Edit tour

Windows Analysis Report
mark_v7.exe

Overview

General Information

Sample name:	mark_v7.exe
Analysis ID:	1580601
MD5:	53c8388962d7d25bfd57ddda57097212
SHA1:	a20d210fd3c0d006289025ccaa2f08a2b3d4fc0b
SHA256:	f35a62dc13fd9fc4707aac5039481f28c94ef217694df7ab8ea567a5d08ba920
Tags:	exemalwaretrojanuser-Joker
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

AI detected suspicious sample

Contains functionality to inject threads in other processes

Machine Learning detection for sample

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found large amount of non-executed APIs

Internet Provider seen in connection with other malware

Sigma detected: Communication To Uncommon Destination Ports

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

mark_v7.exe (PID: 3884 cmdline: "C:\Users\user\Desktop\mark_v7.exe" MD5: 53C8388962D7D25BFD57DDDA57097212)

conhost.exe (PID: 4152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Sigma Signatures

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 167.99.31.61, DestinationIsIpv6: false, DestinationPort: 8080, EventID: 3, Image: C:\Users\user\Desktop\mark_v7.exe, Initiated: true, ProcessId: 3884, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49699

Suricata Signatures

ET MALWARE Trojan-GameThief.Win32.OnLineGames.bnye Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-25T12:01:57.759310+0100	2012736	1	Malware Command and Control Activity Detected	192.168.2.6	49699	167.99.31.61	8080	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-25T12:01:57.759310+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	49699	167.99.31.61	8080	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: mark_v7.exe	Virustotal: Detection: 33%			Perma Link
Source: mark_v7.exe	ReversingLabs: Detection: 23%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 96.9% probability

Machine Learning detection for sample

Source: mark_v7.exe

Joe Sandbox ML: detected

Source: mark_v7.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\mark_v7.exe

Code function: 0_2_00007FF6A4F64178 FindFirstFileExW,

0_2_00007FF6A4F64178

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2012736 - Severity 1 - ET MALWARE Trojan-GameThief.Win32.OnLineGames.bnye Checkin : 192.168.2.6:49699 -> 167.99.31.61:8080

Source: global traffic

TCP traffic: 192.168.2.6:49699 -> 167.99.31.61:8080

Source: Joe Sandbox View

ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS

Source: Network traffic

Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:49699 -> 167.99.31.61:8080

Source: global traffic

HTTP traffic detected: GET /sc.wav HTTP/1.1User-Agent: Mozilla/5.0Host: vpn.reconix.co:8080Cache-Control: no-cache

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\mark_v7.exe

Code function: 0_2_00007FF6A4F54910 InternetOpenW,InternetSetOptionW,InternetSetOptionW,InternetSetOptionW,InternetOpenUrlW,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetSetOptionW,InternetCloseHandle,InternetCloseHandle,

0_2_00007FF6A4F54910

Source: global traffic

HTTP traffic detected: GET /sc.wav HTTP/1.1User-Agent: Mozilla/5.0Host: vpn.reconix.co:8080Cache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: vpn.reconix.co

Source: mark_v7.exe, 00000000.00000002.2119178428.0000024BABBB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vpn.reconix.co/
Source: mark_v7.exe, 00000000.00000002.2119178428.0000024BABBB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vpn.reconix.co/K
Source: mark_v7.exe	String found in binary or memory: http://vpn.reconix.co:8080/sc.wav
Source: mark_v7.exe, 00000000.00000002.2119178428.0000024BABB9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vpn.reconix.co:8080/sc.wav3f
Source: mark_v7.exe, 00000000.00000002.2119178428.0000024BABB9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vpn.reconix.co:8080/sc.wavM
Source: mark_v7.exe, 00000000.00000002.2119178428.0000024BABB9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vpn.reconix.co:8080/sc.wavR
Source: mark_v7.exe, 00000000.00000002.2119178428.0000024BABB9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://vpn.reconix.co:8080/sc.wavr

Source: C:\Users\user\Desktop\mark_v7.exe	Code function: 0_2_00007FF6A4F55E50	0_2_00007FF6A4F55E50
Source: C:\Users\user\Desktop\mark_v7.exe	Code function: 0_2_00007FF6A4F54910	0_2_00007FF6A4F54910
Source: C:\Users\user\Desktop\mark_v7.exe	Code function: 0_2_00007FF6A4F67F10	0_2_00007FF6A4F67F10
Source: C:\Users\user\Desktop\mark_v7.exe	Code function: 0_2_00007FF6A4F6CD58	0_2_00007FF6A4F6CD58
Source: C:\Users\user\Desktop\mark_v7.exe	Code function: 0_2_00007FF6A4F62DDC	0_2_00007FF6A4F62DDC
Source: C:\Users\user\Desktop\mark_v7.exe	Code function: 0_2_00007FF6A4F5E8D8	0_2_00007FF6A4F5E8D8
Source: C:\Users\user\Desktop\mark_v7.exe	Code function: 0_2_00007FF6A4F5D7E4	0_2_00007FF6A4F5D7E4
Source: C:\Users\user\Desktop\mark_v7.exe	Code function: 0_2_00007FF6A4F62948	0_2_00007FF6A4F62948
Source: C:\Users\user\Desktop\mark_v7.exe	Code function: 0_2_00007FF6A4F64178	0_2_00007FF6A4F64178
Source: C:\Users\user\Desktop\mark_v7.exe	Code function: 0_2_00007FF6A4F5D9E8	0_2_00007FF6A4F5D9E8
Source: C:\Users\user\Desktop\mark_v7.exe	Code function: 0_2_00007FF6A4F55450	0_2_00007FF6A4F55450
Source: C:\Users\user\Desktop\mark_v7.exe	Code function: 0_2_00007FF6A4F6345C	0_2_00007FF6A4F6345C
Source: C:\Users\user\Desktop\mark_v7.exe	Code function: 0_2_00007FF6A4F60494	0_2_00007FF6A4F60494
Source: C:\Users\user\Desktop\mark_v7.exe	Code function: 0_2_00007FF6A4F683AC	0_2_00007FF6A4F683AC
Source: C:\Users\user\Desktop\mark_v7.exe	Code function: 0_2_00007FF6A4F5E3B8	0_2_00007FF6A4F5E3B8
Source: C:\Users\user\Desktop\mark_v7.exe	Code function: 0_2_00007FF6A4F5DBEC	0_2_00007FF6A4F5DBEC

Source: classification engine

Classification label: mal68.evad.winEXE@2/1@1/1

Source: C:\Users\user\Desktop\mark_v7.exe

Code function: 0_2_00007FF6A4F543F0 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00007FF6A4F543F0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4152:120:WilError_03

Source: mark_v7.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\mark_v7.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: mark_v7.exe	Virustotal: Detection: 33%
Source: mark_v7.exe	ReversingLabs: Detection: 23%

Source: unknown	Process created: C:\Users\user\Desktop\mark_v7.exe "C:\Users\user\Desktop\mark_v7.exe"
Source: C:\Users\user\Desktop\mark_v7.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\mark_v7.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mark_v7.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\mark_v7.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\mark_v7.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\mark_v7.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\mark_v7.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mark_v7.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mark_v7.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\mark_v7.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\mark_v7.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mark_v7.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\mark_v7.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mark_v7.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mark_v7.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\mark_v7.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\mark_v7.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\mark_v7.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mark_v7.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mark_v7.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Users\user\Desktop\mark_v7.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: mark_v7.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: mark_v7.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: mark_v7.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: mark_v7.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: mark_v7.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: mark_v7.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: mark_v7.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: mark_v7.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: mark_v7.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: mark_v7.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: mark_v7.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: mark_v7.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: mark_v7.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: mark_v7.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\mark_v7.exe

API coverage: 8.5 %

Source: C:\Users\user\Desktop\mark_v7.exe

Code function: 0_2_00007FF6A4F64178 FindFirstFileExW,

0_2_00007FF6A4F64178

Source: mark_v7.exe, 00000000.00000002.2119178428.0000024BABB77000.00000004.00000020.00020000.00000000.sdmp, mark_v7.exe, 00000000.00000002.2119178428.0000024BABBC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: mark_v7.exe, 00000000.00000002.2119178428.0000024BABBC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW>

Source: C:\Users\user\Desktop\mark_v7.exe

Code function: 0_2_00007FF6A4F60C64 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF6A4F60C64

Source: C:\Users\user\Desktop\mark_v7.exe

Code function: 0_2_00007FF6A4F6685C GetProcessHeap,

0_2_00007FF6A4F6685C

Source: C:\Users\user\Desktop\mark_v7.exe	Code function: 0_2_00007FF6A4F59D44 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6A4F59D44
Source: C:\Users\user\Desktop\mark_v7.exe	Code function: 0_2_00007FF6A4F60C64 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6A4F60C64
Source: C:\Users\user\Desktop\mark_v7.exe	Code function: 0_2_00007FF6A4F5A4E8 SetUnhandledExceptionFilter,	0_2_00007FF6A4F5A4E8
Source: C:\Users\user\Desktop\mark_v7.exe	Code function: 0_2_00007FF6A4F5A344 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6A4F5A344

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\mark_v7.exe

Code function: 0_2_00007FF6A4F55450 VirtualAllocEx,WriteProcessMemory,_invalid_parameter,CreateRemoteThreadEx,GetThreadId,WaitForSingleObject,

0_2_00007FF6A4F55450

Source: C:\Users\user\Desktop\mark_v7.exe

Code function: 0_2_00007FF6A4F6CBA0 cpuid

0_2_00007FF6A4F6CBA0

Source: C:\Users\user\Desktop\mark_v7.exe

Code function: 0_2_00007FF6A4F5A224 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF6A4F5A224

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	11 Process Injection	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 DLL Side-Loading	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	12 System Information Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Link
mark_v7.exe	34%	Virustotal	Browse
mark_v7.exe	24%	ReversingLabs
mark_v7.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://vpn.reconix.co:8080/sc.wav	0%	Avira URL Cloud	safe
http://vpn.reconix.co/	0%	Avira URL Cloud	safe
http://vpn.reconix.co/K	0%	Avira URL Cloud	safe
http://vpn.reconix.co:8080/sc.wavR	0%	Avira URL Cloud	safe
http://vpn.reconix.co:8080/sc.wavM	0%	Avira URL Cloud	safe
http://vpn.reconix.co:8080/sc.wav3f	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
vpn.reconix.co	167.99.31.61	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://vpn.reconix.co:8080/sc.wav	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://vpn.reconix.co/K	mark_v7.exe, 00000000.00000002.2119178428.0000024BABBB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://vpn.reconix.co/	mark_v7.exe, 00000000.00000002.2119178428.0000024BABBB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://vpn.reconix.co:8080/sc.wavM	mark_v7.exe, 00000000.00000002.2119178428.0000024BABB9E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://vpn.reconix.co:8080/sc.wav3f	mark_v7.exe, 00000000.00000002.2119178428.0000024BABB9E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://vpn.reconix.co:8080/sc.wavR	mark_v7.exe, 00000000.00000002.2119178428.0000024BABB9E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://vpn.reconix.co:8080/sc.wavr	mark_v7.exe, 00000000.00000002.2119178428.0000024BABB9E000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
167.99.31.61	vpn.reconix.co	United States		14061	DIGITALOCEAN-ASNUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580601
Start date and time:	2024-12-25 12:01:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	mark_v7.exe
Detection:	MAL
Classification:	mal68.evad.winEXE@2/1@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 10 Number of non-executed functions: 37
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 4.175.87.197, 172.202.163.200
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DIGITALOCEAN-ASNUS	telnet.x86.elf	Get hash	malicious	Unknown	Browse	138.68.169.173
	armv7l.elf	Get hash	malicious	Mirai	Browse	138.197.191.101
	nabspc.elf	Get hash	malicious	Unknown	Browse	46.101.240.213
	arm.elf	Get hash	malicious	Unknown	Browse	134.122.107.59
	a1K847qsM0.exe	Get hash	malicious	Njrat	Browse	167.71.56.116
	https://flowto.it/8tooc2sec?fc=0	Get hash	malicious	Unknown	Browse	161.35.24.67
	https://qulatrics.com/	Get hash	malicious	Unknown	Browse	206.189.225.178
	https://qulatrics.com/	Get hash	malicious	Unknown	Browse	206.189.225.178
	https://liladelman.com/rental/1218-west-side-road-block-island/	Get hash	malicious	Unknown	Browse	159.89.55.215
	OZq1f2sZz3.exe	Get hash	malicious	AsyncRAT	Browse	104.236.39.42

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\mark_v7.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.682785614283304
Encrypted:	false
SSDEEP:	3:12OE4VbAZEkMJQXkyfnOBFReDRF2Iv:0Ovb+E3okQK0Rrv
MD5:	D5285F4EE776789D007ECF657E651AE2
SHA1:	F26C7502EFE3FEB19D7A95D6257C2B2EACA8F3B0
SHA-256:	7EEBC929D33573533AA6C33CF5400E6A973B2CC22CF8E119BACF3F82E85398DC
SHA-512:	1BD8833C7F02DDD3C70383EE4E6C6486F2515502AE0C751FEC1431FAF285BD963EA36AAA324246E9CF83CC2E421B6B2B1BB10BAB74BEF34B4741D7B8C79A5EDB
Malicious:	false
Reputation:	low
Preview:	[i] Checking.......[!] InternetOpenUrl failed with error: 12152....[!] Failed to get buffer....

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	5.944520754604166
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	mark_v7.exe
File size:	224'768 bytes
MD5:	53c8388962d7d25bfd57ddda57097212
SHA1:	a20d210fd3c0d006289025ccaa2f08a2b3d4fc0b
SHA256:	f35a62dc13fd9fc4707aac5039481f28c94ef217694df7ab8ea567a5d08ba920
SHA512:	b59287be8eeb663b7f6ee835325714775a495ca5d37a0cbe452f1a461cb4992e076e541cd8553be5fc846f91105e2fdae69bfccc82173b8dd06f90e493a707e8
SSDEEP:	3072:sQ+3DUdFE4tZnITe3DpQx6H/nps/wrZ91rlKJIUgN:fnoezpThywrP1UgN
TLSH:	F724810AA2DC7CE9C1B2C275A73687E4E32AFC118275C74E16C41356DEBE152BD25BE0
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P@...!...!...!.._Y...!.._Y...!.._Y...!.._Y...!...!..}!.......!.......!......<!.......!.......!....J..!...!"..!.......!..Rich.!.

File Icon


Icon Hash:	0d35784d5b5b4531

Static PE Info

General

Entrypoint:	0x140009d30
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x676B76BE [Wed Dec 25 03:06:38 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	7328d481aa902ed47f38a690392dd326

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F0C38AB0E00h
dec eax
add esp, 28h
jmp 00007F0C38AB0787h
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [0001534Bh]
dec eax
mov ecx, ebx
call dword ptr [0001533Ah]
call dword ptr [00015344h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [00015338h]
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [0001532Ch]
test eax, eax
je 00007F0C38AB0919h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [00021212h]
call 00007F0C38AB0AE2h
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [000212F9h], eax
dec eax
lea eax, dword ptr [esp+38h]
dec eax
add eax, 08h
dec eax
mov dword ptr [00021289h], eax
dec eax
mov eax, dword ptr [000212E2h]
dec eax
mov dword ptr [00021153h], eax
dec eax
mov eax, dword ptr [esp+40h]
dec eax
mov dword ptr [00021257h], eax
mov dword ptr [0002112Dh], C0000409h
mov dword ptr [00021127h], 00000001h
mov dword ptr [00021131h], 00000001h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x29184	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3d000	0xb620	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x3b000	0x13e0	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x49000	0xa98	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x27810	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x276d0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1f000	0x2e0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1d4c0	0x1d600	c60d10abbd31f4864dfaca5adc5ddbe2	False	0.5114611037234043	data	6.343624939363486	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1f000	0xab46	0xac00	cafea274428c3924cc41fee78ef5befe	False	0.4578034156976744	OpenPGP Secret Key Version 2	5.017051968584822	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2a000	0x10120	0x1000	0b65c312d085056333aa7b0fc6995082	False	0.2177734375	data	2.9682242461520474	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x3b000	0x13e0	0x1400	3e044d51ee287a858396c4baa0314942	False	0.491015625	PEX Binary Archive	5.239721566095961	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x3d000	0xb620	0xb800	e02ed0ed9c63f07b3046ab09986bb162	False	0.1734672214673913	data	3.8871426586005673	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x49000	0xa98	0xc00	ce74d870bb09d0ebaa08d8ba431a9b32	False	0.6520182291666666	data	5.750710658448876	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x3d270	0xb13	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.8867724867724868
RT_ICON	0x3dd88	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.10341151385927505
RT_ICON	0x3ec30	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.12229241877256318
RT_ICON	0x3f4d8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.11416184971098266
RT_ICON	0x3fa40	0xc4a	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9164017800381437
RT_ICON	0x40690	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.03672649976381672
RT_ICON	0x448b8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.04854771784232365
RT_ICON	0x46e60	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.0698874296435272
RT_ICON	0x47f08	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.1400709219858156
RT_GROUP_ICON	0x48370	0x84	data	English	United States	0.6590909090909091
RT_MANIFEST	0x483f8	0x224	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (488), with CRLF line terminators	English	United States	0.531021897810219

Imports

DLL

Import

WININET.dll

InternetReadFile, InternetSetOptionW, InternetCloseHandle, InternetOpenW, InternetOpenUrlW

KERNEL32.dll

RtlPcToFileHeader, WriteConsoleW, CreateFileW, HeapReAlloc, GetModuleHandleA, LoadLibraryA, lstrcmpiA, CreateRemoteThreadEx, WriteProcessMemory, WaitForSingleObject, CreateToolhelp32Snapshot, Process32NextW, Process32FirstW, CloseHandle, VirtualAllocEx, GetThreadId, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, HeapSize, RtlUnwindEx, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, EncodePointer, RaiseException, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, GetCommandLineA, GetCommandLineW, HeapAlloc, HeapFree, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW, GetFileType, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, SetStdHandle, GetStringTypeW, GetProcessHeap, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, GetFileSizeEx, SetFilePointerEx

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-25T12:01:57.759310+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	49699	167.99.31.61	8080	TCP
2024-12-25T12:01:57.759310+0100	2012736	ET MALWARE Trojan-GameThief.Win32.OnLineGames.bnye Checkin	1	192.168.2.6	49699	167.99.31.61	8080	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 25, 2024 12:01:55.054814100 CET	49699	8080	192.168.2.6	167.99.31.61
Dec 25, 2024 12:01:55.174252987 CET	8080	49699	167.99.31.61	192.168.2.6
Dec 25, 2024 12:01:55.174369097 CET	49699	8080	192.168.2.6	167.99.31.61
Dec 25, 2024 12:01:55.182706118 CET	49699	8080	192.168.2.6	167.99.31.61
Dec 25, 2024 12:01:55.302211046 CET	8080	49699	167.99.31.61	192.168.2.6
Dec 25, 2024 12:01:57.759211063 CET	8080	49699	167.99.31.61	192.168.2.6
Dec 25, 2024 12:01:57.759310007 CET	49699	8080	192.168.2.6	167.99.31.61
Dec 25, 2024 12:01:57.759485006 CET	49699	8080	192.168.2.6	167.99.31.61
Dec 25, 2024 12:01:57.879153013 CET	8080	49699	167.99.31.61	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 25, 2024 12:01:54.718370914 CET	49195	53	192.168.2.6	1.1.1.1
Dec 25, 2024 12:01:55.046338081 CET	53	49195	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 25, 2024 12:01:54.718370914 CET	192.168.2.6	1.1.1.1	0xa8	Standard query (0)	vpn.reconix.co	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 25, 2024 12:01:55.046338081 CET	1.1.1.1	192.168.2.6	0xa8	No error (0)	vpn.reconix.co		167.99.31.61	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

vpn.reconix.co:8080

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49699	167.99.31.61	8080	3884	C:\Users\user\Desktop\mark_v7.exe

Timestamp	Bytes transferred	Direction	Data
Dec 25, 2024 12:01:55.182706118 CET	101	OUT	GET /sc.wav HTTP/1.1 User-Agent: Mozilla/5.0 Host: vpn.reconix.co:8080 Cache-Control: no-cache

Target ID:	0
Start time:	06:01:52
Start date:	25/12/2024
Path:	C:\Users\user\Desktop\mark_v7.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\mark_v7.exe"
Imagebase:	0x7ff6a4f50000
File size:	224'768 bytes
MD5 hash:	53C8388962D7D25BFD57DDDA57097212
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	06:01:52
Start date:	25/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.1%
Total number of Nodes:	446
Total number of Limit Nodes:	13

Executed Functions

Function 00007FF6A4F54910 Relevance: 44.4, APIs: 14, Strings: 11, Instructions: 624
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET ref: 00007FF6A4F54966
InternetSetOptionW.WININET ref: 00007FF6A4F54BB1
InternetSetOptionW.WININET ref: 00007FF6A4F54BCF
InternetSetOptionW.WININET ref: 00007FF6A4F54BED
InternetOpenUrlW.WININET ref: 00007FF6A4F54C16

Strings

Mozilla/5.0, xrefs: 00007FF6A4F5495F
), xrefs: 00007FF6A4F54B73
9, xrefs: 00007FF6A4F5541F
[!] Memory allocation failed, xrefs: 00007FF6A4F54FB8
[, xrefs: 00007FF6A4F54E3A
[!] InternetOpenUrl failed with error: %lu, xrefs: 00007FF6A4F54D73
http://vpn.reconix.co:8080/sc.wav, xrefs: 00007FF6A4F54C0A
M, xrefs: 00007FF6A4F5508A
, xrefs: 00007FF6A4F55305
[!] InternetOpen failed with error: %lu, xrefs: 00007FF6A4F54AB7
[!] InternetReadFile failed with error: %lu, xrefs: 00007FF6A4F55228

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID: Internet$Option$Open
String ID: $)$9$M$Mozilla/5.0$[$[!] InternetOpen failed with error: %lu$[!] InternetOpenUrl failed with error: %lu$[!] InternetReadFile failed with error: %lu$[!] Memory allocation failed$http://vpn.reconix.co:8080/sc.wav
API String ID: 1764825000-940793784
Opcode ID: 1cc16f3be70016595ce96675624f6c0d382df198ba06adb5ab39610c8a3b450b
Instruction ID: 8ad9fcbcdabeea8f612b059bf2ce6ce6b0cf76d19fe20984a9f68161b44bcb5b
Opcode Fuzzy Hash: 1cc16f3be70016595ce96675624f6c0d382df198ba06adb5ab39610c8a3b450b
Instruction Fuzzy Hash: 0E520271A0D5928AE768DB38A8D53BF76E1EBD4301F40503AE58AC7AA9DE7CD405CF01

Function 00007FF6A4F55E50 Relevance: 13.5, Strings: 10, Instructions: 1037
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

*, xrefs: 00007FF6A4F56043
2, xrefs: 00007FF6A4F56CD1
[!] Failed to initialize API, xrefs: 00007FF6A4F5696D
[!] PID not found :( exiting..., xrefs: 00007FF6A4F563FA
[!] Failed to call OP: Status = 0x%08lx, xrefs: 00007FF6A4F56C14
B, xrefs: 00007FF6A4F56FDE
B, xrefs: 00007FF6A4F564B4
[+] PID = %d, xrefs: 00007FF6A4F56814
[!] Failed to get buffer, xrefs: 00007FF6A4F561CB
mspaint.exe, xrefs: 00007FF6A4F562A0

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID:
String ID: *$2$B$B$[!] Failed to call OP: Status = 0x%08lx$[!] Failed to get buffer$[!] Failed to initialize API$[!] PID not found :( exiting...$[+] PID = %d$mspaint.exe
API String ID: 0-3587932735
Opcode ID: 125ca28868dcf1f8980c76e48907f2a3240e1f812d13970b13bec600d3f0bf43
Instruction ID: 778c55be7a725c6398a34ada32c16d0c787cfeac02d814d88a3ae8f1339d316b
Opcode Fuzzy Hash: 125ca28868dcf1f8980c76e48907f2a3240e1f812d13970b13bec600d3f0bf43
Instruction Fuzzy Hash: B2A22F31A0D5924AE768DB3CACD53BF7AE19BD4301F00503AE59EC7AA6DE6CD805CB01

Function 00007FF6A4F6799C Relevance: 6.2, APIs: 4, Instructions: 218
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6A4F67987), ref: 00007FF6A4F67AB8
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6A4F67987), ref: 00007FF6A4F67B43

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 4e94c7dd292bbb1844349f8ba6a6562a6c97a9a5ec7bf7282ab70a4c1b87f342
Instruction ID: e906c9d8b409dd1595b69f6733f32fcfa7c8023a39e245db93b0bff3c2abc3e2
Opcode Fuzzy Hash: 4e94c7dd292bbb1844349f8ba6a6562a6c97a9a5ec7bf7282ab70a4c1b87f342
Instruction Fuzzy Hash: A491C772E1969289F7508F759CC02BDABE6BB85B88F146135DE0E976A9CF3CD441C700

Function 00007FF6A4F60108 Relevance: 4.5, APIs: 3, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6A4F60104), ref: 00007FF6A4F60119
TerminateProcess.KERNEL32(?,?,?,00007FF6A4F60104), ref: 00007FF6A4F60124
ExitProcess.KERNEL32 ref: 00007FF6A4F60133

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 75cd47252ca348697d664fbe1d63f24b799ff1fe1c3d7420bdb75bc166d426d2
Instruction ID: 49d9dfd17f8e69ae46e3608c61c7d4715a83a9da455955f3724bb24903457f63
Opcode Fuzzy Hash: 75cd47252ca348697d664fbe1d63f24b799ff1fe1c3d7420bdb75bc166d426d2
Instruction Fuzzy Hash: F0D09E10F1A6C65AEA186F709DD517992515FC9741F503838D90F873B3DE2DA44D8610

Function 00007FF6A4F59BB4 Relevance: 3.1, APIs: 2, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6A4F5A020: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6A4F5A034

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6A4F59BDD
__scrt_release_startup_lock.LIBCMT ref: 00007FF6A4F59C4B

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 1236291503-0
Opcode ID: a66286efb5a1ddf67842e73e227ff26c37883cb43728f71b61ba9f623028d243
Instruction ID: 57c4d58fee5fb94c577c1d4fe0e70937b14752be9992543991c846bd0d82388f
Opcode Fuzzy Hash: a66286efb5a1ddf67842e73e227ff26c37883cb43728f71b61ba9f623028d243
Instruction Fuzzy Hash: 19314B31E0E64342FA18AB359CD57B95291AFC5784F44A035EA4EC72F7DE6DA405C212

Function 00007FF6A4F674EC Relevance: 3.1, APIs: 2, Instructions: 74
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE ref: 00007FF6A4F6759F
GetLastError.KERNEL32 ref: 00007FF6A4F675BB

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 8b83b15cc7c4a0d3b101f8f03bbeaddeebe49cb913055b88c9d1f2e5de7b0d23
Instruction ID: 14a0e847c139bf282258b946e2c77e03d4c4ea6c1cf161abd529ce8f9342f616
Opcode Fuzzy Hash: 8b83b15cc7c4a0d3b101f8f03bbeaddeebe49cb913055b88c9d1f2e5de7b0d23
Instruction Fuzzy Hash: 6931D772A1AB858AEB109F35E8C06A9B7A2FB98780F446432DB4DC3765DF3CD516C700

Function 00007FF6A4F61BF8 Relevance: 3.1, APIs: 2, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32 ref: 00007FF6A4F61C71
GetFileType.KERNELBASE ref: 00007FF6A4F61C87

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 9fd783dc2a4900c3051b301bdee6de2fd5b39a3cbceec82b59b58416dab91fa5
Instruction ID: fa81fff0bdcfacbd0f9d50c068afe7e60c8a8c5f33fac37072425e9fca165d51
Opcode Fuzzy Hash: 9fd783dc2a4900c3051b301bdee6de2fd5b39a3cbceec82b59b58416dab91fa5
Instruction Fuzzy Hash: BD314431E19B9591EB648B259AD01BCA650FB85BB4B642339DB6E873F0CF38E451D340

Function 00007FF6A4F60039 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6A4F60067

Part of subcall function 00007FF6A4F60160: GetModuleHandleExW.KERNEL32 ref: 00007FF6A4F60185
Part of subcall function 00007FF6A4F60160: GetProcAddress.KERNEL32 ref: 00007FF6A4F6019B
Part of subcall function 00007FF6A4F60160: FreeLibrary.KERNEL32 ref: 00007FF6A4F601C2

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: d25aa29243dea4088ad385749646983487e0f95e9894d38747cc099433b70f8d
Instruction ID: 837099060bc4f72be0b96ac3bb329ef9c42e06948ea54d08c4eabf4caa75b523
Opcode Fuzzy Hash: d25aa29243dea4088ad385749646983487e0f95e9894d38747cc099433b70f8d
Instruction Fuzzy Hash: B1216D32A166819EEB24DFB4C8802BC73A4EB8471CF241635D75D87AE6DF38D584CB40

Function 00007FF6A4F53E40 Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_vfwprintf_l.LIBCONCRTD ref: 00007FF6A4F53E8B

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID: _vfwprintf_l
String ID:
API String ID: 1692953108-0
Opcode ID: f4572c094ca873bd20381e012b646367b31b00622fe0f684fecc9b91589cd55f
Instruction ID: c486e23210ae1c95900e6b2bef6b26f5ab720e8bb603dbc6db5d66ea283a4cc1
Opcode Fuzzy Hash: f4572c094ca873bd20381e012b646367b31b00622fe0f684fecc9b91589cd55f
Instruction Fuzzy Hash: 97F0F232A19B8086E620DB24F89161AB7A0FB88394F406225EACC87B29DF3CC1108B40

Function 00007FF6A4F5A020 Relevance: 1.5, APIs: 1, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6A4F5A034

Part of subcall function 00007FF6A4F5AAF0: __vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00007FF6A4F5AAF8
Part of subcall function 00007FF6A4F5AAF0: __vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00007FF6A4F5AAFD

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID: __scrt_dllmain_crt_thread_attach__vcrt_uninitialize_locks__vcrt_uninitialize_ptd
String ID:
API String ID: 1208906642-0
Opcode ID: b5fc25849003a3a8ada5ab860e3edbd7bd8deed7f2fec2fd8e76e0a2fb528f7b
Instruction ID: 0cb5a14e833e9c742f56a135dc04811fbbb897663836d8e47d742d5c4bed1bcb
Opcode Fuzzy Hash: b5fc25849003a3a8ada5ab860e3edbd7bd8deed7f2fec2fd8e76e0a2fb528f7b
Instruction Fuzzy Hash: BCE0B670D1F24384FE683A311DD22B906802FA5349F50B07BD50EC31A39E9E34769663

Non-executed Functions

Function 00007FF6A4F55450 Relevance: 30.3, APIs: 6, Strings: 11, Instructions: 560memoryinjectionCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6A4F53E40: _vfwprintf_l.LIBCONCRTD ref: 00007FF6A4F53E8B

VirtualAllocEx.KERNEL32 ref: 00007FF6A4F554DD
WriteProcessMemory.KERNEL32 ref: 00007FF6A4F55585
_invalid_parameter.LIBCMTD ref: 00007FF6A4F557D3

Strings

Z, xrefs: 00007FF6A4F55709
[, xrefs: 00007FF6A4F55E22
[i] Changing permissions to READ_EXECUTE, xrefs: 00007FF6A4F5571E
[+] Clean Up, xrefs: 00007FF6A4F55D65
[!] Failed to call CRT: Status = 0x%08lx, xrefs: 00007FF6A4F55B1B
[i] Calling CreateRemoteThreadEx to execute the shellcode, xrefs: 00007FF6A4F5597A
[!] Failed to change permissions to READ_EXECUTE: Status = 0x%08lx, xrefs: 00007FF6A4F558A8
[i] size: %lu bytes, xrefs: 00007FF6A4F554A5
[i] Thread ID: %lu, xrefs: 00007FF6A4F55D49
K, xrefs: 00007FF6A4F55BD8
[!] Failed to call WriteProcessMemory: Status = 0x%08lx, xrefs: 00007FF6A4F5564F

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID: AllocMemoryProcessVirtualWrite_invalid_parameter_vfwprintf_l
String ID: K$Z$[$[!] Failed to call CRT: Status = 0x%08lx$[!] Failed to call WriteProcessMemory: Status = 0x%08lx$[!] Failed to change permissions to READ_EXECUTE: Status = 0x%08lx$[+] Clean Up$[i] Calling CreateRemoteThreadEx to execute the shellcode$[i] Changing permissions to READ_EXECUTE$[i] Thread ID: %lu$[i] size: %lu bytes
API String ID: 1260537430-2531971748
Opcode ID: af27fc23d4f720fcdd1a3f81f4176ef7d0de5332f78082368a147727be6b4980
Instruction ID: ad9a041c0abdc2b2a73cc3b1cf23c7b6a8bb42393ef11bf664b90d3f8efd0e2f
Opcode Fuzzy Hash: af27fc23d4f720fcdd1a3f81f4176ef7d0de5332f78082368a147727be6b4980
Instruction Fuzzy Hash: 6F421471A0D5928AE768DB38A8D43BF76E1EBD4301F00513AE589C7AA9DE7CD905CF01

Function 00007FF6A4F683AC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMONLIBRARYCODE

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF6A4F683FA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6A4F68A66
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6A4F68BDC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6A4F68E9A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6A4F690BA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6A4F692F7
memcpy_s.LIBCPMT ref: 00007FF6A4F693D2
memcpy_s.LIBCPMT ref: 00007FF6A4F6947D
memcpy_s.LIBCPMT ref: 00007FF6A4F6954C

Strings

1#IND, xrefs: 00007FF6A4F684E7
1#INF, xrefs: 00007FF6A4F68523
1#SNAN, xrefs: 00007FF6A4F6850A
1#QNAN, xrefs: 00007FF6A4F68513

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 22158d967f507a41f7d4223f1c49d9dbd0af371d615fed8ca836a079cd5b1536
Instruction ID: 30adad060cf521b57cfc81886861459fcefc790f907805998671d708af5c1ef8
Opcode Fuzzy Hash: 22158d967f507a41f7d4223f1c49d9dbd0af371d615fed8ca836a079cd5b1536
Instruction Fuzzy Hash: 3EB2D972A1A2D28BE7648F74D980BFDB7A1FB94744F506139DA0D97A94DF3CA900CB40

Function 00007FF6A4F543F0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 311processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF6A4F5441D
Process32FirstW.KERNEL32 ref: 00007FF6A4F54617

Strings

$, xrefs: 00007FF6A4F545EA
E, xrefs: 00007FF6A4F548DB

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID: CreateFirstProcess32SnapshotToolhelp32
String ID: $$E
API String ID: 2353314856-928736151
Opcode ID: 27f4ea1f1bf3220c08c763b2075ef71db40dc3594e777dbe87ea2a6dd8378b8f
Instruction ID: 8d391ef759ac648f836759a47a3a9abfeed0f75744c2f4545d98e737aec580ce
Opcode Fuzzy Hash: 27f4ea1f1bf3220c08c763b2075ef71db40dc3594e777dbe87ea2a6dd8378b8f
Instruction Fuzzy Hash: 41D11071A0D5924BD768DB3CA8D537B7AE1EBC4301F10513AE68AC7AA9DE6CD805CF01

Function 00007FF6A4F5A344 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6A4F5A360
RtlCaptureContext.KERNEL32 ref: 00007FF6A4F5A38D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6A4F5A3A7
RtlVirtualUnwind.KERNEL32 ref: 00007FF6A4F5A3E8
IsDebuggerPresent.KERNEL32 ref: 00007FF6A4F5A43C
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6A4F5A459
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6A4F5A464

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: bc5d155351869abd3934ceb4587d6c72f84c0e544f419129d2cd5d9115ac6f4b
Instruction ID: fc3b473d6def05761a1d0374d7371cd7dbfe764e5e9e595febaf7295b7e839dc
Opcode Fuzzy Hash: bc5d155351869abd3934ceb4587d6c72f84c0e544f419129d2cd5d9115ac6f4b
Instruction Fuzzy Hash: 7B313072A0AB8196EB608F70E8803ED7364FB84748F44543ADB4E87BA9DF78D558C710

Function 00007FF6A4F60C64 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6A4F60CDD
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6A4F60CF5
RtlVirtualUnwind.KERNEL32 ref: 00007FF6A4F60D30
IsDebuggerPresent.KERNEL32 ref: 00007FF6A4F60D69
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6A4F60D73
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6A4F60D7E

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 8e59c9358d1640dcb3c9bfe80af94b7b5c29a699d3f0c094609e3e576e38442c
Instruction ID: 48f19df72324740dbed2d5db630e2330e8a5b9d357388b9a0a8f2fbfa135fd06
Opcode Fuzzy Hash: 8e59c9358d1640dcb3c9bfe80af94b7b5c29a699d3f0c094609e3e576e38442c
Instruction Fuzzy Hash: 5B315E32619B819ADB60CF35E8802AE73A0FBC8754F501536EA9D83B65DF38D555CB00

Function 00007FF6A4F5A224 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6A4F5A250
GetCurrentThreadId.KERNEL32 ref: 00007FF6A4F5A25E
GetCurrentProcessId.KERNEL32 ref: 00007FF6A4F5A26A
QueryPerformanceCounter.KERNEL32 ref: 00007FF6A4F5A27A

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 09b34e5eb01b65e21e5ab57414b660caf1064f2ae994193f6f09143ea654af88
Instruction ID: 62d4a8fef68c4421bb088b191a96c4ac6fcc6a17e532ade4a007db037c03d016
Opcode Fuzzy Hash: 09b34e5eb01b65e21e5ab57414b660caf1064f2ae994193f6f09143ea654af88
Instruction Fuzzy Hash: 0F111C22B19B018AEB008F70EC952A833A4FB59758F442E31DA6D877A4DF7CD1648340

Function 00007FF6A4F67F10 Relevance: 4.8, APIs: 3, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF6A4F67F76
memcpy_s.LIBCPMT ref: 00007FF6A4F67FA1

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: b41cb84a548d2e61bdeb7bb10330278f5fecde395d7a0ce6ff99175555b28b3c
Instruction ID: c46763b9b502b3b887af65583fa52a5148d14ae862e7ae2ac72b3bac8832411d
Opcode Fuzzy Hash: b41cb84a548d2e61bdeb7bb10330278f5fecde395d7a0ce6ff99175555b28b3c
Instruction Fuzzy Hash: 31C1E472B1A6C687EB24CF29A48466AF791F7C4B84F44A139DB4A83754DF3DE901CB40

Function 00007FF6A4F6CD58 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF6A4F6CFA7
RaiseException.KERNEL32 ref: 00007FF6A4F6CFB8

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: f33f0bd377485474e369ffe98575429038715d08cf8a835ef38705ff0538d6ee
Instruction ID: be8a18da2c905ce06c1b4018f8915f900b48513ee291a144027d2c67090cc6a1
Opcode Fuzzy Hash: f33f0bd377485474e369ffe98575429038715d08cf8a835ef38705ff0538d6ee
Instruction Fuzzy Hash: 45B13B73A06BC5CAEB15CF29C8863687BA0F784B88F159925DA9D877B8CF39D451C700

Function 00007FF6A4F62DDC Relevance: 2.6, Strings: 2, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

Strings

gfff, xrefs: 00007FF6A4F62F66
e+000, xrefs: 00007FF6A4F62EE9

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: 45b46012d1c0bf26ac58a82852236fe0cc570d8ff39719d27a42e62241cab812
Instruction ID: a63ef6debd535cd3ccb0a7067fe6b1fd68cc1e4e59fdeff390bafb42d15c036a
Opcode Fuzzy Hash: 45b46012d1c0bf26ac58a82852236fe0cc570d8ff39719d27a42e62241cab812
Instruction Fuzzy Hash: 71516A62B1D2C246E7249E359C80769FB91F794B94F09E235CB988BAE5CF7DD4408700

Function 00007FF6A4F64178 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b397099d2791fc469ffcdc7faae3aec4ebe3785fccec4a2873f13ca3cb35dc6d
Instruction ID: 51ff057e6c6783ef1cf8d355f77f353aa65a42549df7c7d02c2308c130221d63
Opcode Fuzzy Hash: b397099d2791fc469ffcdc7faae3aec4ebe3785fccec4a2873f13ca3cb35dc6d
Instruction Fuzzy Hash: 0C51F722B097D185FB10AB76AD805AEBBA1FB80794F245135EE5CA7BA9DF3CD401C704

Function 00007FF6A4F62948 Relevance: 1.5, Strings: 1, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF6A4F62C8A

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: 5d3aa5215e7b1499e55759fc0027dbc7cd5f8292022a9b8a81994a20105cf082
Instruction ID: 1b803ddc3994100c4798099422f7f54580f09fc155dcb714e6bd854b94fa37df
Opcode Fuzzy Hash: 5d3aa5215e7b1499e55759fc0027dbc7cd5f8292022a9b8a81994a20105cf082
Instruction Fuzzy Hash: 55A15762B0A7C646EB21DF39A8807ADFB94EB91B84F06A031DE4D877A5DE3DD501C701

Function 00007FF6A4F5E3B8 Relevance: 1.5, Strings: 1, Instructions: 250COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 00007FF6A4F5E5C2

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 9292c1909d4d5ff6e19cd41967842bf288430eb099d74b57b4701dd6f40ec8f4
Instruction ID: e31d5b1d36ad31b1da5327e44c9a7a9849cf2f9ed230e639dbeb90a19c8141ba
Opcode Fuzzy Hash: 9292c1909d4d5ff6e19cd41967842bf288430eb099d74b57b4701dd6f40ec8f4
Instruction Fuzzy Hash: 10B1B176A1A78185E7A48F39C89027D3BA4EB85F88F18A135DA4DC73ADDF39D440C742

Function 00007FF6A4F6685C Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6A4F66860

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 7b84f975143446e2cbcd9f8a2807d50c1265a4eafd489251f556ad3b39486447
Instruction ID: e061977f487819f45f4e78194dfb3c27ffab262c554d20e499b4b1214b978602
Opcode Fuzzy Hash: 7b84f975143446e2cbcd9f8a2807d50c1265a4eafd489251f556ad3b39486447
Instruction Fuzzy Hash: B5B09224E0BA82C2EA082B316CC221422E4BF88700F985138C00CC2330DF2C20B56B10

Function 00007FF6A4F5E8D8 Relevance: .4, Instructions: 351COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e038a71e764e5f07ea2d3f7507c68c1bff02966f0ea4b3a5e2a13bfc42550c64
Instruction ID: 27e054b3b0433e4dcec1ec82004af0f48e4d9fb7920bae254ba705bd5faeffca
Opcode Fuzzy Hash: e038a71e764e5f07ea2d3f7507c68c1bff02966f0ea4b3a5e2a13bfc42550c64
Instruction Fuzzy Hash: A4E19032A0964285E7E48B38C9D837827A1EB85B58F14E235CA4DC76EDDF29E841C302

Function 00007FF6A4F6345C Relevance: .2, Instructions: 198COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0beef57d4d81ae4f9477feb73e5011971a425e07953d9e6409e3cb8347ca993
Instruction ID: c77e0589ccba6cee8f534d29193a7a46249b298d2b9c34b8ca3476022d49ae47
Opcode Fuzzy Hash: c0beef57d4d81ae4f9477feb73e5011971a425e07953d9e6409e3cb8347ca993
Instruction Fuzzy Hash: 2281C272A0D7C146E774CB29988176AEA91FBC5794F545239DE8E83BA9DF3DE4008B00

Function 00007FF6A4F5D7E4 Relevance: .1, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91f19b1489606b8bc19d5a4809129a5af38383a0e9e623e80f569da898e81a1e
Instruction ID: 6f326178f71e73cf4b833fcbf885b5c61bd1c6055584950bc988b316dff87097
Opcode Fuzzy Hash: 91f19b1489606b8bc19d5a4809129a5af38383a0e9e623e80f569da898e81a1e
Instruction Fuzzy Hash: 93516476A1B65186E7248B39C48033837A0EB95F59F24E131CE8D977B5CF3AE842C781

Function 00007FF6A4F5D9E8 Relevance: .1, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5768c36f5caadb0d001be6ede6c0a97f1360bd3ad018192d3e7a341192088c4
Instruction ID: 03c2567107501ddd147b623935a12c366bac10f9715c9b6dc508f36f258d137a
Opcode Fuzzy Hash: f5768c36f5caadb0d001be6ede6c0a97f1360bd3ad018192d3e7a341192088c4
Instruction Fuzzy Hash: 05517376A1B65186E7648B39C48022937A1EBC4F58F28E131CE4C977B5CF3AE942C742

Function 00007FF6A4F5DBEC Relevance: .1, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4804d1b93ce0b97165496bd195f56fd62168f29abec30e04b3eb9e9b2791b78
Instruction ID: 1a9fc7ce232ebc52635ec9555c1e7aad792f3b155c7a6e18ab4548a9d1a3752c
Opcode Fuzzy Hash: b4804d1b93ce0b97165496bd195f56fd62168f29abec30e04b3eb9e9b2791b78
Instruction Fuzzy Hash: 97519F76A1BA5186E7258B39C89423837B0EB85F58F25E131CA4D877A4CF7AE843C741

Function 00007FF6A4F60494 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: e39d3a6a4745a9ca475ce6e16f80eb61d7b6675672aa413b282b817f4f332eb4
Instruction ID: b0af4668889e99eb96d3e8b19c23d80a55a37cdb3c793734a8c627ff28791fa1
Opcode Fuzzy Hash: e39d3a6a4745a9ca475ce6e16f80eb61d7b6675672aa413b282b817f4f332eb4
Instruction Fuzzy Hash: 0B41D462B15A9585EF08CF3ADD94169A3A1BB88FC0B59A432DE0DD7B68DF3CD4418300

Function 00007FF6A4F6CBA0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06765e3e769664596c98c1387e2f6e4fe9174840ac955173aff2e886965b2cc6
Instruction ID: 662098ef8528d2c0eacd89c9015ee540f8d5aa3aced0d7d25487249242e1b5ba
Opcode Fuzzy Hash: 06765e3e769664596c98c1387e2f6e4fe9174840ac955173aff2e886965b2cc6
Instruction Fuzzy Hash: 47F04F71B1D2D5CADBA4CF28AC826297791E748384B90913ED68DC3A24DA3C90608F44

Function 00007FF6A4F5A4E8 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d852e4f6dd6e88fc97deae05714aa7b452463a0eb018e0a0a536b7ed936e6541
Instruction ID: 7ec774d92f66e6e8a3df279323b815018b2dd24142fe6548bc974657ed381676
Opcode Fuzzy Hash: d852e4f6dd6e88fc97deae05714aa7b452463a0eb018e0a0a536b7ed936e6541
Instruction Fuzzy Hash: 5CA0012290E846A4E6048B60AC941216620AB90300B817432C11D879719E7CA490C261

Function 00007FF6A4F5BC70 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF6A4F5BCCD

Part of subcall function 00007FF6A4F5CC14: __GetUnwindTryBlock.LIBCMT ref: 00007FF6A4F5CC57
Part of subcall function 00007FF6A4F5CC14: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF6A4F5CC7C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6A4F5BDA5
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF6A4F5BFF3
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6A4F5C100

Strings

csm, xrefs: 00007FF6A4F5BD4E
csm, xrefs: 00007FF6A4F5BCE7
csm, xrefs: 00007FF6A4F5BDC8

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 06d78aa3b8356eedd2fca4e3a56e75d54ba4396f55f007474ca930dfdee9f5da
Instruction ID: e646efb29deb02aca9c890f499f8b265d6e39173a5f50e33bd0a049560446804
Opcode Fuzzy Hash: 06d78aa3b8356eedd2fca4e3a56e75d54ba4396f55f007474ca930dfdee9f5da
Instruction Fuzzy Hash: 69D184329097818AEB20DF75D8803AD77A0FB85789F14A135EE4D97B66CF38E090C742

Function 00007FF6A4F61140 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF6A4F61552), ref: 00007FF6A4F612BC
GetProcAddress.KERNEL32(?,?,?,00007FF6A4F61552), ref: 00007FF6A4F612C8

Strings

api-ms-, xrefs: 00007FF6A4F61206
ext-ms-, xrefs: 00007FF6A4F61219

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: ddb3ae1cebc378c8412ada9312686c7672396f7e2ca393543f714a7511f8aa28
Instruction ID: 7e88a56f062826628b597f0e3af3406d6d972377898d693582938bc2762a46c3
Opcode Fuzzy Hash: ddb3ae1cebc378c8412ada9312686c7672396f7e2ca393543f714a7511f8aa28
Instruction Fuzzy Hash: 2C41CB21B1AA8285EE55DB36AD806B6A395BF85B90F486635DD0DC77A8EF3CE405C300

Function 00007FF6A4F5AF24 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF6A4F5B1D6,?,?,?,00007FF6A4F5AEC8,?,?,?,00007FF6A4F5AAD1), ref: 00007FF6A4F5AFA9
GetLastError.KERNEL32(?,?,?,00007FF6A4F5B1D6,?,?,?,00007FF6A4F5AEC8,?,?,?,00007FF6A4F5AAD1), ref: 00007FF6A4F5AFB7
LoadLibraryExW.KERNEL32(?,?,?,00007FF6A4F5B1D6,?,?,?,00007FF6A4F5AEC8,?,?,?,00007FF6A4F5AAD1), ref: 00007FF6A4F5AFE1
FreeLibrary.KERNEL32(?,?,?,00007FF6A4F5B1D6,?,?,?,00007FF6A4F5AEC8,?,?,?,00007FF6A4F5AAD1), ref: 00007FF6A4F5B04F
GetProcAddress.KERNEL32(?,?,?,00007FF6A4F5B1D6,?,?,?,00007FF6A4F5AEC8,?,?,?,00007FF6A4F5AAD1), ref: 00007FF6A4F5B05B

Strings

api-ms-, xrefs: 00007FF6A4F5AFC9

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 5002c3478240859d91d603377b4c8c51d1ae95930c09dffe45f68fcb7a3bfa4d
Instruction ID: a339f599dcc22e83b779181a844eddef10855c5c0c449ed0d6df13721d0f5eba
Opcode Fuzzy Hash: 5002c3478240859d91d603377b4c8c51d1ae95930c09dffe45f68fcb7a3bfa4d
Instruction Fuzzy Hash: 0731EE31A1BB4295EE11DB22AC8067573D4BF84BA0F59A535DD2D8B3A4EF3CE445C301

Function 00007FF6A4F621E8 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6A4F621F7
FlsGetValue.KERNEL32 ref: 00007FF6A4F6220C
FlsSetValue.KERNEL32 ref: 00007FF6A4F6222D
FlsSetValue.KERNEL32 ref: 00007FF6A4F6225A
FlsSetValue.KERNEL32 ref: 00007FF6A4F6226B
FlsSetValue.KERNEL32 ref: 00007FF6A4F6227C
SetLastError.KERNEL32 ref: 00007FF6A4F62297

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: fd3f4e450e7988948c209e1879f635c239aea1308d636bb6eeb1547c5c7661e5
Instruction ID: 0c2ea16c3aed831fb5f543138d8d2a9236715f75d19d445d5c9bcbc9d411c169
Opcode Fuzzy Hash: fd3f4e450e7988948c209e1879f635c239aea1308d636bb6eeb1547c5c7661e5
Instruction Fuzzy Hash: 4B213E24F0F6C242FA54A7719EC1179D2529FC97B0F156F34D92E87AFBDE2CA4418600

Function 00007FF6A4F6C568 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF6A4F6C599
GetLastError.KERNEL32 ref: 00007FF6A4F6C5A5
CloseHandle.KERNEL32 ref: 00007FF6A4F6C5BD
CreateFileW.KERNEL32 ref: 00007FF6A4F6C5E8
WriteConsoleW.KERNEL32 ref: 00007FF6A4F6C607

Strings

CONOUT$, xrefs: 00007FF6A4F6C5C9

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 7080f1759af1962fb33c0ec0e422b44054395cda6b270677adb39bf0a386a5ef
Instruction ID: 4b39a429d3036e50a64f5796bd9c0913e28a760624d63ba1ebaa54fb12141b8a
Opcode Fuzzy Hash: 7080f1759af1962fb33c0ec0e422b44054395cda6b270677adb39bf0a386a5ef
Instruction Fuzzy Hash: 16116621B19B8186E7508B62EC94325B3A0FBC8FE4F045234EA5EC77A4DF7CD4548744

Function 00007FF6A4F62360 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6A4F61075,?,?,?,?,00007FF6A4F610F3,?,?,00000000,00007FF6A4F6247E,?,?,?), ref: 00007FF6A4F6236F
FlsSetValue.KERNEL32(?,?,?,00007FF6A4F61075,?,?,?,?,00007FF6A4F610F3,?,?,00000000,00007FF6A4F6247E,?,?,?), ref: 00007FF6A4F623A5
FlsSetValue.KERNEL32(?,?,?,00007FF6A4F61075,?,?,?,?,00007FF6A4F610F3,?,?,00000000,00007FF6A4F6247E,?,?,?), ref: 00007FF6A4F623D2
FlsSetValue.KERNEL32(?,?,?,00007FF6A4F61075,?,?,?,?,00007FF6A4F610F3,?,?,00000000,00007FF6A4F6247E,?,?,?), ref: 00007FF6A4F623E3
FlsSetValue.KERNEL32(?,?,?,00007FF6A4F61075,?,?,?,?,00007FF6A4F610F3,?,?,00000000,00007FF6A4F6247E,?,?,?), ref: 00007FF6A4F623F4
SetLastError.KERNEL32(?,?,?,00007FF6A4F61075,?,?,?,?,00007FF6A4F610F3,?,?,00000000,00007FF6A4F6247E,?,?,?), ref: 00007FF6A4F6240F

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 683b331be4a16bc35bf86e6167d4d1af5cc8b9268dbd908459ed21f39154743b
Instruction ID: 6c433956741e44be47f74a44b59c24460a95d542d4a999ba074c5425e26763a8
Opcode Fuzzy Hash: 683b331be4a16bc35bf86e6167d4d1af5cc8b9268dbd908459ed21f39154743b
Instruction Fuzzy Hash: F1114F20F0F2C282FA54A7355ED2179E2429FC57B0F156B35D93E876F7DE6CA4418601

Function 00007FF6A4F60160 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6A4F60185
GetProcAddress.KERNEL32 ref: 00007FF6A4F6019B
FreeLibrary.KERNEL32 ref: 00007FF6A4F601C2

Strings

CorExitProcess, xrefs: 00007FF6A4F60194
mscoree.dll, xrefs: 00007FF6A4F6017C

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b9b0cf25f5d9b6d9b83dfe1f7fa100c23d288bf055f6122e27c5178e075af21a
Instruction ID: 9e354a99ca027367218525179a2c51ec69881147bb972ad00d458703aa7256fd
Opcode Fuzzy Hash: b9b0cf25f5d9b6d9b83dfe1f7fa100c23d288bf055f6122e27c5178e075af21a
Instruction Fuzzy Hash: E7F04F21A1EB4686FA148B34ECD437AA320AFC9BA1F642635C56D872F4CF2CD444CB10

Function 00007FF6A4F6C9A0 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6A4F6C9C8
_set_statfp.LIBCMT ref: 00007FF6A4F6C9E3
_set_statfp.LIBCMT ref: 00007FF6A4F6C9FF
_set_statfp.LIBCMT ref: 00007FF6A4F6CA3B

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
Instruction ID: 9b68094840dd2d860fc2cb28f9a5975b4ce4ead21a7c6919426d53f91c615999
Opcode Fuzzy Hash: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
Instruction Fuzzy Hash: 0311C132E1EAD381F7545578EEE6375A0416FD9370F092230EAEEC72F6CE6CA8815201

Function 00007FF6A4F62428 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF6A4F60BF3,?,?,00000000,00007FF6A4F60E8E), ref: 00007FF6A4F62447
FlsSetValue.KERNEL32(?,?,?,00007FF6A4F60BF3,?,?,00000000,00007FF6A4F60E8E), ref: 00007FF6A4F62466
FlsSetValue.KERNEL32(?,?,?,00007FF6A4F60BF3,?,?,00000000,00007FF6A4F60E8E), ref: 00007FF6A4F6248E
FlsSetValue.KERNEL32(?,?,?,00007FF6A4F60BF3,?,?,00000000,00007FF6A4F60E8E), ref: 00007FF6A4F6249F
FlsSetValue.KERNEL32(?,?,?,00007FF6A4F60BF3,?,?,00000000,00007FF6A4F60E8E), ref: 00007FF6A4F624B0

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 59724d992d15333fa193ce278d53c702b6214a622c873772a7334d43b8997db6
Instruction ID: 7d4709b22b057d51bad0b0818e2a186e30334e3deeb8ac4fa11de063e59a9996
Opcode Fuzzy Hash: 59724d992d15333fa193ce278d53c702b6214a622c873772a7334d43b8997db6
Instruction Fuzzy Hash: C9110A20F0F28241FE58A735AED127AE2529FC57B0F156B35ED2D87AF7DE2CA4418600

Function 00007FF6A4F622BC Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF6A4F622CD
FlsSetValue.KERNEL32 ref: 00007FF6A4F622EC
FlsSetValue.KERNEL32 ref: 00007FF6A4F62314
FlsSetValue.KERNEL32 ref: 00007FF6A4F62325
FlsSetValue.KERNEL32 ref: 00007FF6A4F62336

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 5d25d9e83496e835950b5ecd794f732d52c0690cd6a9d1688453466e3abe4f10
Instruction ID: 7092e15b1d98aec921f6a7647b3a931f33327be8bdedf59134ab1655461fa762
Opcode Fuzzy Hash: 5d25d9e83496e835950b5ecd794f732d52c0690cd6a9d1688453466e3abe4f10
Instruction Fuzzy Hash: B611C524E0F28641FD58A7355DD217992428FC6370E193B35D93E8B6F7DE2CB4419202

Function 00007FF6A4F5A8B0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6A4F5A8DB
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6A4F5A972
RtlUnwindEx.KERNEL32 ref: 00007FF6A4F5A9CC

Strings

csm, xrefs: 00007FF6A4F5A959

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 5f5d302166e19634829c094452bfe87a873ebe6b813598db0edb239a19e2502c
Instruction ID: 87e7649f21bdcd37b495af463d0b724c2892bf0182b3d9c3896228de297f117c
Opcode Fuzzy Hash: 5f5d302166e19634829c094452bfe87a873ebe6b813598db0edb239a19e2502c
Instruction Fuzzy Hash: A7519331F1A6428ADB14CB25D9846787791EBC4B94F11D132EA5EC3768EFBCE861C702

Function 00007FF6A4F5C140 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6A4F5C19F
_CallSETranslator.LIBVCRUNTIME ref: 00007FF6A4F5C1EB

Strings

MOC, xrefs: 00007FF6A4F5C1B3
RCC, xrefs: 00007FF6A4F5C1BB

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 60f6320091066ee4df9eea52bc9c04b11228bf2b902cead3227b2dc1035e28eb
Instruction ID: 2af725593470bf1009f2bd1ce0d48cf27a349a2b45ed9c88b7543ab8a93a2e3f
Opcode Fuzzy Hash: 60f6320091066ee4df9eea52bc9c04b11228bf2b902cead3227b2dc1035e28eb
Instruction Fuzzy Hash: CC616E32909BC5C5E7309B25E8803AAB7A0FBC5B94F049225EB9D57B65DF7CD190CB01

Function 00007FF6A4F5C4F0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6A4F5C518
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF6A4F5C600

Strings

csm, xrefs: 00007FF6A4F5C53A
csm, xrefs: 00007FF6A4F5C652

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 4dedabad64849d541369821fffd6302125c4cd2447467dfb5b60e4f5a2655fe0
Instruction ID: 8f6e52fec9266e2c37e49f060a783574e12920fe60b50b2f08289fbcc3d4da9c
Opcode Fuzzy Hash: 4dedabad64849d541369821fffd6302125c4cd2447467dfb5b60e4f5a2655fe0
Instruction Fuzzy Hash: 7351733290A2C2C6DB748F35988426877A0FB95B94F14A135DA9EC7BA5CF3CE550CB02

Function 00007FF6A4F67074 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF6A4F670F3
WriteFile.KERNEL32 ref: 00007FF6A4F673BB
WriteFile.KERNEL32 ref: 00007FF6A4F67401
GetLastError.KERNEL32 ref: 00007FF6A4F674B7

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: b427c493d79cd69df0973f38144ff804a1e4f3923916a32b6a0420c97276a5ad
Instruction ID: 45ca56301435c88f26bc4019b283482c59bf28b2bb1ed6695b5bfe69f4acbee1
Opcode Fuzzy Hash: b427c493d79cd69df0973f38144ff804a1e4f3923916a32b6a0420c97276a5ad
Instruction Fuzzy Hash: B8D11532B0AA8189E710CF75D8801AD7BB2FB84B98B005236CF5DD7BA9DE38D406C740

Function 00007FF6A4F6770C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF6A4F67823
GetLastError.KERNEL32 ref: 00007FF6A4F67845

Strings

U, xrefs: 00007FF6A4F677CF

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: a984cb8f0ef6dbe813b37106abef04d71e7b0803456cb9d357151010d4e928c2
Instruction ID: 2d278243b4438fa72215a75a4d6ab2c109e82a8ed9bf9e855b4fef61b5ddf390
Opcode Fuzzy Hash: a984cb8f0ef6dbe813b37106abef04d71e7b0803456cb9d357151010d4e928c2
Instruction Fuzzy Hash: E041B222A1AA8181EB60CF35E8843AAA7A1FBC8794F505031EE4DC77A8DF7CD441C750

Function 00007FF6A4F5CF98 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF6A4F5CFE8
RaiseException.KERNEL32 ref: 00007FF6A4F5D029

Strings

csm, xrefs: 00007FF6A4F5D016

Memory Dump Source

Source File: 00000000.00000002.2119413719.00007FF6A4F51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A4F50000, based on PE: true

Associated: 00000000.00000002.2119399418.00007FF6A4F50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119434919.00007FF6A4F6F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119450177.00007FF6A4F7A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2119464758.00007FF6A4F8B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6a4f50000_mark_v7.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: c364e52ee2a58e29b16a24da1e50c5ad60b21da6634c0706be35ab7451ec72c7
Instruction ID: 03d79fe8b2260781f789740c12cd1e5c96283581fdd05fd19edb4db39861bf94
Opcode Fuzzy Hash: c364e52ee2a58e29b16a24da1e50c5ad60b21da6634c0706be35ab7451ec72c7
Instruction Fuzzy Hash: 1811303261AB8182EB218F25F840259B7E4FB88B84F589230DF8D47768DF3CD551CB40

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report mark_v7.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Statistics

CPU Usage

Memory Usage

Windows Analysis Report
mark_v7.exe

Function 00007FF6A4F54910 Relevance: 44.4, APIs: 14, Strings: 11, Instructions: 624
networkCOMMON

Function 00007FF6A4F55E50 Relevance: 13.5, Strings: 10, Instructions: 1037
COMMON

Function 00007FF6A4F6799C Relevance: 6.2, APIs: 4, Instructions: 218
COMMONLIBRARYCODE

Function 00007FF6A4F60108 Relevance: 4.5, APIs: 3, Instructions: 14
COMMON

Function 00007FF6A4F59BB4 Relevance: 3.1, APIs: 2, Instructions: 94
COMMON

Function 00007FF6A4F674EC Relevance: 3.1, APIs: 2, Instructions: 74
fileCOMMONLIBRARYCODE

Function 00007FF6A4F61BF8 Relevance: 3.1, APIs: 2, Instructions: 71
COMMON

Function 00007FF6A4F60039 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Function 00007FF6A4F53E40 Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Function 00007FF6A4F5A020 Relevance: 1.5, APIs: 1, Instructions: 19
COMMON