Edit tour

Windows Analysis Report
HUBED342024.exe

Overview

General Information

Sample name:	HUBED342024.exe
Analysis ID:	1580087
MD5:	8e148751995240a3f18c5bd846783d2d
SHA1:	576f54bd58d27c1e7d779c9900388c8dfc7c02be
SHA256:	776e675ee48e029e417d5ed22ef53ccb5225660871d2152c4f4dc786eff91e62
Tags:	exeuser-TeamDreier
Infos:

Detection

MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected MassLogger RAT

Yara detected Telegram RAT

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

HUBED342024.exe (PID: 7352 cmdline: "C:\Users\user\Desktop\HUBED342024.exe" MD5: 8E148751995240A3F18C5BD846783D2D)

powershell.exe (PID: 7552 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\HUBED342024.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7776 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

HUBED342024.exe (PID: 7560 cmdline: "C:\Users\user\Desktop\HUBED342024.exe" MD5: 8E148751995240A3F18C5BD846783D2D)

cleanup

Malware Configuration

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7704742999:AAG0GCBtZYjgQBMY4ELoXFDZtEO_hdGA7UY", "Telegram Chatid": "7245529134"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.3423260696.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000005.00000002.3423260696.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.3423260696.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000005.00000002.3423260696.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xefdf:$a1: get_encryptedPassword 0xf307:$a2: get_encryptedUsername 0xed7a:$a3: get_timePasswordChanged 0xee9b:$a4: get_passwordField 0xeff5:$a5: set_encryptedPassword 0x10951:$a7: get_logins 0x10602:$a8: GetOutlookPasswords 0x103f4:$a9: StartKeylogger 0x108a1:$a10: KeyLoggerEventArgs 0x10451:$a11: KeyLoggerEventArgsEventHandler
00000005.00000002.3425599530.0000000002A54000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.2181052353.0000000003B79000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000001.00000002.2181052353.0000000003B79000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.2181052353.0000000003B79000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000001.00000002.2181052353.0000000003B79000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x27cc7:$a1: get_encryptedPassword 0x27fef:$a2: get_encryptedUsername 0x27a62:$a3: get_timePasswordChanged 0x27b83:$a4: get_passwordField 0x27cdd:$a5: set_encryptedPassword 0x29639:$a7: get_logins 0x292ea:$a8: GetOutlookPasswords 0x290dc:$a9: StartKeylogger 0x29589:$a10: KeyLoggerEventArgs 0x29139:$a11: KeyLoggerEventArgsEventHandler
00000001.00000002.2181052353.0000000003BC8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000001.00000002.2181052353.0000000003BC8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.2181052353.0000000003BC8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000001.00000002.2181052353.0000000003BC8000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x75c4f:$a1: get_encryptedPassword 0x8c86f:$a1: get_encryptedPassword 0x75f77:$a2: get_encryptedUsername 0x8cb97:$a2: get_encryptedUsername 0x759ea:$a3: get_timePasswordChanged 0x8c60a:$a3: get_timePasswordChanged 0x75b0b:$a4: get_passwordField 0x8c72b:$a4: get_passwordField 0x75c65:$a5: set_encryptedPassword 0x8c885:$a5: set_encryptedPassword 0x775c1:$a7: get_logins 0x8e1e1:$a7: get_logins 0x77272:$a8: GetOutlookPasswords 0x8de92:$a8: GetOutlookPasswords 0x77064:$a9: StartKeylogger 0x8dc84:$a9: StartKeylogger 0x77511:$a10: KeyLoggerEventArgs 0x8e131:$a10: KeyLoggerEventArgs 0x770c1:$a11: KeyLoggerEventArgsEventHandler 0x8dce1:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: HUBED342024.exe PID: 7352	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: HUBED342024.exe PID: 7352	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: HUBED342024.exe PID: 7352	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: HUBED342024.exe PID: 7352	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: HUBED342024.exe PID: 7352	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x39cef:$a1: get_encryptedPassword 0x513f9:$a1: get_encryptedPassword 0x3a008:$a2: get_encryptedUsername 0x51712:$a2: get_encryptedUsername 0x39a9e:$a3: get_timePasswordChanged 0x511a8:$a3: get_timePasswordChanged 0x39bbf:$a4: get_passwordField 0x512c9:$a4: get_passwordField 0x39d05:$a5: set_encryptedPassword 0x5140f:$a5: set_encryptedPassword 0x3b608:$a7: get_logins 0x52d12:$a7: get_logins 0x3b2b9:$a8: GetOutlookPasswords 0x529c3:$a8: GetOutlookPasswords 0x3b0ab:$a9: StartKeylogger 0x527b5:$a9: StartKeylogger 0x3b558:$a10: KeyLoggerEventArgs 0x52c62:$a10: KeyLoggerEventArgs 0x3b108:$a11: KeyLoggerEventArgsEventHandler 0x52812:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: HUBED342024.exe PID: 7560	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: HUBED342024.exe PID: 7560	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: HUBED342024.exe PID: 7560	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: HUBED342024.exe PID: 7560	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x227c5:$a1: get_encryptedPassword 0x22ade:$a2: get_encryptedUsername 0x22574:$a3: get_timePasswordChanged 0x22695:$a4: get_passwordField 0x227db:$a5: set_encryptedPassword 0x240de:$a7: get_logins 0x23d8f:$a8: GetOutlookPasswords 0x23b81:$a9: StartKeylogger 0x2402e:$a10: KeyLoggerEventArgs 0x23bde:$a11: KeyLoggerEventArgsEventHandler
Click to see the 17 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.HUBED342024.exe.3b91ae8.4.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
1.2.HUBED342024.exe.3b91ae8.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.HUBED342024.exe.3b91ae8.4.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.HUBED342024.exe.3b91ae8.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1df:$a1: get_encryptedPassword 0xf507:$a2: get_encryptedUsername 0xef7a:$a3: get_timePasswordChanged 0xf09b:$a4: get_passwordField 0xf1f5:$a5: set_encryptedPassword 0x10b51:$a7: get_logins 0x10802:$a8: GetOutlookPasswords 0x105f4:$a9: StartKeylogger 0x10aa1:$a10: KeyLoggerEventArgs 0x10651:$a11: KeyLoggerEventArgsEventHandler
1.2.HUBED342024.exe.3b91ae8.4.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1418b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13689:$a3: \Google\Chrome\User Data\Default\Login Data 0x13997:$a4: \Orbitum\User Data\Default\Login Data 0x1478f:$a5: \Kometa\User Data\Default\Login Data
5.2.HUBED342024.exe.400000.0.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
5.2.HUBED342024.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.HUBED342024.exe.3c2ea70.1.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
1.2.HUBED342024.exe.3c2ea70.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.HUBED342024.exe.3c2ea70.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
5.2.HUBED342024.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.HUBED342024.exe.3b91ae8.4.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
1.2.HUBED342024.exe.3b91ae8.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.HUBED342024.exe.3b91ae8.4.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
5.2.HUBED342024.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1df:$a1: get_encryptedPassword 0xf507:$a2: get_encryptedUsername 0xef7a:$a3: get_timePasswordChanged 0xf09b:$a4: get_passwordField 0xf1f5:$a5: set_encryptedPassword 0x10b51:$a7: get_logins 0x10802:$a8: GetOutlookPasswords 0x105f4:$a9: StartKeylogger 0x10aa1:$a10: KeyLoggerEventArgs 0x10651:$a11: KeyLoggerEventArgsEventHandler
1.2.HUBED342024.exe.3c2ea70.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd3df:$a1: get_encryptedPassword 0xd707:$a2: get_encryptedUsername 0xd17a:$a3: get_timePasswordChanged 0xd29b:$a4: get_passwordField 0xd3f5:$a5: set_encryptedPassword 0xed51:$a7: get_logins 0xea02:$a8: GetOutlookPasswords 0xe7f4:$a9: StartKeylogger 0xeca1:$a10: KeyLoggerEventArgs 0xe851:$a11: KeyLoggerEventArgsEventHandler
1.2.HUBED342024.exe.3b91ae8.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd3df:$a1: get_encryptedPassword 0xd707:$a2: get_encryptedUsername 0xd17a:$a3: get_timePasswordChanged 0xd29b:$a4: get_passwordField 0xd3f5:$a5: set_encryptedPassword 0xed51:$a7: get_logins 0xea02:$a8: GetOutlookPasswords 0xe7f4:$a9: StartKeylogger 0xeca1:$a10: KeyLoggerEventArgs 0xe851:$a11: KeyLoggerEventArgsEventHandler
5.2.HUBED342024.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1418b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13689:$a3: \Google\Chrome\User Data\Default\Login Data 0x13997:$a4: \Orbitum\User Data\Default\Login Data 0x1478f:$a5: \Kometa\User Data\Default\Login Data
1.2.HUBED342024.exe.3c2ea70.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1238b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x11889:$a3: \Google\Chrome\User Data\Default\Login Data 0x11b97:$a4: \Orbitum\User Data\Default\Login Data 0x1298f:$a5: \Kometa\User Data\Default\Login Data
1.2.HUBED342024.exe.3b91ae8.4.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1238b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x11889:$a3: \Google\Chrome\User Data\Default\Login Data 0x11b97:$a4: \Orbitum\User Data\Default\Login Data 0x1298f:$a5: \Kometa\User Data\Default\Login Data
1.2.HUBED342024.exe.3c2ea70.1.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
1.2.HUBED342024.exe.3c2ea70.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.HUBED342024.exe.3c2ea70.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.HUBED342024.exe.3c2ea70.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1df:$a1: get_encryptedPassword 0x25dff:$a1: get_encryptedPassword 0xf507:$a2: get_encryptedUsername 0x26127:$a2: get_encryptedUsername 0xef7a:$a3: get_timePasswordChanged 0x25b9a:$a3: get_timePasswordChanged 0xf09b:$a4: get_passwordField 0x25cbb:$a4: get_passwordField 0xf1f5:$a5: set_encryptedPassword 0x25e15:$a5: set_encryptedPassword 0x10b51:$a7: get_logins 0x27771:$a7: get_logins 0x10802:$a8: GetOutlookPasswords 0x27422:$a8: GetOutlookPasswords 0x105f4:$a9: StartKeylogger 0x27214:$a9: StartKeylogger 0x10aa1:$a10: KeyLoggerEventArgs 0x276c1:$a10: KeyLoggerEventArgs 0x10651:$a11: KeyLoggerEventArgsEventHandler 0x27271:$a11: KeyLoggerEventArgsEventHandler
Click to see the 19 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\HUBED342024.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\HUBED342024.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\HUBED342024.exe", ParentImage: C:\Users\user\Desktop\HUBED342024.exe, ParentProcessId: 7352, ParentProcessName: HUBED342024.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\HUBED342024.exe", ProcessId: 7552, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\HUBED342024.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\HUBED342024.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\HUBED342024.exe", ParentImage: C:\Users\user\Desktop\HUBED342024.exe, ParentProcessId: 7352, ParentProcessName: HUBED342024.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\HUBED342024.exe", ProcessId: 7552, ProcessName: powershell.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T21:50:16.133490+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49718	193.122.6.168	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000001.00000002.2181052353.0000000003B79000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7704742999:AAG0GCBtZYjgQBMY4ELoXFDZtEO_hdGA7UY", "Telegram Chatid": "7245529134"}

Multi AV Scanner detection for submitted file

Source: HUBED342024.exe

ReversingLabs: Detection: 73%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: HUBED342024.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: HUBED342024.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 172.67.177.134:443 -> 192.168.2.6:49723 version: TLS 1.0

Source: HUBED342024.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\HUBED342024.exe	Code function: 4x nop then jmp 00E09731h	5_2_00E09480
Source: C:\Users\user\Desktop\HUBED342024.exe	Code function: 4x nop then jmp 00E09E5Ah	5_2_00E09A40
Source: C:\Users\user\Desktop\HUBED342024.exe	Code function: 4x nop then jmp 00E09E5Ah	5_2_00E09A30
Source: C:\Users\user\Desktop\HUBED342024.exe	Code function: 4x nop then jmp 00E09E5Ah	5_2_00E09D87

Source: global traffic

HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 193.122.6.168 193.122.6.168
Source: Joe Sandbox View	IP Address: 172.67.177.134 172.67.177.134

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic

Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49718 -> 193.122.6.168:80

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown

HTTPS traffic detected: 172.67.177.134:443 -> 192.168.2.6:49723 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: HUBED342024.exe, 00000005.00000002.3425599530.000000000297E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: HUBED342024.exe, 00000005.00000002.3425599530.000000000297E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.comd
Source: HUBED342024.exe, 00000005.00000002.3425599530.000000000297E000.00000004.00000800.00020000.00000000.sdmp, HUBED342024.exe, 00000005.00000002.3425599530.000000000296C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: HUBED342024.exe, 00000005.00000002.3425599530.0000000002901000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: HUBED342024.exe, 00000005.00000002.3425599530.000000000297E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/d
Source: HUBED342024.exe, 00000001.00000002.2181052353.0000000003B79000.00000004.00000800.00020000.00000000.sdmp, HUBED342024.exe, 00000001.00000002.2181052353.0000000003BC8000.00000004.00000800.00020000.00000000.sdmp, HUBED342024.exe, 00000005.00000002.3423260696.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: HUBED342024.exe, 00000005.00000002.3425599530.000000000297E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.orgd
Source: HUBED342024.exe, 00000005.00000002.3425599530.000000000299C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: HUBED342024.exe, 00000005.00000002.3425599530.000000000299C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.orgd
Source: HUBED342024.exe, 00000001.00000002.2180525420.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, HUBED342024.exe, 00000005.00000002.3425599530.0000000002901000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: HUBED342024.exe, 00000001.00000002.2181052353.0000000003B79000.00000004.00000800.00020000.00000000.sdmp, HUBED342024.exe, 00000001.00000002.2181052353.0000000003BC8000.00000004.00000800.00020000.00000000.sdmp, HUBED342024.exe, 00000005.00000002.3423260696.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot-/sendDocument?chat_id=
Source: HUBED342024.exe, 00000005.00000002.3425599530.000000000297E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: HUBED342024.exe, 00000001.00000002.2181052353.0000000003B79000.00000004.00000800.00020000.00000000.sdmp, HUBED342024.exe, 00000001.00000002.2181052353.0000000003BC8000.00000004.00000800.00020000.00000000.sdmp, HUBED342024.exe, 00000005.00000002.3425599530.000000000297E000.00000004.00000800.00020000.00000000.sdmp, HUBED342024.exe, 00000005.00000002.3423260696.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: HUBED342024.exe, 00000005.00000002.3425599530.000000000297E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189d
Source: HUBED342024.exe, 00000005.00000002.3425599530.000000000297E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189l

Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 1.2.HUBED342024.exe.3b91ae8.4.raw.unpack, UltraSpeed.cs	.Net Code: VKCodeToUnicode
Source: 1.2.HUBED342024.exe.3c2ea70.1.raw.unpack, UltraSpeed.cs	.Net Code: VKCodeToUnicode

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.HUBED342024.exe.3b91ae8.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 1.2.HUBED342024.exe.3b91ae8.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.HUBED342024.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 1.2.HUBED342024.exe.3c2ea70.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 1.2.HUBED342024.exe.3b91ae8.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.HUBED342024.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.2.HUBED342024.exe.3c2ea70.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.2.HUBED342024.exe.3b91ae8.4.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.2.HUBED342024.exe.3c2ea70.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000005.00000002.3423260696.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000001.00000002.2181052353.0000000003B79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000001.00000002.2181052353.0000000003BC8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: HUBED342024.exe PID: 7352, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: HUBED342024.exe PID: 7560, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Source: C:\Users\user\Desktop\HUBED342024.exe	Code function: 1_2_05154458	1_2_05154458
Source: C:\Users\user\Desktop\HUBED342024.exe	Code function: 1_2_05154448	1_2_05154448
Source: C:\Users\user\Desktop\HUBED342024.exe	Code function: 1_2_051524E4	1_2_051524E4
Source: C:\Users\user\Desktop\HUBED342024.exe	Code function: 1_2_07031DE8	1_2_07031DE8
Source: C:\Users\user\Desktop\HUBED342024.exe	Code function: 1_2_0703CDF0	1_2_0703CDF0
Source: C:\Users\user\Desktop\HUBED342024.exe	Code function: 1_2_07034948	1_2_07034948
Source: C:\Users\user\Desktop\HUBED342024.exe	Code function: 1_2_07293750	1_2_07293750
Source: C:\Users\user\Desktop\HUBED342024.exe	Code function: 1_2_07297520	1_2_07297520
Source: C:\Users\user\Desktop\HUBED342024.exe	Code function: 1_2_07297530	1_2_07297530
Source: C:\Users\user\Desktop\HUBED342024.exe	Code function: 1_2_072970F8	1_2_072970F8
Source: C:\Users\user\Desktop\HUBED342024.exe	Code function: 1_2_0729DE40	1_2_0729DE40
Source: C:\Users\user\Desktop\HUBED342024.exe	Code function: 1_2_07298C38	1_2_07298C38
Source: C:\Users\user\Desktop\HUBED342024.exe	Code function: 1_2_07296CC0	1_2_07296CC0
Source: C:\Users\user\Desktop\HUBED342024.exe	Code function: 1_2_07296888	1_2_07296888
Source: C:\Users\user\Desktop\HUBED342024.exe	Code function: 5_2_00E0C530	5_2_00E0C530
Source: C:\Users\user\Desktop\HUBED342024.exe	Code function: 5_2_00E02DD1	5_2_00E02DD1
Source: C:\Users\user\Desktop\HUBED342024.exe	Code function: 5_2_00E09480	5_2_00E09480
Source: C:\Users\user\Desktop\HUBED342024.exe	Code function: 5_2_00E0C521	5_2_00E0C521
Source: C:\Users\user\Desktop\HUBED342024.exe	Code function: 5_2_00E0946F	5_2_00E0946F

Source: HUBED342024.exe, 00000001.00000002.2180525420.0000000002B7F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs HUBED342024.exe
Source: HUBED342024.exe, 00000001.00000002.2184781499.0000000005700000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs HUBED342024.exe
Source: HUBED342024.exe, 00000001.00000002.2185964899.00000000077B0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs HUBED342024.exe
Source: HUBED342024.exe, 00000001.00000002.2181052353.0000000003B79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs HUBED342024.exe
Source: HUBED342024.exe, 00000001.00000000.2163683988.00000000008B0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameEDhb.exe" vs HUBED342024.exe
Source: HUBED342024.exe, 00000001.00000002.2180525420.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs HUBED342024.exe
Source: HUBED342024.exe, 00000001.00000002.2181052353.0000000003BC8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs HUBED342024.exe
Source: HUBED342024.exe, 00000001.00000002.2181052353.0000000003BC8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs HUBED342024.exe
Source: HUBED342024.exe, 00000001.00000002.2179563186.0000000000F7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs HUBED342024.exe
Source: HUBED342024.exe, 00000005.00000002.3423576970.0000000000957000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs HUBED342024.exe
Source: HUBED342024.exe, 00000005.00000002.3423260696.000000000041A000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs HUBED342024.exe
Source: HUBED342024.exe	Binary or memory string: OriginalFilenameEDhb.exe" vs HUBED342024.exe

Source: HUBED342024.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1.2.HUBED342024.exe.3b91ae8.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 1.2.HUBED342024.exe.3b91ae8.4.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.HUBED342024.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 1.2.HUBED342024.exe.3c2ea70.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 1.2.HUBED342024.exe.3b91ae8.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.HUBED342024.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.HUBED342024.exe.3c2ea70.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.HUBED342024.exe.3b91ae8.4.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.HUBED342024.exe.3c2ea70.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000005.00000002.3423260696.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000001.00000002.2181052353.0000000003B79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000001.00000002.2181052353.0000000003BC8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: HUBED342024.exe PID: 7352, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: HUBED342024.exe PID: 7560, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: HUBED342024.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 1.2.HUBED342024.exe.3b91ae8.4.raw.unpack, UltraSpeed.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.HUBED342024.exe.3b91ae8.4.raw.unpack, COVIDPickers.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.HUBED342024.exe.3c2ea70.1.raw.unpack, UltraSpeed.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.HUBED342024.exe.3c2ea70.1.raw.unpack, COVIDPickers.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 1.2.HUBED342024.exe.3d47e08.3.raw.unpack, vGEZyueWSOhGtBk4qt.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.HUBED342024.exe.3da2e28.2.raw.unpack, vGEZyueWSOhGtBk4qt.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.HUBED342024.exe.77b0000.6.raw.unpack, BKfcZoJdDv53wrRPdB.cs	Security API names: _0020.SetAccessControl
Source: 1.2.HUBED342024.exe.77b0000.6.raw.unpack, BKfcZoJdDv53wrRPdB.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.HUBED342024.exe.77b0000.6.raw.unpack, BKfcZoJdDv53wrRPdB.cs	Security API names: _0020.AddAccessRule
Source: 1.2.HUBED342024.exe.3d47e08.3.raw.unpack, BKfcZoJdDv53wrRPdB.cs	Security API names: _0020.SetAccessControl
Source: 1.2.HUBED342024.exe.3d47e08.3.raw.unpack, BKfcZoJdDv53wrRPdB.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.HUBED342024.exe.3d47e08.3.raw.unpack, BKfcZoJdDv53wrRPdB.cs	Security API names: _0020.AddAccessRule
Source: 1.2.HUBED342024.exe.77b0000.6.raw.unpack, vGEZyueWSOhGtBk4qt.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.HUBED342024.exe.3da2e28.2.raw.unpack, BKfcZoJdDv53wrRPdB.cs	Security API names: _0020.SetAccessControl
Source: 1.2.HUBED342024.exe.3da2e28.2.raw.unpack, BKfcZoJdDv53wrRPdB.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.HUBED342024.exe.3da2e28.2.raw.unpack, BKfcZoJdDv53wrRPdB.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/6@2/2

Source: C:\Users\user\Desktop\HUBED342024.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HUBED342024.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\HUBED342024.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7568:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z3iwkv4x.r2w.ps1

Jump to behavior

Source: HUBED342024.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: HUBED342024.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\HUBED342024.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\HUBED342024.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: HUBED342024.exe, 00000005.00000002.3425599530.00000000029EE000.00000004.00000800.00020000.00000000.sdmp, HUBED342024.exe, 00000005.00000002.3425599530.0000000002A1D000.00000004.00000800.00020000.00000000.sdmp, HUBED342024.exe, 00000005.00000002.3425599530.00000000029DE000.00000004.00000800.00020000.00000000.sdmp, HUBED342024.exe, 00000005.00000002.3427263189.000000000392D000.00000004.00000800.00020000.00000000.sdmp, HUBED342024.exe, 00000005.00000002.3425599530.0000000002A10000.00000004.00000800.00020000.00000000.sdmp, HUBED342024.exe, 00000005.00000002.3425599530.00000000029FC000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: HUBED342024.exe

ReversingLabs: Detection: 73%

Source: unknown	Process created: C:\Users\user\Desktop\HUBED342024.exe "C:\Users\user\Desktop\HUBED342024.exe"
Source: C:\Users\user\Desktop\HUBED342024.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\HUBED342024.exe"
Source: C:\Users\user\Desktop\HUBED342024.exe	Process created: C:\Users\user\Desktop\HUBED342024.exe "C:\Users\user\Desktop\HUBED342024.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\HUBED342024.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\HUBED342024.exe"	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process created: C:\Users\user\Desktop\HUBED342024.exe "C:\Users\user\Desktop\HUBED342024.exe"	Jump to behavior

Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\HUBED342024.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\HUBED342024.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\HUBED342024.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: HUBED342024.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: HUBED342024.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: 1.2.HUBED342024.exe.3da2e28.2.raw.unpack, BKfcZoJdDv53wrRPdB.cs	.Net Code: vtMWQOhDBp System.Reflection.Assembly.Load(byte[])
Source: 1.2.HUBED342024.exe.77b0000.6.raw.unpack, BKfcZoJdDv53wrRPdB.cs	.Net Code: vtMWQOhDBp System.Reflection.Assembly.Load(byte[])
Source: 1.2.HUBED342024.exe.3d47e08.3.raw.unpack, BKfcZoJdDv53wrRPdB.cs	.Net Code: vtMWQOhDBp System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\HUBED342024.exe	Code function: 1_2_05151668 push 1C050BCFh; iretd	1_2_0515166D
Source: C:\Users\user\Desktop\HUBED342024.exe	Code function: 1_2_05150CC8 pushfd ; retf	1_2_05150CD1
Source: C:\Users\user\Desktop\HUBED342024.exe	Code function: 1_2_07295C72 pushfd ; ret	1_2_07295C81
Source: C:\Users\user\Desktop\HUBED342024.exe	Code function: 5_2_00E0B3A8 push eax; iretd	5_2_00E0B445

Source: HUBED342024.exe

Static PE information: section name: .text entropy: 7.3371981191853

Source: 1.2.HUBED342024.exe.3da2e28.2.raw.unpack, ntaqAjggZ3soHhG3ngL.cs	High entropy of concatenated method names: 'ikkUi9kMwl', 'dQuUz3WfGk', 'VVVTfk29ul', 'TqCTgAwClt', 'bbITst5N78', 'vYrTXMCjed', 'lZ8TWNPGst', 'E8pTClyggH', 'outTtsQhpq', 'I92TcuE7CC'
Source: 1.2.HUBED342024.exe.3da2e28.2.raw.unpack, r3PZeRYkfcj0D0oe9W.cs	High entropy of concatenated method names: 'W8SnkFVHJo', 'fXFnVdqZXN', 'DCLnYhi7ZN', 'aKWnIXdtOV', 'FHJnbjgvfC', 'dIvn13o0bM', 'ldmnZSL5io', 'yssnqptkHo', 'd9Ln4TIuDn', 'Q2GnKNy27R'
Source: 1.2.HUBED342024.exe.3da2e28.2.raw.unpack, Qip3YMgWuX7c2TIXiTT.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'zTwHDmrCKg', 'TWrHUSwtKi', 'lagHTyva1b', 'kLAHHE83he', 'ClhHP4xeI0', 'QbBHpwu4m6', 'NKmHNrFpkx'
Source: 1.2.HUBED342024.exe.3da2e28.2.raw.unpack, u70kBqWEe0Gq5IFHi8.cs	High entropy of concatenated method names: 'QiPgRGEZyu', 'dSOgJhGtBk', 'hkrg9PvTgH', 'fipgFv4NRa', 'J5HgnfA5L3', 'E78gjHlMRu', 'vQCIPxxiv5kJk0Tw6k', 'zompKGJOe8sH6kAqL0', 'LSyggBkMFF', 'Tr3gXIsews'
Source: 1.2.HUBED342024.exe.3da2e28.2.raw.unpack, RXDF57zVDhYSt7uLZL.cs	High entropy of concatenated method names: 'eZWUMS9aiE', 'W7xUetspYe', 'optU8IObZK', 'dq0U3rkXC4', 'eBaUb1GIBg', 'RdjUZXYKpL', 'B3qUqMAN8k', 'wh9UNbutsC', 'sjGUaQwyU8', 'pI6U2mWfSO'
Source: 1.2.HUBED342024.exe.3da2e28.2.raw.unpack, sjXoshBoHC8PXIJvtT.cs	High entropy of concatenated method names: 'S9AmeT4QYA', 'thcm8FylVJ', 'KwOm3R7Eyi', 'iNGmbibCQW', 'NjDmZl0oYj', 'ukxmqJWWwR', 'M4xmK4O2MY', 'RbtmhG6SP6', 'Behmk78EM1', 'OnymGypPlq'
Source: 1.2.HUBED342024.exe.3da2e28.2.raw.unpack, zfe1sdbrR2S03mAHDS.cs	High entropy of concatenated method names: 'Mu9RN2MsnMLxftf7hxj', 'FhwSLuMCAWoyrjo5cxj', 'pily5VyfZX', 'LaZyDA8C5Y', 'd35yUkIvn0', 'gB8pEJMXrkV6RYu7iMW', 'bIIr3bMvV8O1KK6u4i0', 'mQpFCwMQj6cuj2p5TRG'
Source: 1.2.HUBED342024.exe.3da2e28.2.raw.unpack, wjOyZASY3yGLp2qtFy.cs	High entropy of concatenated method names: 'NtZ762f4Yq', 'GLb7i7dZMo', 'DCS5fe16T5', 'eZj5guH8cO', 'Nqj7GxgVXk', 'MIM7VMVSx5', 'Gc07BSliKk', 'nAc7YaP6PA', 'AqK7IZFurA', 'Q6d7x721qO'
Source: 1.2.HUBED342024.exe.3da2e28.2.raw.unpack, SrFKEasbuAJ5pUuDKk.cs	High entropy of concatenated method names: 'RY3Qw4V8n', 'LJ8vGPSHF', 'EUvMvcdkK', 'irouDcsXv', 'Sml81P11m', 'hjKOAdkeN', 'yayX0KO1VneleoyVg5', 'S54KBbAx5455PGPGOW', 'jGF5a4swX', 'VZvU4fL18'
Source: 1.2.HUBED342024.exe.3da2e28.2.raw.unpack, memblcxctooqU42Wlx.cs	High entropy of concatenated method names: 'ToString', 'A5HjG4MRDr', 'FtZjbyAJVr', 'hMaj1HcokF', 'eBDjZEuA2E', 'Q3PjqVjo8g', 'qsVj4eDseO', 'Hs8jKvC9e2', 'QCsjh3ubDi', 'HBRjoBRoTg'
Source: 1.2.HUBED342024.exe.3da2e28.2.raw.unpack, VLHouGcExBE4ubhDhj.cs	High entropy of concatenated method names: 'Dispose', 'NONgdj3B31', 'm0JsbL3qsZ', 'IuveBToG9e', 'OXwgilhlu6', 'jN9gz5GWfB', 'ProcessDialogKey', 'yM6sfbvNju', 'zJUsg2sGTL', 'xUcssLfANd'
Source: 1.2.HUBED342024.exe.3da2e28.2.raw.unpack, rL3e783HlMRuXmYr9c.cs	High entropy of concatenated method names: 'XdyyCdH2xN', 'ATsycLuy6j', 'sS2ywugLUg', 'SNryRxiYkQ', 'iliyJbQscc', 'vLiwAP7KIQ', 'mHJwSym4Uy', 'vvfw0bwLfg', 'GiYw6UXBaa', 'XBVwdsyLt3'
Source: 1.2.HUBED342024.exe.3da2e28.2.raw.unpack, STxdj8oZCEeIpOIg9N.cs	High entropy of concatenated method names: 'CAKRaL7e5a', 'a4BR2NduZV', 'gubRQnvot9', 'KABRvmWbud', 'ou1RlyVcom', 'lurRM6W3n8', 'R6hRuaYEld', 'y86RegthsC', 'IJ6R8QR2L8', 'k2sROyfcZ6'
Source: 1.2.HUBED342024.exe.3da2e28.2.raw.unpack, OgOEMw8krPvTgHtipv.cs	High entropy of concatenated method names: 'DeTrvlU3TN', 'Y25rMrCFFT', 'O6xreYuodu', 'H1Pr8nI8yP', 'iW2rnaMNjn', 'XsFrj9HpA5', 'aXcr74hkAM', 'Ya8r5IAOyM', 'fYcrDx4970', 'LSkrUkMwyn'
Source: 1.2.HUBED342024.exe.3da2e28.2.raw.unpack, bdOuco0jQkONj3B31G.cs	High entropy of concatenated method names: 'D9xDns5fu7', 'jsHD7nqgG3', 'fflDDVmKTb', 'SLMDT6CmDU', 'dwFDPobBXC', 'nIEDNlMEWv', 'Dispose', 'ruZ5tPStcH', 'cDU5cPtrlG', 'Vrt5rOs8Gl'
Source: 1.2.HUBED342024.exe.3da2e28.2.raw.unpack, XbvNjudQJU2sGTLaUc.cs	High entropy of concatenated method names: 'qiCD3hVoxw', 'EKgDbR2Ojr', 'ScRD1KiNKs', 'GvxDZ03cR3', 'NtwDqWXBvC', 'QaPD4kO6SG', 'rHiDKfGg60', 'OWvDhGLPaT', 'sbpDoekgJy', 'iroDk9ds1m'
Source: 1.2.HUBED342024.exe.3da2e28.2.raw.unpack, SYsihOK0CESMR7nfpc.cs	High entropy of concatenated method names: 'SFVRtfqSIp', 'gfSRrHpRUd', 'du5Rye3UAM', 'f5qyiuBhpC', 'u5Wyz01Xxc', 'P5xRfpXN4y', 'PNTRgLhrfp', 'DtURsbYYkA', 'IMsRXsMEuA', 'ziVRWFxiDl'
Source: 1.2.HUBED342024.exe.3da2e28.2.raw.unpack, vGEZyueWSOhGtBk4qt.cs	High entropy of concatenated method names: 'oB9cYku0gl', 'DU6cIFrlZX', 'VE5cxKvGgn', 'KArcLosE9x', 'knmcAM43SY', 'KJGcSoBQXo', 'NHAc0c5uO6', 'uwGc6TAIZs', 'kXkcd2EhEO', 'uDCciAjEih'
Source: 1.2.HUBED342024.exe.3da2e28.2.raw.unpack, HNV5HZgfLkmaWU3kWHS.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Y7QUG8wMrN', 'JaKUVqJ5La', 'pybUBbjbRT', 'A3WUY0gf4U', 'iihUIOHROy', 'zK0UxVJbbV', 'tsYULZTJuY'
Source: 1.2.HUBED342024.exe.3da2e28.2.raw.unpack, BKfcZoJdDv53wrRPdB.cs	High entropy of concatenated method names: 'vtSXC51igh', 'GsIXt7okav', 'REZXcOl4yL', 'C76XrhV0GF', 'J5UXwKfH4D', 'RWhXyGMK4t', 'zJtXRoGX7S', 'KrkXJUhcRM', 'J2yXEBA3U1', 'L7QX9jYTxY'
Source: 1.2.HUBED342024.exe.3da2e28.2.raw.unpack, TfANd1iQAAEMLdV3ev.cs	High entropy of concatenated method names: 'HaNUrskMOG', 'SCRUwCbIgc', 'ocVUy8pxyi', 'wrEURdsRjE', 'etmUDdDm1m', 'CViUJCaZ0U', 'Next', 'Next', 'Next', 'NextBytes'
Source: 1.2.HUBED342024.exe.77b0000.6.raw.unpack, ntaqAjggZ3soHhG3ngL.cs	High entropy of concatenated method names: 'ikkUi9kMwl', 'dQuUz3WfGk', 'VVVTfk29ul', 'TqCTgAwClt', 'bbITst5N78', 'vYrTXMCjed', 'lZ8TWNPGst', 'E8pTClyggH', 'outTtsQhpq', 'I92TcuE7CC'
Source: 1.2.HUBED342024.exe.77b0000.6.raw.unpack, r3PZeRYkfcj0D0oe9W.cs	High entropy of concatenated method names: 'W8SnkFVHJo', 'fXFnVdqZXN', 'DCLnYhi7ZN', 'aKWnIXdtOV', 'FHJnbjgvfC', 'dIvn13o0bM', 'ldmnZSL5io', 'yssnqptkHo', 'd9Ln4TIuDn', 'Q2GnKNy27R'
Source: 1.2.HUBED342024.exe.77b0000.6.raw.unpack, Qip3YMgWuX7c2TIXiTT.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'zTwHDmrCKg', 'TWrHUSwtKi', 'lagHTyva1b', 'kLAHHE83he', 'ClhHP4xeI0', 'QbBHpwu4m6', 'NKmHNrFpkx'
Source: 1.2.HUBED342024.exe.77b0000.6.raw.unpack, u70kBqWEe0Gq5IFHi8.cs	High entropy of concatenated method names: 'QiPgRGEZyu', 'dSOgJhGtBk', 'hkrg9PvTgH', 'fipgFv4NRa', 'J5HgnfA5L3', 'E78gjHlMRu', 'vQCIPxxiv5kJk0Tw6k', 'zompKGJOe8sH6kAqL0', 'LSyggBkMFF', 'Tr3gXIsews'
Source: 1.2.HUBED342024.exe.77b0000.6.raw.unpack, RXDF57zVDhYSt7uLZL.cs	High entropy of concatenated method names: 'eZWUMS9aiE', 'W7xUetspYe', 'optU8IObZK', 'dq0U3rkXC4', 'eBaUb1GIBg', 'RdjUZXYKpL', 'B3qUqMAN8k', 'wh9UNbutsC', 'sjGUaQwyU8', 'pI6U2mWfSO'
Source: 1.2.HUBED342024.exe.77b0000.6.raw.unpack, sjXoshBoHC8PXIJvtT.cs	High entropy of concatenated method names: 'S9AmeT4QYA', 'thcm8FylVJ', 'KwOm3R7Eyi', 'iNGmbibCQW', 'NjDmZl0oYj', 'ukxmqJWWwR', 'M4xmK4O2MY', 'RbtmhG6SP6', 'Behmk78EM1', 'OnymGypPlq'
Source: 1.2.HUBED342024.exe.77b0000.6.raw.unpack, zfe1sdbrR2S03mAHDS.cs	High entropy of concatenated method names: 'Mu9RN2MsnMLxftf7hxj', 'FhwSLuMCAWoyrjo5cxj', 'pily5VyfZX', 'LaZyDA8C5Y', 'd35yUkIvn0', 'gB8pEJMXrkV6RYu7iMW', 'bIIr3bMvV8O1KK6u4i0', 'mQpFCwMQj6cuj2p5TRG'
Source: 1.2.HUBED342024.exe.77b0000.6.raw.unpack, wjOyZASY3yGLp2qtFy.cs	High entropy of concatenated method names: 'NtZ762f4Yq', 'GLb7i7dZMo', 'DCS5fe16T5', 'eZj5guH8cO', 'Nqj7GxgVXk', 'MIM7VMVSx5', 'Gc07BSliKk', 'nAc7YaP6PA', 'AqK7IZFurA', 'Q6d7x721qO'
Source: 1.2.HUBED342024.exe.77b0000.6.raw.unpack, SrFKEasbuAJ5pUuDKk.cs	High entropy of concatenated method names: 'RY3Qw4V8n', 'LJ8vGPSHF', 'EUvMvcdkK', 'irouDcsXv', 'Sml81P11m', 'hjKOAdkeN', 'yayX0KO1VneleoyVg5', 'S54KBbAx5455PGPGOW', 'jGF5a4swX', 'VZvU4fL18'
Source: 1.2.HUBED342024.exe.77b0000.6.raw.unpack, memblcxctooqU42Wlx.cs	High entropy of concatenated method names: 'ToString', 'A5HjG4MRDr', 'FtZjbyAJVr', 'hMaj1HcokF', 'eBDjZEuA2E', 'Q3PjqVjo8g', 'qsVj4eDseO', 'Hs8jKvC9e2', 'QCsjh3ubDi', 'HBRjoBRoTg'
Source: 1.2.HUBED342024.exe.77b0000.6.raw.unpack, VLHouGcExBE4ubhDhj.cs	High entropy of concatenated method names: 'Dispose', 'NONgdj3B31', 'm0JsbL3qsZ', 'IuveBToG9e', 'OXwgilhlu6', 'jN9gz5GWfB', 'ProcessDialogKey', 'yM6sfbvNju', 'zJUsg2sGTL', 'xUcssLfANd'
Source: 1.2.HUBED342024.exe.77b0000.6.raw.unpack, rL3e783HlMRuXmYr9c.cs	High entropy of concatenated method names: 'XdyyCdH2xN', 'ATsycLuy6j', 'sS2ywugLUg', 'SNryRxiYkQ', 'iliyJbQscc', 'vLiwAP7KIQ', 'mHJwSym4Uy', 'vvfw0bwLfg', 'GiYw6UXBaa', 'XBVwdsyLt3'
Source: 1.2.HUBED342024.exe.77b0000.6.raw.unpack, STxdj8oZCEeIpOIg9N.cs	High entropy of concatenated method names: 'CAKRaL7e5a', 'a4BR2NduZV', 'gubRQnvot9', 'KABRvmWbud', 'ou1RlyVcom', 'lurRM6W3n8', 'R6hRuaYEld', 'y86RegthsC', 'IJ6R8QR2L8', 'k2sROyfcZ6'
Source: 1.2.HUBED342024.exe.77b0000.6.raw.unpack, OgOEMw8krPvTgHtipv.cs	High entropy of concatenated method names: 'DeTrvlU3TN', 'Y25rMrCFFT', 'O6xreYuodu', 'H1Pr8nI8yP', 'iW2rnaMNjn', 'XsFrj9HpA5', 'aXcr74hkAM', 'Ya8r5IAOyM', 'fYcrDx4970', 'LSkrUkMwyn'
Source: 1.2.HUBED342024.exe.77b0000.6.raw.unpack, bdOuco0jQkONj3B31G.cs	High entropy of concatenated method names: 'D9xDns5fu7', 'jsHD7nqgG3', 'fflDDVmKTb', 'SLMDT6CmDU', 'dwFDPobBXC', 'nIEDNlMEWv', 'Dispose', 'ruZ5tPStcH', 'cDU5cPtrlG', 'Vrt5rOs8Gl'
Source: 1.2.HUBED342024.exe.77b0000.6.raw.unpack, XbvNjudQJU2sGTLaUc.cs	High entropy of concatenated method names: 'qiCD3hVoxw', 'EKgDbR2Ojr', 'ScRD1KiNKs', 'GvxDZ03cR3', 'NtwDqWXBvC', 'QaPD4kO6SG', 'rHiDKfGg60', 'OWvDhGLPaT', 'sbpDoekgJy', 'iroDk9ds1m'
Source: 1.2.HUBED342024.exe.77b0000.6.raw.unpack, SYsihOK0CESMR7nfpc.cs	High entropy of concatenated method names: 'SFVRtfqSIp', 'gfSRrHpRUd', 'du5Rye3UAM', 'f5qyiuBhpC', 'u5Wyz01Xxc', 'P5xRfpXN4y', 'PNTRgLhrfp', 'DtURsbYYkA', 'IMsRXsMEuA', 'ziVRWFxiDl'
Source: 1.2.HUBED342024.exe.77b0000.6.raw.unpack, vGEZyueWSOhGtBk4qt.cs	High entropy of concatenated method names: 'oB9cYku0gl', 'DU6cIFrlZX', 'VE5cxKvGgn', 'KArcLosE9x', 'knmcAM43SY', 'KJGcSoBQXo', 'NHAc0c5uO6', 'uwGc6TAIZs', 'kXkcd2EhEO', 'uDCciAjEih'
Source: 1.2.HUBED342024.exe.77b0000.6.raw.unpack, HNV5HZgfLkmaWU3kWHS.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Y7QUG8wMrN', 'JaKUVqJ5La', 'pybUBbjbRT', 'A3WUY0gf4U', 'iihUIOHROy', 'zK0UxVJbbV', 'tsYULZTJuY'
Source: 1.2.HUBED342024.exe.77b0000.6.raw.unpack, BKfcZoJdDv53wrRPdB.cs	High entropy of concatenated method names: 'vtSXC51igh', 'GsIXt7okav', 'REZXcOl4yL', 'C76XrhV0GF', 'J5UXwKfH4D', 'RWhXyGMK4t', 'zJtXRoGX7S', 'KrkXJUhcRM', 'J2yXEBA3U1', 'L7QX9jYTxY'
Source: 1.2.HUBED342024.exe.77b0000.6.raw.unpack, TfANd1iQAAEMLdV3ev.cs	High entropy of concatenated method names: 'HaNUrskMOG', 'SCRUwCbIgc', 'ocVUy8pxyi', 'wrEURdsRjE', 'etmUDdDm1m', 'CViUJCaZ0U', 'Next', 'Next', 'Next', 'NextBytes'
Source: 1.2.HUBED342024.exe.3d47e08.3.raw.unpack, ntaqAjggZ3soHhG3ngL.cs	High entropy of concatenated method names: 'ikkUi9kMwl', 'dQuUz3WfGk', 'VVVTfk29ul', 'TqCTgAwClt', 'bbITst5N78', 'vYrTXMCjed', 'lZ8TWNPGst', 'E8pTClyggH', 'outTtsQhpq', 'I92TcuE7CC'
Source: 1.2.HUBED342024.exe.3d47e08.3.raw.unpack, r3PZeRYkfcj0D0oe9W.cs	High entropy of concatenated method names: 'W8SnkFVHJo', 'fXFnVdqZXN', 'DCLnYhi7ZN', 'aKWnIXdtOV', 'FHJnbjgvfC', 'dIvn13o0bM', 'ldmnZSL5io', 'yssnqptkHo', 'd9Ln4TIuDn', 'Q2GnKNy27R'
Source: 1.2.HUBED342024.exe.3d47e08.3.raw.unpack, Qip3YMgWuX7c2TIXiTT.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'zTwHDmrCKg', 'TWrHUSwtKi', 'lagHTyva1b', 'kLAHHE83he', 'ClhHP4xeI0', 'QbBHpwu4m6', 'NKmHNrFpkx'
Source: 1.2.HUBED342024.exe.3d47e08.3.raw.unpack, u70kBqWEe0Gq5IFHi8.cs	High entropy of concatenated method names: 'QiPgRGEZyu', 'dSOgJhGtBk', 'hkrg9PvTgH', 'fipgFv4NRa', 'J5HgnfA5L3', 'E78gjHlMRu', 'vQCIPxxiv5kJk0Tw6k', 'zompKGJOe8sH6kAqL0', 'LSyggBkMFF', 'Tr3gXIsews'
Source: 1.2.HUBED342024.exe.3d47e08.3.raw.unpack, RXDF57zVDhYSt7uLZL.cs	High entropy of concatenated method names: 'eZWUMS9aiE', 'W7xUetspYe', 'optU8IObZK', 'dq0U3rkXC4', 'eBaUb1GIBg', 'RdjUZXYKpL', 'B3qUqMAN8k', 'wh9UNbutsC', 'sjGUaQwyU8', 'pI6U2mWfSO'
Source: 1.2.HUBED342024.exe.3d47e08.3.raw.unpack, sjXoshBoHC8PXIJvtT.cs	High entropy of concatenated method names: 'S9AmeT4QYA', 'thcm8FylVJ', 'KwOm3R7Eyi', 'iNGmbibCQW', 'NjDmZl0oYj', 'ukxmqJWWwR', 'M4xmK4O2MY', 'RbtmhG6SP6', 'Behmk78EM1', 'OnymGypPlq'
Source: 1.2.HUBED342024.exe.3d47e08.3.raw.unpack, zfe1sdbrR2S03mAHDS.cs	High entropy of concatenated method names: 'Mu9RN2MsnMLxftf7hxj', 'FhwSLuMCAWoyrjo5cxj', 'pily5VyfZX', 'LaZyDA8C5Y', 'd35yUkIvn0', 'gB8pEJMXrkV6RYu7iMW', 'bIIr3bMvV8O1KK6u4i0', 'mQpFCwMQj6cuj2p5TRG'
Source: 1.2.HUBED342024.exe.3d47e08.3.raw.unpack, wjOyZASY3yGLp2qtFy.cs	High entropy of concatenated method names: 'NtZ762f4Yq', 'GLb7i7dZMo', 'DCS5fe16T5', 'eZj5guH8cO', 'Nqj7GxgVXk', 'MIM7VMVSx5', 'Gc07BSliKk', 'nAc7YaP6PA', 'AqK7IZFurA', 'Q6d7x721qO'
Source: 1.2.HUBED342024.exe.3d47e08.3.raw.unpack, SrFKEasbuAJ5pUuDKk.cs	High entropy of concatenated method names: 'RY3Qw4V8n', 'LJ8vGPSHF', 'EUvMvcdkK', 'irouDcsXv', 'Sml81P11m', 'hjKOAdkeN', 'yayX0KO1VneleoyVg5', 'S54KBbAx5455PGPGOW', 'jGF5a4swX', 'VZvU4fL18'
Source: 1.2.HUBED342024.exe.3d47e08.3.raw.unpack, memblcxctooqU42Wlx.cs	High entropy of concatenated method names: 'ToString', 'A5HjG4MRDr', 'FtZjbyAJVr', 'hMaj1HcokF', 'eBDjZEuA2E', 'Q3PjqVjo8g', 'qsVj4eDseO', 'Hs8jKvC9e2', 'QCsjh3ubDi', 'HBRjoBRoTg'
Source: 1.2.HUBED342024.exe.3d47e08.3.raw.unpack, VLHouGcExBE4ubhDhj.cs	High entropy of concatenated method names: 'Dispose', 'NONgdj3B31', 'm0JsbL3qsZ', 'IuveBToG9e', 'OXwgilhlu6', 'jN9gz5GWfB', 'ProcessDialogKey', 'yM6sfbvNju', 'zJUsg2sGTL', 'xUcssLfANd'
Source: 1.2.HUBED342024.exe.3d47e08.3.raw.unpack, rL3e783HlMRuXmYr9c.cs	High entropy of concatenated method names: 'XdyyCdH2xN', 'ATsycLuy6j', 'sS2ywugLUg', 'SNryRxiYkQ', 'iliyJbQscc', 'vLiwAP7KIQ', 'mHJwSym4Uy', 'vvfw0bwLfg', 'GiYw6UXBaa', 'XBVwdsyLt3'
Source: 1.2.HUBED342024.exe.3d47e08.3.raw.unpack, STxdj8oZCEeIpOIg9N.cs	High entropy of concatenated method names: 'CAKRaL7e5a', 'a4BR2NduZV', 'gubRQnvot9', 'KABRvmWbud', 'ou1RlyVcom', 'lurRM6W3n8', 'R6hRuaYEld', 'y86RegthsC', 'IJ6R8QR2L8', 'k2sROyfcZ6'
Source: 1.2.HUBED342024.exe.3d47e08.3.raw.unpack, OgOEMw8krPvTgHtipv.cs	High entropy of concatenated method names: 'DeTrvlU3TN', 'Y25rMrCFFT', 'O6xreYuodu', 'H1Pr8nI8yP', 'iW2rnaMNjn', 'XsFrj9HpA5', 'aXcr74hkAM', 'Ya8r5IAOyM', 'fYcrDx4970', 'LSkrUkMwyn'
Source: 1.2.HUBED342024.exe.3d47e08.3.raw.unpack, bdOuco0jQkONj3B31G.cs	High entropy of concatenated method names: 'D9xDns5fu7', 'jsHD7nqgG3', 'fflDDVmKTb', 'SLMDT6CmDU', 'dwFDPobBXC', 'nIEDNlMEWv', 'Dispose', 'ruZ5tPStcH', 'cDU5cPtrlG', 'Vrt5rOs8Gl'
Source: 1.2.HUBED342024.exe.3d47e08.3.raw.unpack, XbvNjudQJU2sGTLaUc.cs	High entropy of concatenated method names: 'qiCD3hVoxw', 'EKgDbR2Ojr', 'ScRD1KiNKs', 'GvxDZ03cR3', 'NtwDqWXBvC', 'QaPD4kO6SG', 'rHiDKfGg60', 'OWvDhGLPaT', 'sbpDoekgJy', 'iroDk9ds1m'
Source: 1.2.HUBED342024.exe.3d47e08.3.raw.unpack, SYsihOK0CESMR7nfpc.cs	High entropy of concatenated method names: 'SFVRtfqSIp', 'gfSRrHpRUd', 'du5Rye3UAM', 'f5qyiuBhpC', 'u5Wyz01Xxc', 'P5xRfpXN4y', 'PNTRgLhrfp', 'DtURsbYYkA', 'IMsRXsMEuA', 'ziVRWFxiDl'
Source: 1.2.HUBED342024.exe.3d47e08.3.raw.unpack, vGEZyueWSOhGtBk4qt.cs	High entropy of concatenated method names: 'oB9cYku0gl', 'DU6cIFrlZX', 'VE5cxKvGgn', 'KArcLosE9x', 'knmcAM43SY', 'KJGcSoBQXo', 'NHAc0c5uO6', 'uwGc6TAIZs', 'kXkcd2EhEO', 'uDCciAjEih'
Source: 1.2.HUBED342024.exe.3d47e08.3.raw.unpack, HNV5HZgfLkmaWU3kWHS.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Y7QUG8wMrN', 'JaKUVqJ5La', 'pybUBbjbRT', 'A3WUY0gf4U', 'iihUIOHROy', 'zK0UxVJbbV', 'tsYULZTJuY'
Source: 1.2.HUBED342024.exe.3d47e08.3.raw.unpack, BKfcZoJdDv53wrRPdB.cs	High entropy of concatenated method names: 'vtSXC51igh', 'GsIXt7okav', 'REZXcOl4yL', 'C76XrhV0GF', 'J5UXwKfH4D', 'RWhXyGMK4t', 'zJtXRoGX7S', 'KrkXJUhcRM', 'J2yXEBA3U1', 'L7QX9jYTxY'
Source: 1.2.HUBED342024.exe.3d47e08.3.raw.unpack, TfANd1iQAAEMLdV3ev.cs	High entropy of concatenated method names: 'HaNUrskMOG', 'SCRUwCbIgc', 'ocVUy8pxyi', 'wrEURdsRjE', 'etmUDdDm1m', 'CViUJCaZ0U', 'Next', 'Next', 'Next', 'NextBytes'

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: HUBED342024.exe PID: 7352, type: MEMORYSTR

Source: C:\Users\user\Desktop\HUBED342024.exe	Memory allocated: F00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Memory allocated: 2B70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Memory allocated: 4B70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Memory allocated: 8F10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Memory allocated: 7950000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Memory allocated: 9F10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Memory allocated: AF10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Memory allocated: E00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Memory allocated: 2900000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Memory allocated: 2720000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\HUBED342024.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5714			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3975			Jump to behavior

Source: C:\Users\user\Desktop\HUBED342024.exe TID: 7404	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7748	Thread sleep time: -4611686018427385s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\HUBED342024.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: HUBED342024.exe, 00000001.00000002.2179563186.0000000000FE2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: HUBED342024.exe, 00000001.00000002.2185964899.00000000077B0000.00000004.08000000.00040000.00000000.sdmp, HUBED342024.exe, 00000001.00000002.2181052353.0000000003BC8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ywHgfSFMaQ
Source: HUBED342024.exe, 00000005.00000002.3423618165.00000000009C5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\HUBED342024.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 1.2.HUBED342024.exe.3b91ae8.4.raw.unpack, UltraSpeed.cs	Reference to suspicious API methods: MapVirtualKey(VKCode, 0u)
Source: 1.2.HUBED342024.exe.3b91ae8.4.raw.unpack, FFDecryptor.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(hModule, method), typeof(T))
Source: 1.2.HUBED342024.exe.3b91ae8.4.raw.unpack, FFDecryptor.cs	Reference to suspicious API methods: hModuleList.Add(LoadLibrary(text9 + "\\mozglue.dll"))

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\HUBED342024.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\HUBED342024.exe"
Source: C:\Users\user\Desktop\HUBED342024.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\HUBED342024.exe"			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\HUBED342024.exe

Memory written: C:\Users\user\Desktop\HUBED342024.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\HUBED342024.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\HUBED342024.exe"			Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Process created: C:\Users\user\Desktop\HUBED342024.exe "C:\Users\user\Desktop\HUBED342024.exe"			Jump to behavior

Source: C:\Users\user\Desktop\HUBED342024.exe	Queries volume information: C:\Users\user\Desktop\HUBED342024.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Queries volume information: C:\Users\user\Desktop\HUBED342024.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\HUBED342024.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 1.2.HUBED342024.exe.3b91ae8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.HUBED342024.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.HUBED342024.exe.3c2ea70.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.HUBED342024.exe.3b91ae8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.HUBED342024.exe.3c2ea70.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3423260696.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2181052353.0000000003B79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2181052353.0000000003BC8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HUBED342024.exe PID: 7352, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HUBED342024.exe PID: 7560, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 1.2.HUBED342024.exe.3b91ae8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.HUBED342024.exe.3c2ea70.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.HUBED342024.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.HUBED342024.exe.3b91ae8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.HUBED342024.exe.3c2ea70.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3423260696.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2181052353.0000000003B79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2181052353.0000000003BC8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HUBED342024.exe PID: 7352, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HUBED342024.exe PID: 7560, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\HUBED342024.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\HUBED342024.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\HUBED342024.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 1.2.HUBED342024.exe.3b91ae8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.HUBED342024.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.HUBED342024.exe.3c2ea70.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.HUBED342024.exe.3b91ae8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.HUBED342024.exe.3c2ea70.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3423260696.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3425599530.0000000002A54000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2181052353.0000000003B79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2181052353.0000000003BC8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HUBED342024.exe PID: 7352, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HUBED342024.exe PID: 7560, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 1.2.HUBED342024.exe.3b91ae8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.HUBED342024.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.HUBED342024.exe.3c2ea70.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.HUBED342024.exe.3b91ae8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.HUBED342024.exe.3c2ea70.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3423260696.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2181052353.0000000003B79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2181052353.0000000003BC8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HUBED342024.exe PID: 7352, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HUBED342024.exe PID: 7560, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 1.2.HUBED342024.exe.3b91ae8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.HUBED342024.exe.3c2ea70.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.HUBED342024.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.HUBED342024.exe.3b91ae8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.HUBED342024.exe.3c2ea70.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3423260696.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2181052353.0000000003B79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2181052353.0000000003BC8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HUBED342024.exe PID: 7352, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HUBED342024.exe PID: 7560, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	111 Process Injection	1 Masquerading	1 OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Disable or Modify Tools	1 Input Capture	1 Process Discovery	Remote Desktop Protocol	1 Input Capture	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	11 Archive Collected Data	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	1 Data from Local System	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
HUBED342024.exe	74%	ReversingLabs	ByteCode-MSIL.Infostealer.Pony
HUBED342024.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	172.67.177.134	true	false	high
ax-0001.ax-msedge.net	150.171.27.10	true	false	high
checkip.dyndns.com	193.122.6.168	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false		high
https://reallyfreegeoip.org/xml/8.46.123.189	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://reallyfreegeoip.org/xml/8.46.123.189l	HUBED342024.exe, 00000005.00000002.3425599530.000000000297E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.comd	HUBED342024.exe, 00000005.00000002.3425599530.000000000297E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/q	HUBED342024.exe, 00000001.00000002.2181052353.0000000003B79000.00000004.00000800.00020000.00000000.sdmp, HUBED342024.exe, 00000001.00000002.2181052353.0000000003BC8000.00000004.00000800.00020000.00000000.sdmp, HUBED342024.exe, 00000005.00000002.3423260696.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.orgd	HUBED342024.exe, 00000005.00000002.3425599530.000000000299C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/8.46.123.189d	HUBED342024.exe, 00000005.00000002.3425599530.000000000297E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.org	HUBED342024.exe, 00000005.00000002.3425599530.000000000299C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.orgd	HUBED342024.exe, 00000005.00000002.3425599530.000000000297E000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	HUBED342024.exe, 00000005.00000002.3425599530.000000000297E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	HUBED342024.exe, 00000005.00000002.3425599530.000000000297E000.00000004.00000800.00020000.00000000.sdmp, HUBED342024.exe, 00000005.00000002.3425599530.000000000296C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	HUBED342024.exe, 00000005.00000002.3425599530.000000000297E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/d	HUBED342024.exe, 00000005.00000002.3425599530.000000000297E000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	HUBED342024.exe, 00000001.00000002.2180525420.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, HUBED342024.exe, 00000005.00000002.3425599530.0000000002901000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot-/sendDocument?chat_id=	HUBED342024.exe, 00000001.00000002.2181052353.0000000003B79000.00000004.00000800.00020000.00000000.sdmp, HUBED342024.exe, 00000001.00000002.2181052353.0000000003BC8000.00000004.00000800.00020000.00000000.sdmp, HUBED342024.exe, 00000005.00000002.3423260696.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	HUBED342024.exe, 00000001.00000002.2181052353.0000000003B79000.00000004.00000800.00020000.00000000.sdmp, HUBED342024.exe, 00000001.00000002.2181052353.0000000003BC8000.00000004.00000800.00020000.00000000.sdmp, HUBED342024.exe, 00000005.00000002.3425599530.000000000297E000.00000004.00000800.00020000.00000000.sdmp, HUBED342024.exe, 00000005.00000002.3423260696.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.122.6.168	checkip.dyndns.com	United States		31898	ORACLE-BMC-31898US	false
172.67.177.134	reallyfreegeoip.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580087
Start date and time:	2024-12-23 21:49:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	HUBED342024.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/6@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 99% Number of executed functions: 77 Number of non-executed functions: 13
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 40.126.53.6, 20.223.35.26, 2.16.158.35, 184.28.90.27, 13.107.246.63, 4.245.163.56, 20.31.169.57, 2.16.158.81, 150.171.27.10
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, login.live.com, ctldl.windowsupdate.com, tse1.mm.bing.net, g.bing.com, arc.msn.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target HUBED342024.exe, PID 7560 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: HUBED342024.exe

Simulations

Behavior and APIs

Time	Type	Description
15:50:08	API Interceptor	1x Sleep call for process: HUBED342024.exe modified
15:50:10	API Interceptor	12x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.122.6.168	YU SV Payment.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	PAYMENT ADVICE 750013-1012449943-81347-pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	Invoice.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	MV GOLDEN SCHULTE DETAILS.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	pedido-035241.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	QUOTATION REQUEST - BQS058.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	SWIFT091816-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	Shipment 990847575203.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
172.67.177.134	Order_12232024.exe	Get hash	malicious	MassLogger RAT	Browse
	rTTSWIFTCOPIES.exe	Get hash	malicious	MassLogger RAT	Browse
	Ziraat_Bankasi_Swift_Mesaji_TXB04958T.scr.exe	Get hash	malicious	MassLogger RAT	Browse
	YU SV Payment.exe	Get hash	malicious	MassLogger RAT	Browse
	PAYMENT ADVICE 750013-1012449943-81347-pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	HUSDGHCE23ED.exe	Get hash	malicious	MassLogger RAT	Browse
	66776676676.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	RFQ December-January Forcast and TCL.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	Invoice.exe	Get hash	malicious	Snake Keylogger	Browse
	PK241200518-EMAIL RELEASE-pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ax-0001.ax-msedge.net	Onboard Training Checklist v1.1 - Wyatt Young (1).xlsx	Get hash	malicious	Unknown	Browse	150.171.28.10
	https://jkqbjwq.maxiite.com	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10
	OZq1f2sZz3.exe	Get hash	malicious	AsyncRAT	Browse	150.171.27.10
	Olz7TmvkEW.exe	Get hash	malicious	UltraVNC	Browse	150.171.27.10
	Archivo-PxFkiLTWYG-23122024095010.hta	Get hash	malicious	Unknown	Browse	150.171.28.10
	BVGvbpplT8.exe	Get hash	malicious	LummaC, Stealc	Browse	150.171.28.10
	613vKYuY2S.exe	Get hash	malicious	LummaC	Browse	150.171.28.10
	r4xiHKy8aM.exe	Get hash	malicious	Socks5Systemz	Browse	150.171.28.10
	vRWw6y4Pj2.exe	Get hash	malicious	Unknown	Browse	150.171.27.10
	2E814B7D-3F0B-4AF7-8C7C-C8AE7CD57525_12172024125634383.dll	Get hash	malicious	Unknown	Browse	150.171.28.10
checkip.dyndns.com	MT Eagle Asia 11.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	Order_12232024.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	rTTSWIFTCOPIES.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	Ziraat_Bankasi_Swift_Mesaji_TXB04958T.scr.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	Statement_3029_from_Cross_Traders_and_Logistics_ltd.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	Invoice DHL - AWB 2024 E4001 - 0000731.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Requested Documentation.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	YU SV Payment.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	PURCHASE ORDER TRC-090971819130-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	132.226.247.73
	PAYMENT ADVICE 750013-1012449943-81347-pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
reallyfreegeoip.org	MT Eagle Asia 11.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	Order_12232024.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	rTTSWIFTCOPIES.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	Ziraat_Bankasi_Swift_Mesaji_TXB04958T.scr.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	Statement_3029_from_Cross_Traders_and_Logistics_ltd.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	Invoice DHL - AWB 2024 E4001 - 0000731.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	YU SV Payment.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	PURCHASE ORDER TRC-090971819130-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	PAYMENT ADVICE 750013-1012449943-81347-pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.177.134
	Overheaped237.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.67.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	MT Eagle Asia 11.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	Order_12232024.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	rTTSWIFTCOPIES.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	nshkmips.elf	Get hash	malicious	Mirai	Browse	132.145.36.70
	Ziraat_Bankasi_Swift_Mesaji_TXB04958T.scr.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	Statement_3029_from_Cross_Traders_and_Logistics_ltd.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	nshkarm.elf	Get hash	malicious	Mirai	Browse	140.238.15.102
	nshsh4.elf	Get hash	malicious	Mirai	Browse	140.238.98.44
	Requested Documentation.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	YU SV Payment.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
CLOUDFLARENETUS	https://www.canva.com/design/DAGaHpv1g1M/bVE7B2sT8b8T3P-e2xb64w/view?utm_content=DAGaHpv1g1M&utm_campaign=designshare&utm_medium=link2&utm_source=uniquelinks&utlId=h1ee3678e45	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	Violated Heroine_91zbZ-1.exe	Get hash	malicious	Unknown	Browse	104.18.20.226
	Play Aud.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://flowto.it/8tooc2sec?fc=0	Get hash	malicious	Unknown	Browse	104.18.35.227
	Violated Heroine_91zbZ-1.exe	Get hash	malicious	Unknown	Browse	104.20.87.8
	vFile__0054seconds__Airborn.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://jkqbjwq.maxiite.com	Get hash	malicious	Unknown	Browse	104.16.123.96
	[External] 120112 Manual Policies Overview Guide_ 8VM8-WZPT3L-LYH1.eml	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://jkqbjwq.maxiite.com	Get hash	malicious	HTMLPhisher	Browse	172.66.43.2
	https://qulatrics.com/	Get hash	malicious	Unknown	Browse	104.17.25.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	MT Eagle Asia 11.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	Order_12232024.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	rTTSWIFTCOPIES.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	Ziraat_Bankasi_Swift_Mesaji_TXB04958T.scr.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	Statement_3029_from_Cross_Traders_and_Logistics_ltd.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	Browser.Daemon.exe	Get hash	malicious	Unknown	Browse	172.67.177.134
	Browser.Daemon.exe	Get hash	malicious	Unknown	Browse	172.67.177.134
	Invoice DHL - AWB 2024 E4001 - 0000731.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	YU SV Payment.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	PURCHASE ORDER TRC-090971819130-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.177.134

Process:	C:\Users\user\Desktop\HUBED342024.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379401388151058
Encrypted:	false
SSDEEP:	48:fWSU4xymI4RfoUeW+gZ9tK8NPZHUxL7u1iMuge//8PUyus:fLHxvIIwLgZ2KRHWLOug8s
MD5:	1A71ECE43593D19630F97D4040AEED41
SHA1:	62DF351226E518ECF6019D8CCA3356A8073551A3
SHA-256:	38F4816F96E7B0F23EF75A046B2F69A293D52C00328E1FE5D354650D647B06B0
SHA-512:	B82C360A7894B8837433F4F69EF6DEF4F6D98D7333873AD383A39462311FF3C56F43035EE6E45160518D36B2CBDC17D9396D557B78AFAF1DAFF3A1AA52BC982E
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1shwjbqh.wfb.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fcf5hmxf.2gr.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qkrnligi.ggr.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z3iwkv4x.r2w.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.0820640699344946
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	HUBED342024.exe
File size:	756'224 bytes
MD5:	8e148751995240a3f18c5bd846783d2d
SHA1:	576f54bd58d27c1e7d779c9900388c8dfc7c02be
SHA256:	776e675ee48e029e417d5ed22ef53ccb5225660871d2152c4f4dc786eff91e62
SHA512:	c7dcdda292b45bc9c1febb4890e1617f5eab9db3bdbab85484f6374abaca2f11328163b6ab380133679a7ac764e5d7c2d46081d477420e4cff72767e93ad3bd4
SSDEEP:	12288:/DkX1pKP1zms3Y4kSTvcncIQYtbl4EMw+7H9TeOKfdgwo:/AXa1znDk+En2YzTl+79Tydzo
TLSH:	A9F4AEB8D574810DCC692B7445F2ED35126B7EAAAB70A2CE9BC87DE37A3354344247C2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....hg..............0.................. ... ....@.. ....................................@................................

File Icon


Icon Hash:	1103212484000000

Static PE Info

General

Entrypoint:	0x4a15c6
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6768BDF4 [Mon Dec 23 01:33:40 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add dword ptr [eax], eax
add byte ptr [eax], al
add al, byte ptr [eax]
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
or byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
and byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax+00000000h], al
add dword ptr [eax], eax
add byte ptr [eax], al
add al, byte ptr [eax]
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
or byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
and byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax+00530000h], al
jns 00007F7D3C69BB52h
jnc 00007F7D3C69BB52h
je 00007F7D3C69BB52h
add byte ptr [ebp+00h], ch
add byte ptr [edx+00h], dl
add byte ptr [esi+00h], ah
insb
add byte ptr [ebp+00h], ah
arpl word ptr [eax], ax
je 00007F7D3C69BB52h
imul eax, dword ptr [eax], 006E006Fh
add byte ptr [ecx+00h], al
jnc 00007F7D3C69BB52h
jnc 00007F7D3C69BB52h
add byte ptr [ebp+00h], ch
bound eax, dword ptr [eax]
insb
add byte ptr [ecx+00h], bh
add byte ptr [eax], al
add byte ptr [eax], al
dec esp
add byte ptr [edi+00h], ch
popad
add byte ptr [eax+eax+00h], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa1574	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa2000	0x18c3c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xbc000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x9f64c	0x9f800	5d599ece28f0090ec7e83eab5b7eb9d3	False	0.7604636069749217	data	7.3371981191853	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa2000	0x18c3c	0x18e00	1cefffe0cb4aa7151f4751cf34ec6251	False	0.1884422110552764	data	3.2194358174016275	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xbc000	0xc	0x200	612595092601871d2b2defbc7f573a02	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xa21f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 23622 x 23622 px/m	0.3324468085106383
RT_ICON	0xa2658	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 23622 x 23622 px/m	0.25117260787992496
RT_ICON	0xa3700	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 23622 x 23622 px/m	0.2183609958506224
RT_ICON	0xa5ca8	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 23622 x 23622 px/m	0.19550070854983467
RT_ICON	0xa9ed0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 23622 x 23622 px/m	0.1723796285342482
RT_GROUP_ICON	0xba6f8	0x4c	data	0.75
RT_VERSION	0xba744	0x30c	data	0.4269230769230769
RT_MANIFEST	0xbaa50	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-23T21:50:16.133490+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49718	193.122.6.168	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 21:50:10.922015905 CET	49718	80	192.168.2.6	193.122.6.168
Dec 23, 2024 21:50:11.041975975 CET	80	49718	193.122.6.168	192.168.2.6
Dec 23, 2024 21:50:11.042073011 CET	49718	80	192.168.2.6	193.122.6.168
Dec 23, 2024 21:50:11.042315960 CET	49718	80	192.168.2.6	193.122.6.168
Dec 23, 2024 21:50:11.161885977 CET	80	49718	193.122.6.168	192.168.2.6
Dec 23, 2024 21:50:15.152455091 CET	80	49718	193.122.6.168	192.168.2.6
Dec 23, 2024 21:50:15.157243013 CET	49718	80	192.168.2.6	193.122.6.168
Dec 23, 2024 21:50:15.278873920 CET	80	49718	193.122.6.168	192.168.2.6
Dec 23, 2024 21:50:16.093729973 CET	80	49718	193.122.6.168	192.168.2.6
Dec 23, 2024 21:50:16.133490086 CET	49718	80	192.168.2.6	193.122.6.168
Dec 23, 2024 21:50:16.233658075 CET	49723	443	192.168.2.6	172.67.177.134
Dec 23, 2024 21:50:16.233695984 CET	443	49723	172.67.177.134	192.168.2.6
Dec 23, 2024 21:50:16.233769894 CET	49723	443	192.168.2.6	172.67.177.134
Dec 23, 2024 21:50:16.241574049 CET	49723	443	192.168.2.6	172.67.177.134
Dec 23, 2024 21:50:16.241588116 CET	443	49723	172.67.177.134	192.168.2.6
Dec 23, 2024 21:50:17.493551016 CET	443	49723	172.67.177.134	192.168.2.6
Dec 23, 2024 21:50:17.493635893 CET	49723	443	192.168.2.6	172.67.177.134
Dec 23, 2024 21:50:17.496227026 CET	49723	443	192.168.2.6	172.67.177.134
Dec 23, 2024 21:50:17.496238947 CET	443	49723	172.67.177.134	192.168.2.6
Dec 23, 2024 21:50:17.496514082 CET	443	49723	172.67.177.134	192.168.2.6
Dec 23, 2024 21:50:17.539736986 CET	49723	443	192.168.2.6	172.67.177.134
Dec 23, 2024 21:50:17.548283100 CET	49723	443	192.168.2.6	172.67.177.134
Dec 23, 2024 21:50:17.595335960 CET	443	49723	172.67.177.134	192.168.2.6
Dec 23, 2024 21:50:17.942464113 CET	443	49723	172.67.177.134	192.168.2.6
Dec 23, 2024 21:50:17.942527056 CET	443	49723	172.67.177.134	192.168.2.6
Dec 23, 2024 21:50:17.942575932 CET	49723	443	192.168.2.6	172.67.177.134
Dec 23, 2024 21:50:17.948554993 CET	49723	443	192.168.2.6	172.67.177.134
Dec 23, 2024 21:51:21.093727112 CET	80	49718	193.122.6.168	192.168.2.6
Dec 23, 2024 21:51:21.093803883 CET	49718	80	192.168.2.6	193.122.6.168
Dec 23, 2024 21:51:56.103060961 CET	49718	80	192.168.2.6	193.122.6.168
Dec 23, 2024 21:51:56.222882986 CET	80	49718	193.122.6.168	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 21:50:10.750117064 CET	64887	53	192.168.2.6	1.1.1.1
Dec 23, 2024 21:50:10.887698889 CET	53	64887	1.1.1.1	192.168.2.6
Dec 23, 2024 21:50:16.095273018 CET	61596	53	192.168.2.6	1.1.1.1
Dec 23, 2024 21:50:16.233011007 CET	53	61596	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 23, 2024 21:50:10.750117064 CET	192.168.2.6	1.1.1.1	0x4fac	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Dec 23, 2024 21:50:16.095273018 CET	192.168.2.6	1.1.1.1	0x858f	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 23, 2024 21:50:10.887698889 CET	1.1.1.1	192.168.2.6	0x4fac	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 21:50:10.887698889 CET	1.1.1.1	192.168.2.6	0x4fac	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Dec 23, 2024 21:50:10.887698889 CET	1.1.1.1	192.168.2.6	0x4fac	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Dec 23, 2024 21:50:10.887698889 CET	1.1.1.1	192.168.2.6	0x4fac	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Dec 23, 2024 21:50:10.887698889 CET	1.1.1.1	192.168.2.6	0x4fac	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Dec 23, 2024 21:50:10.887698889 CET	1.1.1.1	192.168.2.6	0x4fac	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Dec 23, 2024 21:50:16.233011007 CET	1.1.1.1	192.168.2.6	0x858f	No error (0)	reallyfreegeoip.org		172.67.177.134	A (IP address)	IN (0x0001)	false
Dec 23, 2024 21:50:16.233011007 CET	1.1.1.1	192.168.2.6	0x858f	No error (0)	reallyfreegeoip.org		104.21.67.152	A (IP address)	IN (0x0001)	false
Dec 23, 2024 21:51:10.421441078 CET	1.1.1.1	192.168.2.6	0x9890	No error (0)	g-bing-com.ax-0001.ax-msedge.net	ax-0001.ax-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 21:51:10.421441078 CET	1.1.1.1	192.168.2.6	0x9890	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false
Dec 23, 2024 21:51:10.421441078 CET	1.1.1.1	192.168.2.6	0x9890	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49718	193.122.6.168	80	7560	C:\Users\user\Desktop\HUBED342024.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 21:50:11.042315960 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 23, 2024 21:50:15.152455091 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 20:50:14 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Dec 23, 2024 21:50:15.157243013 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 23, 2024 21:50:16.093729973 CET	273	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 20:50:15 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49723	172.67.177.134	443	7560	C:\Users\user\Desktop\HUBED342024.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 20:50:17 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-23 20:50:17 UTC	862	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 20:50:17 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 301806 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v9jhbe%2BosL0ith0e9C5oGZlY7T92BjqBrNqf1w%2BKqrwNwUwaYYFeJu%2FJAO933OjgAzDANXLX%2Fk0%2B5UgeB9riUApDp70BwXuGwIaL1KVJlb2O4zw3PwW4TKGl472AVXq9QUC%2F%2B1k8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6b391d0988330c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2300&min_rtt=2142&rtt_var=916&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1363211&cwnd=190&unsent_bytes=0&cid=c0f0b7dda63b4c8b&ts=460&x=0"
2024-12-23 20:50:17 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Target ID:	1
Start time:	15:50:08
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\HUBED342024.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\HUBED342024.exe"
Imagebase:	0x800000
File size:	756'224 bytes
MD5 hash:	8E148751995240A3F18C5BD846783D2D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000001.00000002.2181052353.0000000003B79000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2181052353.0000000003B79000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000001.00000002.2181052353.0000000003B79000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000001.00000002.2181052353.0000000003B79000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000001.00000002.2181052353.0000000003BC8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2181052353.0000000003BC8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000001.00000002.2181052353.0000000003BC8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000001.00000002.2181052353.0000000003BC8000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:50:09
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\HUBED342024.exe"
Imagebase:	0xb40000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:50:09
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\HUBED342024.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\HUBED342024.exe"
Imagebase:	0x500000
File size:	756'224 bytes
MD5 hash:	8E148751995240A3F18C5BD846783D2D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000005.00000002.3423260696.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.3423260696.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000005.00000002.3423260696.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000005.00000002.3423260696.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.3425599530.0000000002A54000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	15:50:09
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:50:11
Start date:	23/12/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff717f30000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	328
Total number of Limit Nodes:	14

Executed Functions

Function 07293750 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2185893723.0000000007290000.00000040.00000800.00020000.00000000.sdmp, Offset: 07290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7290000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f2b68ad8136732f7e70325c9f3f155fcfa86c542e36377d835861d70bc3885a
Instruction ID: 384fb5fa962e911dc091c38956ed18b1ff50f04a9bfd625213badcefd66c6854
Opcode Fuzzy Hash: 5f2b68ad8136732f7e70325c9f3f155fcfa86c542e36377d835861d70bc3885a
Instruction Fuzzy Hash: 482108B1D146588BEB18CFA6C9143DEFAF7AFC9300F08C56AD509B6254DBB80A458F90

Function 07299924 Relevance: 1.7, APIs: 1, Instructions: 247
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07299B66

Memory Dump Source

Source File: 00000001.00000002.2185893723.0000000007290000.00000040.00000800.00020000.00000000.sdmp, Offset: 07290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7290000_HUBED342024.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 650cd5e34861624428459dc70d3946f1f615da73b5272e3c9b7d5c097e68d8de
Instruction ID: 9da750a5f08a20fdb92f60431d35a1befe1ce2d456d7e30ca7847ba26e236eab
Opcode Fuzzy Hash: 650cd5e34861624428459dc70d3946f1f615da73b5272e3c9b7d5c097e68d8de
Instruction Fuzzy Hash: 1AA14CB1D1021ADFEF14CFA9CC417DDBBB6AF88310F1881A9E848A7240D774A981CF91

Function 07299930 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07299B66

Memory Dump Source

Source File: 00000001.00000002.2185893723.0000000007290000.00000040.00000800.00020000.00000000.sdmp, Offset: 07290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7290000_HUBED342024.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 180b3db130c75c1430db7e01593a6dbeef04de7f95a5958abdbdd4b7c74fc45f
Instruction ID: 6c38a68708d50c0daff079dcf360c7896f703c0b52cafeba02061d5a8efbe93a
Opcode Fuzzy Hash: 180b3db130c75c1430db7e01593a6dbeef04de7f95a5958abdbdd4b7c74fc45f
Instruction Fuzzy Hash: EF914DB1D1025ADFEF14DF69CC417DDBBB6AF88320F1881A9E848A7240D774A985CF91

Function 00F0EDC2 Relevance: 1.7, APIs: 1, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00F0F026

Memory Dump Source

Source File: 00000001.00000002.2179272381.0000000000F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f00000_HUBED342024.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: abfb84d543be6e3f9f4e177d4620d96026ca72b218e58cb89dc8669ca308e836
Instruction ID: 387f52e6097286acbf535bd2fecc213427674d719da08495a8d8c4aea1951a46
Opcode Fuzzy Hash: abfb84d543be6e3f9f4e177d4620d96026ca72b218e58cb89dc8669ca308e836
Instruction Fuzzy Hash: 96815570A00B058FD724CF29D58175ABBF1FF88310F14892DE49ADBA80D778E945DB91

Function 05154E60 Relevance: 1.6, APIs: 1, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05156222

Memory Dump Source

Source File: 00000001.00000002.2184087189.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5150000_HUBED342024.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 8531608a462a86ad3c271b6ff292d28eb6c25910714ec70267ac6b9b9b046fbb
Instruction ID: b2b5e6133c20073bf6c01b672979ebc5c4b23c1646e8a0272e555ddfefd4d5fc
Opcode Fuzzy Hash: 8531608a462a86ad3c271b6ff292d28eb6c25910714ec70267ac6b9b9b046fbb
Instruction Fuzzy Hash: 1B5100B1C04359DFDB14DFA9D890ADEBBB1FF88314F64812AE818AB211D7749885CF94

Function 05156105 Relevance: 1.6, APIs: 1, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05156222

Memory Dump Source

Source File: 00000001.00000002.2184087189.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5150000_HUBED342024.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 07777aa03cd64b6ff0f3b3f3b8a7edabfeb40eb1b48bda327130e2abc05e72b9
Instruction ID: c0e4c42cde5804afc8fcd2c9e5817943e181972bce5bb9d6e49e1a5752777579
Opcode Fuzzy Hash: 07777aa03cd64b6ff0f3b3f3b8a7edabfeb40eb1b48bda327130e2abc05e72b9
Instruction Fuzzy Hash: 4951B0B1D00349DFDF14CF99D984ADEBBB5BF48310F64862AE819AB210D7749985CF90

Function 05154EA8 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05156222

Memory Dump Source

Source File: 00000001.00000002.2184087189.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5150000_HUBED342024.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: a31e2372fa10b8beab18d836a4f3b34b11948f1941e48550cb6fdc27e500632d
Instruction ID: 79459c4f1c58b9e6560e42261e32d78ea2aac776042f5939e8d944552d841149
Opcode Fuzzy Hash: a31e2372fa10b8beab18d836a4f3b34b11948f1941e48550cb6fdc27e500632d
Instruction Fuzzy Hash: A951AEB1D04349EFDB14CF99D984ADEBBB5BF88310F64812AE819AB210D775A845CF90

Function 05154FFC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 051587A1

Memory Dump Source

Source File: 00000001.00000002.2184087189.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5150000_HUBED342024.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: b57538f8b6d8c3e490f91c0a9c7c6c74d5c72b035c73c982f00fca6908256423
Instruction ID: 7269ae49b5c6ece72999a76b910d91c97586b9c0c7c90c15ec52d235cc86f177
Opcode Fuzzy Hash: b57538f8b6d8c3e490f91c0a9c7c6c74d5c72b035c73c982f00fca6908256423
Instruction Fuzzy Hash: 93410D78900305DFDB14DF59C448AAEBBF5FB89324F258459D529AB321D774A841CF60

Function 00F044C4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00F059C9

Memory Dump Source

Source File: 00000001.00000002.2179272381.0000000000F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f00000_HUBED342024.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 507b6a398d4ed22af4efc6f3b1759aa1807e1dfc6c7b8b6618e46ccfc8e4965e
Instruction ID: eca14f2484a80180b30d92db6f4d13f12abc1146dcc73d90ae33452a85896702
Opcode Fuzzy Hash: 507b6a398d4ed22af4efc6f3b1759aa1807e1dfc6c7b8b6618e46ccfc8e4965e
Instruction Fuzzy Hash: 9341F170C0071DCBDB24CFA9C884B8EBBB5BF89704F2081AAD409AB251DBB56945DF90

Function 00F0590C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00F059C9

Memory Dump Source

Source File: 00000001.00000002.2179272381.0000000000F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f00000_HUBED342024.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 7ff137fce01c42a9baae26d8ba3d1702ab46b49d42367667e76b11d5198ab211
Instruction ID: 784a538f86f0ca9db144d4201fd2ad02c65c684931e21c67cc55cee6d62508fe
Opcode Fuzzy Hash: 7ff137fce01c42a9baae26d8ba3d1702ab46b49d42367667e76b11d5198ab211
Instruction Fuzzy Hash: EB41EF70C00619CBDB24CFA9C885B8EBBF5BF49704F2081AAD409AB251DBB56946DF50

Function 07033310 Relevance: 1.6, APIs: 1, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 070333AF

Memory Dump Source

Source File: 00000001.00000002.2185368607.0000000007030000.00000040.00000800.00020000.00000000.sdmp, Offset: 07030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7030000_HUBED342024.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 0e41dfb8455c264905b1e57ee5006c1bd85470350ca5ae5c48ccac1dc9ee93c0
Instruction ID: 81466314a508d52b8054b16431c54d17395178aa3f8080923d81001a23eabd4d
Opcode Fuzzy Hash: 0e41dfb8455c264905b1e57ee5006c1bd85470350ca5ae5c48ccac1dc9ee93c0
Instruction Fuzzy Hash: 2431C4B5D002499FDB10CF9AD884ADEFBF9FF48310F24842AE919A7210D774A545CFA4

Function 072996A0 Relevance: 1.6, APIs: 1, Instructions: 73
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07299738

Memory Dump Source

Source File: 00000001.00000002.2185893723.0000000007290000.00000040.00000800.00020000.00000000.sdmp, Offset: 07290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7290000_HUBED342024.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 03abed83903d3327dabbf727df015fe44a7e8e764d0185f08e69da5bbb91a292
Instruction ID: 0f6aefe255d8db9fea4fdf9bb541570939a67d719b4714e6ddd1ce22833c07dd
Opcode Fuzzy Hash: 03abed83903d3327dabbf727df015fe44a7e8e764d0185f08e69da5bbb91a292
Instruction Fuzzy Hash: C9212AB59103599FDF10CFA9C885BDEBBF5FF88320F148429E958A7240C778A950CBA4

Function 07033318 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 070333AF

Memory Dump Source

Source File: 00000001.00000002.2185368607.0000000007030000.00000040.00000800.00020000.00000000.sdmp, Offset: 07030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7030000_HUBED342024.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 51dd92832975a92a4244f0d10cc80571d644065cc161a907598008263c7e2fd6
Instruction ID: 3b3f8806a138daa50be93643562b4596e3763da528c83c1be93d29b61da05e50
Opcode Fuzzy Hash: 51dd92832975a92a4244f0d10cc80571d644065cc161a907598008263c7e2fd6
Instruction Fuzzy Hash: 3321A3B5D002499FDB10CF9AD884ADEFBF9FB48320F14842AE919A7310D775A544CFA4

Function 072996A8 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07299738

Memory Dump Source

Source File: 00000001.00000002.2185893723.0000000007290000.00000040.00000800.00020000.00000000.sdmp, Offset: 07290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7290000_HUBED342024.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 937e921bf978be89b1ae516c7578c3c825c92a51803614fa948d16e49fac84b0
Instruction ID: ff6a40f0ff3511f5afc96d127ef6e866f97abaaf4be593077272bd31e3f38665
Opcode Fuzzy Hash: 937e921bf978be89b1ae516c7578c3c825c92a51803614fa948d16e49fac84b0
Instruction Fuzzy Hash: 68212AB59003599FDF10CFA9C885BDEBBF5FF88320F148429E558A7240C778A550CBA4

Function 07299509 Relevance: 1.6, APIs: 1, Instructions: 66threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0729958E

Memory Dump Source

Source File: 00000001.00000002.2185893723.0000000007290000.00000040.00000800.00020000.00000000.sdmp, Offset: 07290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7290000_HUBED342024.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 48b2c1a37a195ddf196d1be1a91c610a8295f319463eb71abee698f8d70f187d
Instruction ID: d3ccf3d5c8da47b512193c5c0a29297985742613957440e2f6ee62ad3fe4ddfe
Opcode Fuzzy Hash: 48b2c1a37a195ddf196d1be1a91c610a8295f319463eb71abee698f8d70f187d
Instruction Fuzzy Hash: C8213AB19003099FEB10DFAAC4857EFBBF4EF88324F188429D559A7241C778A944CFA4

Function 05151458 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,05151B4E,?,?,?,?,?), ref: 05151C0F

Memory Dump Source

Source File: 00000001.00000002.2184087189.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5150000_HUBED342024.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ca1ec02859707af83304c97d1ed88cbcd6e96c09e961386611c40f05203e1f27
Instruction ID: 6e5d8c8af6a0fba4344de968be06a3bfc05a8e7f64b0be0a9bab479f4457880a
Opcode Fuzzy Hash: ca1ec02859707af83304c97d1ed88cbcd6e96c09e961386611c40f05203e1f27
Instruction Fuzzy Hash: CE21E6B5900249EFDB10CF99D984ADEFBF5FB48320F14841AE958A7310D379A950CFA4

Function 05151B80 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,05151B4E,?,?,?,?,?), ref: 05151C0F

Memory Dump Source

Source File: 00000001.00000002.2184087189.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5150000_HUBED342024.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c1d8aea046d84c9386d2f77e8ec8731633912b1d3bfbb1a0d39def4f33671400
Instruction ID: 04074aedb75938f3059d62a22ad671e071b4ef25cfe0dd82b50ce08f3df83bf2
Opcode Fuzzy Hash: c1d8aea046d84c9386d2f77e8ec8731633912b1d3bfbb1a0d39def4f33671400
Instruction Fuzzy Hash: DC21E5B5900249EFDB10CF9AD984ADEFBF5FB48320F14841AE958A7310D379A954CF64

Function 07299798 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07299818

Memory Dump Source

Source File: 00000001.00000002.2185893723.0000000007290000.00000040.00000800.00020000.00000000.sdmp, Offset: 07290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7290000_HUBED342024.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 64037d7f16ee615fcb42de0a0a85ebe6440cb32569414f5f530f966834a008bc
Instruction ID: a13409446accf5284711a5aa8f2604de9c759886052044f352884f09bc556a5e
Opcode Fuzzy Hash: 64037d7f16ee615fcb42de0a0a85ebe6440cb32569414f5f530f966834a008bc
Instruction Fuzzy Hash: 292128B18003599FDB10DFAAC881ADEFBF5FF88320F14842DE558A7250C738A950CBA4

Function 07299790 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07299818

Memory Dump Source

Source File: 00000001.00000002.2185893723.0000000007290000.00000040.00000800.00020000.00000000.sdmp, Offset: 07290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7290000_HUBED342024.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 00a280ff483c74699d75253da788e99a6a95187bc5a2bb21c59cc9c792e3dbac
Instruction ID: 1f4190e0f9a7852411d06234a0677bf3771f03e7a735b9722caf475112759a58
Opcode Fuzzy Hash: 00a280ff483c74699d75253da788e99a6a95187bc5a2bb21c59cc9c792e3dbac
Instruction Fuzzy Hash: AC2105B18002599FDB10CFA9C981AEEBBF5FF88320F14842EE559A7250C7389950DBA4

Function 07299510 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0729958E

Memory Dump Source

Source File: 00000001.00000002.2185893723.0000000007290000.00000040.00000800.00020000.00000000.sdmp, Offset: 07290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7290000_HUBED342024.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 7c43c9b65cf2ee48542b6c8afdfb7e73eeae9e18df756eb333f7672a4135aacd
Instruction ID: df9f1587540025b5a3dbc7c9c439f92e971e99a50ef25f77d0dfb8077d045794
Opcode Fuzzy Hash: 7c43c9b65cf2ee48542b6c8afdfb7e73eeae9e18df756eb333f7672a4135aacd
Instruction Fuzzy Hash: 212118B19003099FEB10DFAAC4857EEBBF4EF88324F148429D559A7241D778A944CFA5

Function 072995E0 Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07299656

Memory Dump Source

Source File: 00000001.00000002.2185893723.0000000007290000.00000040.00000800.00020000.00000000.sdmp, Offset: 07290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7290000_HUBED342024.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d9213c8c2b79998e42d679ac5e0d04425d029dc880b160cbb9493e1a5f1d4efe
Instruction ID: e324e18928c6bbe1496f65be9c4e1e299e928d325efdc9a231f8ffe4efcdba93
Opcode Fuzzy Hash: d9213c8c2b79998e42d679ac5e0d04425d029dc880b160cbb9493e1a5f1d4efe
Instruction Fuzzy Hash: 591159B19002499FEF10DFA9C845BDFBBF5EF88320F148419E559A7250C735A550CBA5

Function 072995E8 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07299656

Memory Dump Source

Source File: 00000001.00000002.2185893723.0000000007290000.00000040.00000800.00020000.00000000.sdmp, Offset: 07290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7290000_HUBED342024.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: bbf483e312bac66b4f3d029d8da9b627174fa3c422e11556eed052026c9a9107
Instruction ID: 52547f73d0bac4952bda272c35c61bb3f9afb1d82b5bc087f8d87b458c3c6e1c
Opcode Fuzzy Hash: bbf483e312bac66b4f3d029d8da9b627174fa3c422e11556eed052026c9a9107
Instruction Fuzzy Hash: B81167B18002499FDF10DFAAC844BDFBBF5EF88320F148419E559A7250C739A550CFA4

Function 07299459 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 072994C2

Memory Dump Source

Source File: 00000001.00000002.2185893723.0000000007290000.00000040.00000800.00020000.00000000.sdmp, Offset: 07290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7290000_HUBED342024.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: dfae76869234a1d7754e617d2d3b98204fe0c78f0e7513487dcb81a63f0fb8f8
Instruction ID: a694edb2f4c066763575c85214b5fbe25f0c340f57ed6b4f83b8b62fe135925f
Opcode Fuzzy Hash: dfae76869234a1d7754e617d2d3b98204fe0c78f0e7513487dcb81a63f0fb8f8
Instruction Fuzzy Hash: 19116DB19003498FEB10DFAAC4457DFFBF4EF88720F148819D559A7240C735A540CBA5

Function 07299460 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 072994C2

Memory Dump Source

Source File: 00000001.00000002.2185893723.0000000007290000.00000040.00000800.00020000.00000000.sdmp, Offset: 07290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7290000_HUBED342024.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 0a706c87aec1c4e55f420d86c976820e553b4f0f68b1831823da8d506123e6d7
Instruction ID: 27bdd80b1ee9c760fbd90d2a5fe989b71cdb626a6b2754195c76da40e903b7a4
Opcode Fuzzy Hash: 0a706c87aec1c4e55f420d86c976820e553b4f0f68b1831823da8d506123e6d7
Instruction Fuzzy Hash: DA113AB19003498FEB10DFAAC4457DEFBF4EF88724F248419D559A7240C779A540CBA5

Function 072982BC Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0729C15D

Memory Dump Source

Source File: 00000001.00000002.2185893723.0000000007290000.00000040.00000800.00020000.00000000.sdmp, Offset: 07290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7290000_HUBED342024.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 13ae557a7fd5655ab4469202688d16be6c33f5cb6e2386eeb11038292fa768bd
Instruction ID: 38cd157b13eda13adb4552ad1c0464abee4e14d8079f3f9a56c573cff4432de9
Opcode Fuzzy Hash: 13ae557a7fd5655ab4469202688d16be6c33f5cb6e2386eeb11038292fa768bd
Instruction Fuzzy Hash: 831103B5800349DFDB10DF9AD884BDEBBF8EB48320F24845AE558A7210C375A984CFA5

Function 0729C0F8 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0729C15D

Memory Dump Source

Source File: 00000001.00000002.2185893723.0000000007290000.00000040.00000800.00020000.00000000.sdmp, Offset: 07290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7290000_HUBED342024.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 63c8ceeac8d67ddbbd65575dab9828871520014bf67965bd65a3c2cfdadef82e
Instruction ID: 06c4ad60a17ccb18e68aa9e7c3ea6e47a80aa4688e71dfed1aa807b38cc341f4
Opcode Fuzzy Hash: 63c8ceeac8d67ddbbd65575dab9828871520014bf67965bd65a3c2cfdadef82e
Instruction Fuzzy Hash: 801106B5800349DFDB10DF99D845BDEFBF8EB48310F14841AD558A7600C375A584CFA5

Function 00F0EFC0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00F0F026

Memory Dump Source

Source File: 00000001.00000002.2179272381.0000000000F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f00000_HUBED342024.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: c4a18ca98d8e79d553a85b44d748ea08358baa9a64305e8e72d5e29860c02e6f
Instruction ID: 6c861420414c326dc1b2d279f7c7e28bb0960aea34b533a913b56cd32caa8ed7
Opcode Fuzzy Hash: c4a18ca98d8e79d553a85b44d748ea08358baa9a64305e8e72d5e29860c02e6f
Instruction Fuzzy Hash: BC1110B5C00249CFDB20CF9AD444ADEFBF4AB88320F14842AD428B7651C379A549CFA5

Function 00EBD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2178533383.0000000000EBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ebd000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 132c86036987568d11976f4834ef1d3a3cbe96a55310ce8f7a6a51db53f77d69
Instruction ID: e8b2cbc896d0d540d6e662f8ae4041243fa6c2013763e25dacba28b51630560f
Opcode Fuzzy Hash: 132c86036987568d11976f4834ef1d3a3cbe96a55310ce8f7a6a51db53f77d69
Instruction Fuzzy Hash: B6212271608200DFDB14EF14D980B97BB66EB88318F20C56DD80A5B292D33AD847CA61

Function 00EBD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2178533383.0000000000EBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ebd000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 997dae4a2c88fc619c7d6085ee09349173247db01ab5088e4f3a33427fd4ade7
Instruction ID: 391c38ac844ec182c322b54d85747e282d1ad8aaaea33a93ee27068806f80ebc
Opcode Fuzzy Hash: 997dae4a2c88fc619c7d6085ee09349173247db01ab5088e4f3a33427fd4ade7
Instruction Fuzzy Hash: 5B210471508284EFDB05DF54D9C0BA7BBA5FB84318F20C66DE9095B2A2D336D846CB61

Function 00EBD005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2178533383.0000000000EBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ebd000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fa99e486171a923acb9eaa64d6d6a009a851b8e7d69fc850d3e3b8c44189a8a
Instruction ID: 0279242a5fc3e623835c855c3bdf8e43daed8c0aae61b6edb87c6a8f8cfa130b
Opcode Fuzzy Hash: 3fa99e486171a923acb9eaa64d6d6a009a851b8e7d69fc850d3e3b8c44189a8a
Instruction Fuzzy Hash: 6F21537550D3808FCB12DF24D994756BF71EB46314F28C5DAD8498F6A7C33A980ACB62

Function 00EBD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2178533383.0000000000EBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ebd000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5dd070f47a673dda7babee824c8441981cc2d376d27ad6ac8e2bf7ef2f1688d
Instruction ID: cfb389112d893072ae1a5bf0c195634bcb9751f23cc3a3765322b80cc6dfc43b
Opcode Fuzzy Hash: f5dd070f47a673dda7babee824c8441981cc2d376d27ad6ac8e2bf7ef2f1688d
Instruction Fuzzy Hash: 3011BB75508280DFCB02CF50C9C0B56BBA1FB84318F24C6A9D8494B2A6C33AD81ACBA1

Function 00EAD745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2178374362.0000000000EAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ead000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 174ec931f44174d04ee43653b89c1b148b4c016a9eb8f95dcfe3a3fc42bfda9f
Instruction ID: 8bbc5d65a0aa856f385e891eb198eb8ded3de9ed5fa6d8cd15cbb76bb2f7071f
Opcode Fuzzy Hash: 174ec931f44174d04ee43653b89c1b148b4c016a9eb8f95dcfe3a3fc42bfda9f
Instruction Fuzzy Hash: 8401F7310083449AE7144E25CD84BA7BF98DF46324F18851BFD0A5F682C239A841C671

Function 00EAD744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2178374362.0000000000EAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ead000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61c33a01389326adf18d3871e7579ad791114ce45aa5b8d2004e43831538794d
Instruction ID: 520f148f00527bd30458f2bd4323b90d2229c0407bf6c8673e6a08b3afa0a64d
Opcode Fuzzy Hash: 61c33a01389326adf18d3871e7579ad791114ce45aa5b8d2004e43831538794d
Instruction Fuzzy Hash: F6F0C271008344AEE7148E15DC84B62FF98EB86738F18C05BFD091F696C279A844CBB1

Non-executed Functions

Function 07031DE8 Relevance: .6, Instructions: 626COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2185368607.0000000007030000.00000040.00000800.00020000.00000000.sdmp, Offset: 07030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7030000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b1d5f68b19ccf4a59bf301966fdf06a9e6bbc4337a640be6b934fee68f00307
Instruction ID: d939f9f16795ed7852e1521701a565eb6a6ea785d96d8eb160e418d746f38bf3
Opcode Fuzzy Hash: 3b1d5f68b19ccf4a59bf301966fdf06a9e6bbc4337a640be6b934fee68f00307
Instruction Fuzzy Hash: 58327F70E002588FDB54DFB9C8917AEBBF6BF89300F148269E409AF395DA349D45CB91

Function 0729DE40 Relevance: .4, Instructions: 377COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2185893723.0000000007290000.00000040.00000800.00020000.00000000.sdmp, Offset: 07290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7290000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df42ae5ddce2336513ae16c17cd287674f59276ff071741e1caee780c18be88e
Instruction ID: 77680ce55d2c2958120210678bdebca7d3b642066311b4d13fe46cc64e97ef6f
Opcode Fuzzy Hash: df42ae5ddce2336513ae16c17cd287674f59276ff071741e1caee780c18be88e
Instruction Fuzzy Hash: D1D19DB2B107028FDB29DB79C860B6EB7E6AF89700F18487DD14A8B391DB35E901D751

Function 05154458 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2184087189.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5150000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 210826c726794df70eecf30d1a288b8ce0620cd1071280a4d6c1531de0197381
Instruction ID: 2f043779dfcb903f53cb26a12b8128d669f155e3d3df3f63d3d900865a6e47b3
Opcode Fuzzy Hash: 210826c726794df70eecf30d1a288b8ce0620cd1071280a4d6c1531de0197381
Instruction Fuzzy Hash: AF1252F0422B458ED722CF66ED4E18D3EB1BF85318B504209E2656A6E9DFBC154BCF84

Function 07297530 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2185893723.0000000007290000.00000040.00000800.00020000.00000000.sdmp, Offset: 07290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7290000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e135c9dabe558463de1cb4694f979eeca0c724cbc189b12ce58dd2f714cd591a
Instruction ID: e4537a095c681677e2b2ed184eedb3a400695e36db0dea7f35c32300f31376ed
Opcode Fuzzy Hash: e135c9dabe558463de1cb4694f979eeca0c724cbc189b12ce58dd2f714cd591a
Instruction Fuzzy Hash: C7E1FCB4E102198FDB14DFA9C5809AEFBF2FF89305F248169D418AB356D731A942CF60

Function 072970F8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2185893723.0000000007290000.00000040.00000800.00020000.00000000.sdmp, Offset: 07290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7290000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b90da7c9bc4aeaae054d3568c476717bd8e31b46223ceaa9ed3d38dd906bd072
Instruction ID: d05690cf01f34f218f523e205672f47a3e96d3ff906e16d4dd8304b33d2a9d30
Opcode Fuzzy Hash: b90da7c9bc4aeaae054d3568c476717bd8e31b46223ceaa9ed3d38dd906bd072
Instruction Fuzzy Hash: AAE1EBB4E102199FDB14DFA9C5809AEFBF2FF89305F248169D818AB356D731A941CF60

Function 07298C38 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2185893723.0000000007290000.00000040.00000800.00020000.00000000.sdmp, Offset: 07290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7290000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 687d0a4e12ac81fb0d6977bc36a958dfa10d0d7cb4ab103e58b79fc950071504
Instruction ID: 86467375a9f47f13166e9779e38618710a3ecbd198209705430eb14965ccaad8
Opcode Fuzzy Hash: 687d0a4e12ac81fb0d6977bc36a958dfa10d0d7cb4ab103e58b79fc950071504
Instruction Fuzzy Hash: 86E11CB4E102198FDB14DFA9C5809AEFBF2FF89304F288169D458AB356D735A941CF60

Function 07296CC0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2185893723.0000000007290000.00000040.00000800.00020000.00000000.sdmp, Offset: 07290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7290000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dbc703707f828e35ae2eda4f7395de18252759290d59b8df416dd2f12954434
Instruction ID: 768ff8e27758d5884ab987fadf8952f24ae672c56ea02c9a6e580f330ef3c625
Opcode Fuzzy Hash: 3dbc703707f828e35ae2eda4f7395de18252759290d59b8df416dd2f12954434
Instruction Fuzzy Hash: 2FE11CB4E102198FDB14DFA9C5809AEFBF2FF89305F248169D454AB356D731A942CF60

Function 07296888 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2185893723.0000000007290000.00000040.00000800.00020000.00000000.sdmp, Offset: 07290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7290000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d985775b05dc8f79043f4d1860d78a3351745829d24198de7abc259144a47819
Instruction ID: 377ec0e59c6c6abd526b5a5095a49fd2627c77160f7e79eceafabb293962e559
Opcode Fuzzy Hash: d985775b05dc8f79043f4d1860d78a3351745829d24198de7abc259144a47819
Instruction Fuzzy Hash: 74E1FBB4E102198FDB14DFA9C590AAEFBF2FF89305F248169D414AB356D731A942CF60

Function 07034948 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2185368607.0000000007030000.00000040.00000800.00020000.00000000.sdmp, Offset: 07030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7030000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7dd490888d1e0680fe67709ac6df33c5fa8e6ee8e283cfdbdfd27fd08366066
Instruction ID: 901f4b85af6942f31ecd94ef89d375396a641099c91a580e4798549ffe41c5b7
Opcode Fuzzy Hash: e7dd490888d1e0680fe67709ac6df33c5fa8e6ee8e283cfdbdfd27fd08366066
Instruction Fuzzy Hash: 10C159B1E006599FCB54CFA5C8807ADBBF6AF88300F04C6AAE409AF255DB71D985CF50

Function 051524E4 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2184087189.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5150000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b4d4b4e93ad3203ee79d83131795db88a0bf0168bf97ff1019c1228ddca1f23
Instruction ID: 06597016c21eabf9e842690a5252d5482396dee2bd9e1a5ee82507fa2e962ebe
Opcode Fuzzy Hash: 6b4d4b4e93ad3203ee79d83131795db88a0bf0168bf97ff1019c1228ddca1f23
Instruction Fuzzy Hash: 30A16F36E10205CFCF19DFB4D8845DEBBB2FF84310B15856AE826AB255DB71E946CB40

Function 05154448 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2184087189.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5150000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c672141359f4ee11df03132dcc631cfd6c67ea09d99641ff394a7c801c423b83
Instruction ID: 6aa4d878a0d8768114340e738d810eb781d041177b337f6721b9951846def0ea
Opcode Fuzzy Hash: c672141359f4ee11df03132dcc631cfd6c67ea09d99641ff394a7c801c423b83
Instruction Fuzzy Hash: FDC1D5F0422A458ED722CF66ED4A18D7FB1BF85314F514209E2616B6D8DFB8154BCF84

Function 07297520 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2185893723.0000000007290000.00000040.00000800.00020000.00000000.sdmp, Offset: 07290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7290000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f347be1e4284e094393d63633b7b2d7eae9534dfb0663e26b633ab62c21c6497
Instruction ID: e3d6a79096f6dc0e98956bc8cb95510c47b899c1a4f1f29d4a6f495322d2492d
Opcode Fuzzy Hash: f347be1e4284e094393d63633b7b2d7eae9534dfb0663e26b633ab62c21c6497
Instruction Fuzzy Hash: 25611DB4E102198FDB14DFA9C581AAEFBF2FF89304F248169D418A7355D731A941CFA0

Function 0703CDF0 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2185368607.0000000007030000.00000040.00000800.00020000.00000000.sdmp, Offset: 07030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7030000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95d194a7d90f990faf139e79d03e7eeae52edd5b60190db57fe3c4584783a351
Instruction ID: f8b55e729d1281b5cd164a3d2efe004a127c772e487c6fb36c91ec194bfb7e28
Opcode Fuzzy Hash: 95d194a7d90f990faf139e79d03e7eeae52edd5b60190db57fe3c4584783a351
Instruction Fuzzy Hash: F44102B1A14215CFE7109B69D4402BFB7F9EF46709F04826BE426EB2C1D738C542D761

Analysis Process: HUBED342024.exePID: 7560, Parent PID: 7352COMMON

Executed Functions

Function 00E0C530 Relevance: 4.3, Strings: 1, Instructions: 3069COMMON

Download Yara Rule

Strings

N, xrefs: 00E0F910

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-1130791706
Opcode ID: a0b8264656f0d7f911cd6737fbde68952d4366b4629e7c81b8f5549df47fbae3
Instruction ID: a953abf47abd9ad7e310684f1531f20ee703df3cb5275c341e02ec75cd058866
Opcode Fuzzy Hash: a0b8264656f0d7f911cd6737fbde68952d4366b4629e7c81b8f5549df47fbae3
Instruction Fuzzy Hash: F273D731D1075A8EDB11EFA8C854AA9F7B1FF99300F11D69AE44877261EB70AAC4CF41

Function 00E02DD1 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d5021f2e85525a77c022f3a64de4355311072e13f23147127276946e73fbdf6
Instruction ID: 2e281e58d13478b1e2ecf262a96733f2eceba295c83e86f8d80f9dd432e806c4
Opcode Fuzzy Hash: 3d5021f2e85525a77c022f3a64de4355311072e13f23147127276946e73fbdf6
Instruction Fuzzy Hash: 9391C474B01358DBDB08EB7988582BEBBB7BFC8700B14886ED146E7394DE348D468791

Function 00E09480 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b95cac50c0e714940b7c5aadefc3e96f7cbdf74b3f6b6d58421066fb07b52257
Instruction ID: a05ff12cd465b4c57f1604d61a465cbd3b4ee7205ab583f2f1331463ab31c7ff
Opcode Fuzzy Hash: b95cac50c0e714940b7c5aadefc3e96f7cbdf74b3f6b6d58421066fb07b52257
Instruction Fuzzy Hash: BFC1B278E04218CFDB14DFA5D944B9DBBB2BF89304F2091A9D809AB395DB359E85CF10

Function 00E0C521 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0cb4ff39b2bf66e3f0fbdb46f743bffa520ab5c410798946c74ff54f88dc573
Instruction ID: 32ab782e68f8f2fedce8f842c0768162a0f91d2c5a61b0d5e5881a5ef4892817
Opcode Fuzzy Hash: f0cb4ff39b2bf66e3f0fbdb46f743bffa520ab5c410798946c74ff54f88dc573
Instruction Fuzzy Hash: 62A1F271D006198EDB14DFA9C8846EDFBB1EF89300F10D2AAE408B7261EB709AC5CF51

Function 00E09A30 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb0af4a10a66c8887c636f8c11aaad7d263d05e9d69491d9a749029b01d27e4
Instruction ID: 83b2ce2522281ed079958ba8bc88928bd58cbf201ad2a76a2233049e5d5c91c7
Opcode Fuzzy Hash: dbb0af4a10a66c8887c636f8c11aaad7d263d05e9d69491d9a749029b01d27e4
Instruction Fuzzy Hash: 6BA1F370E00609CFEB14DFA9D588BDDBBB1FF89304F209269E409AB292DB745985CF54

Function 00E09A40 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eb8201a54a3b557ebefa156c6f5fe454cc81c43e7159406e1d586bc2fe1856b
Instruction ID: a40a5f7e5cb69b51604b0ae825ac859bea27da7efb39470b7bf7d2b9585f0f2e
Opcode Fuzzy Hash: 7eb8201a54a3b557ebefa156c6f5fe454cc81c43e7159406e1d586bc2fe1856b
Instruction Fuzzy Hash: AAA1F470D00608CFEB14DFA9D988B9DBBB1FF89314F209269E409BB292DB745985CF54

Function 00E09D87 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd2388c6e0f1d20b99d3fa3c385d5c0e0cb00372533d56fb6e927c8666e767e1
Instruction ID: ac3990117e11609048cc692baa1f52ae4734f84251bec48634fd7186103958ae
Opcode Fuzzy Hash: dd2388c6e0f1d20b99d3fa3c385d5c0e0cb00372533d56fb6e927c8666e767e1
Instruction Fuzzy Hash: 4591D070D00608CFEB14DFA8C988B9DBBB1FF49314F209259E409BB292DB759985CF14

Function 00E0946F Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20b222b45297f27792e5fcc1ff77a4a804c17c68e6aea8dfc3bbaf6c833835b7
Instruction ID: a5d5d626d551cbe9ea22d97a3368fe520d25e0a11f3101d2d70344c5def8d1bf
Opcode Fuzzy Hash: 20b222b45297f27792e5fcc1ff77a4a804c17c68e6aea8dfc3bbaf6c833835b7
Instruction Fuzzy Hash: FF410474D00248CBEB18CFA6D84469DBBF2AF89300F24D02AD415BB395EB384946CF10

Function 00E0AF78 Relevance: 1.5, Strings: 1, Instructions: 224COMMON

Download Yara Rule

Strings

, xrefs: 00E0B065

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 17fcd3d824785fd7a24cb9e94a8f85b18baca9a5289906d9c879a1779c78243f
Instruction ID: e0a09f6a1690109335fcfe39c3421baba3617e8d0d1071acab265a0c0fcd6660
Opcode Fuzzy Hash: 17fcd3d824785fd7a24cb9e94a8f85b18baca9a5289906d9c879a1779c78243f
Instruction Fuzzy Hash: 9D71D634B04204DBDF246F78945926E7B96FF84364F248629F926E73D0CF358D8687A1

Function 00E0AF73 Relevance: 1.4, Strings: 1, Instructions: 183COMMON

Download Yara Rule

Strings

, xrefs: 00E0B015

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 41d4306362bb4df686ce90251f66a5b6d6ee965b513e405bf4835ef328a81b0b
Instruction ID: 1d9a66f9a12999190f4a7651d1a672a40e57e7baeb91978803a2705e6eb1f4d9
Opcode Fuzzy Hash: 41d4306362bb4df686ce90251f66a5b6d6ee965b513e405bf4835ef328a81b0b
Instruction Fuzzy Hash: 6A51C234B04204CBDB186F78985926E7BA6FFC8364F248529F526E73D0DF398D4687A1

Function 00E0B500 Relevance: .4, Instructions: 390COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aac4237f2f1c4eb8bc0d92f39791046b81a97f562e2b64ae55339ada06cb3f10
Instruction ID: 7a0bdbc3eb6d7a3b0d0e83c06d1837cde05eccba67f538847d16c9395cafe1aa
Opcode Fuzzy Hash: aac4237f2f1c4eb8bc0d92f39791046b81a97f562e2b64ae55339ada06cb3f10
Instruction Fuzzy Hash: 24D11971B042048FDB14DB68C895AAD7BB6FF89320F285165E505EB3E1CB35DC86CB61

Function 00E02B29 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59df4b7c85da9789cdcda30cb826a8148cfff435ee19c68f1f129dbcac2702db
Instruction ID: b00dd7e3766966f539236ae06aa0a4b70a5e409eefc1a8d4f31db676efbdf583
Opcode Fuzzy Hash: 59df4b7c85da9789cdcda30cb826a8148cfff435ee19c68f1f129dbcac2702db
Instruction Fuzzy Hash: 2B81D32964420ACFEF38092A44EC3D9B7E19AF931A760345FEBC2B61C5D5904CC746D7

Function 00E0BF80 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac9a7a01ba25c30b60e2fd863729c4946e64f3f6ca474b51205b8c1d1a3f1e5a
Instruction ID: 66a873224639a28992f2b95286ce33e16439c1e18c4d4d07d5336543f32865a2
Opcode Fuzzy Hash: ac9a7a01ba25c30b60e2fd863729c4946e64f3f6ca474b51205b8c1d1a3f1e5a
Instruction Fuzzy Hash: F961D476B002059FC714CBB8D844AAEBBF5EBC8324B24962AE559E7380D731DC41C7A0

Function 00E00B23 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a40c56d5b45bb9d94a9872cf844a85746e0c004d0bf6ee23e16418d00ca29d66
Instruction ID: 73a5f75e66ba2c4dfb2aad149d88eb6bf1c71cd685089ccdfb5354a7df22b8ed
Opcode Fuzzy Hash: a40c56d5b45bb9d94a9872cf844a85746e0c004d0bf6ee23e16418d00ca29d66
Instruction Fuzzy Hash: 88A1FF78A0424ACFCF05EFB8E895A9DBBB1FF48309B104529D505AB369DB706D46CF90

Function 00E00B30 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbffc72520fb35d78d572825d556db1c957d73ebb4b84adc2edc795cde652311
Instruction ID: 9e3ef3568c662cdb208707fcfbac69547b4753dfca18862512ef69b68120e73f
Opcode Fuzzy Hash: cbffc72520fb35d78d572825d556db1c957d73ebb4b84adc2edc795cde652311
Instruction Fuzzy Hash: B7A1CF78A0420ACFCF05EFB8E885A9DBBB1FF48709B105529D505AB369DB706D45CF90

Function 00E0BC28 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd7284aa1dbd5f0a512dbfc966ddc7b2cb222dd6b92b33d98fcbc56538c5d491
Instruction ID: bbfafd2e61143af7e1e11df94008a4d0230946d932f26db3de25b4485e674448
Opcode Fuzzy Hash: dd7284aa1dbd5f0a512dbfc966ddc7b2cb222dd6b92b33d98fcbc56538c5d491
Instruction Fuzzy Hash: B141A235B042489FDB04ABB8D8566AE7FBAFF89340F144479F505DB291DE349D42C760

Function 00E03F78 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f03aeda5eb97eb2138223f358bd316a6ad3007be14abfb9f5c3fd402c8978cf0
Instruction ID: 04084a825f9a754d31f0e248587ae99e04af033076aeb12c162a31dfb7d37ea9
Opcode Fuzzy Hash: f03aeda5eb97eb2138223f358bd316a6ad3007be14abfb9f5c3fd402c8978cf0
Instruction Fuzzy Hash: A751D4B4E00209DFDB44DFA9D58499DBBF2BF89310F209429E915BB3A4DB309986CF51

Function 00E03168 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78d0a4b1c48ac865875710cb4d3f5afa88ccff4cb4d0069b81e577439d1e9f46
Instruction ID: 42b2d0820c796db458ea883ebbbdae7b86e5a14eb7f7d1d71ee29ca3051f2017
Opcode Fuzzy Hash: 78d0a4b1c48ac865875710cb4d3f5afa88ccff4cb4d0069b81e577439d1e9f46
Instruction Fuzzy Hash: 0D41C274E05208CFCB48DFAAD88499DBBF2BF89304F249529E805BB364DB359945CF14

Function 00E09249 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e56500ceb1fdd12b79fb5225f31e232c55285cab7147f9d0c4a8fc57c5aedc72
Instruction ID: a7eb32c728d3cd734163e059a05561777681c96add06d260b1a0f2ee86034b4c
Opcode Fuzzy Hash: e56500ceb1fdd12b79fb5225f31e232c55285cab7147f9d0c4a8fc57c5aedc72
Instruction Fuzzy Hash: 1B31BC7003A64A8FC3013B61A5AE17EBFB8FB4F31B7056C42F10AC0555AF384586CB60

Function 00E0B869 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bef6700593347b246481d5ab93046372d5e85e3aa2945d15a00022b85bc472c4
Instruction ID: 49036c0a535126e8b054a01d3cfa14e170e2da8810ca959fcf867d2e33858970
Opcode Fuzzy Hash: bef6700593347b246481d5ab93046372d5e85e3aa2945d15a00022b85bc472c4
Instruction Fuzzy Hash: 16311B35B001098FCB05DFA8C485EDDBBB2FF88324F555154E501AB3A1CB71EC868BA0

Function 00E0B89D Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cd48d036968839655b640ef2ba4c6a740ab9481af10db6b29b5c60388f849bb
Instruction ID: 197b6792958bc957a1b10b593c76707993982c88bc5b6b239ad2d05acec8048b
Opcode Fuzzy Hash: 4cd48d036968839655b640ef2ba4c6a740ab9481af10db6b29b5c60388f849bb
Instruction Fuzzy Hash: 07312A35B001098FCB05DFA8C481EDDBBB2FF88324F555154E601AB3A1CB71EC868BA0

Function 00E0BDE8 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6c5938da650902a022616425642c2e236a5b983d5df53282528c14af43131ab
Instruction ID: 3aeeb0a68382f225cb56d78351cb280830bb68d456f029e090786771da7c6431
Opcode Fuzzy Hash: a6c5938da650902a022616425642c2e236a5b983d5df53282528c14af43131ab
Instruction Fuzzy Hash: EA31A235704208DFC704DF79C855AAE7BB6FF89300B248069E6059B3A5CF359D46CB90

Function 00E018C8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f29176dafff9e69d860d07916f366b18ae2be58a692e32ecd0278c0d215b620
Instruction ID: 764c7e4888629d2aed3dd6a27814477dd1c68ebaed6984b9ef92c174ddd53ed6
Opcode Fuzzy Hash: 1f29176dafff9e69d860d07916f366b18ae2be58a692e32ecd0278c0d215b620
Instruction Fuzzy Hash: AE21C171A0024A9FCB14DF24C8509AE77A5EBD9764F50C459E94AAF380DA34EE85CB90

Function 00D7D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3424734935.0000000000D7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d7d000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 309daadb49bc21b2b55ed34a59e070bec2ec1a4ba2a3965c55387518f632d0c4
Instruction ID: 7622421917fea48b5e8e24f584199561b7c222fb1b417cd8f41f4112398fbf62
Opcode Fuzzy Hash: 309daadb49bc21b2b55ed34a59e070bec2ec1a4ba2a3965c55387518f632d0c4
Instruction Fuzzy Hash: 4321DE71604204EFDB14DF14D980B26BBB6EF84314F38C66DE94E4A292D37AD847CA72

Function 00D7D005 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3424734935.0000000000D7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d7d000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc7a6cc8519ef09384c6524b6d70d9f390cc822db34b44f738dfb6b41058194e
Instruction ID: f2770de6a1b0c2cb48018287593708d70afc66e668b95c3e81d8c7008f029a3f
Opcode Fuzzy Hash: dc7a6cc8519ef09384c6524b6d70d9f390cc822db34b44f738dfb6b41058194e
Instruction Fuzzy Hash: 56215C7150D3C09FCB03CB24D990711BF71AF46214F29C5EBD8898F2A7D23A980ACB62

Function 00E00EC8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f140b5747c80af4df24f7b3e55094fdeab6eea03defffb92ff13ffd9ca569eae
Instruction ID: 80402312f84ee379a3002c647b64cca8fe20094392b3fa2af10d62b2e3cc8755
Opcode Fuzzy Hash: f140b5747c80af4df24f7b3e55094fdeab6eea03defffb92ff13ffd9ca569eae
Instruction Fuzzy Hash: 04215170A04209DFDB05EFB9C4407AEB7B2EF86304F10C5AA9414AB395DB749985CF61

Function 00E017B8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9254feb504cb2f3abc0eb19f7b842f80a2acb972de8c97660b13140c255cb733
Instruction ID: 27973809ca130c65a90e98ba9c5ba0c2a6504d8c611a50e647ab937c3017c59d
Opcode Fuzzy Hash: 9254feb504cb2f3abc0eb19f7b842f80a2acb972de8c97660b13140c255cb733
Instruction Fuzzy Hash: CA212574D0534A8FCB45DFB8C8845EEBFB0BF0A300F1455AAD445BB251EB304A99CBA1

Function 00E0BB48 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7caa31b0587ad9fb51c268bbd8cedc5fade39bfcc619f5868ffc24d1c506b66
Instruction ID: d5b12d31f6fb50a2e2755464754a1d0b3ab82a49d90a91556bbc587d25bedc94
Opcode Fuzzy Hash: e7caa31b0587ad9fb51c268bbd8cedc5fade39bfcc619f5868ffc24d1c506b66
Instruction Fuzzy Hash: 36115E76700204CFD714DB69E988E5AB7E6FF98725B218079E14ACB3A4CB71EC44CB50

Function 00E04850 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ae9ae6684bef7626c7630c9b41b27ed73dbe201c81b595597c18959257b53ec
Instruction ID: 235d445c6ffb9ae5442b02b2068cc2264bd0eb6b398deb501413f9dfcba5186a
Opcode Fuzzy Hash: 0ae9ae6684bef7626c7630c9b41b27ed73dbe201c81b595597c18959257b53ec
Instruction Fuzzy Hash: BB01F1BAF013454FD718ABB9894853B67E7AF88228324883ADA05C73D4EF30CC058790

Function 00E04860 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b88486df998ea83cdea7e195ab024a8b79e146b05ffcd80cbc59c35f76d4697
Instruction ID: a861ad2b23813b79e57840cfebf1a6b7bd14c277e0ad35062e07c23ffc294cb3
Opcode Fuzzy Hash: 6b88486df998ea83cdea7e195ab024a8b79e146b05ffcd80cbc59c35f76d4697
Instruction Fuzzy Hash: F001A2B5B012554BD718AAB9494852F76EBAFC4628710883DEA05C7394FF70CC054BA1

Function 00E093B0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d281823829fce0610d3b8a8f6df7f2ccd65467da0af3c84e2f47c657074e79d
Instruction ID: 5182ed45420aa9dcc005e0406f41a7651baabc8cd9c9f93176cf58a2cbdc249a
Opcode Fuzzy Hash: 1d281823829fce0610d3b8a8f6df7f2ccd65467da0af3c84e2f47c657074e79d
Instruction Fuzzy Hash: 35118F70D0424ACFDB41EFB8C44079EBBB1FF42304F0482A9C154AB396EB344A468B91

Function 00E093C0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7d47971677b0ad4285855faf9bd80343d9dbf414ccf65342217e3c399af88e4
Instruction ID: 20b762d5ecc17d736aa78a673d375be1f7e9024c872a68ec2b548c2bf3d27dea
Opcode Fuzzy Hash: d7d47971677b0ad4285855faf9bd80343d9dbf414ccf65342217e3c399af88e4
Instruction Fuzzy Hash: 0D113970D0020ADFDB40EFB8C581B9EBBF5FF44304F1095A9C158AB39AEB705A468B91

Function 00E0A508 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d96fccef924e8e6886f8825cbbdcf65509632c85dd7d6bbd3adf2baf630f8ba
Instruction ID: b1c1c4d259c145a0a15387dcdecb4433273e55a8622062ffe4bdb82bfb21ab25
Opcode Fuzzy Hash: 4d96fccef924e8e6886f8825cbbdcf65509632c85dd7d6bbd3adf2baf630f8ba
Instruction Fuzzy Hash: 7A014C75E1020A9BDB149F69E8495AE7FB9FF88350B004439F91AE3281DB348D11CBA1

Function 00E0A4F9 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbc539ca5e63c01ce982348c9c4ea147fb9d168aa94b589847a606c917912240
Instruction ID: b858d84a5a3d6a55c820cab33a9bdef45025daa6559d607974c559316ed6d3f6
Opcode Fuzzy Hash: cbc539ca5e63c01ce982348c9c4ea147fb9d168aa94b589847a606c917912240
Instruction Fuzzy Hash: E0015EB2E0421A9FCB14DF6898589EE7FB5FB88310B11413AF955A3281DB304D12CB92

Function 00E0BB46 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5bf373cb0df76dbcb42d9831881d4e2b2ab58ae1e8a2b06480b2ffa5cf95ef3
Instruction ID: bc262791ad7baec85a4d3640e34f9c06402cd336a6c1fe7557215623a1118fc9
Opcode Fuzzy Hash: b5bf373cb0df76dbcb42d9831881d4e2b2ab58ae1e8a2b06480b2ffa5cf95ef3
Instruction Fuzzy Hash: 8D012876700200CFD724DB69D998B6AB3E6FF98725F15846DE14A9B3A4CB71EC84CB10

Function 00E0BEF8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b69ef014e439df60faefa8c3c20aaed7c69bd4ba5ec615d8bb2ed5ea4d3df63
Instruction ID: d0604e02552fca47eee7a40f329be3d4d90c42e20965bf24f3d327590d71d711
Opcode Fuzzy Hash: 1b69ef014e439df60faefa8c3c20aaed7c69bd4ba5ec615d8bb2ed5ea4d3df63
Instruction Fuzzy Hash: C3F0C83AB142049BCB151A74984926D3BAAEBC9251F144426F506C7381DF39CC479B51

Function 00E0C1B0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22b6a0c55fd269246d16dcfb4dc0534eeea8a40a9e1a191631f93efecc1d5c78
Instruction ID: 0b3aa6b9093926b08dbca62b4d13c1d6ad7e0fbde27d1ee6a97e700b1a6bd2fc
Opcode Fuzzy Hash: 22b6a0c55fd269246d16dcfb4dc0534eeea8a40a9e1a191631f93efecc1d5c78
Instruction Fuzzy Hash: FBF0A032B046219BCB19576AE41596EB7EAEFC5731714007AF509EB3A1CF32DC028B90

Function 00E046C9 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fd9438841095091022c61609ac59feceb2dccbe9c46532770aca8a40cc70846
Instruction ID: 9bdd166fe1ca07e9efb2a39242cf00d793b946cff3baf75237c48157aca64fde
Opcode Fuzzy Hash: 7fd9438841095091022c61609ac59feceb2dccbe9c46532770aca8a40cc70846
Instruction Fuzzy Hash: 36F0AC75565B428FE7112B70BCED6AE7B60EB0B3077446D45E00ED1276EBB104858B26

Function 00E0B9EA Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca5e76ecaf9475e938aefa5ca3b6a6ba496fd47d086add9e5095607a7ff73214
Instruction ID: 0e92b5e82a5c0d2084ed5dabe4e9ac5b17ee586e33cf7e66c7904e5f061c2543
Opcode Fuzzy Hash: ca5e76ecaf9475e938aefa5ca3b6a6ba496fd47d086add9e5095607a7ff73214
Instruction Fuzzy Hash: 8CF0B4B6A002089FCB51DFB9D5815DEBFF6FB4C350B54452AE209E3201E7349A468BD0

Function 00E0B9F8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29b621884009a915d2a6be7434c68b98b8e86d76e33c39679337ba585daacfde
Instruction ID: 0a29cee9f8f18ea642d2cb767a48e2f2894d1dff7adf753b0ded8637d012d35b
Opcode Fuzzy Hash: 29b621884009a915d2a6be7434c68b98b8e86d76e33c39679337ba585daacfde
Instruction Fuzzy Hash: 4CF08272A002089F8B50DFAD984099FFBF9FB88350B50453AD609E3201E770AA559BE1

Function 00E046D8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50b0fe45446682c78b72dcdd9935f712892f93ea5e9892c7f1cebc99e07f935d
Instruction ID: ef85eb74d99d884ef8e41f6da38eeeebbb324e1fb4219e46beede9ee8015f787
Opcode Fuzzy Hash: 50b0fe45446682c78b72dcdd9935f712892f93ea5e9892c7f1cebc99e07f935d
Instruction Fuzzy Hash: BEE099B4421B03CBE7103F60B9AC23E7AA5EB0B317B803C01A00EC1279AFB014D48A26

Function 00E01877 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37517656fffda0a2572abb6c6d8ca36ad318adc51ab6aed48dc0d9a2888c0bcf
Instruction ID: f1579ba0f19bfd48f9b5df4be42a734df56ab4817c166eca254169fd55aa65ca
Opcode Fuzzy Hash: 37517656fffda0a2572abb6c6d8ca36ad318adc51ab6aed48dc0d9a2888c0bcf
Instruction Fuzzy Hash: AAE09A319112AB8FC702EFA0DC444EEFB34EE82250B4546A3D010BF040EB30669ECB60

Function 00E01888 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac0e541a33b0e23f3888f4b3b9c1d1ee645cd4ebd030111646b5b6733cc24c7c
Instruction ID: 147ee78828227962921ec1eba055844c63657c25adc41008e53666b5b6430e1e
Opcode Fuzzy Hash: ac0e541a33b0e23f3888f4b3b9c1d1ee645cd4ebd030111646b5b6733cc24c7c
Instruction Fuzzy Hash: C1D01732E2126B968B00AAA5EC048EEB738EE96661B948626D52437140EB70665986A1

Function 00E04830 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3425122298.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_e00000_HUBED342024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b78b630be498b238b6db8d4e3a6125eda2d56cb166166b015c07d9706aeb42e
Instruction ID: e43fb81ca86a31caaaaf7d694de16ede69084fb42e314ae77adb861cf4703b93
Opcode Fuzzy Hash: 9b78b630be498b238b6db8d4e3a6125eda2d56cb166166b015c07d9706aeb42e
Instruction Fuzzy Hash: E8C04CA941D7C49EDB0B5F205565059BB70AE53305B2518EED082854A3E6254215C30B

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report HUBED342024.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: MassLogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HUBED342024.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1shwjbqh.wfb.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fcf5hmxf.2gr.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qkrnligi.ggr.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z3iwkv4x.r2w.ps1

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
HUBED342024.exe

Function 07299924 Relevance: 1.7, APIs: 1, Instructions: 247
processCOMMON

Function 07299930 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 00F0EDC2 Relevance: 1.7, APIs: 1, Instructions: 200
COMMON

Function 05154E60 Relevance: 1.6, APIs: 1, Instructions: 139
COMMON

Function 05156105 Relevance: 1.6, APIs: 1, Instructions: 117
COMMON

Function 05154EA8 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Function 05154FFC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Function 00F044C4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 00F0590C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 07033310 Relevance: 1.6, APIs: 1, Instructions: 74
COMMON

Function 072996A0 Relevance: 1.6, APIs: 1, Instructions: 73
injectionCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre