 23, 2024 16:31:30.969938040 CET	730	IN	HTTP/1.1 502 Bad Gateway Date: Mon, 23 Dec 2024 15:31:30 GMT Content-Type: text/html Content-Length: 547 Connection: keep-alive X-Request-ID: 0b2bca5ccce06aaff43bf5b4f172b94c Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 [TRUNCATED] Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49708	104.21.67.152	443	5956	C:\Users\user\Desktop\MT Eagle Asia 11.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 15:31:05 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-23 15:31:05 UTC	864	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 15:31:05 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 282654 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PG8MM5uZGDF0xki5dicBR1XOME%2Fnp%2FyvZr%2Bl44JTuakqFieYpZN%2FVCHpaEqpPBNWAWUYvt9yVlTurq4xOe%2F9e5FA8Sl0aBQpOiRrXqw8iub8h2I%2B%2B5xS5suEV6fhn%2FZRtPeHQwOR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6965865abfde93-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1509&min_rtt=1496&rtt_var=587&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1823860&cwnd=248&unsent_bytes=0&cid=44b3f74afe86a5bd&ts=477&x=0"
2024-12-23 15:31:05 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49710	104.21.67.152	443	5956	C:\Users\user\Desktop\MT Eagle Asia 11.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 15:31:08 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2024-12-23 15:31:08 UTC	854	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 15:31:08 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 282657 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4IkxPN6jQMlRS5OSUD35d7WtgMNnKw%2BdEI0JgPI1HCL28uINMNCJIZiXGsThVLKLsq36jxgjVJiGhz0Xbw4%2FGt%2FxkN6zLypXblBjZp3cyzqEg8MqGhu0C25sKOp09HUSlI45oz33"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6965990eda4349-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1583&min_rtt=1583&rtt_var=594&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1844598&cwnd=227&unsent_bytes=0&cid=4a52cdcaa9f79b64&ts=463&x=0"
2024-12-23 15:31:08 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49713	104.21.67.152	443	5956	C:\Users\user\Desktop\MT Eagle Asia 11.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 15:31:11 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2024-12-23 15:31:11 UTC	858	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 15:31:11 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 282660 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o0vfeur0VwscJn8P%2FU%2FpJMMULmbEPjWJYmDpisFFofhTv%2Bs6Ukoh2IBsHRbymZo9351%2F3IFZ6OVmL7rq0fKxL%2Bqi4uESoimr8d29J2WOgQzr5JcAQZkthPU6Nx2M73EnRZEktQp0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6965ae4e2d42ce-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1594&min_rtt=1587&rtt_var=609&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2850&recv_bytes=699&delivery_rate=1776155&cwnd=233&unsent_bytes=0&cid=38a033421022287a&ts=528&x=0"
2024-12-23 15:31:11 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49715	104.21.67.152	443	5956	C:\Users\user\Desktop\MT Eagle Asia 11.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 15:31:15 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-23 15:31:16 UTC	856	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 15:31:16 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 282665 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yGbPoKK27a1hqjQA7N87Cuuc6NIvE2x%2B7edj1Z08EtPzTM0ivIG7i%2BgsM5V97q0vxyj2MRi4%2FkaHJRU940RtF1INofQfKupbZta5tI3wlCpQ8rbe%2BaxPxfGe7aY7VdClgRzsvE4h"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6965c98b950f83-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1742&min_rtt=1578&rtt_var=709&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1850443&cwnd=230&unsent_bytes=0&cid=10d06ca49038be34&ts=455&x=0"
2024-12-23 15:31:16 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49722	104.21.67.152	443	5956	C:\Users\user\Desktop\MT Eagle Asia 11.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 15:31:20 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-23 15:31:20 UTC	852	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 15:31:20 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 282669 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gNo9mstI2bwtZi0cwF7vQ7Uyfd4lMHZKS7QF8cYAz5yHu5hNP0STYKJ7z9y1xYGMpQrfUtusKeS3ZG8j2FcaFK1LDcMJlRAQNHD6zS65o46AKhyxBCgO6flau%2BX2l3noYcaPL%2BMx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6965e7295c4367-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1749&min_rtt=1746&rtt_var=662&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=699&delivery_rate=1643218&cwnd=237&unsent_bytes=0&cid=1fcf4c97f540c5e4&ts=453&x=0"
2024-12-23 15:31:20 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49735	104.21.67.152	443	5956	C:\Users\user\Desktop\MT Eagle Asia 11.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 15:31:23 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-23 15:31:23 UTC	858	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 15:31:23 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 282672 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TtN4TtnMN4eyfX9o3jqFFCItQN4NP6meBzvEWm7OfRop%2BEl5jugyOB0%2B96FQ02cmW8yH4yzEfHUdJmguCXkIFZO1K2U2uwmtaznXhO438S4O7oS06pfIgHIcFNRYit%2BoZA4%2FJ%2BEO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6965f978a1727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1805&min_rtt=1801&rtt_var=684&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1591280&cwnd=232&unsent_bytes=0&cid=19b73ea597e6907b&ts=458&x=0"
2024-12-23 15:31:23 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49742	104.21.67.152	443	5956	C:\Users\user\Desktop\MT Eagle Asia 11.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 15:31:26 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-23 15:31:26 UTC	854	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 15:31:26 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 282675 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x6ME0YbCgwBo1jPMIjRGuVRzC%2BgLCHj30phc42fACz3FbPA0ZQ9nJuRI8dcA3Vf3R917PTk%2F5yz3rfrM7jhsMid3%2FGsygq6a2duEnay9Usgdax578SG9w7RIxzwHc8yEXV3oO3Pc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f69660beb65c440-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1470&min_rtt=1464&rtt_var=561&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1931216&cwnd=245&unsent_bytes=0&cid=ce4d78ba5777cb14&ts=460&x=0"
2024-12-23 15:31:26 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Target ID:	0
Start time:	10:30:58
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\MT Eagle Asia 11.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\MT Eagle Asia 11.exe"
Imagebase:	0x6c0000
File size:	826'368 bytes
MD5 hash:	421C6F53652413A316DA7E7E0C7F99AD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.4521447023.0000000003B29000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.4521447023.0000000003B29000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.4521447023.0000000003B29000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.4521447023.0000000003B29000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	10:30:59
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\MT Eagle Asia 11.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\MT Eagle Asia 11.exe"
Imagebase:	0x7c0000
File size:	826'368 bytes
MD5 hash:	421C6F53652413A316DA7E7E0C7F99AD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.4518039393.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000002.00000002.4518039393.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000002.00000002.4518039393.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000002.00000002.4518039393.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000002.00000002.4519807660.0000000002DAB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000002.00000002.4519807660.0000000002C01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.2%
Total number of Nodes:	195
Total number of Limit Nodes:	11

Executed Functions

Function 050ABF60 Relevance: 1.9, Strings: 1, Instructions: 619
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(, xrefs: 050AC720

Memory Dump Source

Source File: 00000000.00000002.4522499949.00000000050A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50a0000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 744fb353dbf1cf7dfc72a63830010c499af959fce87e47ee0664efbe05a77d88
Instruction ID: 800f1938eda6889c1bf685133d2c3a3b5fd16cdf659434f868460f3332500182
Opcode Fuzzy Hash: 744fb353dbf1cf7dfc72a63830010c499af959fce87e47ee0664efbe05a77d88
Instruction Fuzzy Hash: A852D271E012288FDB64DF65C994BDDBBF2BF89304F1481EA9409A7291DB345E85CF40

Function 056B9680 Relevance: .4, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4523936417.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_56b0000_MT Eagle Asia 11.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 16f2bf35738f2dd965f3c6861ee1841216b9f7b45009aae69f45e4cde5c637e6
Instruction ID: 3881d881b09b2ab5cec6e84449d0046b8c7e85fc05d4988fae1a4af943e8b64e
Opcode Fuzzy Hash: 16f2bf35738f2dd965f3c6861ee1841216b9f7b45009aae69f45e4cde5c637e6
Instruction Fuzzy Hash: 3CF15E30A00209CFEB14DFA9C984BADBBF2FF88314F158569D505AF365DBB5A985CB40

Function 050A65B0 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4522499949.00000000050A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50a0000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fb82558db6d8f6773d5bf8a4a9636ece6063b7dfbe9152e532584ec988c1287
Instruction ID: 3dc2b85066cdd8f95cc2c21534fa2d3578c3c93892e301f6b4d3b00177f5e573
Opcode Fuzzy Hash: 7fb82558db6d8f6773d5bf8a4a9636ece6063b7dfbe9152e532584ec988c1287
Instruction Fuzzy Hash: E1A1EF74E012198FDB14DFA9D584A9DFBF2FF48314F1885A9E408AB356DB34A981CF50

Function 010EAD48 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 010EAF9E

Memory Dump Source

Source File: 00000000.00000002.4519053943.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10e0000_MT Eagle Asia 11.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 3fbd49576ead68e6bfcf98a676b5ee680ceb59a8c75abf36d00fcf14ac873740
Instruction ID: e63511cc25b099b822e4c1d0bbd91b8aab1ffc4937507635c6e903c601ae76bd
Opcode Fuzzy Hash: 3fbd49576ead68e6bfcf98a676b5ee680ceb59a8c75abf36d00fcf14ac873740
Instruction Fuzzy Hash: 3A712170A00B05CFE764DF6AD44879ABBF5FF88304F008A69D48ADBA50DB75E945CB90

Function 050ACA98 Relevance: 1.6, APIs: 1, Instructions: 140
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(00000000,?,00000009,?,?,?,?,?,?,?), ref: 050ACBDC

Memory Dump Source

Source File: 00000000.00000002.4522499949.00000000050A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50a0000_MT Eagle Asia 11.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 1061601cecf34bdd084bb7d599a34f9e2216d0841b25740ed3359d768a53a4d9
Instruction ID: 14393be8e1ff00e3ceb2928b60f062b5c0bfffcbda3e7ee361076d043214efc4
Opcode Fuzzy Hash: 1061601cecf34bdd084bb7d599a34f9e2216d0841b25740ed3359d768a53a4d9
Instruction Fuzzy Hash: 96512571900319DFEB24CF99D940BDDBBF2BF49300F0180AAE909AB250C7759A89CF91

Function 050ACAA0 Relevance: 1.6, APIs: 1, Instructions: 137
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(00000000,?,00000009,?,?,?,?,?,?,?), ref: 050ACBDC

Memory Dump Source

Source File: 00000000.00000002.4522499949.00000000050A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50a0000_MT Eagle Asia 11.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 08d402122975f58047a0105f4813a6795ea004a3ee808fdd532fc5ce27616926
Instruction ID: 9724ac4198c70004e1de43e7d6a3d06d07a453501ae47d361faacfd6483539a6
Opcode Fuzzy Hash: 08d402122975f58047a0105f4813a6795ea004a3ee808fdd532fc5ce27616926
Instruction Fuzzy Hash: D6511571901319DFEB24CF99D944BDDBBF2BF49300F0180AAE909AB250C7759A89CF91

Function 050A18E4 Relevance: 1.6, APIs: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 050A1A02

Memory Dump Source

Source File: 00000000.00000002.4522499949.00000000050A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50a0000_MT Eagle Asia 11.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 7d547f666b84f911642ace9ec1430ce1d4221aa25dff5419e9a57d5bffc2712e
Instruction ID: a6ad11c3f363bee0f09d0d39d0d1fc4aa59c6ab1622d45ec43c5adf6923b3eb9
Opcode Fuzzy Hash: 7d547f666b84f911642ace9ec1430ce1d4221aa25dff5419e9a57d5bffc2712e
Instruction Fuzzy Hash: D451C0B1D003099FDB14CF99D884ADEBBF5FF48310F24812AE819AB254D7759985CF90

Function 050A18F0 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 050A1A02

Memory Dump Source

Source File: 00000000.00000002.4522499949.00000000050A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50a0000_MT Eagle Asia 11.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: c74cafd47ddda80b7f182f99f11492fa0b5d4b0d7acaa3df21589a0de10c3a09
Instruction ID: 73bce0d943b1d1f17de16c002d2e9e2528abcac339803beae198d5de6d2e2f1d
Opcode Fuzzy Hash: c74cafd47ddda80b7f182f99f11492fa0b5d4b0d7acaa3df21589a0de10c3a09
Instruction Fuzzy Hash: C141CFB1D003099FDB14CF9AD884ADEFBF5BF48310F24812AE819AB214D774A985CF90

Function 010E4248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 010E59C9

Memory Dump Source

Source File: 00000000.00000002.4519053943.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10e0000_MT Eagle Asia 11.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 5641c35526d6b664a7b9e90998c269217fce815a4a6ce9e05b66e45080592e1d
Instruction ID: 66c81126971d618c9425cb6258624a7a3a3a78d64722754d6b1633406329c824
Opcode Fuzzy Hash: 5641c35526d6b664a7b9e90998c269217fce815a4a6ce9e05b66e45080592e1d
Instruction Fuzzy Hash: E341E3B4C00719CFDB24CFAAC848A9DBBF5BF45308F24845AD408AB255DB756946CF90

Function 050A4050 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 050A4111

Memory Dump Source

Source File: 00000000.00000002.4522499949.00000000050A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50a0000_MT Eagle Asia 11.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 542ccd17d6163dd855ba34a769df5d1cb3ee5e4a460f1444e138416a2fcfa8a4
Instruction ID: 74bd78675b0936f34e9c4a8a67acd76f931cbc488edf6ae20945b224101ea97f
Opcode Fuzzy Hash: 542ccd17d6163dd855ba34a769df5d1cb3ee5e4a460f1444e138416a2fcfa8a4
Instruction Fuzzy Hash: A54106B9900209DFDB14CF99D848AAABBF5FB88314F248559D519AB321D375A841CBA0

Function 010E590D Relevance: 1.6, APIs: 1, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 010E59C9

Memory Dump Source

Source File: 00000000.00000002.4519053943.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10e0000_MT Eagle Asia 11.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 3cf91695b5c6f5303ef777c9a614cb6d107c4c7383e959a7cf0e72075b7ffa89
Instruction ID: 2ba42238aff4afb23cbec72d830d6f8647a929e3626a43a5c3e716be3b2b07ea
Opcode Fuzzy Hash: 3cf91695b5c6f5303ef777c9a614cb6d107c4c7383e959a7cf0e72075b7ffa89
Instruction Fuzzy Hash: 2841F0B4C00719CFEB25CFA9C884B8DBBF1BF49308F24849AC448AB255CB756946CF50

Function 050ABC48 Relevance: 1.6, APIs: 1, Instructions: 71injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 050ABCE0

Memory Dump Source

Source File: 00000000.00000002.4522499949.00000000050A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50a0000_MT Eagle Asia 11.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: a5e82c71f23e755bc6b296020ced75431c2f66f469139b2ef353cade27d5f92a
Instruction ID: 2b05ecbe007c3e2ca1f8fd9b4a996968e27b8593ae1e22ae1bbd975d4ea542e9
Opcode Fuzzy Hash: a5e82c71f23e755bc6b296020ced75431c2f66f469139b2ef353cade27d5f92a
Instruction Fuzzy Hash: A3216DB59003499FDB10CFAAC881BEEBFF5FF48310F108429E919A7240CB789555CBA0

Function 050ABC50 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 050ABCE0

Memory Dump Source

Source File: 00000000.00000002.4522499949.00000000050A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50a0000_MT Eagle Asia 11.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 8d27bbb9fdc3a5f9694f2a9db8a72155cd8f249d693986383e5036d47f8ec04f
Instruction ID: 3572cfd84c7d6684e3dd81a8be7ce685977a96e9edd927e8d57c7acd5216410a
Opcode Fuzzy Hash: 8d27bbb9fdc3a5f9694f2a9db8a72155cd8f249d693986383e5036d47f8ec04f
Instruction Fuzzy Hash: 452119B59003499FDB10DFAAC885BEEBBF5FF48310F108429E959A7240DB789954CBA0

Function 010EB730 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,010ED5E6,?,?,?,?,?), ref: 010ED6A7

Memory Dump Source

Source File: 00000000.00000002.4519053943.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10e0000_MT Eagle Asia 11.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 96956f0f9f9be87334745eb9273d81857efa195bb928f5b7accf72e83c19de4b
Instruction ID: 35025ce043024f9010ffc819161c3f68c6e799c83ee69824da481de5b3b50a2c
Opcode Fuzzy Hash: 96956f0f9f9be87334745eb9273d81857efa195bb928f5b7accf72e83c19de4b
Instruction Fuzzy Hash: D121E4B5900208AFDB10CF9AD584AEEFFF8FB48310F14801AE958A7310D378A954CFA4

Function 050ABB73 Relevance: 1.6, APIs: 1, Instructions: 64threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 050ABBF6

Memory Dump Source

Source File: 00000000.00000002.4522499949.00000000050A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50a0000_MT Eagle Asia 11.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: addd4920e27b7a63d29a10197f012f0756d2afa91ccbae6cd551ebcb2c595fb8
Instruction ID: 7ab0520db7ac894c65e8938b74c6d9c523e1fefe305066372b40ed944621de4f
Opcode Fuzzy Hash: addd4920e27b7a63d29a10197f012f0756d2afa91ccbae6cd551ebcb2c595fb8
Instruction Fuzzy Hash: FA2118B1D002098FDB10DFAAC5857EEBBF4FF48314F548429D559A7241CB78A945CFA1

Function 010ED619 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,010ED5E6,?,?,?,?,?), ref: 010ED6A7

Memory Dump Source

Source File: 00000000.00000002.4519053943.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10e0000_MT Eagle Asia 11.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ea1ddbd1ba10d1047192f61e3ab5e0efe634a134a54ff35819a0824e95d10897
Instruction ID: 4e55451fcf020376b37fb7e927966583b98543f1db830e333ae6d86a08c14ae9
Opcode Fuzzy Hash: ea1ddbd1ba10d1047192f61e3ab5e0efe634a134a54ff35819a0824e95d10897
Instruction Fuzzy Hash: A721E2B59002089FDB10CFAAD584AEEFFF9FB48310F14801AE958A7310C378A955CFA4

Function 050ABB78 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 050ABBF6

Memory Dump Source

Source File: 00000000.00000002.4522499949.00000000050A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50a0000_MT Eagle Asia 11.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: e19fdabdd89e4a556478f382c03e466fd8a73fdd2acb651fc3017f003decee35
Instruction ID: 818dc59ff4c8f8f0a90a96eeba8a4bc592b20973557647c3ccea66aae28ee4a1
Opcode Fuzzy Hash: e19fdabdd89e4a556478f382c03e466fd8a73fdd2acb651fc3017f003decee35
Instruction Fuzzy Hash: 402115B1D002098FDB10DFAAC485BEEBBF4FF48314F14842AD559A7241CB78A945CFA1

Function 050ACD80 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 050ACDF9

Memory Dump Source

Source File: 00000000.00000002.4522499949.00000000050A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50a0000_MT Eagle Asia 11.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 28df1540339c08a600d0817303edf8953f3c51915168a3479af952d1eeec6453
Instruction ID: d3533597df4f3ae67e411590348dc9e46ac51cb8ecb2ed8b9d23abf0d5b4aad3
Opcode Fuzzy Hash: 28df1540339c08a600d0817303edf8953f3c51915168a3479af952d1eeec6453
Instruction Fuzzy Hash: 2A21F7B58003499FDB10CF9AD884ADEFBF4FB48310F10841AE958A7211C378A954CFA5

Function 050ACCC8 Relevance: 1.6, APIs: 1, Instructions: 56threadCOMMON

Download Yara Rule

APIs

Wow64GetThreadContext.KERNEL32(?,00000000), ref: 050ACD3B

Memory Dump Source

Source File: 00000000.00000002.4522499949.00000000050A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50a0000_MT Eagle Asia 11.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: bd2b52b8e736cad1256a2c8f7b29e40146b34f75d1f8be8e3774fe4c34257908
Instruction ID: 092e558a5d7bf1e8e01a00a75266c46c5b60f68ffc2c6928913a6181bf63c212
Opcode Fuzzy Hash: bd2b52b8e736cad1256a2c8f7b29e40146b34f75d1f8be8e3774fe4c34257908
Instruction Fuzzy Hash: B11129B29006898FDB10CF9AD845BDEFFF4FB88210F158029E458A3200D338A545CFA1

Function 050ACD88 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 050ACDF9

Memory Dump Source

Source File: 00000000.00000002.4522499949.00000000050A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50a0000_MT Eagle Asia 11.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: b01ced69584b09bee5cb6fe0d0015f21fb16ffe1df7db14fc5e8a541a10523b9
Instruction ID: 2c8fed834e581e937d4a70a9bc81c02759d4d33a6822e84c5315683fa5095a72
Opcode Fuzzy Hash: b01ced69584b09bee5cb6fe0d0015f21fb16ffe1df7db14fc5e8a541a10523b9
Instruction Fuzzy Hash: 5521D3B5800359DFDB10CF9AD884ADEFBF8FB48310F10842AE958A3250C378A954CFA5

Function 050ABD38 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 050ABDAE

Memory Dump Source

Source File: 00000000.00000002.4522499949.00000000050A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50a0000_MT Eagle Asia 11.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ed3bd52c220b41e55066511a21b2648e8b8db7a7f30c7e6de276f0988000124f
Instruction ID: 4a1c277fe7c317bbbde38bbfbc287d2f0117211f9aa3e9ef0916aa5948bb769b
Opcode Fuzzy Hash: ed3bd52c220b41e55066511a21b2648e8b8db7a7f30c7e6de276f0988000124f
Instruction Fuzzy Hash: 2C1159768002489FCB10DFAAD844BEEBFF5EF48310F148419E519A7250CB79A554CFA0

Function 056B7A30 Relevance: 1.6, APIs: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,?,00000000,00000000,00000000,?,?,?,?,056B9862,00000000,00000000,03B24364,02B404FC), ref: 056B9CB0

Memory Dump Source

Source File: 00000000.00000002.4523936417.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_56b0000_MT Eagle Asia 11.jbxd

Similarity

API ID: MessagePeek
String ID:
API String ID: 2222842502-0
Opcode ID: 9b3c1cc0fa5a628966a3dc817be13a1110f6b801ec0f6a6487563542331183bd
Instruction ID: 9b814fded490b8ed129f9da228c034de6c397df58f3b3cb3bb3d0fc24d2f9b0a
Opcode Fuzzy Hash: 9b3c1cc0fa5a628966a3dc817be13a1110f6b801ec0f6a6487563542331183bd
Instruction Fuzzy Hash: F31114B58002099FDB10CF9AC944BEEBBF8FB08310F10802AE958A3340C378A944CFA5

Function 050ACCD0 Relevance: 1.6, APIs: 1, Instructions: 54threadCOMMON

Download Yara Rule

APIs

Wow64GetThreadContext.KERNEL32(?,00000000), ref: 050ACD3B

Memory Dump Source

Source File: 00000000.00000002.4522499949.00000000050A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50a0000_MT Eagle Asia 11.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 51c5d07e8951fcce2f1e519e84ff040ec5514f189bae7e1013ffd3eb64a56ef7
Instruction ID: 021b0bd4861bac00365de214bce431e11db8bbdaff1d9037cabaf6132589d3e3
Opcode Fuzzy Hash: 51c5d07e8951fcce2f1e519e84ff040ec5514f189bae7e1013ffd3eb64a56ef7
Instruction Fuzzy Hash: 041134B2C006498FDB10CF9AD845BDEFBF4FB88320F158029E418A3200D338A945CFA1

Function 056B9C42 Relevance: 1.6, APIs: 1, Instructions: 54windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,?,00000000,00000000,00000000,?,?,?,?,056B9862,00000000,00000000,03B24364,02B404FC), ref: 056B9CB0

Memory Dump Source

Source File: 00000000.00000002.4523936417.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_56b0000_MT Eagle Asia 11.jbxd

Similarity

API ID: MessagePeek
String ID:
API String ID: 2222842502-0
Opcode ID: 6e07dbb7009a64af0e720e6ddf37232e8900438e26a2d6cfd8f13ce38888278f
Instruction ID: 480ddef21af176ab864534884a91c875142794b53ddc9797a3a9ecd6eba01a6f
Opcode Fuzzy Hash: 6e07dbb7009a64af0e720e6ddf37232e8900438e26a2d6cfd8f13ce38888278f
Instruction Fuzzy Hash: 7B11E7B58002499FDB10DF9AD945BDEFBF8FB48310F108419E558A3250C378A544CFA5

Function 050ABD40 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 050ABDAE

Memory Dump Source

Source File: 00000000.00000002.4522499949.00000000050A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50a0000_MT Eagle Asia 11.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a2331c02f7fea80f588a3f1dd3fd9d6b58a9f619c631f2d4d5bda23d471f78af
Instruction ID: 08e34c45e09c2b84ecf143cd9742c68de836ec5a0d971cd84a1c6735e580905a
Opcode Fuzzy Hash: a2331c02f7fea80f588a3f1dd3fd9d6b58a9f619c631f2d4d5bda23d471f78af
Instruction Fuzzy Hash: FD1137768002499FCB10DFAAC844AEEFFF5FF48310F108419E519A7250CB79A954CFA0

Function 050ABDF8 Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 050ABE62

Memory Dump Source

Source File: 00000000.00000002.4522499949.00000000050A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50a0000_MT Eagle Asia 11.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 06003c1e5f42af263b0b08e5ae17583fcc35c42e0f8d5765f789681e7307fb57
Instruction ID: 9ecedb4bb7823b3558dec0fce05491f486bfc193915038d3f9e684da9cf61ffa
Opcode Fuzzy Hash: 06003c1e5f42af263b0b08e5ae17583fcc35c42e0f8d5765f789681e7307fb57
Instruction Fuzzy Hash: 331125B59003498FCB20DFAAD4457EEFFF5EF88724F24841AD519A7240CB79A945CBA0

Function 050ABE00 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 050ABE62

Memory Dump Source

Source File: 00000000.00000002.4522499949.00000000050A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50a0000_MT Eagle Asia 11.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 8f6c7bc80a2fb6714c306a9e9dcc04d37126048e6253b6cab39a3c65dd5e3b6d
Instruction ID: eebd225c8b8bb4c83a003d820d2d1a2aa010cf9ec134938a536521b90ef38f73
Opcode Fuzzy Hash: 8f6c7bc80a2fb6714c306a9e9dcc04d37126048e6253b6cab39a3c65dd5e3b6d
Instruction Fuzzy Hash: A61136B1D003488FCB20DFAAC4457EEFBF5EF88724F208419D519A7240CB79A944CBA0

Function 050A1B30 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 050A1B95

Memory Dump Source

Source File: 00000000.00000002.4522499949.00000000050A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50a0000_MT Eagle Asia 11.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: c86f0f2a7d2539284758e459301b981fa48eff539308f10c119ebb43c039a68b
Instruction ID: f516d78a94b02f4cea6f571e02c23c40aab0f82ee592b936980cda29a21dc6df
Opcode Fuzzy Hash: c86f0f2a7d2539284758e459301b981fa48eff539308f10c119ebb43c039a68b
Instruction Fuzzy Hash: AE1106B6800248DFDB10DF99D585BDEFBF8EF48320F20841AD559A7240D374A945CFA1

Function 010EAF38 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 010EAF9E

Memory Dump Source

Source File: 00000000.00000002.4519053943.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10e0000_MT Eagle Asia 11.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f850f4dfe5996b5dde5cc7e32dba64c1f89e86fc59bda7a095890ab610ebb18b
Instruction ID: 7b07965b1515c6d70f542710e5a6af94628b997902fa76e8d156efbd1c03384b
Opcode Fuzzy Hash: f850f4dfe5996b5dde5cc7e32dba64c1f89e86fc59bda7a095890ab610ebb18b
Instruction Fuzzy Hash: AC1110B6D00249CFDB10CF9AC448ADEFBF4EF88314F10845AD959A7240C379A545CFA1

Function 056B92AC Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,056B99A7), ref: 056BA445

Memory Dump Source

Source File: 00000000.00000002.4523936417.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_56b0000_MT Eagle Asia 11.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 3713f8ecd20d1896ea91f7cbd7cb388ec091476171f9a26c42436fe1696c3f75
Instruction ID: 7be353dec3ab66d61638468409efde458a4b0e81f1cc9c17d4b9447f8d4bb41f
Opcode Fuzzy Hash: 3713f8ecd20d1896ea91f7cbd7cb388ec091476171f9a26c42436fe1696c3f75
Instruction Fuzzy Hash: A811E0B5C046488FDB10DF9AD448BDEFBF4EB48314F10851AD519A3600D378A545CFA5

Function 056BA3E0 Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,056B99A7), ref: 056BA445

Memory Dump Source

Source File: 00000000.00000002.4523936417.00000000056B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 056B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_56b0000_MT Eagle Asia 11.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 37ee968a8ea69c4632daee73e28c895799fef63e4b19373ff6c66e8f2a806fe1
Instruction ID: eb3733f268f5e8508d6e4d3c7f7137b906df84ed650046c746a8c63607eb22b1
Opcode Fuzzy Hash: 37ee968a8ea69c4632daee73e28c895799fef63e4b19373ff6c66e8f2a806fe1
Instruction Fuzzy Hash: B7111DB4C006898FCB20DFAAD448ADEFBF4EB48314F14852AD919A3600C378A544CFA6

Function 050A1B38 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 050A1B95

Memory Dump Source

Source File: 00000000.00000002.4522499949.00000000050A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50a0000_MT Eagle Asia 11.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 704997848b22641db67129fbe6dc7aff4cf7247494b4ba176595ddaf7ee0c87f
Instruction ID: 2cb1c5d26c492b2a93c4f947b70d4fa55b26a42542eefdddea11b11c98772889
Opcode Fuzzy Hash: 704997848b22641db67129fbe6dc7aff4cf7247494b4ba176595ddaf7ee0c87f
Instruction Fuzzy Hash: 7111D3B58002499FDB10DF9AD585BDEFBF8EB48320F10841AD959A7240D379A944CFA5

Function 0105D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4518822591.000000000105D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0105D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_105d000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ff6eb971b192845dec2f343d80237ccdce982640e33e39b04925b62de7341e2
Instruction ID: c02bca375c58112f04fcee8159696110cd090e0ed6a3615e3abef55eb1a61c11
Opcode Fuzzy Hash: 5ff6eb971b192845dec2f343d80237ccdce982640e33e39b04925b62de7341e2
Instruction Fuzzy Hash: C9210371504200DFDB55DF68D580B17BFA5EB84314F20C5AAED894B256C33AD407CB61

Function 0105D2BC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4518822591.000000000105D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0105D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_105d000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89b558ee1a531e2fc0fe79229410f58839e40f2abce8eb067e9d9d77ec585175
Instruction ID: 6652b46172a3fccd4061c9615db123ab360508dd8ac57a672291123d554578fd
Opcode Fuzzy Hash: 89b558ee1a531e2fc0fe79229410f58839e40f2abce8eb067e9d9d77ec585175
Instruction Fuzzy Hash: F621D4715042449FDB85DF58D584B2BBBA5FB84324F24C5AAED890B247C33AD406CBA2

Function 0105D006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4518822591.000000000105D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0105D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_105d000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c611bcfa2705993148af6844cfdaa260d04e4eaafe2deaf865922a838c15019
Instruction ID: cc783914e2219fbc14106903953885479257bcd7409906daadb130c7b0e198b5
Opcode Fuzzy Hash: 0c611bcfa2705993148af6844cfdaa260d04e4eaafe2deaf865922a838c15019
Instruction Fuzzy Hash: 5121A4755093808FDB53CF64D994715BFB1EB45214F28C5DBD8898B2A7C33AD40ACB62

Function 0105D2B7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4518822591.000000000105D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0105D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_105d000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58489c3f61924d27558184a5eb21aea17821769c0c96028cc0fb4c2ef8240ab9
Instruction ID: 30fbd02d8ae9fecd4ab449e9212359381059ef4f5a3136cf30bde1ba97f4b7e8
Opcode Fuzzy Hash: 58489c3f61924d27558184a5eb21aea17821769c0c96028cc0fb4c2ef8240ab9
Instruction Fuzzy Hash: 33119075504280DFDB52CF14D5C4B1ABFA1FB84224F24C6AADC894B657C33AD40ACBA2

Non-executed Functions

Function 050AAD51 Relevance: 2.8, Strings: 2, Instructions: 261COMMON

Download Yara Rule

Strings

Xaq, xrefs: 050AAD8F
$]q, xrefs: 050AAD76

Memory Dump Source

Source File: 00000000.00000002.4522499949.00000000050A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50a0000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID: Xaq$$]q
API String ID: 0-1280934391
Opcode ID: fe289b90604939a2cb41480e187e64df795523a09b1463f07df7bb129dfd0d88
Instruction ID: 0657d4abae27db587fe145e5ada69c1ce60180f63076289dba7396f7d62a0e1c
Opcode Fuzzy Hash: fe289b90604939a2cb41480e187e64df795523a09b1463f07df7bb129dfd0d88
Instruction Fuzzy Hash: CB818175B042189BDB1CDFB9A85467E7BA7BFC8710F04852DE447EB388CE3998029791

Function 050A0040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4522499949.00000000050A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50a0000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7dc817509fda8d703aff5b03be1bc98069ffeb2de6fe9746fd8ecbfdd5a689f
Instruction ID: f07bb384b2c62c550eb3fb5869041f7cc3c537d3696e78a7b59d2aeb9289f074
Opcode Fuzzy Hash: e7dc817509fda8d703aff5b03be1bc98069ffeb2de6fe9746fd8ecbfdd5a689f
Instruction Fuzzy Hash: FA1293B2401745CAD7B8CF65E94C18D3BB6BB85328B904329D2752B2E9DBB815CBCF44

Function 010ED304 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4519053943.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10e0000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4b3754b2ab009ef3ec4f433a4cfb89cda03686d065a6cd67a910b2a54e9a5ec
Instruction ID: 38d73d0639e0a00902fdf9319aee07597037c28cfe8a739440b8fe262425eac4
Opcode Fuzzy Hash: b4b3754b2ab009ef3ec4f433a4cfb89cda03686d065a6cd67a910b2a54e9a5ec
Instruction Fuzzy Hash: 61A16036A00206CFCF15DFB5C8445DEBBF2FF84300B1585AAE941AB265DB71E945CB40

Function 050A0006 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4522499949.00000000050A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50a0000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11fbbf5eab88b6f768d90a94eabe1e5500af7b3566d6396b81594350ab6a0074
Instruction ID: 07f349f8b3edb64ee6e24061481d740a933d949d4f98758454dceeb023909e06
Opcode Fuzzy Hash: 11fbbf5eab88b6f768d90a94eabe1e5500af7b3566d6396b81594350ab6a0074
Instruction Fuzzy Hash: 6CC1F7B2400746CBD7A9CF64E84818D7BB6BB85328F554329D1716B2E9DBB824CBCF44

Function 010E25D8 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4519053943.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10e0000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c697305145e8d58966649f7f5a065d09bbfdcb0059e4a4b734d199a47960e96
Instruction ID: 85eeb80d97f8427a5830fea7cc7f877c87e747965cc48c59043050dae770a917
Opcode Fuzzy Hash: 4c697305145e8d58966649f7f5a065d09bbfdcb0059e4a4b734d199a47960e96
Instruction Fuzzy Hash: 1A417D87C08690AFC793277A98A51D13BA4DE2B22CF4443CAC4E94E9D3F65B8063D7C5

Analysis Process: MT Eagle Asia 11.exePID: 5956, Parent PID: 4436COMMON

Executed Functions

Function 01126730 Relevance: 6.7, Strings: 5, Instructions: 439COMMON

Download Yara Rule

Strings

(o]q, xrefs: 01126CA5
(o]q, xrefs: 0112697A
(o]q, xrefs: 01126988
,aq, xrefs: 01126A00
,aq, xrefs: 011269F2

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$(o]q$,aq$,aq
API String ID: 0-615190528
Opcode ID: bd9e390c61da25a2d0abe5ff13d7ffed37790316feaf88144a878726f29aa644
Instruction ID: 72e4c840d300c69ffbb2c221b98736b96b7beaf6129aab2f7257927f962bfa09
Opcode Fuzzy Hash: bd9e390c61da25a2d0abe5ff13d7ffed37790316feaf88144a878726f29aa644
Instruction Fuzzy Hash: 79029270A00229DFCF19CF69C984AAEBBF6FF48304F158069E915AB2A5D730DC61CB51

Function 01129858 Relevance: 3.4, Strings: 2, Instructions: 850COMMON

Download Yara Rule

Strings

(o]q, xrefs: 01129C78
4']q, xrefs: 0112A273

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID: (o]q$4']q
API String ID: 0-176817397
Opcode ID: 6413937200d0064e977f13761a3ad59465f2928ceb904002bee1619ae02a1324
Instruction ID: 2963807e08195ea371ff9f9b10ef558216d84fe13b72564288400a7456a1fca5
Opcode Fuzzy Hash: 6413937200d0064e977f13761a3ad59465f2928ceb904002bee1619ae02a1324
Instruction Fuzzy Hash: 6072B370A00229CFCB19CF68D984AAEBBF2FF88314F158569E8159B3A5D730ED51CB51

Function 01126108 Relevance: 3.0, Strings: 2, Instructions: 509COMMON

Download Yara Rule

Strings

(o]q, xrefs: 01126642
Haq, xrefs: 0112650E

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID: (o]q$Haq
API String ID: 0-903699183
Opcode ID: 29c88be9a7e3c02cfb10328061b14c3ee796a1601ad1078a71888316dbb00524
Instruction ID: 55b9d7996c76f678594ff40043417a955d38d9ead8ef0c05366d2dec99505904
Opcode Fuzzy Hash: 29c88be9a7e3c02cfb10328061b14c3ee796a1601ad1078a71888316dbb00524
Instruction Fuzzy Hash: F712A270A002198FDB18CF69C854BAEBBF6FF88304F108569E849DB395DB349D56CB91

Function 0112B328 Relevance: 2.8, Strings: 2, Instructions: 349COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0112B758
PH]q, xrefs: 0112B747

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: 855d61e0a0742341a68afd69dc502ae43dffd1e235d7c40432000de096fa87a0
Instruction ID: dd30999f715cb0e282b74d8ee8cafad9be5252859e37498abbd7fc0eba16036d
Opcode Fuzzy Hash: 855d61e0a0742341a68afd69dc502ae43dffd1e235d7c40432000de096fa87a0
Instruction Fuzzy Hash: 67E1F974E04268CFDB18CFA9D884A9DBBB2FF49310F158069E919AB362D730AC51CF54

Function 06838B58 Relevance: 2.7, Strings: 2, Instructions: 238COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06838E9A
PH]q, xrefs: 06838EAB

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: 322202dd0473514288090c4805f1a5a702b7a912604cb39e04b022c9efa15abf
Instruction ID: 3eaa6f0c33f78d71c7383ed66dcc0cd46061216ea98b28b5e110ae0d34b59ede
Opcode Fuzzy Hash: 322202dd0473514288090c4805f1a5a702b7a912604cb39e04b022c9efa15abf
Instruction Fuzzy Hash: 6CA125B0E01328CFDB54CFA9D884AADBBF2BF89304F10816AE459AB355DB345945CF90

Function 0112C190 Relevance: 2.7, Strings: 2, Instructions: 203COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0112C3F8
PH]q, xrefs: 0112C3E7

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: af67c21a8f663792e560ad89a563f8088ec00f72b4302d9b7eb2edfd15a1de78
Instruction ID: 963c8c4505700fa5f77c215bb6cbc5ae883b78ab299187ff8e65e9cecb34fa86
Opcode Fuzzy Hash: af67c21a8f663792e560ad89a563f8088ec00f72b4302d9b7eb2edfd15a1de78
Instruction Fuzzy Hash: 1291B174E00218CFDB18DFAAD984A9DBBF2BF89300F14C469E919AB365DB309941CF51

Function 0112BBD2 Relevance: 2.7, Strings: 2, Instructions: 191COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0112BE38
PH]q, xrefs: 0112BE27

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: 096a5be4d0f81742a017006a52f07b83749e77e62e40f9b5f716a98eeab7d50d
Instruction ID: d6737d45ffc8c8e115748616ab43a92410c35e86fba88ebd6b808d1e26a94d01
Opcode Fuzzy Hash: 096a5be4d0f81742a017006a52f07b83749e77e62e40f9b5f716a98eeab7d50d
Instruction Fuzzy Hash: 1881B174E042588FDB18DFAAD884A9DBBF2FF89304F14C069E508AB365DB349941CF15

Function 0112C470 Relevance: 2.7, Strings: 2, Instructions: 184COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0112C6D8
PH]q, xrefs: 0112C6C7

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: 86c1f0e93c7608e36451447dae07b41759917d57d5239a5c8256751e126e1f35
Instruction ID: 277b5c806db985721358f89dc5d273368e75c1a0864efb0855a8c7072636e3c3
Opcode Fuzzy Hash: 86c1f0e93c7608e36451447dae07b41759917d57d5239a5c8256751e126e1f35
Instruction Fuzzy Hash: 4181C074E002588FDB18DFAAD884A9DBBF2BF89300F14D069E509AB365DB34A945CF50

Function 0112C752 Relevance: 2.7, Strings: 2, Instructions: 183COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0112C9A7
PH]q, xrefs: 0112C9B8

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: 1ad8c18a97cde394ac8c7d53d95fa78c43fdcc44a5e98f08e9c04c6db5603017
Instruction ID: 62af311287fc55ae9396fdca9fb8597e6384321510726f8aab25c807cd9513b5
Opcode Fuzzy Hash: 1ad8c18a97cde394ac8c7d53d95fa78c43fdcc44a5e98f08e9c04c6db5603017
Instruction Fuzzy Hash: B681A274E00258CFDB18DFAAD884A9DBBF2BF89310F14C069E519AB365EB349945CF50

Function 0112CA32 Relevance: 2.7, Strings: 2, Instructions: 183COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0112CC87
PH]q, xrefs: 0112CC98

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: 9f6dddf966b14d5eaeb1d1c1213bc3f5517b8c886614b1ddf39f8aea095c014d
Instruction ID: a28dbd059ed584a82e237a3bb0a71e7364075d8b47e6f115a53bd7fb67441cb3
Opcode Fuzzy Hash: 9f6dddf966b14d5eaeb1d1c1213bc3f5517b8c886614b1ddf39f8aea095c014d
Instruction Fuzzy Hash: A681A074E00218CFDB18DFAAD984A9DBBF2BF88300F148069E919AB365DB349951CF50

Function 01124AD9 Relevance: 2.7, Strings: 2, Instructions: 183COMMON

Download Yara Rule

Strings

PH]q, xrefs: 01124D30
PH]q, xrefs: 01124D41

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: bb22c889fa0ac48123500c9e0aec6191d5ce1c44f88c668fd70ae59af15cd143
Instruction ID: a6a44219d48f1974070b1827f33d4fc2d356f62e9f156c673c7b1c5c8528e5b6
Opcode Fuzzy Hash: bb22c889fa0ac48123500c9e0aec6191d5ce1c44f88c668fd70ae59af15cd143
Instruction Fuzzy Hash: 9281B274E00258CFDB18CFAAD984A9DBBF2BF88300F15C069E819AB365DB309955CF50

Function 0112BEB2 Relevance: 2.7, Strings: 2, Instructions: 182COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0112C118
PH]q, xrefs: 0112C107

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: 20a769b9d420a8216e8a535a2b592158dda7b98f8b6d01780a382053ac21c73b
Instruction ID: a6cfd48be96d920f7ae244a4d421e4713a7481e49c362dcda3456df19b689612
Opcode Fuzzy Hash: 20a769b9d420a8216e8a535a2b592158dda7b98f8b6d01780a382053ac21c73b
Instruction Fuzzy Hash: 1681C174E00258CFDB18DFAAD884A9DBBF2BF89300F14C069E509AB365DB349945CF55

Function 0112B4F2 Relevance: 2.6, Strings: 2, Instructions: 150COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0112B758
PH]q, xrefs: 0112B747

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: db29600cdb25bfbf986f9d33bde1a3410eb5d5ed890e3b6b78adcd784584d4f9
Instruction ID: 9d29ba84793de28a42f36cd70d06dfb6fdfd640234053a8340e7a60e6dd2fbb6
Opcode Fuzzy Hash: db29600cdb25bfbf986f9d33bde1a3410eb5d5ed890e3b6b78adcd784584d4f9
Instruction Fuzzy Hash: 0061B274E006589FDB18DFAAD984A9DBBF2FF89300F14C069E418AB365EB349941CF54

Function 068311A0 Relevance: .7, Instructions: 745COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff69e50554ece20973d315867523f59753d7d137a6092abd568257e67cef4949
Instruction ID: e1379f5ea910f322e9ee4a2af04312ef6f19da15c376d69ed19d078187666f68
Opcode Fuzzy Hash: ff69e50554ece20973d315867523f59753d7d137a6092abd568257e67cef4949
Instruction Fuzzy Hash: 8A827C74E012288FDB65DF69DD88B9DBBB2BF88700F1081E9984DA7265DB305E81CF51

Function 0112EE68 Relevance: .7, Instructions: 717COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5388031fe6c257af5f5587412a9b4095b64abb3e5b28f7d19fdc091d7615e406
Instruction ID: 8d12a60761aa56ddd33e3fb2b204f201f436fa078486baf5dad26f53347baf22
Opcode Fuzzy Hash: 5388031fe6c257af5f5587412a9b4095b64abb3e5b28f7d19fdc091d7615e406
Instruction Fuzzy Hash: A872CD74E012298FDB69DF69C984BDDBBB2BB49304F1481E9D409A7355DB34AE82CF40

Function 06838608 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a52b31c154fa40aa958024ffdb6dd28a46d821f806031658426b37ca0f797b6b
Instruction ID: 4403c894f489c827adfb25d6def9a8e4af5b83718d34a7a534740e501590a6bc
Opcode Fuzzy Hash: a52b31c154fa40aa958024ffdb6dd28a46d821f806031658426b37ca0f797b6b
Instruction Fuzzy Hash: CEE1E574E01218CFDB58DFA9D944B9DBBB2BF88304F2081A9D808A7395DB355E85CF51

Function 0683B6E8 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d8f4b0b753c2bf1f552040bced1b64d7d4ed2157d6427f67343b3267d319514
Instruction ID: b3a682c3f25dc5a2ca00a9b8d404ce59db2507ef43250e6568c49b5be281c844
Opcode Fuzzy Hash: 2d8f4b0b753c2bf1f552040bced1b64d7d4ed2157d6427f67343b3267d319514
Instruction Fuzzy Hash: 60A1A4B0E012288FEB58CF6AD944B9DBBF2AF89300F14C0AAD50CA7255DB745A85CF51

Function 0683D670 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a23927e3873c4b5155d7f778113ed34fb2ef7f79ba166abf560af846543baa7
Instruction ID: ef44b0aa135ad052613b840c5f3235381ab9f9f8e897c87358a94c76914d969f
Opcode Fuzzy Hash: 6a23927e3873c4b5155d7f778113ed34fb2ef7f79ba166abf560af846543baa7
Instruction Fuzzy Hash: 05A1B170E012288FEB68CF6AD944B9DBBF2BF89300F14D0AAD50DA7255DB705A85CF50

Function 0683C388 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a98132ba0fe7c7290c10098c073bd1570a27380be0ac2c43c0c9bfa9212800df
Instruction ID: b5e16baa72e0bf7945e6a16d4ee5bf75634c275869a0ce2fab9d5eef362d9d8d
Opcode Fuzzy Hash: a98132ba0fe7c7290c10098c073bd1570a27380be0ac2c43c0c9bfa9212800df
Instruction Fuzzy Hash: 0AA1A271E012288FEB68CF6AD944B9DBBF2BF89300F14C0AAD509B7255DB705A85CF51

Function 0683A408 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b486268d2ed7199f7b5940f2b97299bcdb7b49cd75821dcca4b3e9e70f393b46
Instruction ID: aa68711b30ab1f72686a9a69d3184ec7dc20dfdb26d46f316bef9095b9c8e0aa
Opcode Fuzzy Hash: b486268d2ed7199f7b5940f2b97299bcdb7b49cd75821dcca4b3e9e70f393b46
Instruction Fuzzy Hash: ABA1B374E012288FEB68CF6AC944B9DFBF2AF89300F14C0AAD54DA7255DB345A85CF50

Function 0683C9D8 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e7c7ec537be376bb352d9c0a100edb2f355b2955d4d151e539af11262825f22
Instruction ID: 899b2e49f405f78494bdeb84653630ec482bf0fd86b83df3be27893726848293
Opcode Fuzzy Hash: 2e7c7ec537be376bb352d9c0a100edb2f355b2955d4d151e539af11262825f22
Instruction Fuzzy Hash: 6FA1B371E012288FEB68CF6AD944B9DBBF2AF89300F14C0AAD50DB7251DB345A85CF50

Function 0683BD38 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 356b5fba8a7589a8a577472fd645e63593298befc3b6410036316e1ff8060d7b
Instruction ID: 7fdf72ad4f955baeb9035359e62120cddcb044fd8dd924d71a1d7c49cb7e14c8
Opcode Fuzzy Hash: 356b5fba8a7589a8a577472fd645e63593298befc3b6410036316e1ff8060d7b
Instruction Fuzzy Hash: 60A1B4B4E012288FEB58CF6AC944B9DBBF2AF89300F14C0AAD508A7255DB745A85CF51

Function 0683AA58 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa14743a6c5e57ec97ea295b56deb4501e962f5ee2794aed4ddc1e2fa67cf218
Instruction ID: 441a36cac911d56fcedc116601f2d25c904d228e990946c77968537013bd862a
Opcode Fuzzy Hash: fa14743a6c5e57ec97ea295b56deb4501e962f5ee2794aed4ddc1e2fa67cf218
Instruction Fuzzy Hash: 01A1A170E012288FEB68CF6AD944B9DFBF2AF89300F14C0AAD50DA7255DB745A85CF51

Function 0683B0A0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd96a8f011d29b1bdae19bd46a92344218a61a96d0bbaf1ad773058ac79ec933
Instruction ID: 915d9d98eba590419a8f0620c41f3971eafb8ad22211dd6409c23cd1b2685ca2
Opcode Fuzzy Hash: bd96a8f011d29b1bdae19bd46a92344218a61a96d0bbaf1ad773058ac79ec933
Instruction Fuzzy Hash: B6A1A5B5E012288FEB58CF6AC944B9DFBF2AF89300F14C1AAD50CA7255DB305A85CF51

Function 0683D028 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7842fa174f8a8a9de7199c5d8b50b00315622302ecc5dd801c7058bd22446c5b
Instruction ID: 161f24d6bb95c6747c6d70662f36d12a72473a1ad17c56cfa96b61bc6408ce04
Opcode Fuzzy Hash: 7842fa174f8a8a9de7199c5d8b50b00315622302ecc5dd801c7058bd22446c5b
Instruction Fuzzy Hash: 2BA19270E012288FEB68CF6AD944B9DFBF2AF89300F14C0AAD50DA7255DB745A85CF51

Function 0683B08F Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c992a413b8c16c251713ea74e7e0500562f5475fda7a65e6a78f270458fb54df
Instruction ID: 31f22596e0583829f7ed72647367160807c4a7cb11578b6f3a37c5f747cb3c26
Opcode Fuzzy Hash: c992a413b8c16c251713ea74e7e0500562f5475fda7a65e6a78f270458fb54df
Instruction Fuzzy Hash: 4281B8B1D006288FEB68CF6AC945B9DBBF2AF89300F14C1AAD50DA7254DB744A85CF51

Function 06831191 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7d07a627c715b7de38604a33ad793bc3f30349185ad8c14d7bc8eca8c30a185
Instruction ID: 7f455ea70771c7d92b1b659abeb184b061fdbb261e3d748912b7cc7b5a0f9791
Opcode Fuzzy Hash: d7d07a627c715b7de38604a33ad793bc3f30349185ad8c14d7bc8eca8c30a185
Instruction Fuzzy Hash: D381B174E012698FDB69DF69DC44BDDBBB2BB89700F1080EAD848A7254DB305E81CF81

Function 0683D018 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 891f59a10aae3935023acd683e35cf03a18d9f6511aac8e7cb757e549087522b
Instruction ID: 68e8e6435f7b850a6c394699ec2030e551509953a7bb2eb31fe20dbef538691d
Opcode Fuzzy Hash: 891f59a10aae3935023acd683e35cf03a18d9f6511aac8e7cb757e549087522b
Instruction Fuzzy Hash: CA718570E016288FEB68CF6AD94479DFBF2AF89300F14C0AAD50DA7254EB745A85CF51

Function 0683AA48 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9daeff58134e4a9aec947077fe4afe06e0811be4aa3eeeeaf655a0be43cde32
Instruction ID: 1b9b6a8ef5d50c4cd338070658fba2f6776fb57f6db5d40bb2ac12d59745ab39
Opcode Fuzzy Hash: b9daeff58134e4a9aec947077fe4afe06e0811be4aa3eeeeaf655a0be43cde32
Instruction Fuzzy Hash: 4A719570E016288FEB68CF6AD944B9DFBF2AF89300F14C0AAD50DA7255DB744A85CF51

Function 068385FC Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 383b2d0c108a5f74b09698d785c05dce573c024fe340f1b5fbcbaab4386043a7
Instruction ID: 18105b9c9d266e18e872cdce46ab92dea0bb763b58057f4583ad3c01a103eee1
Opcode Fuzzy Hash: 383b2d0c108a5f74b09698d785c05dce573c024fe340f1b5fbcbaab4386043a7
Instruction Fuzzy Hash: 7B41D3B0D012188BEB58DFAAC8447DEBBF2BF88304F14C069D418BB294DB355946CF55

Function 0683D663 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f2294deadeba4e79c4057faaeb8c9ef0d29c7d6091378aa371aeb9dca3711e8
Instruction ID: b2b50603517c45499aab447e5288049970a1a4c55dde34ef0e9d2440a0d71298
Opcode Fuzzy Hash: 0f2294deadeba4e79c4057faaeb8c9ef0d29c7d6091378aa371aeb9dca3711e8
Instruction Fuzzy Hash: 7B416B71D016288BEB58CF6BDD457C9FAF3AFC8310F14C1AAD50CA6254DB740A858F51

Function 0683B6D9 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f66c2875af9f5478d81edb4da2e79eaee2190405b537852c28371956cf0aaecd
Instruction ID: d2a3e7f80932dd58072a909967fc0d58bd6ea4514af154e022eb42edd3c2f2d5
Opcode Fuzzy Hash: f66c2875af9f5478d81edb4da2e79eaee2190405b537852c28371956cf0aaecd
Instruction Fuzzy Hash: 934177B1D016188BEB58CF6BC94579DFAF3AFC8304F14C1AAD50CA6264EB740A868F51

Function 0683A3F8 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb485d0a8d813508dee84911664b208de5759894d24e31fde428c780371b558f
Instruction ID: 0e528c46910409d87c84bc96b897221fde097eab66ff6de8976f13c2e3128cf2
Opcode Fuzzy Hash: eb485d0a8d813508dee84911664b208de5759894d24e31fde428c780371b558f
Instruction Fuzzy Hash: F74157B1E016188BEB58CF6BC9457DAFAF3AFC8314F14C1AAC50CA6264DB740A858F51

Function 0683C378 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad8ecfc1255ae645b542f844de4491c158bf7cfba25135f1370de66caab99571
Instruction ID: c9123c7673cbd47a97a269da6b8d336a39e4ccb33af9e7d2be16eae02f4d28b7
Opcode Fuzzy Hash: ad8ecfc1255ae645b542f844de4491c158bf7cfba25135f1370de66caab99571
Instruction Fuzzy Hash: 434169B1D016188FEB58CF6BD94578DFAF3AFC9304F14C1AAD50CA6264DB740A858F51

Function 0683C9C8 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f47f64f3971ed67f2e4ffe323468d81d0be28cf23b79d234a0584d18855d05b7
Instruction ID: f4beae7e6725abaf927463cfa17c7c23c60e7a0a355604fb64d7d37898d55b80
Opcode Fuzzy Hash: f47f64f3971ed67f2e4ffe323468d81d0be28cf23b79d234a0584d18855d05b7
Instruction Fuzzy Hash: 824179B1D016288BEB58CF6BCD4578AFAF3AFC8304F14C0AAC50CA6264DB740A85CF51

Function 0683BD28 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47b487e759593be25606e50083c17d9389e77eb19fcb1d4d5e30438f940c5132
Instruction ID: 6b4d8da9c3c28e2a07998aafeff8eae5e87eeef2169bb602bd98bef9879865d7
Opcode Fuzzy Hash: 47b487e759593be25606e50083c17d9389e77eb19fcb1d4d5e30438f940c5132
Instruction Fuzzy Hash: 064149B1E016188FEB58CF6BD945799FAF3AFC8304F14C1AAD50CA6264EB740A858F51

Function 01126E58 Relevance: 10.5, Strings: 8, Instructions: 475COMMON

Download Yara Rule

Strings

(o]q, xrefs: 01126E96
(o]q, xrefs: 0112701A
(o]q, xrefs: 01127367
,aq, xrefs: 011272F8
(o]q, xrefs: 01126F7D
(o]q, xrefs: 01127377
(o]q, xrefs: 01126F51
,aq, xrefs: 01127308

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$(o]q$(o]q$(o]q$(o]q$,aq$,aq
API String ID: 0-1435242062
Opcode ID: f74ceda6e34090180718e665bd6a653aa26e2ec2ab48d0cad8c317929b87d5c1
Instruction ID: 6fa5fbdb726bd5a6081b4f161671dad428d26d5da8b7429960611ba6f45e507d
Opcode Fuzzy Hash: f74ceda6e34090180718e665bd6a653aa26e2ec2ab48d0cad8c317929b87d5c1
Instruction Fuzzy Hash: 73127B30A002198FCB29CF69D984E9EBBF6FF49314F158599E905DB2A1D730EC51CB50

Function 011287E9 Relevance: 4.2, Strings: 3, Instructions: 493COMMON

Download Yara Rule

Strings

4']q, xrefs: 01128811
4']q, xrefs: 01128837
;]q, xrefs: 01128C2C

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID: 4']q$4']q$;]q
API String ID: 0-1096896373
Opcode ID: 81a4ae6b9e06b1d1086069b2e8ca1648aba3d9e819bc44d95f419fd253234cd8
Instruction ID: 8c5b75f9e3e6e3fa0c4c1959d4897e85fbdcc27ba4210278d3ce57c5d2fc45ce
Opcode Fuzzy Hash: 81a4ae6b9e06b1d1086069b2e8ca1648aba3d9e819bc44d95f419fd253234cd8
Instruction Fuzzy Hash: 22F180703101218FEB2D9A3DC958B3D7ADAEF85605F15446AE502CF3A2EB69CC61C752

Function 011277F0 Relevance: 3.2, Strings: 2, Instructions: 692COMMON

Download Yara Rule

Strings

$]q, xrefs: 01128337
$]q, xrefs: 01128314

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: f3399e213905d24bf1120c0b576e80ddaaa7a174f74e6cc26aa5ecb5a28cea6d
Instruction ID: 217eed5e3a18e546434b514fb2fbf917b80a16a66fb62aeb42048954157c5f78
Opcode Fuzzy Hash: f3399e213905d24bf1120c0b576e80ddaaa7a174f74e6cc26aa5ecb5a28cea6d
Instruction Fuzzy Hash: 6B526674A00218CFEB15DBA4C950B9EBBB6FF84300F1080A9D50A673A6DF355E45DFA5

Function 011256A8 Relevance: 2.8, Strings: 2, Instructions: 265COMMON

Download Yara Rule

Strings

Haq, xrefs: 01125793
Haq, xrefs: 011257C6

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID: Haq$Haq
API String ID: 0-4016896955
Opcode ID: a6fb1f7b2c4560faf4e81dad9c41b9229a606fd6772106c8453453fea68a74a8
Instruction ID: 1247b0a8d74676226966e45464b3476cfd02676cd84f692944110e5471acdaad
Opcode Fuzzy Hash: a6fb1f7b2c4560faf4e81dad9c41b9229a606fd6772106c8453453fea68a74a8
Instruction Fuzzy Hash: 6791F0343042648FDB5A9F28D898BAE7BA3BF88304F158469E946CB395DF74CC41DB91

Function 01125C08 Relevance: 2.7, Strings: 2, Instructions: 229COMMON

Download Yara Rule

Strings

,aq, xrefs: 01125CE8
,aq, xrefs: 01125CDE

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID: ,aq$,aq
API String ID: 0-2990736959
Opcode ID: 5cb63f8d6ec1938b86ecae5e813252dff4481da0bc33d38a7903d9a1338e23f2
Instruction ID: 0a5659712c5c93a6a9e59e85bc7318bd823f63bbb5c6eeb82619d5874109b28a
Opcode Fuzzy Hash: 5cb63f8d6ec1938b86ecae5e813252dff4481da0bc33d38a7903d9a1338e23f2
Instruction Fuzzy Hash: 9781AC34A001299FCB9CCF6CC4C89AEBBB7FF89210B158569D515EB365D730E862CB51

Function 068323E0 Relevance: 2.7, Strings: 2, Instructions: 227COMMON

Download Yara Rule

Strings

LR]q, xrefs: 068323FC
LR]q, xrefs: 06832529

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID: LR]q$LR]q
API String ID: 0-3917262905
Opcode ID: 7eff828511018759b97e886a28a145566f912fb43fdcb9659e73a534529d0f23
Instruction ID: 9bab4a565f6850d0a1a58c7a172a598e62c0bbc1f5f8d30efa19e40861d203b4
Opcode Fuzzy Hash: 7eff828511018759b97e886a28a145566f912fb43fdcb9659e73a534529d0f23
Instruction Fuzzy Hash: D681D430B101258FCB58EF79C864A6E77F5BF88604B158569E506DB3A5DB30EE02CBE1

Function 06839510 Relevance: 2.7, Strings: 2, Instructions: 208COMMON

Download Yara Rule

Strings

(&]q, xrefs: 0683962B
(aq, xrefs: 068396EA

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID: (&]q$(aq
API String ID: 0-1602648543
Opcode ID: 5c62bd752dbce7387623c3e1b70c1d65d58b504669be15825a7486175cc9da84
Instruction ID: 8221b76ea05d7c681daf54d4fd72e96e64996d9b897089c1d6ae4db80d7041a5
Opcode Fuzzy Hash: 5c62bd752dbce7387623c3e1b70c1d65d58b504669be15825a7486175cc9da84
Instruction Fuzzy Hash: AB715F31F002199BDF55DFA9D8946EEBBB2AF88700F148529E505A7380EF749D42C7E1

Function 01123428 Relevance: 2.6, Strings: 2, Instructions: 112COMMON

Download Yara Rule

Strings

Xaq, xrefs: 01123435
Xaq, xrefs: 0112345E

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID: Xaq$Xaq
API String ID: 0-1488805882
Opcode ID: 002d3dc91a4ad22350e5fab77c983fa7a0b7706eae607b05bf1ec0de1e8629ad
Instruction ID: 609f4466eba1ed00637dc1f67f16a322dea5498d201ced98f10f88aaa924b5f8
Opcode Fuzzy Hash: 002d3dc91a4ad22350e5fab77c983fa7a0b7706eae607b05bf1ec0de1e8629ad
Instruction Fuzzy Hash: 3A312739B203758BDF1D8EAD599423EA9DABFC8610F040439D92AD3384DB7CCC558762

Function 01120C8F Relevance: 1.7, Strings: 1, Instructions: 401COMMON

Download Yara Rule

Strings

LR]q, xrefs: 01120E5E

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: cd77a2ccea9e2336510ffae14b3abc38b1b7e4c3d9716d019ae48f74176b7bfa
Instruction ID: 9c1c9bf64fa56e5e830dd0080972d633057ba0b971ee4072236e0377fb055655
Opcode Fuzzy Hash: cd77a2ccea9e2336510ffae14b3abc38b1b7e4c3d9716d019ae48f74176b7bfa
Instruction Fuzzy Hash: 2A22927890025ACFCB58EF64E988B9DBBB6FF88305F1185A9D409A7368DB305D85CF50

Function 01120CA0 Relevance: 1.6, Strings: 1, Instructions: 395COMMON

Download Yara Rule

Strings

LR]q, xrefs: 01120E5E

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: f11a0840f39668c88bc15244109f9c4c3906485100688437031c5cdac263135e
Instruction ID: 4007014b9f5b550bea99206c7f566913d86e5cd3583d112e9970fde3f107be06
Opcode Fuzzy Hash: f11a0840f39668c88bc15244109f9c4c3906485100688437031c5cdac263135e
Instruction Fuzzy Hash: 9F22827890025ACFCB58EF64E988B9DBBB6FF88305F1185A9D409A7368DB305D85CF50

Function 0112A650 Relevance: 1.4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

(o]q, xrefs: 0112A7D9

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID: (o]q
API String ID: 0-794736227
Opcode ID: 1d437b58a0ae301b2fd0462e5b8310abc43ece3c261947a623f4ced619f546cf
Instruction ID: 4f4cae111bd0121ea3828c8e9f0fdb5686ede771cbab834c664b791dee27283d
Opcode Fuzzy Hash: 1d437b58a0ae301b2fd0462e5b8310abc43ece3c261947a623f4ced619f546cf
Instruction Fuzzy Hash: 6841F0397002188FCB189F68E8546AE7BF6AFCC710F158479E916D7791DE319C02CBA0

Function 0112A818 Relevance: .4, Instructions: 413COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc317d5de765cc60f6ffd78ac04e0e7857a7e0c1ebe53ecdf46f77f544bf1438
Instruction ID: bd2b467c6bd5a14a38115f43cd97b978c86cd9da3c7d43abee3132301c2bae82
Opcode Fuzzy Hash: dc317d5de765cc60f6ffd78ac04e0e7857a7e0c1ebe53ecdf46f77f544bf1438
Instruction Fuzzy Hash: AFF15D75A002248FCB18CF6DE88499DBBF6FF88310B1A8469E515EB362DB31EC51CB50

Function 01127438 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61cd33850068ede11e3380541f14a0ed173ec107d612f0ef8d853324cf425775
Instruction ID: 9451424615680d1f40cebf8448384b732fbc4ad045742a1117c648c04074e79e
Opcode Fuzzy Hash: 61cd33850068ede11e3380541f14a0ed173ec107d612f0ef8d853324cf425775
Instruction Fuzzy Hash: 47713B347002658FDB29DF2CC898AAE7BE5AF59600F1500A9E916CB3B1DB74DC51CB91

Function 0112D36A Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 688cf7f32a528be643a838f3a6f3ced1aa457acebffd7774993691c8202120d5
Instruction ID: 7794d1ee6141d20279068fffeb47715b6a13bf538be533278822991048fbf24f
Opcode Fuzzy Hash: 688cf7f32a528be643a838f3a6f3ced1aa457acebffd7774993691c8202120d5
Instruction Fuzzy Hash: B251B278135B838FDF286BA0B5AC13A7BB1FB2FB277456D65E12EC1519DB3400858B21

Function 0112D378 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8442ee5c482ad039dece843b26cd8870e8f80487f269ab2e46b511d09ed75e0a
Instruction ID: b3225ac096d60eafb9403af01d8e62ad05fda4efa5ab83af72c56c44181fc106
Opcode Fuzzy Hash: 8442ee5c482ad039dece843b26cd8870e8f80487f269ab2e46b511d09ed75e0a
Instruction Fuzzy Hash: 1E519278171B478FDF286BA0B5AC13A7BB1FB2FB2B3456D61E12EC5518DB3000858B61

Function 0112E137 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cba25b5bac3a3cf358bc5ee563e3a834b1437d1cd94af486567c931f031e6ea
Instruction ID: cb320e48e410489ca38cae97fc79b51a0fa7dcd7bac361a761b25392d8ed932d
Opcode Fuzzy Hash: 4cba25b5bac3a3cf358bc5ee563e3a834b1437d1cd94af486567c931f031e6ea
Instruction Fuzzy Hash: E9612474E01318DFDB18DFA5D944AADBBB2FF88304F208529D809AB355DB395946CF41

Function 0683DCC0 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a490573ae384d751fed146da22b9d6b4f50a3f02f419ccc165b313d0dbf0af64
Instruction ID: c55eff1e2b1638b73cd3bd730be876ef296fb71ce559ab85cdbfd0541a5b082c
Opcode Fuzzy Hash: a490573ae384d751fed146da22b9d6b4f50a3f02f419ccc165b313d0dbf0af64
Instruction Fuzzy Hash: 2141393591132ACFDB04AFA1D85C7EEBBB5EB4A316F004865D102A72E5DB780A44CFA5

Function 0112D032 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c410bf3c86ee3304e27554e5357009bfa32e5da533e47538db3ee8db25b32e23
Instruction ID: 7dd8442013ba1460d951738385dce5e6ef833db3a1712b955d88cd6ad5f52593
Opcode Fuzzy Hash: c410bf3c86ee3304e27554e5357009bfa32e5da533e47538db3ee8db25b32e23
Instruction Fuzzy Hash: 5A518074E01218DFDB58DFA9D58499DBBF2FF89310F24816AE819AB365DB31A901CF10

Function 01123908 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0497ee4cb8d61090b3e1c74e762cd89672baa109a12ba9855bba1a789b18ae8
Instruction ID: a424edfdee11890e671de6c53fa036f388ed78505eaef06ed3a074894f054958
Opcode Fuzzy Hash: a0497ee4cb8d61090b3e1c74e762cd89672baa109a12ba9855bba1a789b18ae8
Instruction Fuzzy Hash: 2D51A474E01218CFCB08DFB9D99499DBBB2FF89304B209469E805AB364DB35AD01CF50

Function 0112EF49 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad48947de66cb6671e7841ea86c5c0eabff2408764a5416f816003de1fc6da1b
Instruction ID: eed877efa031ba5979199e675f935842d7536b5823642a5cb5f9c7935ee986b2
Opcode Fuzzy Hash: ad48947de66cb6671e7841ea86c5c0eabff2408764a5416f816003de1fc6da1b
Instruction Fuzzy Hash: 4451DF74E06229CFCB28DF69D984BEDBBB2BB49305F1055A9D409A7350DB35AE81CF40

Function 01129A63 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa1efba2a79709059d85693117376a04a2ce16a42b9696bd1f59f70e005326a3
Instruction ID: f6f6d51e8f83de70d0748a44b4f01f46ce7f58a3798c31f337ae43646092aed8
Opcode Fuzzy Hash: fa1efba2a79709059d85693117376a04a2ce16a42b9696bd1f59f70e005326a3
Instruction Fuzzy Hash: 7E41C031A0426DDFCF19CFACC844A9EBFB2BF49314F048555E9159B296D330E960CBA1

Function 06839500 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 438156cb22e2a05143edbd149b1dac5f62b5f9654eb8bd9176792aca7222189b
Instruction ID: 978b453428531a387b37388aeefa2929e56f0356b711adc0bef51977a01c02b4
Opcode Fuzzy Hash: 438156cb22e2a05143edbd149b1dac5f62b5f9654eb8bd9176792aca7222189b
Instruction Fuzzy Hash: 4C414F31E012199BDF54DFA9C890ADEFBB5AF88710F148129E515B7380FBB0A946CBD1

Function 06839A49 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba48aa6514e661565f303f571c9fccca7d1707f98c8be18070be77e1ed1ab8f9
Instruction ID: 0f5c7b5fb42b00572fdb21794a06362175b73749108bb10b351b0312f38ad9ad
Opcode Fuzzy Hash: ba48aa6514e661565f303f571c9fccca7d1707f98c8be18070be77e1ed1ab8f9
Instruction Fuzzy Hash: 9641DF78E05218CFDF08DFA5D984BEDBBF2BB48304F10812AD419A7294EB745946CF90

Function 06839A58 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a3b1035a0ffcc6e0665f4c914eb2b2ebc48ba3336c750d8e50ac70cc04e4f5a
Instruction ID: 34a3856e4ec9a08d7b9fd0f849ce4b8e86d43d400848d765cbe25ead9ac73462
Opcode Fuzzy Hash: 6a3b1035a0ffcc6e0665f4c914eb2b2ebc48ba3336c750d8e50ac70cc04e4f5a
Instruction Fuzzy Hash: 4341C074E05218CFDF48DFA5D9847EDBBF2BB88304F10812AD419A7294EB745946CF50

Function 01124DC8 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8be2cf491abf6a2e622d9be2e79b450e71bfee2d0975047a969d19feacd04429
Instruction ID: a49dbbd139d46c05a86325867d51bfa19f8119d4d88d5859c0bc3730fc32ac00
Opcode Fuzzy Hash: 8be2cf491abf6a2e622d9be2e79b450e71bfee2d0975047a969d19feacd04429
Instruction Fuzzy Hash: 9A31E33520412ADFDB1D9F68E444AAF3BA6FF48704F008424F91A97285DB38DD71DBA1

Function 0683DCB1 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cc7544e6357b41f3f486b706856e576840f6a6ab2907174047f1c35612419b0
Instruction ID: 24b3cc548e33976e74cf502a163c7caa9ae34a565d04f644602c562fafb2fa95
Opcode Fuzzy Hash: 9cc7544e6357b41f3f486b706856e576840f6a6ab2907174047f1c35612419b0
Instruction Fuzzy Hash: D9316B31911319DFDB04AFA1D85C7EEBBB5FB49316F048864D102A72A4CBB80A44CFA1

Function 011276D0 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6c94df346e1cc0556ffa3c65b106f03ed14e84a2495144cf0f69232cea94cc6
Instruction ID: fe0772cc914fcd73f4a314f136f0a03b3e8469d1820893273d84c1b0f5727bb6
Opcode Fuzzy Hash: a6c94df346e1cc0556ffa3c65b106f03ed14e84a2495144cf0f69232cea94cc6
Instruction Fuzzy Hash: 6221B6353006214BDB2D173D899CA3F769B9FE4A18B144079D506CB7D5EF24CC52D781

Function 011276E0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c1adb6a57cb5257e42e98f2189b128205f294d7401008bbd3d6f1deb1a6b210
Instruction ID: 51d0bfa1c775cf157fa61b46fa92e514e62cf0baa993441c5aac5f62c939b66a
Opcode Fuzzy Hash: 5c1adb6a57cb5257e42e98f2189b128205f294d7401008bbd3d6f1deb1a6b210
Instruction Fuzzy Hash: 7921A1393046254BEB2D17298898A3B368B9FD8B18F144078D606CB7D9EF25CC92D391

Function 0112A809 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b27eed24d95e59768fff583f6a491065c295c0a1b9c782c72ad91c3434a63e10
Instruction ID: 53fb640e6e73dbb3ad2d6289ada8b55512ebd11888240d389cf1f10d5b69c324
Opcode Fuzzy Hash: b27eed24d95e59768fff583f6a491065c295c0a1b9c782c72ad91c3434a63e10
Instruction Fuzzy Hash: 4C318D74B405198FCB08CF6DD8849AEBBF6FF84750B168569E615973A1EB30EC12CB90

Function 01122060 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04269fdfab7c67cd3d16aaf240a4bd6e18c9e46073a7bd83bef9130e922dfd01
Instruction ID: de704754ffe0b8cd007640c09911ca59e2a92e0bae35d0b6cbca2e52dd45e205
Opcode Fuzzy Hash: 04269fdfab7c67cd3d16aaf240a4bd6e18c9e46073a7bd83bef9130e922dfd01
Instruction Fuzzy Hash: 2821D335A002159FCF19DF78D8409AE37A6EB98264F20C419D80ACB340DB39FE46CBD2

Function 01125A60 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd02932059a2fe3cfa114be8f7943517170fb904aac2037c3c7b50ecaa5e825e
Instruction ID: e1d63c44bc982af0fd91a322d01f3d34d6e214a75ade9b910f10e047af33694f
Opcode Fuzzy Hash: fd02932059a2fe3cfa114be8f7943517170fb904aac2037c3c7b50ecaa5e825e
Instruction Fuzzy Hash: D821D0357006218FC76D9B28D4D462EBBA3EF88A25B068179E907DB394DF30DC028BD1

Function 00D8D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4518572613.0000000000D8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d8d000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf2417d4768b8f11aaab435df942336b70bfecb08da530c6143d66f197150fe9
Instruction ID: 7e8095606794767af8740fae49f55c62f05176419c9fb6e65166e5cb3ceaee34
Opcode Fuzzy Hash: cf2417d4768b8f11aaab435df942336b70bfecb08da530c6143d66f197150fe9
Instruction Fuzzy Hash: E821F2B1504204AFCB14EF24C9C4B26BB66FB84314F24C569E9494B2D2C73AD846DB72

Function 011239ED Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d89e2322add933391b7f24880fa8c16de1f53c025272e46717ee1e5ccf8b842
Instruction ID: 8f7c686630aa9766c065c2f55350ea5f5c8106b9a810ebca884ba0192fcd9ff1
Opcode Fuzzy Hash: 7d89e2322add933391b7f24880fa8c16de1f53c025272e46717ee1e5ccf8b842
Instruction Fuzzy Hash: D631C478E11249CFCB58DFB8E59499DBBB6FF49304B21846AE819AB324D731AD05CF40

Function 0112215C Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f14ec0a797d8c42903fbd6fb02ac84b13e3e2bffd901899e899caf6ef3965576
Instruction ID: 911c43d5c271d76e46c895c64ce346866590172dead9b6938cadc17330e54206
Opcode Fuzzy Hash: f14ec0a797d8c42903fbd6fb02ac84b13e3e2bffd901899e899caf6ef3965576
Instruction Fuzzy Hash: 3111B135E042599FCB05ABF89C008EEBB34FF89320B258796D62677151EA30281AC792

Function 01124DB9 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 483a2ccdf03abeec1a58bee55bd8296ef20365d51e3296bdd7c90f94c0f69ea9
Instruction ID: ad0d27bc21bb45c937f2cbed8b4058b953c2c956aa7f6cd8a8de7cbc83b86c8f
Opcode Fuzzy Hash: 483a2ccdf03abeec1a58bee55bd8296ef20365d51e3296bdd7c90f94c0f69ea9
Instruction Fuzzy Hash: 96210831608169CFDB2D9F68E44476B3BA2FF84714F108429F4098B281DB38DC61CBE1

Function 068396F0 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 969ecf7af9733149abd7a0caf1f1bcaecb8e03d59659f7e773d24d977d8cacbc
Instruction ID: 48a64402eb4c0f8f56483bb2fb60653b7c8f4999b74b74d968aec390d94b8d4f
Opcode Fuzzy Hash: 969ecf7af9733149abd7a0caf1f1bcaecb8e03d59659f7e773d24d977d8cacbc
Instruction Fuzzy Hash: 7B11E6353082545FDB469FBC98646AF3EA3EFC9340B00446AE509C7381DE248E02C3E2

Function 0683E0C0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f52f789446a34b829e4733d72c6a812a847b3d4939c3b17fec2a33ec826df1ee
Instruction ID: c39537450e7a272255b4ddf6022599d0f7e7691ce22b69fb247fb02956e6f53a
Opcode Fuzzy Hash: f52f789446a34b829e4733d72c6a812a847b3d4939c3b17fec2a33ec826df1ee
Instruction Fuzzy Hash: FD1108343042548FD7090BBA58586AFBFEBAFCA211B158477E946C329ADD288C0683B0

Function 01125A70 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fd48b1a48a916286b81a08e5a4822701f3b25ef07cdf92bf9c558a270fd6262
Instruction ID: 0ed1d5ae824b746d6c1878ecbfd13a042dc0bdfd6e3ca7e243d4f8f43178cd72
Opcode Fuzzy Hash: 6fd48b1a48a916286b81a08e5a4822701f3b25ef07cdf92bf9c558a270fd6262
Instruction Fuzzy Hash: B011CE353006228BD76D9A29D4E892EBBA7BFC8A617164178E907DB350DF20DC028BD0

Function 0112E059 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31dd822c853c04e87f64ff6e665636cf0fda200429ad12fbe83f44593716bfe2
Instruction ID: c07f8cb209ba59ba1949dc89c809509a93255914777c4febd9c5af91e51709a9
Opcode Fuzzy Hash: 31dd822c853c04e87f64ff6e665636cf0fda200429ad12fbe83f44593716bfe2
Instruction Fuzzy Hash: 5D215B70D0020A9FDB49EFB8D94479EBBF1FB44304F50C56AD008AB325EB349A06CB91

Function 06839280 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab5a762206de1cd29a97a3ade11acfed519c2548f143d5f6b942add1ac0f2aa2
Instruction ID: e0a184fd19eff6ab4cf9d3765398d3136050023ef78b6d063db933f658be72cf
Opcode Fuzzy Hash: ab5a762206de1cd29a97a3ade11acfed519c2548f143d5f6b942add1ac0f2aa2
Instruction Fuzzy Hash: 251164B2800249DFDB10CF99C844BEEBFF4EF48320F108819EA18A7210D379A950DFA5

Function 01121F08 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a64f0938fe814acd62a28b5804aa350a59b2282e9713011022ba2e9106cd14ac
Instruction ID: 83c446bfa971903c9fbe21fad6ca61d5ed00e619151f28644b26ccf8956e7c14
Opcode Fuzzy Hash: a64f0938fe814acd62a28b5804aa350a59b2282e9713011022ba2e9106cd14ac
Instruction Fuzzy Hash: 37212274C0460A8FCB14EFA8D8445EEBFF1FF49310F20416AD855B7264EB305A85CBA5

Function 01121F61 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2cecb3c41c8b1aecaf77ee75c1ce8793223dd036999d84225473c4e6b25dd63
Instruction ID: b9e439e9806cf6bcd45eaa370e628e2c5a7966d61ce8a27c42d115bc26f8676f
Opcode Fuzzy Hash: c2cecb3c41c8b1aecaf77ee75c1ce8793223dd036999d84225473c4e6b25dd63
Instruction Fuzzy Hash: 0921EEB8C0420A8FCB44EFA8D8455EEBFF0BF49300F10816AD815B3264EB345A95CBA1

Function 06838EC1 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08f7606d01d573c8c96f8df55e834ae9824674acfa1b115065070838611a3b44
Instruction ID: 06ca7920c89dcface62d59841cb51556dcdd272a2bffc5791226629263161565
Opcode Fuzzy Hash: 08f7606d01d573c8c96f8df55e834ae9824674acfa1b115065070838611a3b44
Instruction Fuzzy Hash: 2411FA74E001598FEB05DFE8D850BEEBBB2AF88315F509465F908E7349EA7099428B91

Function 06839999 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23e52abcce1de4b56948e5ed9d3890f2403d129b877b8067c0c86b239daa1375
Instruction ID: 0d03b8af6b4fbc1309b33f456318095531a4b8ece3c24c451e8596bf92022e64
Opcode Fuzzy Hash: 23e52abcce1de4b56948e5ed9d3890f2403d129b877b8067c0c86b239daa1375
Instruction Fuzzy Hash: A31137B6800249DFDB10CF99C845BEEBFF4EF48320F148819E618A7650D379A554DFA5

Function 0112E068 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90332833d893716af07b310ea9bde914794d7b83a5586110e5662a0c393b3ff2
Instruction ID: dbc4cbd19df1752ca996ad3e8620b110ec93b8107714ceb3b04b91771eba24f0
Opcode Fuzzy Hash: 90332833d893716af07b310ea9bde914794d7b83a5586110e5662a0c393b3ff2
Instruction Fuzzy Hash: B5112C7090120A9FDB49EFA9D944B9EBBF5FB44304F50C565D00897325EB349A06CB91

Function 00D8D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4518572613.0000000000D8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d8d000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 60d201e04afe605999b1a389b54190b540990d067a6ee0f3b79157b6e844cf15
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 3A11DD75504284CFCB12DF10C9C4B15BFA2FB84314F28C6A9D8494B292C33AD84ACF62

Function 06832670 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9e24ee68bca0ce8b0bbd2b667bd475f68e0878a2503064eeac5625d3eb04b3d
Instruction ID: e1aea91f0e55a436d1b208e181db1384cd4cdff33f950000a467aa3d9e66348b
Opcode Fuzzy Hash: d9e24ee68bca0ce8b0bbd2b667bd475f68e0878a2503064eeac5625d3eb04b3d
Instruction Fuzzy Hash: 6811ED35B002258FCB65EB79E808A5E7BF4FF8862471100B9E405CB315EB31CD018BD0

Function 01125607 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d3e533d608a4c8e76f5ccfb7992148d186abfb51adca39ae31295905f6dfe02
Instruction ID: 9ffdc32b3757ecebf6c4f1339cfa2fe63b7c5f34d5d5f04a2b397ead358c22ed
Opcode Fuzzy Hash: 1d3e533d608a4c8e76f5ccfb7992148d186abfb51adca39ae31295905f6dfe02
Instruction Fuzzy Hash: 3E012872B000145FDB598E58A804AEF3BE7DFC8751F19C02AF909D7290DB31881187A0

Function 068325E8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd38728d77d817724018cef8bc1fd2f7058a443dd86666e89de633d83b3f7daf
Instruction ID: 5d365ea90f4bf9b45fc03e57254a263c47bee66a9e16b14f28a658f4d7270c38
Opcode Fuzzy Hash: fd38728d77d817724018cef8bc1fd2f7058a443dd86666e89de633d83b3f7daf
Instruction Fuzzy Hash: 3401F670E002299FCF58EFB9C8106EEBBF5BF48204F10856AD51AE7250E7385A01CBD0

Function 0112DD70 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e910d9f3bfd1c8eb27d125fcbb6097d42595e9fe2341872ea12efcfe0b64a5f
Instruction ID: 90b0f331618ca7a99f4e3b79f4c87aafc4507ed1447b4733db0ad2490bec4423
Opcode Fuzzy Hash: 2e910d9f3bfd1c8eb27d125fcbb6097d42595e9fe2341872ea12efcfe0b64a5f
Instruction Fuzzy Hash: A3E02B70D142148FCF048F9DA8052FD77B0DBD9311F405025E000E32D1E7F4C5158B91

Function 01122010 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5c00fea5759d65e6eee42636331e05239ac135a4cc484b934f700fdef86ad0b
Instruction ID: 026ec87593aaead2b717fd80a890224728a8f6b7dd47fad678258176bd8e7b38
Opcode Fuzzy Hash: b5c00fea5759d65e6eee42636331e05239ac135a4cc484b934f700fdef86ad0b
Instruction Fuzzy Hash: 61E06834C10363AFC711EB60EC044EEBB30EEC2360B01426BE05476011EB741A2ACBA1

Function 01122020 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 474b51ddd5e0112c081c35fc61676ca7cd87b7c81c07621472da24397cdd1e25
Instruction ID: 2d6707e3fd42b7d1f3103e89c27e73df1d19edefd0e9b4ef59037cf632b731a8
Opcode Fuzzy Hash: 474b51ddd5e0112c081c35fc61676ca7cd87b7c81c07621472da24397cdd1e25
Instruction Fuzzy Hash: 67D05B31D2022B97CB11E7A5DC044DFF738EED5265B504626D51837140FB703659C6E1

Function 01128258 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: a401b18a16056f55a5408f9bf71f0f92d021efdb63622384620b97a112465e9a
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: 2EC0123320C1382AA62D208E7C40AA3AB8CC2C62B4A260137F91CA3201AA429C9041B9

Function 0112A70D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6694042609d5895f7208ef336d2bef7054c745dcb4836bb6c34515f46a67bc9b
Instruction ID: 64787e11fdfaa03e3e0ebe42e07a96935d772ff30e36948af3c849d5b02d69ef
Opcode Fuzzy Hash: 6694042609d5895f7208ef336d2bef7054c745dcb4836bb6c34515f46a67bc9b
Instruction Fuzzy Hash: E5D0677AB410189FCB149F98E8408DDBBB6FB9C221B058126E925A3265C6319961DB50

Function 01125EA8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 240fb48ca73d95dfe410710687e4808d19c10965c99125161fc69a7f515741a0
Instruction ID: 5ed01afa890935aadf4413778ff6803d50af562a522516bfac2505d5a8ef48d3
Opcode Fuzzy Hash: 240fb48ca73d95dfe410710687e4808d19c10965c99125161fc69a7f515741a0
Instruction Fuzzy Hash: 6BD05B305483854FCB59F734FA559143B2DBE80708FD541A5E40A4A41EFE7D7C49C761

Function 01125EB8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 951deadd7ebf93199c1c19f1d405e9aabf5c969a4e7703864ea316821223ce90
Instruction ID: c95374628ea67e1e735ab1800cc825b33824b9c9c5e1d939b45461e55a69cc97
Opcode Fuzzy Hash: 951deadd7ebf93199c1c19f1d405e9aabf5c969a4e7703864ea316821223ce90
Instruction Fuzzy Hash: 17C012301443498BCA4DFB75FB45E15371EEEC0308F918530B40A4612DEF787D4887A5

Non-executed Functions

Function 06832809 Relevance: 12.9, Strings: 10, Instructions: 416COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06832DD7
", xrefs: 06833087
PH]q, xrefs: 06832BEA
PH]q, xrefs: 06832CF6
PH]q, xrefs: 06832CE2
PH]q, xrefs: 06832ED2
PH]q, xrefs: 06832DEB
PH]q, xrefs: 06832EE6
PH]q, xrefs: 06832BFE
Haq, xrefs: 06832869

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID: "$Haq$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q
API String ID: 0-2373693423
Opcode ID: 598b29e91d67dad7406f48d001778b662a6be935ea19615c0fd01f3a76f46a45
Instruction ID: eb319bce327c763286f515001431492dcfabf6535ce40fe9b6cad1a24b1e5fb4
Opcode Fuzzy Hash: 598b29e91d67dad7406f48d001778b662a6be935ea19615c0fd01f3a76f46a45
Instruction Fuzzy Hash: 08121474E002188FDB58DF6AD994B9DBBF2BF89300F1080A9D909A7365DB359E85CF50

Function 06832807 Relevance: 12.9, Strings: 10, Instructions: 386COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06832DD7
", xrefs: 06833087
PH]q, xrefs: 06832BEA
PH]q, xrefs: 06832CF6
PH]q, xrefs: 06832CE2
PH]q, xrefs: 06832ED2
PH]q, xrefs: 06832DEB
PH]q, xrefs: 06832EE6
PH]q, xrefs: 06832BFE
Haq, xrefs: 06832869

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID: "$Haq$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q
API String ID: 0-2373693423
Opcode ID: decbcc58841b1c20c583dc13577b364a14156b51dcee44aeb06f5740899c9309
Instruction ID: 54330c5c5895ba43cbf36f01edac404daf7e37a66e7d2abb826bb2f60f77d753
Opcode Fuzzy Hash: decbcc58841b1c20c583dc13577b364a14156b51dcee44aeb06f5740899c9309
Instruction Fuzzy Hash: 2E12F274E002188FDB58DF6AD994B9DBBF2BF89300F1080A9D909A7365DB359E85CF50

Function 068328B0 Relevance: 11.7, Strings: 9, Instructions: 461COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06832DD7
", xrefs: 06833087
PH]q, xrefs: 06832BEA
PH]q, xrefs: 06832CF6
PH]q, xrefs: 06832CE2
PH]q, xrefs: 06832ED2
PH]q, xrefs: 06832DEB
PH]q, xrefs: 06832EE6
PH]q, xrefs: 06832BFE

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID: "$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q
API String ID: 0-3604444728
Opcode ID: 6e170c546b47f90080dc781e4cda3fbd3d56ea62b32edc475243d327f869f77c
Instruction ID: 6b39797a50c1450f0b099532c73c22e02c216963ebdb9862503902d89bc9e283
Opcode Fuzzy Hash: 6e170c546b47f90080dc781e4cda3fbd3d56ea62b32edc475243d327f869f77c
Instruction Fuzzy Hash: B232E274E00228CFDB68CF69D994B9DBBB2BF89304F1080A9D909A7365DB355E85CF50

Function 0112E388 Relevance: 1.8, Strings: 1, Instructions: 596COMMON

Download Yara Rule

Strings

.5uq, xrefs: 0112E4A3

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID: .5uq
API String ID: 0-910421107
Opcode ID: 83a877ec71cf0acd882b384b6fda266cf83c46dcec704ec212667647d3b87e96
Instruction ID: 58e2eeac0d41aeb014dd00cf39506fdb9e5d276912969e9abf73520ea5bca7eb
Opcode Fuzzy Hash: 83a877ec71cf0acd882b384b6fda266cf83c46dcec704ec212667647d3b87e96
Instruction Fuzzy Hash: EA529A74A01228CFDB68DF69C984B9DBBB2BF89304F1085EAD409A7355DB359E81CF50

Function 06835EC8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b467480cedd632709528133b989ddc63aca76a1a2ed4cb176d90776e118cfae
Instruction ID: 0bb5b77c2284fd4e9267faa78aceddde236f4485aa5c6c566dd829a329541a14
Opcode Fuzzy Hash: 1b467480cedd632709528133b989ddc63aca76a1a2ed4cb176d90776e118cfae
Instruction Fuzzy Hash: 52C1A374E00218CFDB58DFA9D984B9DBBB2BF88304F1081A9D809AB355DB355E85CF51

Function 06835618 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69bf491b34d26e5c2fd19d88c369cc21a7f9ab89667baadf6b47172a47c6900b
Instruction ID: 3ccb0eb2c4e6e1e431e3367a98acd4aa120ff0d2de02030692dab16b9f956681
Opcode Fuzzy Hash: 69bf491b34d26e5c2fd19d88c369cc21a7f9ab89667baadf6b47172a47c6900b
Instruction Fuzzy Hash: 8FC1C474E00218CFDB58DFA9D984B9DBBB2BF88304F1081A9D809AB355DB355E85CF51

Function 06835A70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d39b62b72b1a2d5d1bbde9ed5afd7c04f7bddafb5549d3351f60e4ad2d8d134
Instruction ID: 94b6c9a49be46bbe4712f81a8644e3dca4131f487968c4baa417720614d38262
Opcode Fuzzy Hash: 9d39b62b72b1a2d5d1bbde9ed5afd7c04f7bddafb5549d3351f60e4ad2d8d134
Instruction Fuzzy Hash: EEC1B374E00218CFDB58DFA9D984B9DBBB2BF88304F1081A9D809AB365DB355E85CF51

Function 06836BD0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a66ce4bcc6e0f162463b5e65ab2afd3715e869b2499f77719d98044e95e76aa7
Instruction ID: a3cedd8828833ea7901150ffad34d0695749ff0eca972e68858dc374c2b348cf
Opcode Fuzzy Hash: a66ce4bcc6e0f162463b5e65ab2afd3715e869b2499f77719d98044e95e76aa7
Instruction Fuzzy Hash: B7C1B474E00218CFDB58DFA9D984B9DBBB2BF88304F1081A9D809AB355DB355D85CF51

Function 06836320 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 629fdcb58e3572ba8923c9993d168fb666bf427e04a5c5556ae769b000942256
Instruction ID: 15550b8f664a229f927dc17682be07c41aa64b0c79e6a2c4c85c311e615e7b87
Opcode Fuzzy Hash: 629fdcb58e3572ba8923c9993d168fb666bf427e04a5c5556ae769b000942256
Instruction Fuzzy Hash: BDC1C474E00218CFDB58DFA9D994B9DBBB2BF88304F1081A9D809AB355DB359E85CF50

Function 06836778 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cffcd38d4bd170b0c8c2d3d23be8484833536ab805f32b3685ec93f3ae87ec75
Instruction ID: 7b274639337da2a5793d3759b64efc7a162172fbd2557d1999a94ffec2ab245f
Opcode Fuzzy Hash: cffcd38d4bd170b0c8c2d3d23be8484833536ab805f32b3685ec93f3ae87ec75
Instruction Fuzzy Hash: 15C1B474E00218CFDB58DFA9D984B9DBBB2BF88304F1081A9D809AB355DB355E85CF51

Function 06830498 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 049d1e6e7e6bf0ee6648a2e3c298bd238bc9b6a3ecc2899daa40a9de75417401
Instruction ID: deeaff94ae91feeb1865019575dd04452721fa8fd682ae447d09ccfa61488a1e
Opcode Fuzzy Hash: 049d1e6e7e6bf0ee6648a2e3c298bd238bc9b6a3ecc2899daa40a9de75417401
Instruction Fuzzy Hash: 3AC1B274E01218CFDB58DFA9D984B9DBBB2BF88304F1081A9D809AB355DB355E85CF50

Function 068374A8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22037f89e4849c0100928177d427107025c05a050a7a47cfebd8b438cc984caa
Instruction ID: 41aaf3ef60d298885b18b901562e228f120427388cbe36c4d5d7424fc8e4ba03
Opcode Fuzzy Hash: 22037f89e4849c0100928177d427107025c05a050a7a47cfebd8b438cc984caa
Instruction Fuzzy Hash: 93C1C374E00218CFDB58DFA9D984B9DBBB2BF88304F1081A9D809AB355DB359E85CF54

Function 068308F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6009ac0e179a0b8c63691bda18e6bd8763db906a26003e138313694ef706d0ed
Instruction ID: abdc20316bec0f574f9045f3e2b87141aed08d5d7cdb9d99a43628f880643f90
Opcode Fuzzy Hash: 6009ac0e179a0b8c63691bda18e6bd8763db906a26003e138313694ef706d0ed
Instruction Fuzzy Hash: FCC1C374E00218CFDB58DFA9D984B9DBBB2BF88304F2081A9D809AB355DB355E85CF50

Function 06830040 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66009a9e8cbbf875b1ef76fb5548d98b1b9d817f7df9343aebd6697eab7bf372
Instruction ID: 8ee24b4ec191e2a9739f51a230ef8067a6b9c8f31b8daacc2083e691994b164a
Opcode Fuzzy Hash: 66009a9e8cbbf875b1ef76fb5548d98b1b9d817f7df9343aebd6697eab7bf372
Instruction Fuzzy Hash: 1DC1B374E00218CFDB58DFA9D984B9DBBB2BF88304F1081A9D809AB365DB355E85CF51

Function 06837050 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cacd476c0d5feb264bceec43aba110c97893a9abc05fd99a4f45f62f5c1d1b7c
Instruction ID: 3cf2cb3b49f23a52fc70e67d4715e48baa463668d95a7608e5adfbbbfc189fdc
Opcode Fuzzy Hash: cacd476c0d5feb264bceec43aba110c97893a9abc05fd99a4f45f62f5c1d1b7c
Instruction Fuzzy Hash: 78C1D474E00218CFDB58DFA9D984B9DBBB2BF88304F1081A9D809AB355DB359E85CF50

Function 06835198 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c15b293ad42c3cf425b438d8dde30040cb6ebb3b27841b53da9712186a670e05
Instruction ID: 64c297fc48102f89008c7e587a59a79a0e48f857cd02658d12c4a2f24c73efbb
Opcode Fuzzy Hash: c15b293ad42c3cf425b438d8dde30040cb6ebb3b27841b53da9712186a670e05
Instruction Fuzzy Hash: 67C1C474E00218CFDB58DFA9D984B9DBBB2BF88304F1081A9D809AB355DB359E85CF51

Function 068381B0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5830d2108b966b129ee2542eef07b128484577d5360af096e01f1a195c77deb
Instruction ID: 37bc103b474393e122f665e2fb4b4b9c26cabdc4e9e82a52b6020e77968391a2
Opcode Fuzzy Hash: f5830d2108b966b129ee2542eef07b128484577d5360af096e01f1a195c77deb
Instruction Fuzzy Hash: 09C1B374E00218CFDB58DFA9D984B9DBBB2BF88304F1081A9D809AB355DB359E85CF51

Function 06837900 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 960c2cd5b633c80a83cbfd5280dfb498997157557fa8deb9d9fc62cfd10b860a
Instruction ID: 6e5908f44dd1bf43c427ee4ec3a45a43c05ba1eaeb3a289b4f345bed73544a73
Opcode Fuzzy Hash: 960c2cd5b633c80a83cbfd5280dfb498997157557fa8deb9d9fc62cfd10b860a
Instruction Fuzzy Hash: C7C1C474E00218CFDB58DFA9D984B9DBBB2BF88304F1081A9D809AB355DB359E85CF54

Function 06830D48 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 238693b92cdd4d2762693f544e6cf63f38afd1a49876cfcddf092575b293f3a6
Instruction ID: 785b871c141fc96bfd3b533f3744b5ff7f2150b62afb824b2e9f5e023c8d7fa6
Opcode Fuzzy Hash: 238693b92cdd4d2762693f544e6cf63f38afd1a49876cfcddf092575b293f3a6
Instruction Fuzzy Hash: 99C1B474E00218CFDB58DFA9D984B9DBBB2BF88304F1081A9D809AB355DB359E85CF51

Function 06837D58 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5157d59cd728610f721b41d572f13acfc23c89917406db2d784a7bc68ac93e2
Instruction ID: 13540965902f983f6d7a71ebdddc06029d3429e25711117286b91a23396bc5a2
Opcode Fuzzy Hash: a5157d59cd728610f721b41d572f13acfc23c89917406db2d784a7bc68ac93e2
Instruction Fuzzy Hash: 7BC1B474E00218CFDB58DFA9D984B9DBBB2BF88304F1081A9D819AB355DB359E85CF50

Function 068333B8 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0393e6b2503cc5e1e7b93a07190b308911545812481aefe7d98e8fcbbb8228e
Instruction ID: bac8a98e7617a97d21b5ced6dfe3b4786a71cf8238ca559a7f76123eef9794c3
Opcode Fuzzy Hash: c0393e6b2503cc5e1e7b93a07190b308911545812481aefe7d98e8fcbbb8228e
Instruction Fuzzy Hash: 0EB19774E00218CFDB54DFAAD994A9DBBB2FF89310F1081A9D819AB365DB30AD45CF50

Function 0112E9BB Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa1b29fc2a4a601e6281553da126abdc3faee88517684599bcea5a518c65155a
Instruction ID: bb4ef2ef88129f790ea98af14e02a3122738428600bb731042ee9dcf1876753c
Opcode Fuzzy Hash: aa1b29fc2a4a601e6281553da126abdc3faee88517684599bcea5a518c65155a
Instruction Fuzzy Hash: D7A18D74A02228CFDB68DF65C994B99BBB2BF49304F1085EAD40EA7354DB319E81CF51

Function 068333A8 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4523035623.0000000006830000.00000040.00000800.00020000.00000000.sdmp, Offset: 06830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6830000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2db78373b1db934b3b57564a96c2b96a4a55edb5140a7652aed036504a4ebb43
Instruction ID: ae77573a3925db8396e5b0360a53326a79869fa5f7c631dc0e2e4697d005a0f2
Opcode Fuzzy Hash: 2db78373b1db934b3b57564a96c2b96a4a55edb5140a7652aed036504a4ebb43
Instruction Fuzzy Hash: DB519374E00658CFDB48DFAAD984A9DBBF2BF89310F148169D418EB365EB309941CF51

Function 0112EB9B Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 361189739399e3ba323769a2bc08fb3d89ede80db1ee19072e04ba6a548583b5
Instruction ID: 2b91a25baaeea0aacab11b00817daabe2286e7eed8d1892db7b8378d622d2643
Opcode Fuzzy Hash: 361189739399e3ba323769a2bc08fb3d89ede80db1ee19072e04ba6a548583b5
Instruction Fuzzy Hash: 56517E74A01228CFCB68DF24D854B99BBB2BF4A305F5085EAD40EA7354DB35AE81CF51

Function 01126088 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;]q, xrefs: 01126094
\;]q, xrefs: 011260BA
\;]q, xrefs: 0112609E
\;]q, xrefs: 011260C6

Memory Dump Source

Source File: 00000002.00000002.4519168486.0000000001120000.00000040.00000800.00020000.00000000.sdmp, Offset: 01120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1120000_MT Eagle Asia 11.jbxd

Similarity

API ID:
String ID: \;]q$\;]q$\;]q$\;]q
API String ID: 0-2351511683
Opcode ID: 4bdc58602babe2762f2fae9597f08f1d8a38d95db92f240ec4d005013460cadc
Instruction ID: 5bbb400614a14f3d73ab2ea04cd8ab4fcd7c6ecb156baac1c352bf8426ebb92a
Opcode Fuzzy Hash: 4bdc58602babe2762f2fae9597f08f1d8a38d95db92f240ec4d005013460cadc
Instruction Fuzzy Hash: AC01B1317001248F8B2C8E2DC48092977FAAF88A60315417AEA01CB3F4DF75DC61D789

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report MT Eagle Asia 11.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
MT Eagle Asia 11.exe

Function 050ABF60 Relevance: 1.9, Strings: 1, Instructions: 619
COMMON

Function 010EAD48 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Function 050ACA98 Relevance: 1.6, APIs: 1, Instructions: 140
processCOMMON

Function 050ACAA0 Relevance: 1.6, APIs: 1, Instructions: 137
processCOMMON

Function 050A18E4 Relevance: 1.6, APIs: 1, Instructions: 118
COMMON

Function 050A18F0 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Function 010E4248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 050A4050 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Function 010E590D Relevance: 1.6, APIs: 1, Instructions: 91
COMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre