Edit tour

Windows Analysis Report
JIL-_Document_No._2500015903.cmd

Overview

General Information

Sample name:	JIL-_Document_No._2500015903.cmd
Analysis ID:	1580951
MD5:	77be0aa379a1cae6efbaa06091238fc0
SHA1:	28e485a4e1de330f0750458b6d5b8841af2fd095
SHA256:	d7ab60ae836fe857b14fdc6e19147e60e8f74ede79562fa60b08cb5c3d4afd5f
Tags:	cmduser-TeamDreier
Infos:

Detection

DBatLoader

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected DBatLoader

AI detected suspicious sample

Allocates many large memory junks

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Machine Learning detection for dropped file

Abnormal high CPU Usage

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to check if a connection to the internet is available

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to query locales information (e.g. system language)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

cmd.exe (PID: 7164 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\JIL-_Document_No._2500015903.cmd" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

extrac32.exe (PID: 5252 cmdline: extrac32 /y "C:\Users\user\Desktop\JIL-_Document_No._2500015903.cmd" "C:\Users\user\AppData\Local\Temp\x.exe" MD5: 41330D97BF17D07CD4308264F3032547)

x.exe (PID: 4256 cmdline: "C:\Users\user\AppData\Local\Temp\x.exe" MD5: 33DE1300C5879C8093B210EA96359783)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DBatLoader	This Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it.	No Attribution	https://blog.vincss.net/2020/09/re016-malware-analysis-modiloader-eng.html https://blog.vincss.net/re016-malware-analysis-modiloader/ https://gi7w0rm.medium.com/uncovering-ddgroup-a-long-time-threat-actor-d3b3020625a4 https://isc.sans.edu/diary/Malspam+pushes+ModiLoader+DBatLoader+infection+for+Remcos+RAT/29896 https://kienmanowar.wordpress.com/2024/04/09/quicknote-phishing-email-distributes-warzone-rat-via-dbatloader/	https://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.4495741338.0000000002276000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000003.00000002.4509288253.000000007FB80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security

Unpacked PEs

Source	Rule	Description	Author
3.2.x.exe.22765a8.0.raw.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
3.2.x.exe.22765a8.0.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
3.2.x.exe.2830000.2.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\x.exe

ReversingLabs: Detection: 56%

Multi AV Scanner detection for submitted file

Source: JIL-_Document_No._2500015903.cmd	ReversingLabs: Detection: 39%
Source: JIL-_Document_No._2500015903.cmd	Virustotal: Detection: 34%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 96.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\x.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 3_2_028358B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,

3_2_028358B4

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 3_2_0284E2F8 InternetCheckConnectionA,

3_2_0284E2F8

Source: x.exe, 00000003.00000000.2032574356.0000000000483000.00000002.00000001.01000000.00000004.sdmp, x.exe, 00000003.00000003.2037165809.000000007F2F0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.2039316097.000000007F55B000.00000004.00001000.00020000.00000000.sdmp, JIL-_Document_No._2500015903.cmd, x.exe.2.dr	String found in binary or memory: http://programania.com/en.htm
Source: x.exe, 00000003.00000000.2032574356.0000000000483000.00000002.00000001.01000000.00000004.sdmp, x.exe, 00000003.00000003.2037165809.000000007F2F0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.2039316097.000000007F55B000.00000004.00001000.00020000.00000000.sdmp, JIL-_Document_No._2500015903.cmd, x.exe.2.dr	String found in binary or memory: http://programania.com/en.zip
Source: x.exe, 00000003.00000000.2032574356.0000000000483000.00000002.00000001.01000000.00000004.sdmp, x.exe, 00000003.00000003.2037165809.000000007F2F0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.2039316097.000000007F55B000.00000004.00001000.00020000.00000000.sdmp, JIL-_Document_No._2500015903.cmd, x.exe.2.dr	String found in binary or memory: http://programania.com/en_source.zip
Source: x.exe, 00000003.00000002.4508660114.000000002077C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://programania.com/index_ru.htm

Source: C:\Users\user\AppData\Local\Temp\x.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_0284DBB0 RtlDosPa,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,	3_2_0284DBB0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_02847D00 NtWriteVirtualMemory,	3_2_02847D00
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_0284DACC RtlDosPa,NtCreateFile,NtWriteFile,NtClose,	3_2_0284DACC
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_0284DA44 RtlInitUnicodeString,RtlDosPa,NtDeleteFile,	3_2_0284DA44
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_02848BAE GetThreadContext,SetThreadContext,NtResumeThread,	3_2_02848BAE
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_02848BB0 GetThreadContext,SetThreadContext,NtResumeThread,	3_2_02848BB0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_0284D9F0 RtlInitUnicodeString,RtlDosPa,NtDeleteFile,	3_2_0284D9F0

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 3_2_0284EC74 InetIsOffline,CoInitialize,CoUninitialize,Sleep,MoveFileA,MoveFileA,CreateProcessAsUserW,ResumeThread,CloseHandle,CloseHandle,ExitProcess,

3_2_0284EC74

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_028320C4		3_2_028320C4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_0285D59A		3_2_0285D59A

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 0283480C appears 931 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 028344AC appears 73 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 028344D0 appears 32 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 02848824 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 028487A0 appears 54 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 028346A4 appears 244 times

Source: classification engine

Classification label: mal80.troj.evad.winCMD@6/1@0/0

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 3_2_02837F5A GetDiskFreeSpaceA,

3_2_02837F5A

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 3_2_02846D50 CoCreateInstance,

3_2_02846D50

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4564:120:WilError_03

Source: C:\Windows\System32\extrac32.exe

File created: C:\Users\user\AppData\Local\Temp\CAB05252.TMP

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\x.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Windows\System32\extrac32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: JIL-_Document_No._2500015903.cmd	ReversingLabs: Detection: 39%
Source: JIL-_Document_No._2500015903.cmd	Virustotal: Detection: 34%

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\JIL-_Document_No._2500015903.cmd" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\extrac32.exe extrac32 /y "C:\Users\user\Desktop\JIL-_Document_No._2500015903.cmd" "C:\Users\user\AppData\Local\Temp\x.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\extrac32.exe extrac32 /y "C:\Users\user\Desktop\JIL-_Document_No._2500015903.cmd" "C:\Users\user\AppData\Local\Temp\x.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: url.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??????s.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ???.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\x.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: JIL-_Document_No._2500015903.cmd

Static file information: File size 1268675 > 1048576

Data Obfuscation

Yara detected DBatLoader

Source: Yara match	File source: 3.2.x.exe.22765a8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.x.exe.22765a8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.x.exe.2830000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4495741338.0000000002276000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4509288253.000000007FB80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 3_2_028487A0 LoadLibraryW,GetProcAddress,FreeLibrary,

3_2_028487A0

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_0285C2FC push 0285C367h; ret	3_2_0285C35F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_028332FC push eax; ret	3_2_02833338
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_0283635A push 028363B7h; ret	3_2_028363AF
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_0283635C push 028363B7h; ret	3_2_028363AF
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_0285C0AC push 0285C125h; ret	3_2_0285C11D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_0285C1F8 push 0285C288h; ret	3_2_0285C280
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_0285C144 push 0285C1ECh; ret	3_2_0285C1E4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_028486C0 push 02848702h; ret	3_2_028486FA
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_0283673E push 02836782h; ret	3_2_0283677A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_02836740 push 02836782h; ret	3_2_0283677A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_0283C4F4 push ecx; mov dword ptr [esp], edx	3_2_0283C4F9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_0284E5B4 push ecx; mov dword ptr [esp], edx	3_2_0284E5B9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_0283D528 push 0283D554h; ret	3_2_0283D54C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_0283CB0F pushfd ; iretd	3_2_0283CB3D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_0283CB57 push 0283CCFAh; ret	3_2_0283CCF2
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_0285BB6C push 0285BD94h; ret	3_2_0285BD8C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_0283CB74 push 0283CCFAh; ret	3_2_0283CCF2
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_02847894 push 02847911h; ret	3_2_02847909
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_028468CE push 0284697Bh; ret	3_2_02846973
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_028468D0 push 0284697Bh; ret	3_2_02846973
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_02848916 push 02848950h; ret	3_2_02848948
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_0284A91F push 0284A958h; ret	3_2_0284A950
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_02848918 push 02848950h; ret	3_2_02848948
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_0284A920 push 0284A958h; ret	3_2_0284A950
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_0283C94F push eax; iretd	3_2_0283C975
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_02842EE8 push 02842F5Eh; ret	3_2_02842F56
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_02845E04 push ecx; mov dword ptr [esp], edx	3_2_02845E06
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_02842FF4 push 02843041h; ret	3_2_02843039
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 3_2_02842FF3 push 02843041h; ret	3_2_02843039

Source: C:\Windows\System32\extrac32.exe

File created: C:\Users\user\AppData\Local\Temp\x.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 3_2_0284A95C GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_0284A95C

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Allocates many large memory junks

Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 2830000 memory commit 500006912
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 2831000 memory commit 500178944
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 285C000 memory commit 500002816
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 285D000 memory commit 500199424
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 288E000 memory commit 501014528
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 2986000 memory commit 500006912
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 2988000 memory commit 500015104

Source: C:\Users\user\AppData\Local\Temp\x.exe

API coverage: 8.9 %

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 3_2_028358B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,

3_2_028358B4

Source: x.exe, 00000003.00000002.4495581747.000000000075E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll9

Source: C:\Users\user\AppData\Local\Temp\x.exe

API call chain: ExitProcess graph end node

graph_3-28632

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 3_2_0284EBF0 GetModuleHandleW,GetProcAddress,CheckRemoteDebuggerPresent,

3_2_0284EBF0

Source: C:\Users\user\AppData\Local\Temp\x.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 3_2_028487A0 LoadLibraryW,GetProcAddress,FreeLibrary,

3_2_028487A0

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\extrac32.exe extrac32 /y "C:\Users\user\Desktop\JIL-_Document_No._2500015903.cmd" "C:\Users\user\AppData\Local\Temp\x.exe"			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	3_2_02835A78
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: GetLocaleInfoA,	3_2_0283A798
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: GetLocaleInfoA,	3_2_0283A74C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	3_2_02835B84

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 3_2_02839194 GetLocalTime,

3_2_02839194

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 3_2_0283B714 GetVersionExA,

3_2_0283B714

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	1 Native API	1 Valid Accounts	1 Valid Accounts	1 Valid Accounts	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Access Token Manipulation	1 Access Token Manipulation	LSASS Memory	311 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	11 Process Injection	1 Virtualization/Sandbox Evasion	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	11 Process Injection	NTDS	1 System Network Connections Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	24 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
JIL-_Document_No._2500015903.cmd	39%	ReversingLabs	Win32.Trojan.Malcab
JIL-_Document_No._2500015903.cmd	34%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\x.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\x.exe	57%	ReversingLabs	Win32.Trojan.Nekark

Source	Detection	Scanner	Label
http://programania.com/en.zip	0%	Avira URL Cloud	safe
http://programania.com/index_ru.htm	0%	Avira URL Cloud	safe
http://programania.com/en.htm	0%	Avira URL Cloud	safe
http://programania.com/en_source.zip	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://programania.com/en.htm	x.exe, 00000003.00000000.2032574356.0000000000483000.00000002.00000001.01000000.00000004.sdmp, x.exe, 00000003.00000003.2037165809.000000007F2F0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.2039316097.000000007F55B000.00000004.00001000.00020000.00000000.sdmp, JIL-_Document_No._2500015903.cmd, x.exe.2.dr	false	Avira URL Cloud: safe	unknown
http://programania.com/en.zip	x.exe, 00000003.00000000.2032574356.0000000000483000.00000002.00000001.01000000.00000004.sdmp, x.exe, 00000003.00000003.2037165809.000000007F2F0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.2039316097.000000007F55B000.00000004.00001000.00020000.00000000.sdmp, JIL-_Document_No._2500015903.cmd, x.exe.2.dr	false	Avira URL Cloud: safe	unknown
http://programania.com/en_source.zip	x.exe, 00000003.00000000.2032574356.0000000000483000.00000002.00000001.01000000.00000004.sdmp, x.exe, 00000003.00000003.2037165809.000000007F2F0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000003.00000003.2039316097.000000007F55B000.00000004.00001000.00020000.00000000.sdmp, JIL-_Document_No._2500015903.cmd, x.exe.2.dr	false	Avira URL Cloud: safe	unknown
http://programania.com/index_ru.htm	x.exe, 00000003.00000002.4508660114.000000002077C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580951
Start date and time:	2024-12-26 13:51:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	JIL-_Document_No._2500015903.cmd
Detection:	MAL
Classification:	mal80.troj.evad.winCMD@6/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 18 Number of non-executed functions: 40
Cookbook Comments:	Found application associated with file extension: .cmd Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:52:00	API Interceptor	3131x Sleep call for process: x.exe modified

Process:	C:\Windows\System32\extrac32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1268224
Entropy (8bit):	7.390822558230329
Encrypted:	false
SSDEEP:	24576:ebRMhJO7IBx+T+jPrqkmifBnk7fUomfX4nOLWzpF:edSAu6PVABnk7fU1fX4nOLwF
MD5:	33DE1300C5879C8093B210EA96359783
SHA1:	B341B64CC942B9343C2E5974A84A9EB489BF5539
SHA-256:	FFBA3035B72B1DC986AE62EC6868B48D0E2AAC69C8216D1B27461D0FAF933FBC
SHA-512:	61043DDA9BE5D0147C9A5675EE02EF09C76DB3498AE4EEE26C0CEA314D4E362C695233E1AC62FA20085F76C824929270014EE2B7A0CC3B39E943810D7C756983
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 57%
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................f..........dw............@..............................................@...............................&...........................0.............................. ......................@................................text....].......^.................. ..`.itext.......p.......b.............. ..`.data............ ...j..............@....bss.....6...............................idata...&.......(..................@....tls....4................................rdata....... ......................@..@.reloc......0......................@..B.rsrc................<..............@..@.....................Z..............@..@................................................................................................

Static File Info

General

File type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 4294967295 bytes, 1 file, at 0x75 +A "x.exe", number 1, 39 datablocks, 0 compression
Entropy (8bit):	7.390263772618847
TrID:	Microsoft Cabinet Archive (8008/1) 99.91% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.09%
File name:	JIL-_Document_No._2500015903.cmd
File size:	1'268'675 bytes
MD5:	77be0aa379a1cae6efbaa06091238fc0
SHA1:	28e485a4e1de330f0750458b6d5b8841af2fd095
SHA256:	d7ab60ae836fe857b14fdc6e19147e60e8f74ede79562fa60b08cb5c3d4afd5f
SHA512:	c8d4c41808c3f0f9f5859c4cc45cebdb0162e47cae3742df128747bab6aa4ead4dfa5701949d93443a06fcaa781e35c7afe7a2009d6ad7dee1146854d03cbdec
SSDEEP:	24576:gbR0hl6fIBF+3SX7rSgyi3Bng7TUsGTX8j2fW3hh:gdGguKDNIBng7TUhTX8j2fsh
TLSH:	5D45C032A3A15D37D22E27765C07F3E96C18BE053AC56E0FBA851B0C8B2D940787BE55
File Content Preview:	MSCF............u.......................'.......cls && extrac32 /y "%~f0" "%tmp%\x.exe" && start "" "%tmp%\x.exe".....Z............ .x.exe.........MZP.....................@...............................................!..L.!..This program must be run und

File Icon


Icon Hash:	9686878b929a9886

Target ID:	0
Start time:	07:51:59
Start date:	26/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\JIL-_Document_No._2500015903.cmd" "
Imagebase:	0x7ff6f2e10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:51:59
Start date:	26/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:51:59
Start date:	26/12/2024
Path:	C:\Windows\System32\extrac32.exe
Wow64 process (32bit):	false
Commandline:	extrac32 /y "C:\Users\user\Desktop\JIL-_Document_No._2500015903.cmd" "C:\Users\user\AppData\Local\Temp\x.exe"
Imagebase:	0x7ff7e79a0000
File size:	35'328 bytes
MD5 hash:	41330D97BF17D07CD4308264F3032547
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:52:00
Start date:	26/12/2024
Path:	C:\Users\user\AppData\Local\Temp\x.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\x.exe"
Imagebase:	0x400000
File size:	1'268'224 bytes
MD5 hash:	33DE1300C5879C8093B210EA96359783
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000003.00000002.4495741338.0000000002276000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000003.00000002.4509288253.000000007FB80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 57%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	5.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	15.5%
Total number of Nodes:	251
Total number of Limit Nodes:	12

Executed Functions

Function 0284EC74 Relevance: 243.3, APIs: 11, Strings: 122, Instructions: 10535
filesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InetIsOffline.URL(00000000,00000000,0285AFA1,?,?,?,000002F7,00000000,00000000), ref: 0284ECAE

Part of subcall function 02848824: LoadLibraryA.KERNEL32(00000000,00000000,0284890B), ref: 02848858
Part of subcall function 02848824: FreeLibrary.KERNEL32(74AD0000,00000000,02891388,Function_000065D8,00000004,02891398,02891388,05F5E0FF,00000040,0289139C,74AD0000,00000000,00000000,00000000,00000000,0284890B), ref: 028488EB

Part of subcall function 0284EB94: GetModuleHandleW.KERNEL32(KernelBase,?,0284EF98,UacInitialize,0289137C,0285AFD8,OpenSession,0289137C,0285AFD8,ScanBuffer,0289137C,0285AFD8,ScanString,0289137C,0285AFD8,Initialize), ref: 0284EB9A
Part of subcall function 0284EB94: GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 0284EBAC

Part of subcall function 0284EBF0: GetModuleHandleW.KERNEL32(KernelBase), ref: 0284EC00
Part of subcall function 0284EBF0: GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 0284EC12
Part of subcall function 0284EBF0: CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 0284EC29

Part of subcall function 02837E18: GetFileAttributesA.KERNEL32(00000000,?,0284F8CC,ScanString,0289137C,0285AFD8,OpenSession,0289137C,0285AFD8,ScanString,0289137C,0285AFD8,UacScan,0289137C,0285AFD8,UacInitialize), ref: 02837E23

Part of subcall function 0283C2EC: GetModuleFileNameA.KERNEL32(00000000,?,00000105,029858C8,?,0284FBFE,ScanBuffer,0289137C,0285AFD8,OpenSession,0289137C,0285AFD8,ScanBuffer,0289137C,0285AFD8,OpenSession), ref: 0283C303

Part of subcall function 0284DBB0: RtlDosPa.N(00000000,?,00000000,00000000,00000000,0284DC80), ref: 0284DBEB
Part of subcall function 0284DBB0: NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,0284DC80), ref: 0284DC1B
Part of subcall function 0284DBB0: NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 0284DC30
Part of subcall function 0284DBB0: NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 0284DC5C
Part of subcall function 0284DBB0: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 0284DC65

Part of subcall function 02837E3C: GetFileAttributesA.KERNEL32(00000000,?,02852A49,ScanString,0289137C,0285AFD8,OpenSession,0289137C,0285AFD8,ScanBuffer,0289137C,0285AFD8,OpenSession,0289137C,0285AFD8,Initialize), ref: 02837E47

Part of subcall function 02837FD0: CreateDirectoryA.KERNEL32(00000000,00000000,?,02852BE7,OpenSession,0289137C,0285AFD8,ScanString,0289137C,0285AFD8,Initialize,0289137C,0285AFD8,ScanString,0289137C,0285AFD8), ref: 02837FDD

Part of subcall function 0284DACC: RtlDosPa.N(00000000,?,00000000,00000000,00000000,0284DB9E), ref: 0284DB0B
Part of subcall function 0284DACC: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0284DB45
Part of subcall function 0284DACC: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 0284DB72
Part of subcall function 0284DACC: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 0284DB7B

Part of subcall function 028487A0: LoadLibraryW.KERNEL32(bcrypt,?,00000000,00000000,028913A4,0284A3C7,ScanString,028913A4,0284A77C,ScanBuffer,028913A4,0284A77C,Initialize,028913A4,0284A77C,UacScan), ref: 028487B4
Part of subcall function 028487A0: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 028487CE
Part of subcall function 028487A0: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000000,00000000,028913A4,0284A3C7,ScanString,028913A4,0284A77C,ScanBuffer,028913A4,0284A77C,Initialize), ref: 0284880A

Part of subcall function 0284870C: LoadLibraryW.KERNEL32(amsi), ref: 02848715
Part of subcall function 0284870C: FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 02848774

Sleep.KERNEL32(00002710,00000000,00000000,ScanBuffer,0289137C,0285AFD8,OpenSession,0289137C,0285AFD8,ScanBuffer,0289137C,0285AFD8,OpenSession,0289137C,0285AFD8,0285B330), ref: 028549B7

Part of subcall function 0284DA44: RtlInitUnicodeString.NTDLL(?,?), ref: 0284DA6C
Part of subcall function 0284DA44: RtlDosPa.N(00000000,?,00000000,00000000,00000000,0284DABE), ref: 0284DA82
Part of subcall function 0284DA44: NtDeleteFile.NTDLL(?), ref: 0284DAA1

MoveFileA.KERNEL32(00000000,00000000), ref: 02854BB7
MoveFileA.KERNEL32(00000000,00000000), ref: 02854C0D

Strings

URL=file:", xrefs: 028564A7
OpenProcess, xrefs: 0285A29D
DlpGetWebSiteAccess, xrefs: 02859C11
spp, xrefs: 02859824, 02859857, 0285A4F4
RetailTracerEnable, xrefs: 028597DA
D2^Tyj}~TVrgoij[Dkcxn}dmu, xrefs: 0284FE37
WinHttp.WinHttpRequest.5.1, xrefs: 028517E9
DllGetClassObject, xrefs: 0284EFB0, 0284F4E7, 02859840, 0285A510
smartscreenps, xrefs: 0284F4FE, 0284F531, 0284F564
GZmMS1j, xrefs: 0284ECBC
dbgcore, xrefs: 028589A3, 028589B7
kernel32, xrefs: 0285A21B, 0285A24E, 0285A281, 0285A2B4, 0285A2E7, 0285A31A, 0285A34D
EnumServicesStatusExA, xrefs: 0285A0FB
TrustOpenStores, xrefs: 0284F0B0
VirtualAllocEx, xrefs: 0285A237
http, xrefs: 028515D5
DlpGetArchiveFileTraceInfo, xrefs: 02859BDE
bcrypt, xrefs: 0284F36D, 0284F3A0, 0284F3D3, 028599E8
CreateProcessAsUserW, xrefs: 0285A155, 0285A173
NtQuerySystemInformation, xrefs: 0285A0A1
mssip32, xrefs: 0284F258, 0284F28B, 0284F2BE, 028598BD
C:\\Users\\Public\\Libraries\\, xrefs: 02854B66, 02854BBC, 028558B7
NtQuerySecurityObject, xrefs: 0285A70E
NtSetSecurityObject, xrefs: 028589C6
NtOpenSection, xrefs: 0285A642
ScanBuffer, xrefs: 0284EE73, 0284F1CB, 0284F3F5, 0284F95C, 0284FA69, 0284FB81, 0284FF55, 028500F3, 02850299, 028503B9, 0285054E, 02850646, 028508AF, 02850A55, 02850BF1, 02850D07, 02850D95, 028510A9, 0285134A, 0285145B, 028515F8, 028519A3, 02851AAF, 02851CCD, 02851DEA, 02852105, 028521A6, 0285231A, 028524DA, 028527FC, 02852BF3, 02852E92, 02852F23, 028532DD, 028534BF, 02853633, 028537B6, 02853832, 028539E9, 02853BF3, 02853E51, 02854083, 028542C7, 0285450F, 028547C5, 0285492B, 02854AC0, 02854DF8, 02855132, 0285544B, 028557CB, 02855B04, 02855DB6, 02855FBB, 02856121, 02856295, 02856311, 02856EB4, 02856F45, 02857375, 02857508, 02857664, 0285775C, 02857C79, 02857F46, 028580EC, 02858279, 0285840D, 0285858C, 02858803, 028588FB, 02858D17, 02858FF0, 02859164, 0285939A, 0285942C, 02859764, 02859B02, 0285A031, 0285A937
NtOpenFile, xrefs: 0285A80D
BCryptVerifySignature, xrefs: 0284F356, 028599D1
CryptSIPVerifyIndirectData, xrefs: 0284F274, 028598A6
[InternetShortcut], xrefs: 02856498
VirtualAlloc, xrefs: 0285A204
DllRegisterServer, xrefs: 0284F001, 0284F54D
sppc, xrefs: 028595B1, 028595E4, 02859617, 0285964A, 0285A55A, 0285A58D
SLIsGenuineLocalEx, xrefs: 02859600
MiniDumpWriteDump, xrefs: 0285899E
UacUninitialize, xrefs: 02852D1E, 0285301B, 02853113, 028538F1, 02853F8B
SLGetSLIDList, xrefs: 028595CD
ieproxy, xrefs: 0284EFC1, 0284EFE8, 0284F018
CreateProcessA, xrefs: 0285A128
CryptSIPGetSignedDataMsg, xrefs: 0284F2A7
sppwmi, xrefs: 0285A527
DllGetActivationFactory, xrefs: 0284F51A
C:\Windows\System32\, xrefs: 0284F8B7, 028570BB, 02857E03
@echo offset "EPD=sPDet "@% or%e%.%c%%h%.o%o%or, xrefs: 02854598
NtAlertResumeThread, xrefs: 02859D3C
SetUnhandledExceptionFilter, xrefs: 0285A336
lld.SLITUTEN, xrefs: 02853AB8
psapi, xrefs: 0285988A
DlpNotifyPreDragDrop, xrefs: 02859B78
SLGatherMigrationBlob, xrefs: 0285A543
CreateProcessW, xrefs: 0285A137
OpenSession, xrefs: 0284ECE3, 0284EED7, 0284F7BF, 0284F8E0, 0284F9ED, 0284FB05, 0284FED9, 02850077, 0285021D, 0285033D, 028504D2, 028505CA, 028507B7, 0285095D, 02850C8B, 02850EB9, 0285102D, 02851150, 028512CE, 02851674, 028516F7, 0285180F, 02851927, 02851A33, 02851C51, 02851D6E, 0285200D, 02852089, 0285229E, 0285243E, 02852780, 0285293B, 02852B55, 02852C6F, 02852F9F, 0285343E, 028535B7, 0285373A, 02853B77, 02853DD5, 02853F0F, 0285424B, 02854493, 02854675, 02854749, 028548AF, 02854A44, 02854D7C, 02854F16, 028550B6, 0285525B, 028553CF, 0285561F, 028556D3, 02855990, 02855A88, 02855F3F, 02856219, 0285638D, 02856523, 028566D3, 02856DBC, 02856FC1, 028571DA, 0285727D, 02857410, 028577D8, 02857A74, 02857D71, 02857ECA, 02858070, 028581FD, 02858391, 02858510, 02858613, 02858787, 02858A05, 02858BF5, 02858EE6, 0285906C, 028592A2, 028594A8, 0285966C, 0285995B, 02859A0A, 02859C4A, 02859E41, 02859F39, 0285A3EB, 0285A9B3
LdrGetProcedureAddress, xrefs: 0285A7A7
@echo offset "MJtc=Iet "@%r%e%%c%r%h%%o%, xrefs: 0285484E
RtlAllocateHeap, xrefs: 02859D6F, 02859DD5
IconIndex=, xrefs: 028564FD
NtCreateSection, xrefs: 0285A675
BCryptQueryProviderRegistration, xrefs: 0284F389
C:\\Windows \\SysWOW64\\svchost.exe, xrefs: 028536A8
NEO.c, xrefs: 02854445
EtwEventWriteEx, xrefs: 0285A840
NtMapViewOfSection, xrefs: 0285A6A8
WintrustAddActionID, xrefs: 0284F0E3
EtwEventWrite, xrefs: 0285A873
FX.c, xrefs: 028546FB
WriteVirtualMemory, xrefs: 0285A2D0
HotKey=, xrefs: 02856631
endpointdlp, xrefs: 02859B8F, 02859BC2, 02859BF5, 02859C28
ScanString, xrefs: 0284EE0F, 0284F03A, 0284F14F, 0284F2E0, 0284F471, 0284F6FA, 0284F83B, 0284FDC1, 028509D9, 02850B75, 02850FB1, 028511CC, 02851248, 02851565, 0285188B, 02851B54, 02851F91, 028523C2, 028525D2, 02852688, 028529B7, 02852AD9, 02852D9A, 028531E5, 02853CDD, 02854153, 02854348, 02854D00, 02854E9A, 028551DF, 028555A3, 02855C42, 02856428, 0285659F, 02856657, 02856CC4, 0285715E, 028575C5, 02857BE8, 0285868F, 02858A81, 02858E6A, 02859226, 02859524, 028598DF, 02859CC6, 02859EBD, 0285A467
DlpCheckIsCloudSyncApp, xrefs: 02859BAB
FindCertsByIssuer, xrefs: 0284F116
NtReadVirtualMemory, xrefs: 0285A6DB
@echo off@% %e%%c%o%h% %o%rrr% %%o%%f% %f%o%s%, xrefs: 02853361
FlushInstructionCache, xrefs: 0285A303
NtGetWriteWatch, xrefs: 0285A5A9
RtlQueryProcessDebugInformation, xrefs: 0285A0CE
EnumProcessModules, xrefs: 0285A119
MiniDumpReadDumpStream, xrefs: 028589B2
GetProxyDllInfo, xrefs: 0284EFD7
ntdll, xrefs: 0285897B, 028589CB, 028589DF, 02859D53, 02859D86, 02859DB9, 02859DEC, 02859E1F, 0285A5C0, 0285A5F3, 0285A626, 0285A659, 0285A68C, 0285A6BF, 0285A6F2, 0285A725, 0285A758, 0285A78B, 0285A7BE, 0285A7F1, 0285A824, 0285A857, 0285A88A
wintrust, xrefs: 0284F0C7, 0284F0FA, 0284F12D
EnumServicesStatusW, xrefs: 0285A0EC
C:\Users\Public\, xrefs: 02853183, 028554D0, 02856743
C:\Users\Public\aken.pif, xrefs: 02854B51
.url, xrefs: 028554DB
EnumServicesStatusExW, xrefs: 0285A10A
GetProcessMemoryInfo, xrefs: 02859873
sys.thgiseurt, xrefs: 02853ECC
UacInitialize, xrefs: 0284EF3B, 0284F602, 0284FD45, 02853D59, 028541CF, 028549C8, 02854C84, 0285503A, 02855527, 0285703D, 0285887F, 02858C9B
Kernel32, xrefs: 0285A12D, 0285A13C, 0285A178
NtQueryInformationThread, xrefs: 0285A60F
CreateProcessAsUserA, xrefs: 0285A146
tquery, xrefs: 028597F1
RtlCreateQueryDebugBuffer, xrefs: 02859E08
VirtualProtect, xrefs: 0285A26A
LdrLoadDll, xrefs: 0285A774
NtOpenObjectAuditAlarm, xrefs: 02858976
C:\Users\Public\alpha.pif, xrefs: 02854B36
SxTracerGetThreadContextDebug, xrefs: 0285980D, 0285A4DD
BCryptRegisterProvider, xrefs: 0284F3BC
SLGetGenuineInformation, xrefs: 0285959A
SLGetEncryptedPIDEx, xrefs: 0285A576
CreateProcessWithLogonW, xrefs: 0285A164
NtQueryVirtualMemory, xrefs: 0285A5DC
GET, xrefs: 02851902
C:\\Windows \\SysWOW64\\, xrefs: 02853ACE, 02853EE2
Ntdll, xrefs: 0285A0A6, 0285A0B5, 0285A0C4, 0285A0D3
UacScan, xrefs: 0284ED47, 0284F586, 0284F67E, 0284FC4D, 02850833, 02850E11, 02851773, 02851E86, 02853097, 02853261, 028533C2, 0285353B, 028536BE, 0285388F, 0285396D, 02853AFB, 02854007, 028543C4, 028545F9, 028552D7, 02855847, 02855A0C, 02855D3A, 02855E47, 028560A5, 0285619D, 02856D40, 028570E2, 028572F9, 0285748C, 028576E0, 02857B6C, 02857CF5, 02857E4E, 02857FF4, 02858181, 02858315, 02858494, 0285870B, 02858B79, 02858D93, 02858F74, 028590E8, 0285931E, 0285A18E
Initialize, xrefs: 0284EDAB, 0284FCC9, 0284FE5D, 0284FFFB, 028501A1, 02850456, 02850AF9, 02850F35, 028513DF, 028514E9, 02851BD0, 02851F02, 02852222, 02852556, 02852704, 02852A5D, 02852E16, 02854FBE, 02855353, 0285574F, 02855914, 02855B80, 02855CBE, 02855EC3, 02856E38, 02857AF0, 02858AFD, 028596E8, 02859A86, 02859FB5, 0285A36F, 0285A8BB
NtDeviceIoControlFile, xrefs: 0285A0B0
NtWaitForSingleObject, xrefs: 02859DA2
Advapi, xrefs: 0285A0E2, 0285A0F1, 0285A100, 0285A10F, 0285A14B, 0285A15A, 0285A169
SLLoadApplicationPolicies, xrefs: 02859633
CryptSIPGetInfo, xrefs: 0284F241
psapi, xrefs: 0285A11E
advapi32, xrefs: 0285898F
EnumServicesStatusA, xrefs: 0285A0DD
NtWriteVirtualMemory, xrefs: 0285A7DA
NtQueryDirectoryFile, xrefs: 0285A0BF
NtAccessCheck, xrefs: 0285A741
I_QueryTagInformation, xrefs: 0285898A
NtOpenProcess, xrefs: 028589DA

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: File$Library$AddressFreeLoadModuleProc$AttributesCloseCreateHandleMove$CheckDebuggerDeleteDirectoryInetInformationInitNameOfflineOpenPresentQueryReadRemoteSleepStringUnicodeWrite
String ID: .url$@echo offset "EPD=sPDet "@% or%e%.%c%%h%.o%o%or$@echo offset "MJtc=Iet "@%r%e%%c%r%h%%o%$Advapi$BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Users\Public\$C:\Users\Public\aken.pif$C:\Users\Public\alpha.pif$C:\Windows\System32\$C:\\Users\\Public\\Libraries\\$C:\\Windows \\SysWOW64\\$C:\\Windows \\SysWOW64\\svchost.exe$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPGetInfo$CryptSIPGetSignedDataMsg$CryptSIPVerifyIndirectData$D2^Tyj}~TVrgoij[Dkcxn}dmu$DllGetActivationFactory$DllGetClassObject$DllRegisterServer$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FX.c$FindCertsByIssuer$FlushInstructionCache$GET$GZmMS1j$GetProcessMemoryInfo$GetProxyDllInfo$HotKey=$I_QueryTagInformation$IconIndex=$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MiniDumpReadDumpStream$MiniDumpWriteDump$NEO.c$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$TrustOpenStores$URL=file:"$UacInitialize$UacScan$UacUninitialize$VirtualAlloc$VirtualAllocEx$VirtualProtect$WinHttp.WinHttpRequest.5.1$WintrustAddActionID$WriteVirtualMemory$[InternetShortcut]$advapi32$bcrypt$dbgcore$endpointdlp$http$ieproxy$kernel32$lld.SLITUTEN$mssip32$ntdll$psapi$psapi$smartscreenps$spp$sppc$sppwmi$sys.thgiseurt$tquery$wintrust$@echo off@% %e%%c%o%h% %o%rrr% %%o%%f% %f%o%s%
API String ID: 3130226682-181751239
Opcode ID: eb1c9c39924d5b07cb75f395a29532b925ba45991730a68788319c7064fb2bf4
Instruction ID: 5d0957b26d2730d59a73afddff7d6d1c56fcfc53b6d6afe77e6ab5c56041da3d
Opcode Fuzzy Hash: eb1c9c39924d5b07cb75f395a29532b925ba45991730a68788319c7064fb2bf4
Instruction Fuzzy Hash: A7242E7DA101688FDB16EB68DC80ADE73B6FF85310F5041E2E409E7754DA70AE858F92

Function 02835A78 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105,02830000,0285D790), ref: 02835A94
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02830000,0285D790), ref: 02835AB2
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02830000,0285D790), ref: 02835AD0
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02835AEE
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02835B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02835B37
RegQueryValueExA.ADVAPI32(?,02835CE4,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02835B7D,?,80000001), ref: 02835B55
RegCloseKey.ADVAPI32(?,02835B84,00000000,?,?,00000000,02835B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02835B77
lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02835B94
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02835BA1
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02835BA7
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02835BD2
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02835C19
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02835C29
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02835C51
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02835C61
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02835C87
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02835C97

Strings

Software\Borland\Locales, xrefs: 02835AA8, 02835AC6
Software\Borland\Delphi\Locales, xrefs: 02835AE4

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: 3bfd785e2916d0cc76f0bff8e5b4182da16f6d25390cc79155fe9beef331913f
Instruction ID: 7d31e59b48b37cb6463214799bd9763412aac47acce82f12393674953d37a350
Opcode Fuzzy Hash: 3bfd785e2916d0cc76f0bff8e5b4182da16f6d25390cc79155fe9beef331913f
Instruction Fuzzy Hash: 77519C7DA4024C7EFB22D6A8CC46FEF77BD9B08744F8005A1A608E6181D7789A44CFE5

Function 0284EBF0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(KernelBase), ref: 0284EC00
GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 0284EC12
CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 0284EC29

Strings

KernelBase, xrefs: 0284EBFB
CheckRemoteDebuggerPresent, xrefs: 0284EC0C

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: AddressCheckDebuggerHandleModulePresentProcRemote
String ID: CheckRemoteDebuggerPresent$KernelBase
API String ID: 35162468-539270669
Opcode ID: 6434a407fed6a159718683cf69967ce1dd0673d6f65734b8609a76727851ba29
Instruction ID: b5d655d947dc35719f00eaf550d3d688fbc9cc3a315bc71236421a312581208b
Opcode Fuzzy Hash: 6434a407fed6a159718683cf69967ce1dd0673d6f65734b8609a76727851ba29
Instruction Fuzzy Hash: BFF0A77C90425CBBFB22A7AC88897DCFBA96B05328F640795D424E11D1FB7507448696

Function 0284DBB0 Relevance: 7.6, APIs: 5, Instructions: 80
nativefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02834ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02834EDA

RtlDosPa.N(00000000,?,00000000,00000000,00000000,0284DC80), ref: 0284DBEB
NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,0284DC80), ref: 0284DC1B
NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 0284DC30
NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 0284DC5C
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 0284DC65

Part of subcall function 02834C0C: SysFreeString.OLEAUT32(0284E950), ref: 02834C1A

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: File$String$AllocCloseFreeInformationOpenQueryRead
String ID:
API String ID: 2659941336-0
Opcode ID: f03a9ca3f205a1be799e975a49b9829e50ebd2c11e83456245273f17a949c896
Instruction ID: dd9477f70990ff44816c6493ac3991e1d69eb6f1d366ca4eb69ac9a0ad35b87c
Opcode Fuzzy Hash: f03a9ca3f205a1be799e975a49b9829e50ebd2c11e83456245273f17a949c896
Instruction Fuzzy Hash: A621C47965070C7BEB11EAD8CC46FDE77BDAB48700F504461B600F71C1DAB4AA058BA6

Function 0284E2F8 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 0284E436

Strings

ScanBuffer, xrefs: 0284E37F
OpenSession, xrefs: 0284E3D8
Initialize, xrefs: 0284E326

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: 77853a84f55d94af7aa8ccc9d9859b345ba7f26bae702b004c1f03fb9f007d27
Instruction ID: 5754f08fcdb994873dc5907f713fe3f7f0bb5fd6d6c28c04e6c1a9c1bf57c058
Opcode Fuzzy Hash: 77853a84f55d94af7aa8ccc9d9859b345ba7f26bae702b004c1f03fb9f007d27
Instruction Fuzzy Hash: C741117DA1050C9BEB11EBA8CC80A9EB3FAFF4C310F518425E441E7351DA74AD058FA1

Function 02847D00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02848020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02848090,?,?,00000000,?,02847A06,ntdll,00000000,00000000,02847A4B,?,?,00000000), ref: 0284805E
Part of subcall function 02848020: GetModuleHandleA.KERNELBASE(?), ref: 02848072

Part of subcall function 028480C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02848150,?,?,00000000,00000000,?,02848069,00000000,KernelBASE,00000000,00000000,02848090), ref: 02848115
Part of subcall function 028480C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 0284811B
Part of subcall function 028480C8: GetProcAddress.KERNEL32(?,?), ref: 0284812D

NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02847D74

Strings

Ntdll, xrefs: 02847D4B
yromeMlautriVetirW, xrefs: 02847D1B

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$MemoryVirtualWrite
String ID: Ntdll$yromeMlautriVetirW
API String ID: 2719805696-3542721025
Opcode ID: 58a6eb10db1e33b46773845bcab31846b52e8804dff08b3eb3eefc9125e0aa57
Instruction ID: 0ffbffa57aeb00e1d80ad292f15d41d5d258b381741b3c444da00c0290133f2f
Opcode Fuzzy Hash: 58a6eb10db1e33b46773845bcab31846b52e8804dff08b3eb3eefc9125e0aa57
Instruction Fuzzy Hash: C001697D614208AFEB00EFA8DC45FAEB7FDEB48700F514860B508D7680CB74B9148B61

Function 02831724 Relevance: 9.0, APIs: 7, Instructions: 289
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000), ref: 028317D0
Sleep.KERNEL32(0000000A,00000000), ref: 028317E6

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 293be3c4917d4ebd9e6d54305860c06074fa1520f1899d1fa011594462618646
Instruction ID: 18cb05a490d35cdcc69599f16b7ecb96da6855ccb1aa9f1b244b95edbd3ece11
Opcode Fuzzy Hash: 293be3c4917d4ebd9e6d54305860c06074fa1520f1899d1fa011594462618646
Instruction Fuzzy Hash: 88B1127EA003508BEB16CF2CD888365BBE1EB85725F1886A9E54ECB3C5D7709461CBD0

Function 0284870C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(amsi), ref: 02848715

Part of subcall function 028480C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02848150,?,?,00000000,00000000,?,02848069,00000000,KernelBASE,00000000,00000000,02848090), ref: 02848115
Part of subcall function 028480C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 0284811B
Part of subcall function 028480C8: GetProcAddress.KERNEL32(?,?), ref: 0284812D

Part of subcall function 02847D00: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02847D74

FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 02848774

Strings

DllGetClassObject, xrefs: 0284873A
W, xrefs: 02848721
amsi, xrefs: 02848710

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: AddressLibraryProc$FreeHandleLoadMemoryModuleVirtualWrite
String ID: DllGetClassObject$W$amsi
API String ID: 941070894-2671292670
Opcode ID: 78777b6b0dbf721b0ed9470f19e77baa356d7707702c07003713f6a54067abed
Instruction ID: e41cd5f0d7560eef3902020fa422f8c68fc207b2451fdd2d64ab7080c339f4d7
Opcode Fuzzy Hash: 78777b6b0dbf721b0ed9470f19e77baa356d7707702c07003713f6a54067abed
Instruction Fuzzy Hash: DDF0A45910C385BAE201E67C8C45F4FBECD4B52224F048A5CF1E8D62D2EA79D1048BB7

Function 02831A8C Relevance: 7.7, APIs: 6, Instructions: 175
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?,?,00000000,02831FE4), ref: 02831B17
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,02831FE4), ref: 02831B31

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: a79d36d3f189bb74f14f7fe9cec1e524c7e994500fc1efdbc855d365cd8baac0
Instruction ID: 37e4e6f5cf69df2e32d5d8066478905b984376524a673734ed7056494c1a2d4a
Opcode Fuzzy Hash: a79d36d3f189bb74f14f7fe9cec1e524c7e994500fc1efdbc855d365cd8baac0
Instruction Fuzzy Hash: F351C07D6012408FEB16DF6CC988796BBD0AB45B18F1885AEE54DCB2C2E770D445CBE1

Function 0284E2F6 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 0284E436

Strings

ScanBuffer, xrefs: 0284E37F
OpenSession, xrefs: 0284E3D8
Initialize, xrefs: 0284E326

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: e100c454f6c4da9aea3d3ce3208b4838e9cae06fccfc6c4c03effe36bc8403e0
Instruction ID: 1bad9471d987cc91d248d64feb7794df55d03cb0912a7a5d22344d67c26a8960
Opcode Fuzzy Hash: e100c454f6c4da9aea3d3ce3208b4838e9cae06fccfc6c4c03effe36bc8403e0
Instruction Fuzzy Hash: 85410F7DB1050C9BEB11EBA8CC80A9EB3FAFF4C310F518425E441E7251DA74AD058FA1

Function 02848824 Relevance: 3.1, APIs: 2, Instructions: 65
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(00000000,00000000,0284890B), ref: 02848858

Part of subcall function 02848020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02848090,?,?,00000000,?,02847A06,ntdll,00000000,00000000,02847A4B,?,?,00000000), ref: 0284805E
Part of subcall function 02848020: GetModuleHandleA.KERNELBASE(?), ref: 02848072

Part of subcall function 028480C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02848150,?,?,00000000,00000000,?,02848069,00000000,KernelBASE,00000000,00000000,02848090), ref: 02848115
Part of subcall function 028480C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 0284811B
Part of subcall function 028480C8: GetProcAddress.KERNEL32(?,?), ref: 0284812D

Part of subcall function 02847D00: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02847D74

FreeLibrary.KERNEL32(74AD0000,00000000,02891388,Function_000065D8,00000004,02891398,02891388,05F5E0FF,00000040,0289139C,74AD0000,00000000,00000000,00000000,00000000,0284890B), ref: 028488EB

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: HandleModule$AddressLibraryProc$FreeLoadMemoryVirtualWrite
String ID:
API String ID: 3283153180-0
Opcode ID: 4c5d282190d38e13b97ecce1d227271112eddd01a60720c6597f348031ebefdb
Instruction ID: 0de14735a23cfcc9c0e23d40dc5ea62c11ead13dd9d518b4bbb52eeea46c9dcf
Opcode Fuzzy Hash: 4c5d282190d38e13b97ecce1d227271112eddd01a60720c6597f348031ebefdb
Instruction Fuzzy Hash: 5C11847CA44308ABEF02FBBCDC05A5E77B9DB45700F4405A4B608E3B90DE789D006B96

Function 02835814 Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(02830000,?,00000105), ref: 02835832

Part of subcall function 02835A78: GetModuleFileNameA.KERNEL32(00000000,?,00000105,02830000,0285D790), ref: 02835A94
Part of subcall function 02835A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02830000,0285D790), ref: 02835AB2
Part of subcall function 02835A78: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02830000,0285D790), ref: 02835AD0
Part of subcall function 02835A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02835AEE
Part of subcall function 02835A78: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02835B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02835B37
Part of subcall function 02835A78: RegQueryValueExA.ADVAPI32(?,02835CE4,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02835B7D,?,80000001), ref: 02835B55
Part of subcall function 02835A78: RegCloseKey.ADVAPI32(?,02835B84,00000000,?,?,00000000,02835B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02835B77

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: b28d12baadab1e4308946262d595483018c342fe3ea7939c094ad429c1d6dced
Instruction ID: 1e80a3bbc37518111bc2fc1a877ffae3138f4f0fc0566828a07790ec136ca274
Opcode Fuzzy Hash: b28d12baadab1e4308946262d595483018c342fe3ea7939c094ad429c1d6dced
Instruction Fuzzy Hash: BFE06DB9A002148BCB11DE5CC8C0A9737D8AB08B50F400565EC58DF34AD3B4D9208BD1

Function 02837E18 Relevance: 1.5, APIs: 1, Instructions: 16
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000,?,0284F8CC,ScanString,0289137C,0285AFD8,OpenSession,0289137C,0285AFD8,ScanString,0289137C,0285AFD8,UacScan,0289137C,0285AFD8,UacInitialize), ref: 02837E23

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 39d99aea2b4b3de8ff8324b5e373e5cbc7456bababb3b7d58f404b20ec88a84a
Instruction ID: cfb782bd67077159204d450892f9d0333b5072370ea9b2679e4fa45362344c23
Opcode Fuzzy Hash: 39d99aea2b4b3de8ff8324b5e373e5cbc7456bababb3b7d58f404b20ec88a84a
Instruction Fuzzy Hash: 03C08CEE2122000A6E52A1FC0CC400A43C809042393A40B35B43CCA3E2E321C82224D1

Function 02834C48 Relevance: 1.5, APIs: 1, Instructions: 16
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysFreeString.OLEAUT32(0284E950), ref: 02834C1A
SysReAllocStringLen.OLEAUT32(0285BE78,0284E950,000000B4), ref: 02834C62

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 34a044716cc047832c89a5cdbf8a1cf543af0314eed8eb6eb3cc9569b15b6366
Instruction ID: 9eb8f0d25c0c72e60c123b2d12f4de6d0a40da9955d506ed0d59a11c91ee340b
Opcode Fuzzy Hash: 34a044716cc047832c89a5cdbf8a1cf543af0314eed8eb6eb3cc9569b15b6366
Instruction Fuzzy Hash: EBD0807C5001055DBF2FDD994544937736AA9D130A34CC25DDC0ECA241EB75DC02CAF1

Function 0285BB50 Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

timeSetEvent.WINMM(00002710,00000000,0285BB44,00000000,00000001), ref: 0285BB60

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: Eventtime
String ID:
API String ID: 2982266575-0
Opcode ID: d0786b8aa167220f8148ae0891bd2fa4cae93bf8a9ef91ff338820754565d543
Instruction ID: 4920326fd9e4a406738685cab30795b5aae8827dee937b100c042cef04aa5f9a
Opcode Fuzzy Hash: d0786b8aa167220f8148ae0891bd2fa4cae93bf8a9ef91ff338820754565d543
Instruction Fuzzy Hash: CDC092FC7843003EF62166AC2CC2F33718EE304B14F610412BB00FE2D5E5E24C640A66

Function 028315CC Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00140000,00001000,00000004,?,02831A03), ref: 028315E2

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d7c37834b332fe24c529cd60f2c579932d766010faa033ce643307ae5a5d759e
Instruction ID: 164611721756ad31bc683afde7847e9353e24fbb0b2632857d1a34c1d1d9224f
Opcode Fuzzy Hash: d7c37834b332fe24c529cd60f2c579932d766010faa033ce643307ae5a5d759e
Instruction Fuzzy Hash: 70F037F8B413005BEB06EF7D9D483016AD2E789344F108579E709DB2D8E77194018B40

Function 02831682 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00101000,00000004), ref: 028316A4

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2a669a7bab91db20cb42b3a2af6935233a7b8fda59e4b257e86bb6dad1c1a824
Instruction ID: 2683693517bd6c29818727cd30ad420e8f9fd2257c7fa33b699c0402b5ee3d17
Opcode Fuzzy Hash: 2a669a7bab91db20cb42b3a2af6935233a7b8fda59e4b257e86bb6dad1c1a824
Instruction Fuzzy Hash: 71F0FABAB047947BD7118E8A9C80B82BB94FB40720F080139EA4CDB380D7B2A8108BD4

Function 028316E6 Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000,02831FE4), ref: 02831704

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 1b4a79e062a67ee305261807369070bfc78e82772414bcdf9108a829f197f413
Instruction ID: 9b2ec0fff5e90318257e011d65e88eb1ec2934501aeb2a7c3076e3d9d5c761c5
Opcode Fuzzy Hash: 1b4a79e062a67ee305261807369070bfc78e82772414bcdf9108a829f197f413
Instruction Fuzzy Hash: B7E0CD7D3003016FD7115B7D5D88712BBDCEB44B64F184875F549DB281D760E8108BA0

Non-executed Functions

Function 0284A95C Relevance: 59.6, APIs: 17, Strings: 17, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000002,0284ABE3,?,?,0284AC75,00000000,0284AD51), ref: 0284A970
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 0284A988
GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 0284A99A
GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 0284A9AC
GetProcAddress.KERNEL32(00000000,Heap32First), ref: 0284A9BE
GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 0284A9D0
GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 0284A9E2
GetProcAddress.KERNEL32(00000000,Process32First), ref: 0284A9F4
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 0284AA06
GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 0284AA18
GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 0284AA2A
GetProcAddress.KERNEL32(00000000,Thread32First), ref: 0284AA3C
GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 0284AA4E
GetProcAddress.KERNEL32(00000000,Module32First), ref: 0284AA60
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 0284AA72
GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 0284AA84
GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 0284AA96

Strings

Heap32ListNext, xrefs: 0284A9A4
Process32FirstW, xrefs: 0284AA10
Module32Next, xrefs: 0284AA6A
Process32First, xrefs: 0284A9EC
Process32Next, xrefs: 0284A9FE
kernel32.dll, xrefs: 0284A96B
Module32First, xrefs: 0284AA58
CreateToolhelp32Snapshot, xrefs: 0284A980
Module32NextW, xrefs: 0284AA8E
Heap32Next, xrefs: 0284A9C8
Thread32Next, xrefs: 0284AA46
Thread32First, xrefs: 0284AA34
Module32FirstW, xrefs: 0284AA7C
Heap32First, xrefs: 0284A9B6
Toolhelp32ReadProcessMemory, xrefs: 0284A9DA
Process32NextW, xrefs: 0284AA22
Heap32ListFirst, xrefs: 0284A992

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Module32First$Module32FirstW$Module32Next$Module32NextW$Process32First$Process32FirstW$Process32Next$Process32NextW$Thread32First$Thread32Next$Toolhelp32ReadProcessMemory$kernel32.dll
API String ID: 667068680-597814768
Opcode ID: 632c6cedb2bc90c3a54ed25567275a10500eb14a874b0042f221d70a7b0d06b7
Instruction ID: 924bf188d36181a2051cd2086be4c1661560543544b0814953a9ef2773e9b565
Opcode Fuzzy Hash: 632c6cedb2bc90c3a54ed25567275a10500eb14a874b0042f221d70a7b0d06b7
Instruction Fuzzy Hash: 8131E1BCAC4735AFFB06DFBCD8D8A1637A9AB057407050965A006CF245FB789810CF96

Function 02848BB0 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1654threadnativeinjectionCOMMON

Download Yara Rule

APIs

Part of subcall function 02848824: LoadLibraryA.KERNEL32(00000000,00000000,0284890B), ref: 02848858
Part of subcall function 02848824: FreeLibrary.KERNEL32(74AD0000,00000000,02891388,Function_000065D8,00000004,02891398,02891388,05F5E0FF,00000040,0289139C,74AD0000,00000000,00000000,00000000,00000000,0284890B), ref: 028488EB

GetThreadContext.KERNEL32(00000000,02891420,ScanString,028913A4,0284A77C,UacInitialize,028913A4,0284A77C,ScanBuffer,028913A4,0284A77C,ScanBuffer,028913A4,0284A77C,UacInitialize,028913A4), ref: 02849442

Part of subcall function 02847D00: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02847D74

SetThreadContext.KERNEL32(00000000,02891420,ScanBuffer,028913A4,0284A77C,ScanString,028913A4,0284A77C,Initialize,028913A4,0284A77C,00000000,-00000008,028914F8,00000004,028914FC), ref: 0284A157
NtResumeThread.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,00000000,02891420,ScanBuffer,028913A4,0284A77C,ScanString,028913A4,0284A77C,Initialize,028913A4,0284A77C,00000000,-00000008,028914F8), ref: 0284A164

Part of subcall function 028487A0: LoadLibraryW.KERNEL32(bcrypt,?,00000000,00000000,028913A4,0284A3C7,ScanString,028913A4,0284A77C,ScanBuffer,028913A4,0284A77C,Initialize,028913A4,0284A77C,UacScan), ref: 028487B4
Part of subcall function 028487A0: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 028487CE
Part of subcall function 028487A0: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000000,00000000,028913A4,0284A3C7,ScanString,028913A4,0284A77C,ScanBuffer,028913A4,0284A77C,Initialize), ref: 0284880A

Strings

MiniDumpReadDumpStream, xrefs: 0284A568
NtOpenProcess, xrefs: 0284A6E3
BCryptQueryProviderRegistration, xrefs: 0284A3C7
OpenSession, xrefs: 02848BE9, 0284900C, 028490BE, 0284A48F, 0284A5D5
sppc, xrefs: 028491B6
Initialize, xrefs: 02848F2A, 02849538, 028496BF, 02849AA8, 02849D0A, 02849E7A, 02849FED, 0284A252, 0284A583
NtOpenObjectAuditAlarm, xrefs: 0284A474, 0284A52C
ScanBuffer, xrefs: 02848D0C, 02848D94, 0284912F, 02849244, 028492E1, 0284961A, 028497A1, 02849934, 02849B19, 02849C2E, 02849DEC, 02849F5C, 0284A0CF, 0284A2C3, 0284A4E1, 0284A627
UacInitialize, xrefs: 02848E72, 028491D3, 02849352, 02849456, 02849852, 028499C6, 0284A170
NtReadVirtualMemory, xrefs: 0284A460
ntdll, xrefs: 0284A465, 0284A479, 0284A531, 0284A6D4, 0284A6E8
MiniDumpWriteDump, xrefs: 0284A554
UacScan, xrefs: 02848CB3, 02848ECB, 028494C7, 028498C3, 02849A37, 0284A1E1, 0284A679
SLGetLicenseInformation, xrefs: 0284919F
dbgcore, xrefs: 0284A559, 0284A56D
ScanString, xrefs: 02848C42, 02848DED, 02848F9B, 028493C3, 028495A9, 02849730, 02849BBD, 02849D7B, 02849EEB, 0284A05E, 0284A349, 0284A3F6
I_QueryTagInformation, xrefs: 0284A540
bcrypt, xrefs: 0284A3B8, 0284A3CC, 0284A3E0
BCryptRegisterProvider, xrefs: 0284A3DB
NtSetSecurityObject, xrefs: 0284A6CF
BCryptVerifySignature, xrefs: 0284A3B3
advapi32, xrefs: 0284A545

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: Library$Thread$ContextFreeLoad$AddressMemoryProcResumeVirtualWrite
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 3455621253-51457883
Opcode ID: 0a6d1acadb767cbab300e5246538de260925b861507ec87986583d8da0fbc468
Instruction ID: 8e7170226f045b3995d43ffce67947eedc9d119ea749bd4db5325024d5e5ae18
Opcode Fuzzy Hash: 0a6d1acadb767cbab300e5246538de260925b861507ec87986583d8da0fbc468
Instruction Fuzzy Hash: 69E21E7CA5011C9BEB16EB68CC90EDE73BAEF49310F1040A1E549EB315DE74AE458F92

Function 02848BAE Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1605threadCOMMON

Download Yara Rule

APIs

Part of subcall function 02848824: LoadLibraryA.KERNEL32(00000000,00000000,0284890B), ref: 02848858
Part of subcall function 02848824: FreeLibrary.KERNEL32(74AD0000,00000000,02891388,Function_000065D8,00000004,02891398,02891388,05F5E0FF,00000040,0289139C,74AD0000,00000000,00000000,00000000,00000000,0284890B), ref: 028488EB

GetThreadContext.KERNEL32(00000000,02891420,ScanString,028913A4,0284A77C,UacInitialize,028913A4,0284A77C,ScanBuffer,028913A4,0284A77C,ScanBuffer,028913A4,0284A77C,UacInitialize,028913A4), ref: 02849442

Strings

MiniDumpReadDumpStream, xrefs: 0284A568
NtOpenProcess, xrefs: 0284A6E3
BCryptQueryProviderRegistration, xrefs: 0284A3C7
OpenSession, xrefs: 02848BE9, 0284900C, 028490BE, 0284A48F, 0284A5D5
sppc, xrefs: 028491B6
Initialize, xrefs: 02848F2A, 02849538, 028496BF, 02849AA8, 02849D0A, 02849E7A, 02849FED, 0284A252, 0284A583
NtOpenObjectAuditAlarm, xrefs: 0284A474, 0284A52C
ScanBuffer, xrefs: 02848D0C, 02848D94, 0284912F, 02849244, 028492E1, 0284961A, 028497A1, 02849934, 02849B19, 02849C2E, 02849DEC, 02849F5C, 0284A0CF, 0284A2C3, 0284A4E1, 0284A627
UacInitialize, xrefs: 02848E72, 028491D3, 02849352, 02849456, 0284A170
NtReadVirtualMemory, xrefs: 0284A460
ntdll, xrefs: 0284A465, 0284A479, 0284A531, 0284A6D4, 0284A6E8
MiniDumpWriteDump, xrefs: 0284A554
UacScan, xrefs: 02848CB3, 02848ECB, 028494C7, 028498C3, 02849A37, 0284A1E1, 0284A679
SLGetLicenseInformation, xrefs: 0284919F
dbgcore, xrefs: 0284A559, 0284A56D
ScanString, xrefs: 02848C42, 02848DED, 02848F9B, 028493C3, 028495A9, 02849730, 02849BBD, 02849D7B, 02849EEB, 0284A05E, 0284A349, 0284A3F6
I_QueryTagInformation, xrefs: 0284A540
bcrypt, xrefs: 0284A3B8, 0284A3CC, 0284A3E0
BCryptRegisterProvider, xrefs: 0284A3DB
NtSetSecurityObject, xrefs: 0284A6CF
BCryptVerifySignature, xrefs: 0284A3B3
advapi32, xrefs: 0284A545

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: Library$ContextFreeLoadThread
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 720575881-51457883
Opcode ID: bc3aba5d95966dc4d9ae5baf9b0b6b1760239ee6f1da9a7135e923f8a5924dc5
Instruction ID: 030bc8779b19bf47991997729b795857eefe64e22657f984641f0f1129a4ce32
Opcode Fuzzy Hash: bc3aba5d95966dc4d9ae5baf9b0b6b1760239ee6f1da9a7135e923f8a5924dc5
Instruction Fuzzy Hash: 67E21D7CA5011C9BEB16EB68CC90EDE73BAEF49310F1040A1E549EB315DE74AE458F92

Function 028358B4 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 139stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,02836BD0,02830000,0285D790), ref: 028358D1
GetProcAddress.KERNEL32(?,GetLongPathNameA), ref: 028358E8
lstrcpynA.KERNEL32(?,?,?), ref: 02835918
lstrcpynA.KERNEL32(?,?,?,kernel32.dll,02836BD0,02830000,0285D790), ref: 0283597C
lstrcpynA.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,02836BD0,02830000,0285D790), ref: 028359B2
FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,02836BD0,02830000,0285D790), ref: 028359C5
FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,02836BD0,02830000,0285D790), ref: 028359D7
lstrlenA.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02836BD0,02830000,0285D790), ref: 028359E3
lstrcpynA.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02836BD0,02830000), ref: 02835A17
lstrlenA.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02836BD0), ref: 02835A23
lstrcpynA.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 02835A45

Strings

\, xrefs: 028359F5
kernel32.dll, xrefs: 028358CC
GetLongPathNameA, xrefs: 028358DF

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 3245196872-1565342463
Opcode ID: 20ad37e2dbd9a3ff8bb3c1239f3378d64f7da3c2bd0328ea6728ccfc9bc961a5
Instruction ID: 5f0444033f0d6f84729ad0c1e8e34a4898fa5da764bb589bd3a6c8b594ade00d
Opcode Fuzzy Hash: 20ad37e2dbd9a3ff8bb3c1239f3378d64f7da3c2bd0328ea6728ccfc9bc961a5
Instruction Fuzzy Hash: 3C417F7DD00259AFDB12DAE8CC88ADEB3BEAF08310F4449A5E548E7241D7789B448F90

Function 02835B84 Relevance: 15.1, APIs: 10, Instructions: 98stringlibrarythreadCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02835B94
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02835BA1
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02835BA7
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02835BD2
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02835C19
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02835C29
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02835C51
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02835C61
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02835C87
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02835C97

Strings

Software\Borland\Locales, xrefs: 02835AA8, 02835AC6
Software\Borland\Delphi\Locales, xrefs: 02835AE4

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1599918012-2375825460
Opcode ID: 872c564c5497cc255b6ddda9ad26ad67b225e16f2838cfcbc1086dd5fd5d1ed0
Instruction ID: 5efa9141af3549a2ba4bd5d42b49473f5464057f95c0b49fe51c84800509317d
Opcode Fuzzy Hash: 872c564c5497cc255b6ddda9ad26ad67b225e16f2838cfcbc1086dd5fd5d1ed0
Instruction Fuzzy Hash: 1B31C77DE4021C6AFB27D6B89C49FDFB7AD5B04784F4405E19608E6080DB789E448FD1

Function 028487A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(bcrypt,?,00000000,00000000,028913A4,0284A3C7,ScanString,028913A4,0284A77C,ScanBuffer,028913A4,0284A77C,Initialize,028913A4,0284A77C,UacScan), ref: 028487B4
GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 028487CE
FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000000,00000000,028913A4,0284A3C7,ScanString,028913A4,0284A77C,ScanBuffer,028913A4,0284A77C,Initialize), ref: 0284880A

Part of subcall function 02847D00: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02847D74

Strings

bcrypt, xrefs: 028487B3
BCryptVerifySignature, xrefs: 028487C7

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: Library$AddressFreeLoadMemoryProcVirtualWrite
String ID: BCryptVerifySignature$bcrypt
API String ID: 1002360270-4067648912
Opcode ID: 4bd9b00bda0c10be10f1f07fb2dfc6a066d8b8e124ae901a63252ff564952ce0
Instruction ID: bfb5027b3d0790b112a68cba289ee43bcb7d34a32836ae4e4ebfa646c17d216d
Opcode Fuzzy Hash: 4bd9b00bda0c10be10f1f07fb2dfc6a066d8b8e124ae901a63252ff564952ce0
Instruction Fuzzy Hash: 4FF0817DA88219EBEB119A6CA84CB7633BC9741358F0C0929B10CC76C0E7781410AB50

Function 0284DACC Relevance: 6.1, APIs: 4, Instructions: 80nativefileCOMMON

Download Yara Rule

APIs

Part of subcall function 02834ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02834EDA

RtlDosPa.N(00000000,?,00000000,00000000,00000000,0284DB9E), ref: 0284DB0B
NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0284DB45
NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 0284DB72
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 0284DB7B

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: File$AllocCloseCreateStringWrite
String ID:
API String ID: 3308905243-0
Opcode ID: ef78dc56a37a7b5ea296fc6bf1e8470dcedf3b088f6fcf699a73ae194ed3361a
Instruction ID: 51ee3cd47ac09682cd62ef804454aef7264397822d3a29f8580268f03788961c
Opcode Fuzzy Hash: ef78dc56a37a7b5ea296fc6bf1e8470dcedf3b088f6fcf699a73ae194ed3361a
Instruction Fuzzy Hash: AC21C179A4030CBBEB11EAE8CD46F9EB7BDEB04B14F504461B604F71D0DBB46E048A96

Function 0284D9F0 Relevance: 4.5, APIs: 3, Instructions: 47filenativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.NTDLL(?,?), ref: 0284DA6C
RtlDosPa.N(00000000,?,00000000,00000000,00000000,0284DABE), ref: 0284DA82
NtDeleteFile.NTDLL(?), ref: 0284DAA1

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: DeleteFileInitStringUnicode
String ID:
API String ID: 3559453722-0
Opcode ID: 97311c2412812b380f08521188bae99ed0de798ce78c0aa4d3d47d1892d70ff4
Instruction ID: cf2c6d7c2d7e210326c788a34b89cf5668a6459b9851272470bf024e78c24ea1
Opcode Fuzzy Hash: 97311c2412812b380f08521188bae99ed0de798ce78c0aa4d3d47d1892d70ff4
Instruction Fuzzy Hash: 11014F7D90824CAFEB06EAA48941BCD77B9AB45704F5000939240E6082DF74AB148B66

Function 0284DA44 Relevance: 4.5, APIs: 3, Instructions: 45filenativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02834ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02834EDA

RtlInitUnicodeString.NTDLL(?,?), ref: 0284DA6C
RtlDosPa.N(00000000,?,00000000,00000000,00000000,0284DABE), ref: 0284DA82
NtDeleteFile.NTDLL(?), ref: 0284DAA1

Part of subcall function 02834C0C: SysFreeString.OLEAUT32(0284E950), ref: 02834C1A

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: String$AllocDeleteFileFreeInitUnicode
String ID:
API String ID: 2841551397-0
Opcode ID: f33779f7ce2e41976a921b2e3bad5cca291c3d8bde5ae72dadf4bf6fc8dac801
Instruction ID: 3f1fd498e678a75a7a03195ff0f445243aff5b33e9ec0eaad2ad750f2d91a6b0
Opcode Fuzzy Hash: f33779f7ce2e41976a921b2e3bad5cca291c3d8bde5ae72dadf4bf6fc8dac801
Instruction Fuzzy Hash: 5601E17D90420CABEB11EAE4CD51FCEB3BDEB48710F504462E600E6180EB74AB148A65

Function 02837F5A Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 02837F7D

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 60a0a3317bc6745db68fd0609a05e035b6386226a90ab679635ab5dbfaeb8164
Instruction ID: 50fa33735f41c843807b3f86d8101520f8758cbac941e29ebff9731372badd20
Opcode Fuzzy Hash: 60a0a3317bc6745db68fd0609a05e035b6386226a90ab679635ab5dbfaeb8164
Instruction Fuzzy Hash: 0C1100B5A00209AF9B05CF9DC8809AFF7F9EFCC304B14C569A508EB254E6319A018B90

Function 02846D50 Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON

Download Yara Rule

APIs

Part of subcall function 02846CF4: CLSIDFromProgID.OLE32(00000000,?,00000000,02846D41,?,?,?,00000000), ref: 02846D21

CoCreateInstance.OLE32(?,00000000,00000005,02846E34,00000000,00000000,02846DB3,?,00000000,02846E23), ref: 02846D9F

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: CreateFromInstanceProg
String ID:
API String ID: 2151042543-0
Opcode ID: 19a70717b9f99420783f53e4124711202c3f69116e11314e0f5ecee19643d98c
Instruction ID: ee5ba9f3677ddf308c91769682d0b0d70da62c1b80a4a489de42655ce6992bd6
Opcode Fuzzy Hash: 19a70717b9f99420783f53e4124711202c3f69116e11314e0f5ecee19643d98c
Instruction Fuzzy Hash: C701F77D60870CAFF705DF68DC5296B7BEDE74AB10B614435F901D2640FA349A00C9A1

Function 0283A74C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0283A76A

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 2128b34291823b7b3d39fc22196f9eeb1ad11300c5a3118c73b07de52b1b2571
Instruction ID: 30891b67b21b3586e960f67fe98c77f7fb6c77dd7a787ace8f71739bee1351cc
Opcode Fuzzy Hash: 2128b34291823b7b3d39fc22196f9eeb1ad11300c5a3118c73b07de52b1b2571
Instruction Fuzzy Hash: 64E0D83EB0021817D316A55C9C81DF6735D975C350F00417EBD48C7341FEA09D404AEA

Function 0283B714 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,0285C106,00000000,0285C11E), ref: 0283B722

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 833bdb0fc2f2bdfbc44b5e9af5d46e9fcbb4dd45d38abd0f7083f1a10350b54e
Instruction ID: c289563f2104bf3be402d0039a5dd6483f04316f230eb865f58f2de508b8013a
Opcode Fuzzy Hash: 833bdb0fc2f2bdfbc44b5e9af5d46e9fcbb4dd45d38abd0f7083f1a10350b54e
Instruction Fuzzy Hash: FFF0D4BC9443219FC351EF28D541A197BE5FB48B14F408D29EC99C73A0E7389866CF92

Function 0283A798 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0283BDFA,00000000,0283C013,?,?,00000000,00000000), ref: 0283A7AB

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 23fe133b6f3189abf78f0258856cb74c0ef8cfe774ed9d6b2b97d20fe01198e3
Instruction ID: 8125bfd4a028d75cb6625cd2a85976152a90bc9bf7ae5fe1de7ba3791a1ee98e
Opcode Fuzzy Hash: 23fe133b6f3189abf78f0258856cb74c0ef8cfe774ed9d6b2b97d20fe01198e3
Instruction Fuzzy Hash: 3BD05EAE30E2603AA225515E2D94D7B5AECCAC97A1F00843EF5C8C6201E2008C0696F5

Function 02839194 Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 02839198

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: b1eecd68d2e37ad01dc8be627e7f9539d8c1b79e2157fe00e2d627bfaf393da5
Instruction ID: 36279ed80754645ce8ca8595f2490d50e495cf1bcaff86714ca6c0c592f342b0
Opcode Fuzzy Hash: b1eecd68d2e37ad01dc8be627e7f9539d8c1b79e2157fe00e2d627bfaf393da5
Instruction Fuzzy Hash: EEA01108808C30228A803B2E0C0223A3088A800A20FC80F80A8F8802E2FE2E022080EB

Function 0285D59A Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12043076a5366ebb5461ea3a1a8c543de513e28444d30f364bf4840e377266cb
Instruction ID: c7b232916a5afe816f97f151e0ded9be56f7e2bfa8181749b74a171183b5f72a
Opcode Fuzzy Hash: 12043076a5366ebb5461ea3a1a8c543de513e28444d30f364bf4840e377266cb
Instruction Fuzzy Hash: 4651E67A4197D28FC7834F7484953827FF1AF57625B0A01DADC848F0A3E3694897DB51

Function 028320C4 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction ID: d9ca5c35b085eece62e9f9345e2df5b5b2dbbbf6d6fdc43b5a6e4acac797e09a
Opcode Fuzzy Hash: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction Fuzzy Hash: 44317E3213659B4EC7088B3CC8514ADAB93BE937353A843B7C071CB5D7D7B5A26E8290

Function 0283D21C Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(oleaut32.dll), ref: 0283D225

Part of subcall function 0283D1F0: GetProcAddress.KERNEL32(00000000), ref: 0283D209

Strings

VarI4FromStr, xrefs: 0283D351
VariantChangeTypeEx, xrefs: 0283D233
VarAdd, xrefs: 0283D275
VarBstrFromDate, xrefs: 0283D3EB
VarAnd, xrefs: 0283D2F9
VarBoolFromStr, xrefs: 0283D3BF
VarMul, xrefs: 0283D2A1
VarNot, xrefs: 0283D25F
VarR8FromStr, xrefs: 0283D37D
oleaut32.dll, xrefs: 0283D220
VarR4FromStr, xrefs: 0283D367
VarCyFromStr, xrefs: 0283D3A9
VarSub, xrefs: 0283D28B
VarDiv, xrefs: 0283D2B7
VarBstrFromCy, xrefs: 0283D3D5
VarNeg, xrefs: 0283D249
VarIdiv, xrefs: 0283D2CD
VarOr, xrefs: 0283D30F
VarMod, xrefs: 0283D2E3
VarBstrFromBool, xrefs: 0283D401
VarXor, xrefs: 0283D325
VarCmp, xrefs: 0283D33B
VarDateFromStr, xrefs: 0283D393

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: 10f21f5ebaceeed55fa0620d40c6c95fe454a50a56505154fb70d659a8dba21a
Instruction ID: 6023fae9b7dd9f2542e663dd4b2c832e5d0a1752fdbc00b45305ebdae48b1345
Opcode Fuzzy Hash: 10f21f5ebaceeed55fa0620d40c6c95fe454a50a56505154fb70d659a8dba21a
Instruction Fuzzy Hash: 3741886DA882055B560BFBAD740442BB7DED788760360851BF208DB7C1DDB0BC694EEE

Function 02846E60 Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ole32.dll), ref: 02846E66
GetProcAddress.KERNEL32(00000000,CoCreateInstanceEx), ref: 02846E77
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 02846E87
GetProcAddress.KERNEL32(00000000,CoAddRefServerProcess), ref: 02846E97
GetProcAddress.KERNEL32(00000000,CoReleaseServerProcess), ref: 02846EA7
GetProcAddress.KERNEL32(00000000,CoResumeClassObjects), ref: 02846EB7
GetProcAddress.KERNEL32 ref: 02846EC7

Strings

CoReleaseServerProcess, xrefs: 02846EA1
CoCreateInstanceEx, xrefs: 02846E71
ole32.dll, xrefs: 02846E61
CoSuspendClassObjects, xrefs: 02846EC1
CoInitializeEx, xrefs: 02846E81
CoAddRefServerProcess, xrefs: 02846E91
CoResumeClassObjects, xrefs: 02846EB1

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CoAddRefServerProcess$CoCreateInstanceEx$CoInitializeEx$CoReleaseServerProcess$CoResumeClassObjects$CoSuspendClassObjects$ole32.dll
API String ID: 667068680-2233174745
Opcode ID: 77ab40fb7f59aafd3fc166909d14bc247e6a701df920dbf6e49b820630acffdf
Instruction ID: 405371dcaed507dc867b49cfd06f2eae67a1fe45bda40228ea00fec55b775c1d
Opcode Fuzzy Hash: 77ab40fb7f59aafd3fc166909d14bc247e6a701df920dbf6e49b820630acffdf
Instruction Fuzzy Hash: 10F04CECA897397FB7037F7C9C81827279D9D126843101925B842E5A43FFBD88604B9A

Function 02832530 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 254windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,?,Unexpected Memory Leak,00002010), ref: 028328CE

Strings

bytes: , xrefs: 0283275D
An unexpected memory leak has occurred. , xrefs: 02832690
, xrefs: 02832814
The unexpected small block leaks are:, xrefs: 02832707
Unexpected Memory Leak, xrefs: 028328C0
7, xrefs: 028326A1
String, xrefs: 028327A1
The sizes of unexpected leaked medium and large blocks are: , xrefs: 02832849
Unknown, xrefs: 0283278C

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: Message
String ID: $ bytes: $7$An unexpected memory leak has occurred. $String$The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak$Unknown
API String ID: 2030045667-32948583
Opcode ID: ca4802617235d4052a82e0b138cd18013397730ae804efa983f917bfecf0d030
Instruction ID: bfa3915ef22ec5d784ab5d93d09f9e5bd0c32fd4f0392b2d1054ad484eb8f11c
Opcode Fuzzy Hash: ca4802617235d4052a82e0b138cd18013397730ae804efa983f917bfecf0d030
Instruction Fuzzy Hash: 3CA1E73CA042648BDF22AA2CCC80B9876E5EB09714F1441E5DD4DDB28ADB759D89CFD1

Function 0283252E Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 188COMMON

Download Yara Rule

Strings

bytes: , xrefs: 0283275D
An unexpected memory leak has occurred. , xrefs: 02832690
, xrefs: 02832814
The unexpected small block leaks are:, xrefs: 02832707
Unexpected Memory Leak, xrefs: 028328C0
7, xrefs: 028326A1
The sizes of unexpected leaked medium and large blocks are: , xrefs: 02832849

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID:
String ID: $ bytes: $7$An unexpected memory leak has occurred. $The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak
API String ID: 0-2723507874
Opcode ID: cc2dcd96c03cc6f2435465c7377c6ba568625bdf7f9316523fc589f1506854ed
Instruction ID: f3fc76e2c29368965c7f7d0a82c5d9cd5c3c42851d3422f36a92f70e17764968
Opcode Fuzzy Hash: cc2dcd96c03cc6f2435465c7377c6ba568625bdf7f9316523fc589f1506854ed
Instruction Fuzzy Hash: 4A71A53CA042A88EDB22AA2CCC84BD9B6E5EB09714F1041E5D94DDB289DBB54DC5CF91

Function 0283BD48 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,0283C013,?,?,00000000,00000000), ref: 0283BD7E

Part of subcall function 0283A74C: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0283A76A

Strings

m/d/yy, xrefs: 0283BE4D
:mm, xrefs: 0283BFB1
AMPM, xrefs: 0283BF92
:mm:ss, xrefs: 0283BFCE
AMPM , xrefs: 0283BFA1
mmmm d, yyyy, xrefs: 0283BE7A

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: 9892bf007104f695341788893a099d82a4686b2be31176b0b6b0b74c7ad104b9
Instruction ID: a410b2d2b2f7b9cac07ab0912021d31e83541ba849259c0dad578e223c6e66b6
Opcode Fuzzy Hash: 9892bf007104f695341788893a099d82a4686b2be31176b0b6b0b74c7ad104b9
Instruction Fuzzy Hash: BF615E3DB001489BDB06EBACDC90A9F77BB9B48300F549436E241FB745DA75D9098BD2

Function 0284AE20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 0284AE40
GetModuleHandleW.KERNEL32(KernelBase,LoadLibraryExA,?,00000004,?,00000014), ref: 0284AE57
IsBadReadPtr.KERNEL32(?,00000004), ref: 0284AEEB
IsBadReadPtr.KERNEL32(?,00000002), ref: 0284AEF7
IsBadReadPtr.KERNEL32(?,00000014), ref: 0284AF0B

Strings

KernelBase, xrefs: 0284AE52
LoadLibraryExA, xrefs: 0284AE4D

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: Read$HandleModule
String ID: KernelBase$LoadLibraryExA
API String ID: 2226866862-113032527
Opcode ID: 0682bb1cfc70660c73842f1bcdcfedb853a0671eb41967d287c7fb2a4e8593c4
Instruction ID: cbd5d2e374e8045ef4afe0c3d5471208291d2883c6ea63f3c123e5ada706687b
Opcode Fuzzy Hash: 0682bb1cfc70660c73842f1bcdcfedb853a0671eb41967d287c7fb2a4e8593c4
Instruction Fuzzy Hash: 6A3187BE540309BBEB24DF5CCC85F5A77A8AF05764F044114EA58EF281EB74E940CBA5

Function 0283432C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,028343F3,?,?,028907C8,?,?,0285D7A8,0283655D,0285C30D), ref: 02834365
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,028343F3,?,?,028907C8,?,?,0285D7A8,0283655D,0285C30D), ref: 0283436B
GetStdHandle.KERNEL32(000000F5,028343B4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,028343F3,?,?,028907C8), ref: 02834380
WriteFile.KERNEL32(00000000,000000F5,028343B4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,028343F3,?,?), ref: 02834386
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 028343A4

Strings

Runtime error at 00000000, xrefs: 0283435E, 0283439D
Error, xrefs: 02834398

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: ab93594cdc6e9cecb16de694630aca592fa85504c999b9d2bca0ea3a5cc1b7a3
Instruction ID: 34bf6668ffe2e90b517828df6f3574f0b9a4b42f3f8a94ccd86aab78c973c7d4
Opcode Fuzzy Hash: ab93594cdc6e9cecb16de694630aca592fa85504c999b9d2bca0ea3a5cc1b7a3
Instruction Fuzzy Hash: 76F0B46DAC434079FA12B668AC4AF9D275C5B45F25F180A04BA38E50C0C7E8A0C4CBA7

Function 0283AE4C Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0283ACC4: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0283ACE1
Part of subcall function 0283ACC4: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0283AD05
Part of subcall function 0283ACC4: GetModuleFileNameA.KERNEL32(02830000,?,00000105), ref: 0283AD20
Part of subcall function 0283ACC4: LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 0283ADB6

CharToOemA.USER32(?,?), ref: 0283AE83
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 0283AEA0
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 0283AEA6
GetStdHandle.KERNEL32(000000F4,0283AF10,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 0283AEBB
WriteFile.KERNEL32(00000000,000000F4,0283AF10,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 0283AEC1
LoadStringA.USER32(00000000,0000FFEA,?,00000040), ref: 0283AEE3
MessageBoxA.USER32(00000000,?,?,00002010), ref: 0283AEF9

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
String ID:
API String ID: 185507032-0
Opcode ID: a7a9910d431e859f6cf7900fc644c1c595763e71450b6369230f5ea73d7c9471
Instruction ID: 2f41d4a3b21f3762cb8f6a8446cbbce132fdd3bd177a68b161e21dc084b6cf36
Opcode Fuzzy Hash: a7a9910d431e859f6cf7900fc644c1c595763e71450b6369230f5ea73d7c9471
Instruction Fuzzy Hash: 041170BE5442047AD202FBACCC80F8B77EDAB44700F400916B384D60D1EB75E9448FA7

Function 0283E514 Relevance: 9.1, APIs: 6, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0283E5AD
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0283E5C9
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 0283E602
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 0283E67F
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 0283E698
VariantCopy.OLEAUT32(?,00000000), ref: 0283E6CD

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-0
Opcode ID: 64ad64c3195a2b266e732bc1d787a2588087a1c16bed5c34222ee16cb595d48a
Instruction ID: c636ffa3007aebc3f30ecb90396637d97d845ff5d662c73c4fb5cc646b836592
Opcode Fuzzy Hash: 64ad64c3195a2b266e732bc1d787a2588087a1c16bed5c34222ee16cb595d48a
Instruction Fuzzy Hash: 1151D67E90162D9BCB22EF58C880BD9B3BDAF4C300F4041D5E949E7242D674AF858FA1

Function 02833568 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 0283358A
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,028335D9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 028335BD
RegCloseKey.ADVAPI32(?,028335E0,00000000,?,00000004,00000000,028335D9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 028335D3

Strings

SOFTWARE\Borland\Delphi\RTL, xrefs: 02833580
FPUMaskValue, xrefs: 028335B4

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: 52b7c0591229db538816e3fc35eba4fe39363d668987a25d1cd3b7d01d8518ed
Instruction ID: 946a9cb49d15692e6929dc1c01fdf6a2e86afd78b70b152d2e18ff12fcc74042
Opcode Fuzzy Hash: 52b7c0591229db538816e3fc35eba4fe39363d668987a25d1cd3b7d01d8518ed
Instruction Fuzzy Hash: 4701D87E940318BAFB12DB90CD02BBD77ECEB08B10F1005A1BE04D6680F6789610DBD9

Function 028480C8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02848150,?,?,00000000,00000000,?,02848069,00000000,KernelBASE,00000000,00000000,02848090), ref: 02848115
GetProcAddress.KERNEL32(00000000,Kernel32), ref: 0284811B
GetProcAddress.KERNEL32(?,?), ref: 0284812D

Strings

sserddAcorPteG, xrefs: 028480E3
Kernel32, xrefs: 02848110

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: Kernel32$sserddAcorPteG
API String ID: 667068680-1372893251
Opcode ID: 4fb8c88c661fc3b6cac0f6561d4020540db2929965b6cd8ecd29ca47bb0dbcb4
Instruction ID: bd2729bbcf504ea7f3ddcc45c94b7222bbdf976c334a281750c66c0586a60f04
Opcode Fuzzy Hash: 4fb8c88c661fc3b6cac0f6561d4020540db2929965b6cd8ecd29ca47bb0dbcb4
Instruction Fuzzy Hash: 7801A23CA44308BFEB02EFA8DC41E9EB7BEEB48710F514865B504D7740DA78A9009A65

Function 0283A9D8 Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,0283AA6F,?,?,00000000), ref: 0283A9F0

Part of subcall function 0283A74C: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0283A76A

GetThreadLocale.KERNEL32(00000000,00000004,00000000,0283AA6F,?,?,00000000), ref: 0283AA20
EnumCalendarInfoA.KERNEL32(Function_0000A924,00000000,00000000,00000004), ref: 0283AA2B
GetThreadLocale.KERNEL32(00000000,00000003,00000000,0283AA6F,?,?,00000000), ref: 0283AA49
EnumCalendarInfoA.KERNEL32(Function_0000A960,00000000,00000000,00000003), ref: 0283AA54

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: a1f4e68f5202450e1771a53e0804ae77dfe8dc0a270603250dfa49d43cad2048
Instruction ID: eaf35aa93d4c00ddc9645ec9d6af28fcb0555aa888a21ecdddee0fc59741e7cb
Opcode Fuzzy Hash: a1f4e68f5202450e1771a53e0804ae77dfe8dc0a270603250dfa49d43cad2048
Instruction Fuzzy Hash: C301F73E6002587FF707E6BCCD12B6E735DDB41720F514160E651E67C0F6689E108AEA

Function 0283AA88 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,0283AC58,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0283AAB7

Part of subcall function 0283A74C: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0283A76A

Strings

eeee, xrefs: 0283ABC6
ggg, xrefs: 0283AB9D
yyyy, xrefs: 0283ABAD

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: 783f9adf2310e76877463b515793e02f5582f218ce269ca39cc1d3e978261366
Instruction ID: f90251725cc5f3b380de738190621809c8fb9ddf2cc0c0ca44404c63d9af608e
Opcode Fuzzy Hash: 783f9adf2310e76877463b515793e02f5582f218ce269ca39cc1d3e978261366
Instruction Fuzzy Hash: A841267D3041094BE71BAB6DC8902BEB3EBDB81304B504565D5E2C7344E678DD0BCAE2

Function 02848020 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02848090,?,?,00000000,?,02847A06,ntdll,00000000,00000000,02847A4B,?,?,00000000), ref: 0284805E

Part of subcall function 028480C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02848150,?,?,00000000,00000000,?,02848069,00000000,KernelBASE,00000000,00000000,02848090), ref: 02848115
Part of subcall function 028480C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 0284811B
Part of subcall function 028480C8: GetProcAddress.KERNEL32(?,?), ref: 0284812D

GetModuleHandleA.KERNELBASE(?), ref: 02848072

Strings

AeldnaHeludoMteG, xrefs: 02848039
KernelBASE, xrefs: 02848059

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: HandleModule$AddressProc
String ID: AeldnaHeludoMteG$KernelBASE
API String ID: 1883125708-1952140341
Opcode ID: 56de8852c018baa2dbd74805beab7b209d285e3fc15b69fdddaa10de3172a5f0
Instruction ID: 48cd645a1983e91c4a071bb6c73dcaafca825b53992acf557138bf44bb472ba9
Opcode Fuzzy Hash: 56de8852c018baa2dbd74805beab7b209d285e3fc15b69fdddaa10de3172a5f0
Instruction Fuzzy Hash: F8F0F03D614308BFEB01EFB8DC0291EB7ADEB09740B914960F500D3B10DB78BD009A66

Function 0284EB94 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KernelBase,?,0284EF98,UacInitialize,0289137C,0285AFD8,OpenSession,0289137C,0285AFD8,ScanBuffer,0289137C,0285AFD8,ScanString,0289137C,0285AFD8,Initialize), ref: 0284EB9A
GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 0284EBAC

Strings

IsDebuggerPresent, xrefs: 0284EBA6
KernelBase, xrefs: 0284EB95

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsDebuggerPresent$KernelBase
API String ID: 1646373207-2367923768
Opcode ID: 133b7841be745cb082c4c5cc423e5709ec3f86222df364a8e72131b0ab7c30e2
Instruction ID: a4b74499704542826384b6edd5f0c37b38178f367f0872ff4bdaa207137d70b9
Opcode Fuzzy Hash: 133b7841be745cb082c4c5cc423e5709ec3f86222df364a8e72131b0ab7c30e2
Instruction Fuzzy Hash: 03D0126D7557282FB90135FC0CC4C1E02CD99055693201E71B027E11D3FA6A88111555

Function 0283C3FC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,0285C10B,00000000,0285C11E), ref: 0283C402
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 0283C413

Strings

kernel32.dll, xrefs: 0283C3FD
GetDiskFreeSpaceExA, xrefs: 0283C40D

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: dfa34963c711bea7a6f31388021f70b32f7eaa0d5b55ce0d67203c69decb8a50
Instruction ID: 90e5a1a44d10675157bdafc93297b3d4ca83f53f1a5d0a6aa9569fe93a7e8070
Opcode Fuzzy Hash: dfa34963c711bea7a6f31388021f70b32f7eaa0d5b55ce0d67203c69decb8a50
Instruction Fuzzy Hash: 35D0C7ACA413219EFF035BB9788063636D89744766F40EC26E545E5242E7BD84244FD9

Function 0283E170 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0283E21F
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0283E23B
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 0283E2B2
VariantClear.OLEAUT32(?), ref: 0283E2DB

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: 8aa00cc61b707ac15c9433f3790f772ad147275ad2ddf2cbfec09d81ee21ca74
Instruction ID: c236bb5f5e87bf062847ace1a9fe0e2e463aad54ba697ed85a8e9bc7847d9bf4
Opcode Fuzzy Hash: 8aa00cc61b707ac15c9433f3790f772ad147275ad2ddf2cbfec09d81ee21ca74
Instruction Fuzzy Hash: 7741F87DA0161D9BCB62DB58CC90BD9B3BDBF48204F0041D5EA4CE7251DA74AF808F91

Function 0283ACC4 Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0283ACE1
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0283AD05
GetModuleFileNameA.KERNEL32(02830000,?,00000105), ref: 0283AD20
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 0283ADB6

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 7f476ec004eb1766b1c066890dd98336c1cf02d5ce69ad3fce6f3db3b4f095a1
Instruction ID: 30410594b337e93da6598521559619f3456a4153f2e16c43d50377bc12bd9677
Opcode Fuzzy Hash: 7f476ec004eb1766b1c066890dd98336c1cf02d5ce69ad3fce6f3db3b4f095a1
Instruction Fuzzy Hash: E041507DA00258ABDB22DB68CC84BDAB7FDAB18301F0044E5A648E7241E7759F84CF91

Function 0283ACC2 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0283ACE1
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0283AD05
GetModuleFileNameA.KERNEL32(02830000,?,00000105), ref: 0283AD20
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 0283ADB6

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 110a3fd0bbf80de0ab09b25aad3a4ff50b9b20b6cbcb2639fb9fb80406f303ff
Instruction ID: b1c2750f7c492830f2924e593733709ca24249c65831e84b74ae7b3f50bb4770
Opcode Fuzzy Hash: 110a3fd0bbf80de0ab09b25aad3a4ff50b9b20b6cbcb2639fb9fb80406f303ff
Instruction Fuzzy Hash: 8D41427DA00258ABDB22DB5CCC84BDAB7FDAB18301F0444E5A648E7251E7759F84CF91

Function 02831C6C Relevance: 5.3, APIs: 4, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc86a2aaa6f679b476a1705ac2a896c748f47356724c94e7176277d0f7d083b2
Instruction ID: bcc94a6e1f2078ff606b713fa1802e1e5c3c76a8730556e7e8d7601b057537bd
Opcode Fuzzy Hash: bc86a2aaa6f679b476a1705ac2a896c748f47356724c94e7176277d0f7d083b2
Instruction Fuzzy Hash: 72A1F86E7106000BE71AAA7C9C883BDB3C2DBC5B25F18827EE11DCB785DB64C95287D1

Function 02839474 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,02839562), ref: 028394FA
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,02839562), ref: 02839500

Strings

yyyy, xrefs: 028394D5

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: yyyy
API String ID: 3303714858-3145165042
Opcode ID: 4ae84e2e46795798ec7b7a33d4665bc354dc04403a73252e4054336359d90f50
Instruction ID: ad7761aeaebe541e02de70db969bace22e046e302e162ed945c4601adad2e045
Opcode Fuzzy Hash: 4ae84e2e46795798ec7b7a33d4665bc354dc04403a73252e4054336359d90f50
Instruction Fuzzy Hash: 7F21307EA002189FDB12DF98C841AEEB3B9EF48710F5140A5E949E7350D7B49E44CBE6

Function 02836444 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 0283644D
TlsGetValue.KERNEL32(00000020), ref: 02836462

Strings

XGw, xrefs: 02836467

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: AllocValue
String ID: XGw
API String ID: 1189806713-3971455815
Opcode ID: a5c25d6e9f30c3b30b13676ff8c8a345cb6a091723f3234a331606422db1b7fe
Instruction ID: 03e0f9ee7c694a41ca2329bfe621538161aa29e9950aac91c1632a9f9a6bada3
Opcode Fuzzy Hash: a5c25d6e9f30c3b30b13676ff8c8a345cb6a091723f3234a331606422db1b7fe
Instruction Fuzzy Hash: EEC002BCE50331AAEB02BBBD940460A36ADEB01715F08D925B814C7188FB79C411DF9A

Function 0284AD64 Relevance: 5.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 0284AD98
IsBadWritePtr.KERNEL32(?,00000004), ref: 0284ADC8
IsBadReadPtr.KERNEL32(?,00000008), ref: 0284ADE7
IsBadReadPtr.KERNEL32(?,00000004), ref: 0284ADF3

Memory Dump Source

Source File: 00000003.00000002.4496008500.0000000002831000.00000020.00001000.00020000.00000000.sdmp, Offset: 02830000, based on PE: true

Associated: 00000003.00000002.4495994250.0000000002830000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000285D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496044213.000000000288E000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002891000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002986000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.4496097161.0000000002988000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2830000_x.jbxd

Similarity

API ID: Read$Write
String ID:
API String ID: 3448952669-0
Opcode ID: 234bf798fc81b872ff5a85eead7648d9943be952996fa50f1c2af5a655f4751e
Instruction ID: a63cbf96bbaf38f45724deadc548ff6bdf9ca2a70efc24546173004992681a48
Opcode Fuzzy Hash: 234bf798fc81b872ff5a85eead7648d9943be952996fa50f1c2af5a655f4751e
Instruction Fuzzy Hash: A421A2BDA8061DABDB14DF69CC80BAE77A9EF44366F004111EE14DB344EF34E9119AE4

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report JIL-_Document_No._2500015903.cmd

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\x.exe

Static File Info

General

File Icon

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: cmd.exePID: 7164, Parent PID: 1028

General

Chronological Activities

Analysis Process: conhost.exePID: 4564, Parent PID: 7164

General

Chronological Activities

Analysis Process: extrac32.exePID: 5252, Parent PID: 7164

General

Chronological Activities

Analysis Process: x.exePID: 4256, Parent PID: 7164

Windows Analysis Report
JIL-_Document_No._2500015903.cmd

Function 0284EC74 Relevance: 243.3, APIs: 11, Strings: 122, Instructions: 10535
filesleepCOMMON

Function 02835A78 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Function 0284EBF0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28
libraryloaderCOMMON

Function 0284DBB0 Relevance: 7.6, APIs: 5, Instructions: 80
nativefileCOMMON

Function 0284E2F8 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111
networkCOMMON

Function 02847D00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49
nativeCOMMON

Function 02831724 Relevance: 9.0, APIs: 7, Instructions: 289
sleepCOMMON

Function 0284870C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35
libraryCOMMON

Function 02831A8C Relevance: 7.7, APIs: 6, Instructions: 175
sleepCOMMON

Function 0284E2F6 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112
networkCOMMON

Function 02848824 Relevance: 3.1, APIs: 2, Instructions: 65
libraryCOMMON

Function 02835814 Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Function 02837E18 Relevance: 1.5, APIs: 1, Instructions: 16
COMMON

Function 02834C48 Relevance: 1.5, APIs: 1, Instructions: 16
memoryCOMMON

Function 0285BB50 Relevance: 1.5, APIs: 1, Instructions: 12
COMMON