Edit tour

Windows Analysis Report
kthiokadjg.exe

Overview

General Information

Sample name:	kthiokadjg.exe
Analysis ID:	1583704
MD5:	cc5e91e1a0c3ca5edf2bdba7fa252827
SHA1:	004ba0788113ebb3bce8eaf63fa53c70caa91079
SHA256:	30efa81a5d0d9bf04a00b4e30823c2f0c7bd6461383acf0195d857edf2162543
Tags:	exeQuasarRATuser-lontze7
Infos:

Detection

Blackshades

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Blackshades RAT

Yara detected RansomwareGeneric

.NET source code references suspicious native API functions

AI detected suspicious sample

Contains functionality to disable the Task Manager (.Net Source)

Deletes shadow drive data (may be related to ransomware)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Installs a global keyboard hook

Machine Learning detection for sample

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

May check the online IP address of the machine

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Yara signature match

Classification

Process Tree

System is w10x64

kthiokadjg.exe (PID: 7312 cmdline: "C:\Users\user\Desktop\kthiokadjg.exe" MD5: CC5E91E1A0C3CA5EDF2BDBA7FA252827)

schtasks.exe (PID: 7392 cmdline: "schtasks" /create /tn "NET framework" /sc ONLOGON /tr "C:\Users\user\Desktop\kthiokadjg.exe" /rl HIGHEST /f MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7400 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

kthiokadjg.exe (PID: 7468 cmdline: C:\Users\user\Desktop\kthiokadjg.exe MD5: CC5E91E1A0C3CA5EDF2BDBA7FA252827)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
BlackShades		No Attribution	http://contagiodump.blogspot.com/2012/06/rat-samples-from-syrian-targeted.html https://blog.malwarebytes.com/threat-analysis/2012/06/blackshades-in-syria/ https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-2-blackshades-net/ https://blog.malwarebytes.com/threat-analysis/2014/05/taking-off-the-blackshades/ https://www.secureworks.com/research/threat-profiles/aluminum-saratoga	https://malpedia.caad.fkie.fraunhofer.de/details/win.blackshades

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
kthiokadjg.exe	JoeSecurity_Blackshades	Yara detected Blackshades RAT	Joe Security
kthiokadjg.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
kthiokadjg.exe	Windows_Trojan_Quasarrat_e52df647	unknown	unknown	0x3697a:$a1: GetKeyloggerLogsResponse 0x360e5:$a2: DoDownloadAndExecute 0x411ca:$a3: http://api.ipify.org/ 0x3ed41:$a4: Domain: {1}{0}Cookie Name: {2}{0}Value: {3}{0}Path: {4}{0}Expired: {5}{0}HttpOnly: {6}{0}Secure: {7} 0x4008f:$a5: " /sc ONLOGON /tr "
kthiokadjg.exe	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x35ed7:$s1: DoUploadAndExecute 0x360e5:$s2: DoDownloadAndExecute 0x35cdb:$s3: DoShellExecute 0x360aa:$s4: set_Processname 0x6bc8:$op1: 04 1E FE 02 04 16 FE 01 60 0x6aec:$op2: 00 17 03 1F 20 17 19 15 28 0x7552:$op3: 00 04 03 69 91 1B 40 0x7da2:$op3: 00 04 03 69 91 1B 40
kthiokadjg.exe	Quasar_RAT_2	Detects Quasar RAT	Florian Roth	0x3697a:$x1: GetKeyloggerLogsResponse 0x36bba:$s1: DoShellExecuteResponse 0x36533:$s2: GetPasswordsResponse 0x36a8d:$s3: GetStartupItemsResponse 0x35eeb:$s5: RunHidden 0x35f09:$s5: RunHidden 0x35f17:$s5: RunHidden 0x35f2b:$s5: RunHidden
kthiokadjg.exe	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x40055:$xc1: 41 00 64 00 6D 00 69 00 6E 00 00 11 73 00 63 00 68 00 74 00 61 00 73 00 6B 00 73 00 00 1B 2F 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 2F 00 74 00 6E 00 20 00 22 00 00 27 22 00 20 00 2F 00 ... 0x40225:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
kthiokadjg.exe	Vermin_Keylogger_Jan18_1	Detects Vermin Keylogger	Florian Roth	0x3697a:$x3: GetKeyloggerLogsResponse 0x35c51:$x4: GetKeyloggerLogs 0x35eea:$s1: <RunHidden>k__BackingField 0x36b42:$s2: set_SystemInfos 0x35f13:$s3: set_RunHidden 0x35aa6:$s4: set_RemotePath 0x47a28:$s6: Client.exe 0x47abc:$s6: Client.exe 0x30971:$s7: xClient.Core.ReverseProxy.Packets
kthiokadjg.exe	xRAT_1	Detects Patchwork malware	Florian Roth	0x2f783:$x4: xClient.Properties.Resources.resources 0x2f621:$s4: Client.exe 0x35f13:$s7: set_RunHidden
kthiokadjg.exe	CN_disclosed_20180208_KeyLogger_1	Detects malware from disclosed CN malware set	Florian Roth	0x4251d:$x2: Process already elevated. 0x342a0:$x4: get_encryptedPassword 0x360e5:$x5: DoDownloadAndExecute
kthiokadjg.exe	implant_win_quasarrat	Detect QuasarRAT (reted from samples 2023-03)	Sekoia.io	0x401d2:$: 63 00 68 00 63 00 70 00 20 00 36 00 35 00 30 00 30 00 31 00 0x40317:$: 63 00 68 00 63 00 70 00 20 00 36 00 35 00 30 00 30 00 31 00 0x401ea:$: 65 00 63 00 68 00 6F 00 20 00 44 00 4F 00 4E 00 54 00 20 00 43 00 4C 00 4F 00 53 00 45 00 20 00 54 00 48 00 49 00 53 00 20 00 57 00 49 00 4E 00 44 00 4F 00 57 00 21 00 0x4032f:$: 65 00 63 00 68 00 6F 00 20 00 44 00 4F 00 4E 00 54 00 20 00 43 00 4C 00 4F 00 53 00 45 00 20 00 54 00 48 00 49 00 53 00 20 00 57 00 49 00 4E 00 44 00 4F 00 57 00 21 00 0x40226:$: 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0x4036b:$: 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0x4025e:$: 64 00 65 00 6C 00 20 00 2F 00 61 00 20 00 2F 00 71 00 20 00 2F 00 66 00 20 00 22 00 0x402a4:$: 64 00 65 00 6C 00 20 00 2F 00 61 00 20 00 2F 00 71 00 20 00 2F 00 66 00 20 00 22 00 0x35cdb:$: DoShellExecute 0x36bba:$: DoShellExecute 0x3a90b:$: DoShellExecute 0x35c2d:$: DoDownloadFile 0x35c3c:$: DoDownloadFile 0x367e8:$: DoDownloadFile 0x3a5bf:$: DoDownloadFile 0x3a5d4:$: DoDownloadFile 0x3ac96:$: DoDownloadFile
kthiokadjg.exe	Quasar	detect Remcos in memory	JPCERT/CC Incident Response Group	0x3fa4e:$quasarstr1: [PRIVATE KEY LOCATION: "{0}"] 0x3f662:$quasarstr2: User: {0}{3}Pass: {1}{3}Host: {2} 0x31572:$class: Core.MouseKeyHook.WinApi
kthiokadjg.exe	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x3f912:$f1: FileZilla\recentservers.xml 0x3f952:$f2: FileZilla\sitemanager.xml 0x3f986:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x3eefd:$b1: Chrome\User Data\ 0x3ef61:$b1: Chrome\User Data\ 0x3f2f4:$b2: Mozilla\Firefox\Profiles 0x3f6c8:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x44600:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x3f758:$b4: Opera Software\Opera Stable\Login Data 0x3f808:$b5: YandexBrowser\User Data\ 0x3f87a:$b5: YandexBrowser\User Data\ 0x3f0a8:$s4: logins.json 0x3f0f4:$s4: logins.json 0x3f3e2:$s4: logins.json 0x3ec16:$a1: username_value 0x3ec34:$a2: password_value 0x340d5:$a3: encryptedUsername 0x34278:$a3: encryptedUsername 0x3428e:$a3: encryptedUsername 0x343c4:$a3: encryptedUsername 0x340f8:$a4: encryptedPassword
kthiokadjg.exe	MALWARE_Win_QuasarRAT	QuasarRAT payload	ditekSHen	0x3697a:$s1: GetKeyloggerLogsResponse 0x35c51:$s2: GetKeyloggerLogs 0x3e530:$s3: />Log created on 0x3f662:$s4: User: {0}{3}Pass: {1}{3}Host: {2} 0x3ed41:$s5: Domain: {1}{0}Cookie Name: {2}{0}Value: {3}{0}Path: {4}{0}Expired: {5}{0}HttpOnly: {6}{0}Secure: {7} 0x42c82:$s6: grabber_ 0x42c9e:$s6: grabber_ 0x31323:$s7: <virtualKeyCode> 0x35eea:$s8: <RunHidden>k__BackingField 0x31355:$s9: <keyboardHookStruct> 0x3236b:$s10: add_OnHotKeysDown 0x323bd:$s10: add_OnHotKeysDown 0x41032:$ua1: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0 0x41b47:$us2: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A
Click to see the 8 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1653146683.00000000003C2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Blackshades	Yara detected Blackshades RAT	Joe Security
00000000.00000000.1653146683.00000000003C2000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_Quasarrat_e52df647	unknown	unknown	0x3677a:$a1: GetKeyloggerLogsResponse 0x35ee5:$a2: DoDownloadAndExecute 0x40fca:$a3: http://api.ipify.org/ 0x3eb41:$a4: Domain: {1}{0}Cookie Name: {2}{0}Value: {3}{0}Path: {4}{0}Expired: {5}{0}HttpOnly: {6}{0}Secure: {7} 0x3fe8f:$a5: " /sc ONLOGON /tr "
00000000.00000000.1653146683.00000000003C2000.00000002.00000001.01000000.00000003.sdmp	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x35cd7:$s1: DoUploadAndExecute 0x35ee5:$s2: DoDownloadAndExecute 0x35adb:$s3: DoShellExecute 0x35eaa:$s4: set_Processname 0x69c8:$op1: 04 1E FE 02 04 16 FE 01 60 0x68ec:$op2: 00 17 03 1F 20 17 19 15 28 0x7352:$op3: 00 04 03 69 91 1B 40 0x7ba2:$op3: 00 04 03 69 91 1B 40
00000000.00000000.1653146683.00000000003C2000.00000002.00000001.01000000.00000003.sdmp	implant_win_quasarrat	Detect QuasarRAT (reted from samples 2023-03)	Sekoia.io	0x3ffd2:$: 63 00 68 00 63 00 70 00 20 00 36 00 35 00 30 00 30 00 31 00 0x40117:$: 63 00 68 00 63 00 70 00 20 00 36 00 35 00 30 00 30 00 31 00 0x3ffea:$: 65 00 63 00 68 00 6F 00 20 00 44 00 4F 00 4E 00 54 00 20 00 43 00 4C 00 4F 00 53 00 45 00 20 00 54 00 48 00 49 00 53 00 20 00 57 00 49 00 4E 00 44 00 4F 00 57 00 21 00 0x4012f:$: 65 00 63 00 68 00 6F 00 20 00 44 00 4F 00 4E 00 54 00 20 00 43 00 4C 00 4F 00 53 00 45 00 20 00 54 00 48 00 49 00 53 00 20 00 57 00 49 00 4E 00 44 00 4F 00 57 00 21 00 0x40026:$: 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0x4016b:$: 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0x4005e:$: 64 00 65 00 6C 00 20 00 2F 00 61 00 20 00 2F 00 71 00 20 00 2F 00 66 00 20 00 22 00 0x400a4:$: 64 00 65 00 6C 00 20 00 2F 00 61 00 20 00 2F 00 71 00 20 00 2F 00 66 00 20 00 22 00 0x35adb:$: DoShellExecute 0x369ba:$: DoShellExecute 0x3a70b:$: DoShellExecute 0x35a2d:$: DoDownloadFile 0x35a3c:$: DoDownloadFile 0x365e8:$: DoDownloadFile 0x3a3bf:$: DoDownloadFile 0x3a3d4:$: DoDownloadFile 0x3aa96:$: DoDownloadFile
00000000.00000000.1653146683.00000000003C2000.00000002.00000001.01000000.00000003.sdmp	Quasar	detect Remcos in memory	JPCERT/CC Incident Response Group	0x3f84e:$quasarstr1: [PRIVATE KEY LOCATION: "{0}"] 0x3f462:$quasarstr2: User: {0}{3}Pass: {1}{3}Host: {2} 0x31372:$class: Core.MouseKeyHook.WinApi
Process Memory Space: kthiokadjg.exe PID: 7312	JoeSecurity_Ransomware_Generic	Yara detected Ransomware_Generic	Joe Security
Process Memory Space: kthiokadjg.exe PID: 7312	JoeSecurity_Blackshades	Yara detected Blackshades RAT	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.kthiokadjg.exe.3c0000.0.unpack	JoeSecurity_Blackshades	Yara detected Blackshades RAT	Joe Security
0.0.kthiokadjg.exe.3c0000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.kthiokadjg.exe.3c0000.0.unpack	Windows_Trojan_Quasarrat_e52df647	unknown	unknown	0x3697a:$a1: GetKeyloggerLogsResponse 0x360e5:$a2: DoDownloadAndExecute 0x411ca:$a3: http://api.ipify.org/ 0x3ed41:$a4: Domain: {1}{0}Cookie Name: {2}{0}Value: {3}{0}Path: {4}{0}Expired: {5}{0}HttpOnly: {6}{0}Secure: {7} 0x4008f:$a5: " /sc ONLOGON /tr "
0.0.kthiokadjg.exe.3c0000.0.unpack	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x35ed7:$s1: DoUploadAndExecute 0x360e5:$s2: DoDownloadAndExecute 0x35cdb:$s3: DoShellExecute 0x360aa:$s4: set_Processname 0x6bc8:$op1: 04 1E FE 02 04 16 FE 01 60 0x6aec:$op2: 00 17 03 1F 20 17 19 15 28 0x7552:$op3: 00 04 03 69 91 1B 40 0x7da2:$op3: 00 04 03 69 91 1B 40
0.0.kthiokadjg.exe.3c0000.0.unpack	Quasar_RAT_2	Detects Quasar RAT	Florian Roth	0x3697a:$x1: GetKeyloggerLogsResponse 0x36bba:$s1: DoShellExecuteResponse 0x36533:$s2: GetPasswordsResponse 0x36a8d:$s3: GetStartupItemsResponse 0x35eeb:$s5: RunHidden 0x35f09:$s5: RunHidden 0x35f17:$s5: RunHidden 0x35f2b:$s5: RunHidden
0.0.kthiokadjg.exe.3c0000.0.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x40055:$xc1: 41 00 64 00 6D 00 69 00 6E 00 00 11 73 00 63 00 68 00 74 00 61 00 73 00 6B 00 73 00 00 1B 2F 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 2F 00 74 00 6E 00 20 00 22 00 00 27 22 00 20 00 2F 00 ... 0x40225:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
0.0.kthiokadjg.exe.3c0000.0.unpack	Vermin_Keylogger_Jan18_1	Detects Vermin Keylogger	Florian Roth	0x3697a:$x3: GetKeyloggerLogsResponse 0x35c51:$x4: GetKeyloggerLogs 0x35eea:$s1: <RunHidden>k__BackingField 0x36b42:$s2: set_SystemInfos 0x35f13:$s3: set_RunHidden 0x35aa6:$s4: set_RemotePath 0x47a28:$s6: Client.exe 0x47abc:$s6: Client.exe 0x30971:$s7: xClient.Core.ReverseProxy.Packets
0.0.kthiokadjg.exe.3c0000.0.unpack	xRAT_1	Detects Patchwork malware	Florian Roth	0x2f783:$x4: xClient.Properties.Resources.resources 0x2f621:$s4: Client.exe 0x35f13:$s7: set_RunHidden
0.0.kthiokadjg.exe.3c0000.0.unpack	CN_disclosed_20180208_KeyLogger_1	Detects malware from disclosed CN malware set	Florian Roth	0x4251d:$x2: Process already elevated. 0x342a0:$x4: get_encryptedPassword 0x360e5:$x5: DoDownloadAndExecute
0.0.kthiokadjg.exe.3c0000.0.unpack	implant_win_quasarrat	Detect QuasarRAT (reted from samples 2023-03)	Sekoia.io	0x401d2:$: 63 00 68 00 63 00 70 00 20 00 36 00 35 00 30 00 30 00 31 00 0x40317:$: 63 00 68 00 63 00 70 00 20 00 36 00 35 00 30 00 30 00 31 00 0x401ea:$: 65 00 63 00 68 00 6F 00 20 00 44 00 4F 00 4E 00 54 00 20 00 43 00 4C 00 4F 00 53 00 45 00 20 00 54 00 48 00 49 00 53 00 20 00 57 00 49 00 4E 00 44 00 4F 00 57 00 21 00 0x4032f:$: 65 00 63 00 68 00 6F 00 20 00 44 00 4F 00 4E 00 54 00 20 00 43 00 4C 00 4F 00 53 00 45 00 20 00 54 00 48 00 49 00 53 00 20 00 57 00 49 00 4E 00 44 00 4F 00 57 00 21 00 0x40226:$: 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0x4036b:$: 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0x4025e:$: 64 00 65 00 6C 00 20 00 2F 00 61 00 20 00 2F 00 71 00 20 00 2F 00 66 00 20 00 22 00 0x402a4:$: 64 00 65 00 6C 00 20 00 2F 00 61 00 20 00 2F 00 71 00 20 00 2F 00 66 00 20 00 22 00 0x35cdb:$: DoShellExecute 0x36bba:$: DoShellExecute 0x3a90b:$: DoShellExecute 0x35c2d:$: DoDownloadFile 0x35c3c:$: DoDownloadFile 0x367e8:$: DoDownloadFile 0x3a5bf:$: DoDownloadFile 0x3a5d4:$: DoDownloadFile 0x3ac96:$: DoDownloadFile
0.0.kthiokadjg.exe.3c0000.0.unpack	Quasar	detect Remcos in memory	JPCERT/CC Incident Response Group	0x3fa4e:$quasarstr1: [PRIVATE KEY LOCATION: "{0}"] 0x3f662:$quasarstr2: User: {0}{3}Pass: {1}{3}Host: {2} 0x31572:$class: Core.MouseKeyHook.WinApi
0.0.kthiokadjg.exe.3c0000.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x3f912:$f1: FileZilla\recentservers.xml 0x3f952:$f2: FileZilla\sitemanager.xml 0x3f986:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x3eefd:$b1: Chrome\User Data\ 0x3ef61:$b1: Chrome\User Data\ 0x3f2f4:$b2: Mozilla\Firefox\Profiles 0x3f6c8:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x44600:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x3f758:$b4: Opera Software\Opera Stable\Login Data 0x3f808:$b5: YandexBrowser\User Data\ 0x3f87a:$b5: YandexBrowser\User Data\ 0x3f0a8:$s4: logins.json 0x3f0f4:$s4: logins.json 0x3f3e2:$s4: logins.json 0x3ec16:$a1: username_value 0x3ec34:$a2: password_value 0x340d5:$a3: encryptedUsername 0x34278:$a3: encryptedUsername 0x3428e:$a3: encryptedUsername 0x343c4:$a3: encryptedUsername 0x340f8:$a4: encryptedPassword
0.0.kthiokadjg.exe.3c0000.0.unpack	MALWARE_Win_QuasarRAT	QuasarRAT payload	ditekSHen	0x3697a:$s1: GetKeyloggerLogsResponse 0x35c51:$s2: GetKeyloggerLogs 0x3e530:$s3: />Log created on 0x3f662:$s4: User: {0}{3}Pass: {1}{3}Host: {2} 0x3ed41:$s5: Domain: {1}{0}Cookie Name: {2}{0}Value: {3}{0}Path: {4}{0}Expired: {5}{0}HttpOnly: {6}{0}Secure: {7} 0x42c82:$s6: grabber_ 0x42c9e:$s6: grabber_ 0x31323:$s7: <virtualKeyCode> 0x35eea:$s8: <RunHidden>k__BackingField 0x31355:$s9: <keyboardHookStruct> 0x3236b:$s10: add_OnHotKeysDown 0x323bd:$s10: add_OnHotKeysDown 0x41032:$ua1: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0 0x41b47:$us2: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A
Click to see the 8 entries

Suricata Signatures

ET MALWARE Common RAT Connectivity Check Observed

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T12:43:57.042852+0100	2036383	1	A Network Trojan was detected	192.168.2.4	49730	208.95.112.1	80	TCP

Base64 encoded string: 'gCFjRxwluoOzqyPCNSB03407xIz+ONwlD7/vzoHXegrPvHsLpCZNCifkZT/dDk+pIpnY9lciR0jF2j/uqqXxB+QwnjYTDIaJTD/V2X5JfJM=', 'NcFtjbDOcsw7Evd3coMC0y4koy/SRZGydhNmno81ZOWOvdfg7sv0Cj5ad2ROUfX4QMscAIjYJdjrrs41+qcQwg==', 'qMHKxGhonXmt9akngs1YQvmLEHd0YEK3QA1WGD+I9E1uD0/CTraYDvo1l5QaKlLl1vSbSP0ZkcZ3fmp2DVfuOg==', 'Z09FV4j4jq5/J6XIkypuhtrLmI1esAav4m/9cAsmlsnjIoIm6YPVLwFYd7byBB0tMZ6F+hsGLQyFcU1qTH4GTw==', 'pgwMHLu+QYvO3CaxZ4Va949Mf+wqfg9quUboqpUDvCsxe087o39mT/05k3/lE2PIQHW1I6mhxyFN44AvAYvQnA==', 'qHDO23cSS9AKUbQTH24tM4oWT8tVc79R+3d5roSmoCTFHLwGinckzKtfebKZ0jjmOMam4ihlQIcH7z2CnP9ZrQ==', 'Zpe+h8S9A/3LuE5RW2IKiZM0cliNxHBoStgJyFJ6E8vsnN3LTczqpXMqVZCScJiHMP7aiJbjJ14XCUEuOD5bWA=='

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@5/2@1/2

Source: C:\Users\user\Desktop\kthiokadjg.exe

File created: C:\Users\user\AppData\Roaming\Logs

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7400:120:WilError_03
Source: C:\Users\user\Desktop\kthiokadjg.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\kthiokadjg.exe	Mutant created: \Sessions\1\BaseNamedObjects\QAPB6w0UbYXMvQdKRF

Source: kthiokadjg.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: kthiokadjg.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\kthiokadjg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kthiokadjg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\kthiokadjg.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: kthiokadjg.exe	Virustotal: Detection: 79%
Source: kthiokadjg.exe	ReversingLabs: Detection: 86%

Source: unknown	Process created: C:\Users\user\Desktop\kthiokadjg.exe "C:\Users\user\Desktop\kthiokadjg.exe"
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /create /tn "NET framework" /sc ONLOGON /tr "C:\Users\user\Desktop\kthiokadjg.exe" /rl HIGHEST /f
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\kthiokadjg.exe C:\Users\user\Desktop\kthiokadjg.exe
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /create /tn "NET framework" /sc ONLOGON /tr "C:\Users\user\Desktop\kthiokadjg.exe" /rl HIGHEST /f	Jump to behavior

Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Section loaded: userenv.dll	Jump to behavior

Source: C:\Users\user\Desktop\kthiokadjg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: kthiokadjg.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: kthiokadjg.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\kthiokadjg.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /create /tn "NET framework" /sc ONLOGON /tr "C:\Users\user\Desktop\kthiokadjg.exe" /rl HIGHEST /f

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\kthiokadjg.exe

File opened: C:\Users\user\Desktop\kthiokadjg.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: kthiokadjg.exe

Binary or memory string: SBIEDLL.DLL[SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN

Source: C:\Users\user\Desktop\kthiokadjg.exe	Memory allocated: D70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Memory allocated: 2850000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Memory allocated: 2590000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Memory allocated: 13B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Memory allocated: 2F90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Memory allocated: 2BC0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\kthiokadjg.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\kthiokadjg.exe	Window / User API: threadDelayed 3425			Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Window / User API: threadDelayed 6317			Jump to behavior

Source: C:\Users\user\Desktop\kthiokadjg.exe TID: 7456	Thread sleep time: -21213755684765971s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe TID: 7460	Thread sleep count: 3425 > 30	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe TID: 7460	Thread sleep count: 6317 > 30	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe TID: 7492	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\kthiokadjg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BaseBoard
Source: C:\Users\user\Desktop\kthiokadjg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\kthiokadjg.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem

Source: C:\Users\user\Desktop\kthiokadjg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\kthiokadjg.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\kthiokadjg.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: kthiokadjg.exe	Binary or memory string: vboxtray
Source: kthiokadjg.exe	Binary or memory string: VMwareService
Source: kthiokadjg.exe	Binary or memory string: VMwareTray
Source: kthiokadjg.exe	Binary or memory string: vboxservice
Source: kthiokadjg.exe, 00000000.00000002.4105107179.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll1
Source: kthiokadjg.exe	Binary or memory string: vmtoolsd

Source: C:\Users\user\Desktop\kthiokadjg.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\kthiokadjg.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: kthiokadjg.exe, KeyboardNativeMethods.cs	Reference to suspicious API methods: MapVirtualKeyEx(virtualKeyCode, 0, activeKeyboard)
Source: kthiokadjg.exe, Firefox.cs	Reference to suspicious API methods: NativeMethods.LoadLibrary(firefoxPath.FullName + "\\msvcr100.dll")
Source: kthiokadjg.exe, Firefox.cs	Reference to suspicious API methods: ((NSS_InitPtr)Marshal.GetDelegateForFunctionPointer(NativeMethods.GetProcAddress(nssModule, "NSS_Init"), typeof(NSS_InitPtr)))(firefoxProfilePath.FullName)

Source: C:\Users\user\Desktop\kthiokadjg.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /create /tn "NET framework" /sc ONLOGON /tr "C:\Users\user\Desktop\kthiokadjg.exe" /rl HIGHEST /f

Jump to behavior

Source: kthiokadjg.exe	Binary or memory string: Program Manager
Source: kthiokadjg.exe	Binary or memory string: Shell_TrayWnd
Source: kthiokadjg.exe	Binary or memory string: Progman

Source: C:\Users\user\Desktop\kthiokadjg.exe	Queries volume information: C:\Users\user\Desktop\kthiokadjg.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Queries volume information: C:\Users\user\Desktop\kthiokadjg.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\kthiokadjg.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\kthiokadjg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Contains functionality to disable the Task Manager (.Net Source)

Source: kthiokadjg.exe, CommandHandler.cs

.Net Code: HandleDoDisableTaskmgr

Source: kthiokadjg.exe, 00000000.00000002.4108330207.0000000005088000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\kthiokadjg.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\kthiokadjg.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected Blackshades RAT

Source: Yara match	File source: kthiokadjg.exe, type: SAMPLE
Source: Yara match	File source: 0.0.kthiokadjg.exe.3c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1653146683.00000000003C2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kthiokadjg.exe PID: 7312, type: MEMORYSTR

Remote Access Functionality

Yara detected Blackshades RAT

Source: Yara match	File source: kthiokadjg.exe, type: SAMPLE
Source: Yara match	File source: 0.0.kthiokadjg.exe.3c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1653146683.00000000003C2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kthiokadjg.exe PID: 7312, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	41 Windows Management Instrumentation	1 Scheduled Task/Job	12 Process Injection	1 Masquerading	11 Input Capture	141 Security Software Discovery	Remote Services	11 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	11 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	1 DLL Side-Loading	51 Virtualization/Sandbox Evasion	Security Account Manager	51 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Hidden Files and Directories	LSA Secrets	1 Peripheral Device Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	33 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
kthiokadjg.exe	79%	Virustotal		Browse
kthiokadjg.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.Quasar
kthiokadjg.exe	100%	Avira	HEUR/AGEN.1307418
kthiokadjg.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://schemas.datacontract.org/2004/07/xClient.Core.Data	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ip-api.com	208.95.112.1	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ip-api.com/json/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://api.ipify.org/	kthiokadjg.exe	false		high
http://freegeoip.net/xml/	kthiokadjg.exe	false		high
http://schemas.datacontract.org/2004/07/	kthiokadjg.exe, 00000000.00000002.4106164254.0000000002889000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	kthiokadjg.exe, 00000000.00000002.4106164254.0000000002851000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.datacontract.org/2004/07/xClient.Core.Data	kthiokadjg.exe, 00000000.00000002.4106164254.0000000002889000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false
85.192.29.60	unknown	Russian Federation		47711	LINEGROUP-ASRU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583704
Start date and time:	2025-01-03 12:43:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	kthiokadjg.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@5/2@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 38 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
06:43:56	API Interceptor	6012205x Sleep call for process: kthiokadjg.exe modified
11:43:56	Task Scheduler	Run new task: NET framework path: C:\Users\user\Desktop\kthiokadjg.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	file.exe	Get hash	malicious	AsyncRAT, XRed, XWorm	Browse	ip-api.com/line/?fields=hosting
	file.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	file.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	23khy505ab.exe	Get hash	malicious	Njrat	Browse	ip-api.com/line/?fields=hosting
	XClient.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	ip-api.com/line/?fields=hosting
	Java32.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	mcgen.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/json/?fields=225545
	intro.avi.exe	Get hash	malicious	Quasar	Browse	ip-api.com/json/
	AimStar.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/json/?fields=225545
	L988Ph5sKX.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	file.exe	Get hash	malicious	AsyncRAT, XRed, XWorm	Browse	208.95.112.1
	file.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	file.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	23khy505ab.exe	Get hash	malicious	Njrat	Browse	208.95.112.1
	XClient.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	Java32.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	mcgen.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	intro.avi.exe	Get hash	malicious	Quasar	Browse	208.95.112.1
	AimStar.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	L988Ph5sKX.exe	Get hash	malicious	XWorm	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TUT-ASUS	file.exe	Get hash	malicious	AsyncRAT, XRed, XWorm	Browse	208.95.112.1
	file.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	file.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	23khy505ab.exe	Get hash	malicious	Njrat	Browse	208.95.112.1
	XClient.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	Java32.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	mcgen.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	intro.avi.exe	Get hash	malicious	Quasar	Browse	208.95.112.1
	AimStar.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	L988Ph5sKX.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
LINEGROUP-ASRU	file.exe	Get hash	malicious	SmokeLoader	Browse	85.192.60.190
	invoice_template.pdf.lnk	Get hash	malicious	SmokeLoader	Browse	85.192.60.190
	a9rLzLY498.exe	Get hash	malicious	DCRat	Browse	85.192.63.134
	MtgwNNkkgT.exe	Get hash	malicious	DCRat	Browse	85.192.63.134
	file.exe	Get hash	malicious	Unknown	Browse	85.192.63.194
	xGSkelSjdu.exe	Get hash	malicious	Raccoon Stealer v2	Browse	85.192.63.15
	ImBetter.exe	Get hash	malicious	Unknown	Browse	85.192.63.32
	B94872E1A7599AF25CAA25013FC0054E5AFFDA6CFAEF6.dll	Get hash	malicious	Raccoon Stealer v2	Browse	85.192.63.204
	B94872E1A7599AF25CAA25013FC0054E5AFFDA6CFAEF6.dll	Get hash	malicious	Raccoon Stealer v2	Browse	85.192.63.204
	DxIQxeHMa9.exe	Get hash	malicious	Amadey, Laplas Clipper	Browse	85.192.63.121

Process:	C:\Users\user\Desktop\kthiokadjg.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	826
Entropy (8bit):	5.353295152847208
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhBsXE4qdKm:MIHK5HKH1qHiYHKh3okHA
MD5:	CBC102AE9B2B802A4E451ED79E09DEB5
SHA1:	7102EB28C2A703B2AA74F5E419A2D72C66B97896
SHA-256:	0763878B1A8876F16EE532AB23C36782096C2A8CD770C18C6CB1156121734EFB
SHA-512:	CDB7367250343E2DD31876C3B337A0FF6A6E2A7E37FF71C0C8AE7072302FC014BBDE14689C16E25E80D2B1587DFC75FA6BE50AFD0D06083A2A09BD0D256151C7
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\96012833bebd5f21714fc508603cda97\System.Management.ni.dll",0..

C:\Users\user\AppData\Roaming\Logs\01-03-2025

Download File

Process:	C:\Users\user\Desktop\kthiokadjg.exe
File Type:	data
Category:	dropped
Size (bytes):	224
Entropy (8bit):	7.10749708290353
Encrypted:	false
SSDEEP:	6:781CmIoir88ai+NWnT0HY73JEAUoii3Dc:9mIn8+4WIHAVrDc
MD5:	8497EDAC04E912DA4D527D8984246110
SHA1:	58D57231B968518C8B6691FA9BA77CD3D2157917
SHA-256:	4F3CDF15A35B52FB97AC0980E2301A4FB5D67050A98D4A3E2278F9109DFBE0D7
SHA-512:	796D1BDF173EC63093A758C07CAA4141DD95AC75807FFCCFE01EB3779163F27D3F56811F2AE15FCB976BEEDC28B4BF836D26A93646E6030AF9D01C0878928D00
Malicious:	false
Reputation:	low
Preview:	rK.S.@..7F,.f..\|Ph..B......c...Y0...g%B........)D\P.%.Cy...iJ3.?.!T.......=]bj.T..."j../.-.c.+...........<..5..?m_..8.W=...e..?u...6.[.i.PI.#.P..>.p..?.~.w..........a.A......P....D.q...>#..n..."*...X..Gs....E%

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.010424789479464
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	kthiokadjg.exe
File size:	295'424 bytes
MD5:	cc5e91e1a0c3ca5edf2bdba7fa252827
SHA1:	004ba0788113ebb3bce8eaf63fa53c70caa91079
SHA256:	30efa81a5d0d9bf04a00b4e30823c2f0c7bd6461383acf0195d857edf2162543
SHA512:	14ee287465bc50dc16ad042d35a14f9e676f645dabf4c4dfbd8f225845e45ab73fee6c3d7967fe44a21994ddbd5b76d0cbd01ec0a2784f913587313c4a407249
SSDEEP:	6144:E7zO0LSclT6FOwEP5Kq+SMv0VGb7bDcllbkln:6lJtTF9zVGkllbk5
TLSH:	EE545A2527F8A93BD8BE17B4F53141094B76FC07B517F38E6A5818B82C1A38985937E3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...q.jg.................v............... ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x44940e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x676AAA71 [Tue Dec 24 12:34:57 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x493c0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4a000	0x800	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x47414	0x47600	9f69c7a2e0dead1448b37991e0925969	False	0.4229593093257443	data	6.022725630683313	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x4a000	0x800	0x800	a027b6bc741b57fb7aedeed9de1ffae2	False	0.4208984375	data	4.826065116434677	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x4c000	0xc	0x200	654372b0affac22a7ea47de03901c6e6	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x4a090	0x2d4	data			0.43646408839779005
RT_MANIFEST	0x4a374	0x478	exported SGML document, Unicode text, UTF-8 (with BOM) text			0.4423076923076923

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-03T12:43:57.042852+0100	2036383	ET MALWARE Common RAT Connectivity Check Observed	1	192.168.2.4	49730	208.95.112.1	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 12:43:56.531467915 CET	49730	80	192.168.2.4	208.95.112.1
Jan 3, 2025 12:43:56.536320925 CET	80	49730	208.95.112.1	192.168.2.4
Jan 3, 2025 12:43:56.536500931 CET	49730	80	192.168.2.4	208.95.112.1
Jan 3, 2025 12:43:56.536746025 CET	49730	80	192.168.2.4	208.95.112.1
Jan 3, 2025 12:43:56.541532040 CET	80	49730	208.95.112.1	192.168.2.4
Jan 3, 2025 12:43:57.001539946 CET	80	49730	208.95.112.1	192.168.2.4
Jan 3, 2025 12:43:57.042851925 CET	49730	80	192.168.2.4	208.95.112.1
Jan 3, 2025 12:43:58.193116903 CET	49731	5173	192.168.2.4	85.192.29.60
Jan 3, 2025 12:43:58.198091984 CET	5173	49731	85.192.29.60	192.168.2.4
Jan 3, 2025 12:43:58.198252916 CET	49731	5173	192.168.2.4	85.192.29.60
Jan 3, 2025 12:43:58.778518915 CET	5173	49731	85.192.29.60	192.168.2.4
Jan 3, 2025 12:43:58.810355902 CET	49731	5173	192.168.2.4	85.192.29.60
Jan 3, 2025 12:43:58.815191031 CET	5173	49731	85.192.29.60	192.168.2.4
Jan 3, 2025 12:43:58.995204926 CET	5173	49731	85.192.29.60	192.168.2.4
Jan 3, 2025 12:43:59.042862892 CET	49731	5173	192.168.2.4	85.192.29.60
Jan 3, 2025 12:43:59.130260944 CET	5173	49731	85.192.29.60	192.168.2.4
Jan 3, 2025 12:43:59.183475971 CET	49731	5173	192.168.2.4	85.192.29.60
Jan 3, 2025 12:43:59.305685043 CET	49731	5173	192.168.2.4	85.192.29.60
Jan 3, 2025 12:43:59.310559034 CET	5173	49731	85.192.29.60	192.168.2.4
Jan 3, 2025 12:44:24.324218035 CET	49731	5173	192.168.2.4	85.192.29.60
Jan 3, 2025 12:44:24.329205990 CET	5173	49731	85.192.29.60	192.168.2.4
Jan 3, 2025 12:44:49.339827061 CET	49731	5173	192.168.2.4	85.192.29.60
Jan 3, 2025 12:44:49.344712973 CET	5173	49731	85.192.29.60	192.168.2.4
Jan 3, 2025 12:44:52.373409033 CET	80	49730	208.95.112.1	192.168.2.4
Jan 3, 2025 12:44:52.373456955 CET	49730	80	192.168.2.4	208.95.112.1
Jan 3, 2025 12:45:14.402379990 CET	49731	5173	192.168.2.4	85.192.29.60
Jan 3, 2025 12:45:14.407260895 CET	5173	49731	85.192.29.60	192.168.2.4
Jan 3, 2025 12:45:37.013107061 CET	49730	80	192.168.2.4	208.95.112.1
Jan 3, 2025 12:45:37.017910004 CET	80	49730	208.95.112.1	192.168.2.4
Jan 3, 2025 12:45:39.589935064 CET	49731	5173	192.168.2.4	85.192.29.60
Jan 3, 2025 12:45:39.594727039 CET	5173	49731	85.192.29.60	192.168.2.4
Jan 3, 2025 12:46:04.661680937 CET	49731	5173	192.168.2.4	85.192.29.60
Jan 3, 2025 12:46:04.666476011 CET	5173	49731	85.192.29.60	192.168.2.4
Jan 3, 2025 12:46:29.699415922 CET	49731	5173	192.168.2.4	85.192.29.60
Jan 3, 2025 12:46:29.704298019 CET	5173	49731	85.192.29.60	192.168.2.4
Jan 3, 2025 12:46:54.793256998 CET	49731	5173	192.168.2.4	85.192.29.60
Jan 3, 2025 12:46:54.801445961 CET	5173	49731	85.192.29.60	192.168.2.4
Jan 3, 2025 12:47:19.902766943 CET	49731	5173	192.168.2.4	85.192.29.60
Jan 3, 2025 12:47:19.907639980 CET	5173	49731	85.192.29.60	192.168.2.4
Jan 3, 2025 12:47:44.996668100 CET	49731	5173	192.168.2.4	85.192.29.60
Jan 3, 2025 12:47:45.001777887 CET	5173	49731	85.192.29.60	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 12:43:56.520080090 CET	62477	53	192.168.2.4	1.1.1.1
Jan 3, 2025 12:43:56.526783943 CET	53	62477	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 3, 2025 12:43:56.520080090 CET	192.168.2.4	1.1.1.1	0xf969	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 3, 2025 12:43:56.526783943 CET	1.1.1.1	192.168.2.4	0xf969	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	208.95.112.1	80	7312	C:\Users\user\Desktop\kthiokadjg.exe

Timestamp	Bytes transferred	Direction	Data
Jan 3, 2025 12:43:56.536746025 CET	144	OUT	GET /json/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0 Host: ip-api.com Connection: Keep-Alive
Jan 3, 2025 12:43:57.001539946 CET	483	IN	HTTP/1.1 200 OK Date: Fri, 03 Jan 2025 11:43:56 GMT Content-Type: application/json; charset=utf-8 Content-Length: 306 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 59 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 7a 69 70 22 3a 22 31 30 31 32 33 22 2c 22 6c 61 74 22 3a 34 30 2e 37 31 32 38 2c 22 6c 6f 6e 22 3a 2d 37 34 2e 30 30 36 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 69 73 70 22 3a 22 4c 65 76 65 6c 20 33 22 2c 22 6f 72 67 22 3a 22 43 65 6e 74 75 72 79 4c 69 6e 6b 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 2c 20 4c 4c 43 22 2c 22 61 73 22 3a 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 22 2c 22 71 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 7d Data Ascii: {"status":"success","country":"United States","countryCode":"US","region":"NY","regionName":"New York","city":"New York","zip":"10123","lat":40.7128,"lon":-74.006,"timezone":"America/New_York","isp":"Level 3","org":"CenturyLink Communications, LLC","as":"AS3356 Level 3 Parent, LLC","query":"8.46.123.189"}

Target ID:	0
Start time:	06:43:54
Start date:	03/01/2025
Path:	C:\Users\user\Desktop\kthiokadjg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\kthiokadjg.exe"
Imagebase:	0x3c0000
File size:	295'424 bytes
MD5 hash:	CC5E91E1A0C3CA5EDF2BDBA7FA252827
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Blackshades, Description: Yara detected Blackshades RAT, Source: 00000000.00000000.1653146683.00000000003C2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Quasarrat_e52df647, Description: unknown, Source: 00000000.00000000.1653146683.00000000003C2000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: Quasar_RAT_1, Description: Detects Quasar RAT, Source: 00000000.00000000.1653146683.00000000003C2000.00000002.00000001.01000000.00000003.sdmp, Author: Florian Roth Rule: implant_win_quasarrat, Description: Detect QuasarRAT (reted from samples 2023-03), Source: 00000000.00000000.1653146683.00000000003C2000.00000002.00000001.01000000.00000003.sdmp, Author: Sekoia.io Rule: Quasar, Description: detect Remcos in memory, Source: 00000000.00000000.1653146683.00000000003C2000.00000002.00000001.01000000.00000003.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	06:43:55
Start date:	03/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"schtasks" /create /tn "NET framework" /sc ONLOGON /tr "C:\Users\user\Desktop\kthiokadjg.exe" /rl HIGHEST /f
Imagebase:	0x7b0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:43:55
Start date:	03/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:43:56
Start date:	03/01/2025
Path:	C:\Users\user\Desktop\kthiokadjg.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\kthiokadjg.exe
Imagebase:	0xb10000
File size:	295'424 bytes
MD5 hash:	CC5E91E1A0C3CA5EDF2BDBA7FA252827
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	15.4%
Total number of Nodes:	52
Total number of Limit Nodes:	5

Executed Functions

Function 0635BEA0 Relevance: 1.9, Strings: 1, Instructions: 696COMMON

Download Yara Rule

Strings

Hxq, xrefs: 0635C644

Memory Dump Source

Source File: 00000000.00000002.4109028636.0000000006350000.00000040.00000800.00020000.00000000.sdmp, Offset: 06350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6350000_kthiokadjg.jbxd

Similarity

API ID:
String ID: Hxq
API String ID: 0-2956916855
Opcode ID: 090279c65b8f37786d3780c7a77e7e46d13a6cf52c0a119ef90534f812b58684
Instruction ID: 0c533a1a2bf0204c1cf1389afbb5bffe168cc294bda0758841d839ea5e6fbbdc
Opcode Fuzzy Hash: 090279c65b8f37786d3780c7a77e7e46d13a6cf52c0a119ef90534f812b58684
Instruction Fuzzy Hash: 1A42D270E042598FCB55CB98C880DBDFBB2EF85308F29956DE855EB246C634D986CBD0

Function 0635550F Relevance: 1.9, APIs: 1, Instructions: 366
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4109028636.0000000006350000.00000040.00000800.00020000.00000000.sdmp, Offset: 06350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6350000_kthiokadjg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18260a7c0e3117fb133b6e5b1aa0c67402a1f6014f509e5a5af633847c09e40c
Instruction ID: 718297485e12e7b642bb1c745901a93c449cea535a27fb7df8f453f0f38d4583
Opcode Fuzzy Hash: 18260a7c0e3117fb133b6e5b1aa0c67402a1f6014f509e5a5af633847c09e40c
Instruction Fuzzy Hash: ADE14970E00209CFDB54DFA9C944FADBBF1BF88324F168159E809AF265DB74A945CB81

Function 06354230 Relevance: 1.6, Strings: 1, Instructions: 393
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'tq, xrefs: 06354292

Memory Dump Source

Source File: 00000000.00000002.4109028636.0000000006350000.00000040.00000800.00020000.00000000.sdmp, Offset: 06350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6350000_kthiokadjg.jbxd

Similarity

API ID:
String ID: 4'tq
API String ID: 0-257826263
Opcode ID: 1a8c89274ba03b4019d9314156213e99b2f085851c7629a7ecf64bc0d413f389
Instruction ID: 803e241c8712d081b5d6c1c99ab0381c65ab9adcfe4814fe16b63221d1294687
Opcode Fuzzy Hash: 1a8c89274ba03b4019d9314156213e99b2f085851c7629a7ecf64bc0d413f389
Instruction Fuzzy Hash: 6FE18070A003099FDB58DFA5D854AAEBBF6FF88300F158469D806AB351DB34ED45CB91

Function 00DB9A80 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

\Vcm, xrefs: 00DB9D37

Memory Dump Source

Source File: 00000000.00000002.4105727755.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_kthiokadjg.jbxd

Similarity

API ID:
String ID: \Vcm
API String ID: 0-3044874373
Opcode ID: 87cd9732fce8df82ac188e9a43e92da7bbd1dd085191b04af988f6341bd983c9
Instruction ID: 538e581299ae42bc645249dd0e48e402c870d55524a6370a08b30f46bed5583d
Opcode Fuzzy Hash: 87cd9732fce8df82ac188e9a43e92da7bbd1dd085191b04af988f6341bd983c9
Instruction Fuzzy Hash: F7B17F70E00249CFDF14CFA9D8957DEFBF2AF88304F188529E516A7294EB749845CBA1

Function 00DBA350 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4105727755.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_kthiokadjg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 300c5007166323c4701f85383150f21b906989e595059971fcf60c9390977f71
Instruction ID: 09c16a33604163566e5e8dc4f5009c26c194a28c519a1cc0164f072c44e5028f
Opcode Fuzzy Hash: 300c5007166323c4701f85383150f21b906989e595059971fcf60c9390977f71
Instruction Fuzzy Hash: C6B14EB0E00209CFDF14CFADD8857DDBBF2AF88714F188529D41AA7294EB749845CB92

Function 00DB3334 Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00DB33F1

Memory Dump Source

Source File: 00000000.00000002.4105727755.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_kthiokadjg.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 152d9b641a98a5169e6f05950c62fc694ec191c42354eb16ce55a23145630531
Instruction ID: 2f474d23bb15c9db2496529b2c09b8ce7b6a7bd655463876e2acb74751aa3884
Opcode Fuzzy Hash: 152d9b641a98a5169e6f05950c62fc694ec191c42354eb16ce55a23145630531
Instruction Fuzzy Hash: F941D4B0D00659CFDB24CFA9C845BCEBBF5BF49314F20806AD409AB251EB756946DFA0

Function 00DB1FA4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00DB33F1

Memory Dump Source

Source File: 00000000.00000002.4105727755.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_kthiokadjg.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 412f889e81e78c090e6466c7237e1fa9b4d4ea50658635e26a3b629a2db51a82
Instruction ID: e0dc12d8830f84ecb26e8d5bde3fe2ed2ab3f4c6cafd309cb6cbcd2091214f9e
Opcode Fuzzy Hash: 412f889e81e78c090e6466c7237e1fa9b4d4ea50658635e26a3b629a2db51a82
Instruction Fuzzy Hash: D041C2B0D00719CBDB25CFA9C884BDEBBF5BF49304F24806AD409AB251DB756945DFA0

Function 063514D0 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 06351591

Memory Dump Source

Source File: 00000000.00000002.4109028636.0000000006350000.00000040.00000800.00020000.00000000.sdmp, Offset: 06350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6350000_kthiokadjg.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 6233f344488c8fd77fe894968b465ec62831f1d726b303c08a1dea6ad9b7f952
Instruction ID: cd39991ae267bb886bd14fe060363fd0e871ed1d9a2851cc4a82acf5e199f399
Opcode Fuzzy Hash: 6233f344488c8fd77fe894968b465ec62831f1d726b303c08a1dea6ad9b7f952
Instruction Fuzzy Hash: F34115B4900249CFCB54CF99C848EAABBF5FF88314F258859D919AB321D774A945CFA0

Function 063532DC Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06354A45

Memory Dump Source

Source File: 00000000.00000002.4109028636.0000000006350000.00000040.00000800.00020000.00000000.sdmp, Offset: 06350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6350000_kthiokadjg.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 647ce1bcc148d544fc907be15a728d4ead9a58e25f5c08987f844049baafba0a
Instruction ID: 7e69b8b4e1b9eb713fdeef280fb98310c430629bb536983720ea4de485887565
Opcode Fuzzy Hash: 647ce1bcc148d544fc907be15a728d4ead9a58e25f5c08987f844049baafba0a
Instruction Fuzzy Hash: 401115B5800348CFDB60DF9AD545BDEBBF8EB48320F258459D918A7601C379A944CFE5

Function 063549E8 Relevance: 1.5, APIs: 1, Instructions: 43comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06354A45

Memory Dump Source

Source File: 00000000.00000002.4109028636.0000000006350000.00000040.00000800.00020000.00000000.sdmp, Offset: 06350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6350000_kthiokadjg.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: e1bc408fe3b46f4b0df4dda20fe4022c4c8c92a4f8b0a68b9dccd2a68a6c5441
Instruction ID: 8505ea26d4e23c4ebe3ea8d3f80366138a584c6b7ad32a3a6ed74ccfd571fdcd
Opcode Fuzzy Hash: e1bc408fe3b46f4b0df4dda20fe4022c4c8c92a4f8b0a68b9dccd2a68a6c5441
Instruction Fuzzy Hash: 361112B5C00748CFDB10DF9AD945BDEBBF4AB48320F24895AD528A7741C378A544CFA5

Function 06320618 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108996656.0000000006320000.00000040.00000800.00020000.00000000.sdmp, Offset: 06320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6320000_kthiokadjg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10f388e9429246f2e092cf9337171a64af88b153fff124f93eeb2dec3afb3978
Instruction ID: f96da09bac2c34c6b9a4ac3b098215282e5a67082a2eda55c34a7e21ac92c46f
Opcode Fuzzy Hash: 10f388e9429246f2e092cf9337171a64af88b153fff124f93eeb2dec3afb3978
Instruction Fuzzy Hash: 87D11974A10225CFDB58DF68C598AAD7BF2EF49714B2181A9E406EB371DB30DC49CB90

Function 063202D0 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108996656.0000000006320000.00000040.00000800.00020000.00000000.sdmp, Offset: 06320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6320000_kthiokadjg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab299a9ffa8a8114d2d8033354f46b2a9ba2d5afd27c44746096614235ed7311
Instruction ID: 92fe50eecbf0e48d027afe457f52b216a41d239a8e04914ff34f72f44cd06f60
Opcode Fuzzy Hash: ab299a9ffa8a8114d2d8033354f46b2a9ba2d5afd27c44746096614235ed7311
Instruction Fuzzy Hash: 7C5191B0A006149FDB14DBB9C851FAEBBB6EFC9700F24815DE505AB395DB709C06CBA1

Function 063202E0 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108996656.0000000006320000.00000040.00000800.00020000.00000000.sdmp, Offset: 06320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6320000_kthiokadjg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a8075d6a2011bd13d29b3335484a986e4ef412693385e0d985362e6f9eb38f7
Instruction ID: cde26d5d1016e20336e1870bcecc890a8c82700e21a6744db49467135ba49ce0
Opcode Fuzzy Hash: 0a8075d6a2011bd13d29b3335484a986e4ef412693385e0d985362e6f9eb38f7
Instruction Fuzzy Hash: 385181B0B006189FDB14DB79C855B6EBBF6EFC9700F248169E505AB394DB709C06CBA1

Function 063210C8 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108996656.0000000006320000.00000040.00000800.00020000.00000000.sdmp, Offset: 06320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6320000_kthiokadjg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 881bf4f668850f62f9d4940e8c8dc4cbf619681d2bedc19517e50cdc685b12ff
Instruction ID: 07d112105b5926e8151b31f411dc23efb642113bb68684c44ba83b5fe2e62ee9
Opcode Fuzzy Hash: 881bf4f668850f62f9d4940e8c8dc4cbf619681d2bedc19517e50cdc685b12ff
Instruction Fuzzy Hash: A1414875E002299FDB54CBAAD944AEDB7B5FF89311F048165EA08E7360DB30AC85CBD1

Function 06320609 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108996656.0000000006320000.00000040.00000800.00020000.00000000.sdmp, Offset: 06320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6320000_kthiokadjg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 456902cb29243144e664a090930d79f5cd39e489404c314379e8577c4fe0ca92
Instruction ID: 6594b0ea9b7e545912579aebabbc7c9b67b32ce9ae3886039350c287267d0181
Opcode Fuzzy Hash: 456902cb29243144e664a090930d79f5cd39e489404c314379e8577c4fe0ca92
Instruction Fuzzy Hash: 5641E674A101258FCB58DF68D998A6CB7F1BF48711B2185A9E405DB3B2DB30DC45CF50

Function 063207B8 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108996656.0000000006320000.00000040.00000800.00020000.00000000.sdmp, Offset: 06320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6320000_kthiokadjg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce3c18afb45c869d4947b60a3eaa36969e89c5dcf2b221bec7e4ad2bff40e857
Instruction ID: deff107458b596b90ebc2d1c240430ac42cf4ac623679a435afe5d6847e3fe69
Opcode Fuzzy Hash: ce3c18afb45c869d4947b60a3eaa36969e89c5dcf2b221bec7e4ad2bff40e857
Instruction Fuzzy Hash: 1641E475A10125CFCB88DF68C598A6977F1AF4D720B2581A9E506DB3B1DB30EC49CB90

Function 06320006 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108996656.0000000006320000.00000040.00000800.00020000.00000000.sdmp, Offset: 06320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6320000_kthiokadjg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52844fe5aa556d6186251759330c01a20e4f7ec35e5af1976b45b6e8df64ba18
Instruction ID: 2a68b473a559cf02f6989c49e8f350d87c2a4d989523b0baf1344745f922d4b0
Opcode Fuzzy Hash: 52844fe5aa556d6186251759330c01a20e4f7ec35e5af1976b45b6e8df64ba18
Instruction Fuzzy Hash: 3631D270905362CFDB5A9F74C4106ED7FF2AF4A214F0544AAC081EB252DB389889CBE2

Function 06320AE0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108996656.0000000006320000.00000040.00000800.00020000.00000000.sdmp, Offset: 06320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6320000_kthiokadjg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe3cae485ad82ae54cad1d068c6fbe798cde13c076d0fbbffa73accd9cfe12b0
Instruction ID: cecedcda8eff55611381612c1f752958ce765fd4ab902fca8f7d6b2bd50abae0
Opcode Fuzzy Hash: fe3cae485ad82ae54cad1d068c6fbe798cde13c076d0fbbffa73accd9cfe12b0
Instruction Fuzzy Hash: 9E219174E04225CFDB68EF78D4546ADBBF6EF4C208F204469D406AB365CB34D849CBA1

Function 00BCD3EC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4105515838.0000000000BCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bcd000_kthiokadjg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9f175dbd950297858820469fc6528fbd5cd81a72a827a173be23bdc37faf318
Instruction ID: 7409aa0c21c790c1f54e40eb3791255c23e9358bd89da3ad00f212d5f4acbaa2
Opcode Fuzzy Hash: f9f175dbd950297858820469fc6528fbd5cd81a72a827a173be23bdc37faf318
Instruction Fuzzy Hash: 2B21B0B5504244EFDB099F14D9C0F26BBA5FB98324F24C6BDEA090B356C336E856C6A1

Function 06320AF0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108996656.0000000006320000.00000040.00000800.00020000.00000000.sdmp, Offset: 06320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6320000_kthiokadjg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5347eb802e581ca254d1c18d97de4be86c722c829f32bc53983bf3c67df21844
Instruction ID: a8c03a6b7173324603270019d47fdafdb87ce1f2c14bcc1ce832e522801f4d19
Opcode Fuzzy Hash: 5347eb802e581ca254d1c18d97de4be86c722c829f32bc53983bf3c67df21844
Instruction Fuzzy Hash: 1A216D74A00225CFDB68EB78D4546AD77B6EB8C208F204068D406AB3A4DF35DC09CBE1

Function 00BDD1F0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4105542821.0000000000BDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bdd000_kthiokadjg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3393a49a3239c94dce6797d32ab8ff35327fd16bc9eb22883d553068f0ec5ac
Instruction ID: ea3bdfadc1a64b4841d82bf96588cdc1105e4fddc00c554782048df14613347e
Opcode Fuzzy Hash: e3393a49a3239c94dce6797d32ab8ff35327fd16bc9eb22883d553068f0ec5ac
Instruction Fuzzy Hash: E32134B1504204EFDB10DF54D9C0B26FBE5FB98314F24C9AEE8894B356D336D806CA61

Function 0632015F Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108996656.0000000006320000.00000040.00000800.00020000.00000000.sdmp, Offset: 06320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6320000_kthiokadjg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47170ad71e211da7f75444f7d6d65cc381d782ab09e1fccd00b7e89e670ba48c
Instruction ID: 137f8439b087a49022ccc88eedd7cf0cf30f5e8cfaa3ddee0afeb4a41f92e04e
Opcode Fuzzy Hash: 47170ad71e211da7f75444f7d6d65cc381d782ab09e1fccd00b7e89e670ba48c
Instruction Fuzzy Hash: BE21AF74A00325CFDB59DB78C8146ED7BB6AF4D314F100069D406AB2A5DB389C45CBE6

Function 06320960 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108996656.0000000006320000.00000040.00000800.00020000.00000000.sdmp, Offset: 06320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6320000_kthiokadjg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7c0e6676f5175312166a11b19e086ccf9261710d537e1912725c66d9d959ac1
Instruction ID: 8ca5afe5f7d07e96eb88ea8cd6c816520939a49ef71798d1ac36498a9f200d79
Opcode Fuzzy Hash: e7c0e6676f5175312166a11b19e086ccf9261710d537e1912725c66d9d959ac1
Instruction Fuzzy Hash: 1E216D70E00225CFEB58EB79D4546AD77B6AF4D304F204069D406AB3A4DB359C49CBE1

Function 06320170 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108996656.0000000006320000.00000040.00000800.00020000.00000000.sdmp, Offset: 06320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6320000_kthiokadjg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1161d59e609d64effa9042ef2daa52150635efd949ba699e432f0e495759e17d
Instruction ID: 7c99e86c89b8c571e49cd15b4f865a01ef8fb42dca6ed8de6eec3604c615fd7b
Opcode Fuzzy Hash: 1161d59e609d64effa9042ef2daa52150635efd949ba699e432f0e495759e17d
Instruction Fuzzy Hash: 8C215E74A00225CFDF59EB78C4546AD7BB6EF8D314F100069D406AB394DF359845CBE6

Function 06320040 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108996656.0000000006320000.00000040.00000800.00020000.00000000.sdmp, Offset: 06320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6320000_kthiokadjg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 878c5dbf7a19c46e7a51f3cb007d7d8c2648db6c9a74a103ca51370abc154ae5
Instruction ID: f996d89adb058b0486ff716ab37cc4e721be961456f8c732a99a1e2f0992e60f
Opcode Fuzzy Hash: 878c5dbf7a19c46e7a51f3cb007d7d8c2648db6c9a74a103ca51370abc154ae5
Instruction Fuzzy Hash: C5117F70A00229CBDB58EF74C4546ED7BB6AF8D304F104428C406BB394DF399849CBE6

Function 00BCD3E7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4105515838.0000000000BCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bcd000_kthiokadjg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 555e834afbd1c2fd5414379b306259fbfd17fcb6917d78cd3ce2a61b5f371944
Instruction ID: 6e8c52c8803f6adf6e9fc39e4d0ddfc7a98ed632b8d4c1aa482d74ac1eb8010e
Opcode Fuzzy Hash: 555e834afbd1c2fd5414379b306259fbfd17fcb6917d78cd3ce2a61b5f371944
Instruction Fuzzy Hash: 8911DF76504280DFCB06CF00D5C0B16BFA2FB94320F24C6ADD9090B656C33AE85ACBA1

Function 00BDD1EB Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4105542821.0000000000BDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bdd000_kthiokadjg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bad08bc3297c4791243414a9a82218353e3075920b51f23bb46501d1989d77c
Instruction ID: 789586f0f7f896078b5540d9e85dd10671d2729da1162804df62ba2ef5bacd35
Opcode Fuzzy Hash: 8bad08bc3297c4791243414a9a82218353e3075920b51f23bb46501d1989d77c
Instruction Fuzzy Hash: 0E11BB75504284CFDB12CF54D5C4B15FBA1FB84314F24C6AAD8894B756C33AD80ACB62

Function 063210A0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4108996656.0000000006320000.00000040.00000800.00020000.00000000.sdmp, Offset: 06320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6320000_kthiokadjg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd574782993085a5a45dfa36b6d60e82a4ec742d30c7dd2e861bdf65e7bdda60
Instruction ID: f2cff151646880a7ecfa7f7755cd38efb191e4da06c385285cb1d79e46e2cd91
Opcode Fuzzy Hash: dd574782993085a5a45dfa36b6d60e82a4ec742d30c7dd2e861bdf65e7bdda60
Instruction Fuzzy Hash: D701F772E052949BCB068FA8CD106CDBFB5AF86110F0880ABD984EB253D730544AC7A2

Non-executed Functions

Function 0635E29B Relevance: 4.6, Strings: 3, Instructions: 857COMMON

Download Yara Rule

Strings

?, xrefs: 0635EB78
Hxq, xrefs: 0635EDB8
!, xrefs: 0635EC30

Memory Dump Source

Source File: 00000000.00000002.4109028636.0000000006350000.00000040.00000800.00020000.00000000.sdmp, Offset: 06350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6350000_kthiokadjg.jbxd

Similarity

API ID:
String ID: !$?$Hxq
API String ID: 0-4209759933
Opcode ID: 33914f1442a246fcffe6a57ee834247921f05ebf3dab7a5f5a7e2913bebdbb9b
Instruction ID: 12be7822da4101699b84373312168e5deceec173ab6d05f97dd6b99579cf43b4
Opcode Fuzzy Hash: 33914f1442a246fcffe6a57ee834247921f05ebf3dab7a5f5a7e2913bebdbb9b
Instruction Fuzzy Hash: EB828F30E146598FDF55CF58C980AADFBF2FF80304F298959C855AB246D770AA86CF90

Function 00DB9738 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

\Vcm, xrefs: 00DB9983

Memory Dump Source

Source File: 00000000.00000002.4105727755.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db0000_kthiokadjg.jbxd

Similarity

API ID:
String ID: \Vcm
API String ID: 0-3044874373
Opcode ID: 64e1852b0584395e63cae771d23106aebf531261e8422c7521cecf02ee7ee44b
Instruction ID: a41385449587f1dabda7b2991e8182d58e9a1dba78e1d8e4dca9ce6dc781e239
Opcode Fuzzy Hash: 64e1852b0584395e63cae771d23106aebf531261e8422c7521cecf02ee7ee44b
Instruction Fuzzy Hash: 0D916E70E00249CFDF14CFA9C8957DDFBF2AF88314F188529E506A7294DB749845CBA1

Analysis Process: kthiokadjg.exePID: 7468, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	7.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	42
Total number of Limit Nodes:	4

Executed Functions

Function 013FCAB0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 013FCB2E
GetCurrentThread.KERNEL32 ref: 013FCB6B
GetCurrentProcess.KERNEL32 ref: 013FCBA8
GetCurrentThreadId.KERNEL32 ref: 013FCC01

Memory Dump Source

Source File: 00000003.00000002.1693971648.00000000013F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13f0000_kthiokadjg.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: b9412cbc10f6cba59893c0b6532dc20b5399d12d50c681b003446b26b3227f3c
Instruction ID: cb8bc7faef92cc655351b629e4607b9adedf42a12b718a033ffc2baa01d194c9
Opcode Fuzzy Hash: b9412cbc10f6cba59893c0b6532dc20b5399d12d50c681b003446b26b3227f3c
Instruction Fuzzy Hash: 505164B4D00649CFDB18CFAAC948B9EBBF1EF88318F208559E509A7360DB745984CB61

Function 013FCAAF Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 013FCB2E
GetCurrentThread.KERNEL32 ref: 013FCB6B
GetCurrentProcess.KERNEL32 ref: 013FCBA8
GetCurrentThreadId.KERNEL32 ref: 013FCC01

Memory Dump Source

Source File: 00000003.00000002.1693971648.00000000013F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13f0000_kthiokadjg.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 05a93d7e06f38f9a6ef82ec02fa7139da596596922cf1f44d74aff021e5bdf22
Instruction ID: affc8dec1ebcb46108b7fe3abcc033ec4dc668cf975732fd2135bfb0e26111a2
Opcode Fuzzy Hash: 05a93d7e06f38f9a6ef82ec02fa7139da596596922cf1f44d74aff021e5bdf22
Instruction Fuzzy Hash: 925166B4D006498FDB18CFAAC548BAEBFF1EF88318F208559E509A7360DB745944CF61

Function 013F3334 Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 013F33F1

Memory Dump Source

Source File: 00000003.00000002.1693971648.00000000013F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13f0000_kthiokadjg.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a07934cd91cc1d5356ed3bfa9ad4e55edd4459b3917784c621871c9798b495df
Instruction ID: 84fae435c4501a42326c6d2798856eb27aaab9c5b8b50fab6e485abc7b141bf6
Opcode Fuzzy Hash: a07934cd91cc1d5356ed3bfa9ad4e55edd4459b3917784c621871c9798b495df
Instruction Fuzzy Hash: 4441E3B4C0065DCEDB25DFA9C844BDDBBB5BF45308F20806AD508AB251DB756946CF90

Function 013F1FA4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 013F33F1

Memory Dump Source

Source File: 00000003.00000002.1693971648.00000000013F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13f0000_kthiokadjg.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 9a1f80c9c9ca80fa2b8fc3ebfadb5380601e50a06b0cc4eb63b32dec03d44bf0
Instruction ID: a35ed3907c1430a183d2a137147d25aeaa5dd2637c91111513bbb2d8b54de4e0
Opcode Fuzzy Hash: 9a1f80c9c9ca80fa2b8fc3ebfadb5380601e50a06b0cc4eb63b32dec03d44bf0
Instruction Fuzzy Hash: E341C2B4D0065DCEDB24CFA9C844B9EFBF5BF45308F20806AD509AB251DB756946CF90

Function 013FCCF0 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 013FCD7F

Memory Dump Source

Source File: 00000003.00000002.1693971648.00000000013F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13f0000_kthiokadjg.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b019b0659660cacb67d888f0979802eb8fbe1b3a465b4621dfe02788b2c68339
Instruction ID: 8ba132bda77597237cd153c4e42d0c5a5223c0e5bdda1967ff3093fd697f11f0
Opcode Fuzzy Hash: b019b0659660cacb67d888f0979802eb8fbe1b3a465b4621dfe02788b2c68339
Instruction Fuzzy Hash: 8721F3B5900248DFDB10CFAAD585ADEFFF8EB48320F14841AE918A7250D378A944CFA1

Function 013FCCF8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 013FCD7F

Memory Dump Source

Source File: 00000003.00000002.1693971648.00000000013F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13f0000_kthiokadjg.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6c36424296cdb00c5600e79e78ea07a53c001740c579e69f132fceec5fce3c0f
Instruction ID: 4f7b7a467d64898e1aa785df23a2b8a2ff988cb26003574114796c518aed6fea
Opcode Fuzzy Hash: 6c36424296cdb00c5600e79e78ea07a53c001740c579e69f132fceec5fce3c0f
Instruction Fuzzy Hash: 3921B5B5D002489FDB10CFAAD584ADEFFF8EB48324F14841AE914A7250D375A954CFA5

Function 013FCA58 Relevance: 1.5, APIs: 1, Instructions: 46
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 013FD775

Memory Dump Source

Source File: 00000003.00000002.1693971648.00000000013F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13f0000_kthiokadjg.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 41e96074beccb099536f4ba686759d7ffbe45bf17480d4011ef4c61f6dee0ab0
Instruction ID: c4190d1c39f397ad531ec2b91d61f87fb1edcc9cf93eb8184241f4b7efab170c
Opcode Fuzzy Hash: 41e96074beccb099536f4ba686759d7ffbe45bf17480d4011ef4c61f6dee0ab0
Instruction Fuzzy Hash: C61115B5800288CFDB20DF9AC448B9EFBF8EB48324F248559D518A7210C379A944CFA5

Function 013FD718 Relevance: 1.5, APIs: 1, Instructions: 46
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 013FD775

Memory Dump Source

Source File: 00000003.00000002.1693971648.00000000013F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_13f0000_kthiokadjg.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 206d6db75007521ceae25a67e70b94188bbe70d2fac7473a3e0c518c3c83dae3
Instruction ID: 209e527576fb25a943572059ee034ddd7119f6a71f83e96a2d9ac0b5c5e8e6b4
Opcode Fuzzy Hash: 206d6db75007521ceae25a67e70b94188bbe70d2fac7473a3e0c518c3c83dae3
Instruction Fuzzy Hash: A71115B5C002898FDB10CF9AC944BDEFBF4EB48324F248959D518A7310D379A545CFA5

Function 00FFD3EC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1693597128.0000000000FFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ffd000_kthiokadjg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a121f33f6fd8ae0e3af09c632f8cf441be45c1fe2b2841d990337252ebbfcae
Instruction ID: aaebb4d39ee9f07beaf5fd58d79eb35d25c4ee16b19bc49d6693bc7774a9206c
Opcode Fuzzy Hash: 5a121f33f6fd8ae0e3af09c632f8cf441be45c1fe2b2841d990337252ebbfcae
Instruction Fuzzy Hash: 2A210D72504248DFDB05DF14D5C0B36BF66FF98324F24C569DA090B266C336E856D7A1

Function 00FFD3E7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1693597128.0000000000FFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ffd000_kthiokadjg.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 555e834afbd1c2fd5414379b306259fbfd17fcb6917d78cd3ce2a61b5f371944
Instruction ID: b071c55d789c595e0b143f905fd867301d026f986c060717a59797c68104ccaf
Opcode Fuzzy Hash: 555e834afbd1c2fd5414379b306259fbfd17fcb6917d78cd3ce2a61b5f371944
Instruction Fuzzy Hash: 21112972804244CFDB05CF00D5C0B26BF72FF94324F24C6A9D9090B666C33AD456DBA2

Source: kthiokadjg.exe, 00000000.00000000.1653146683.00000000003C2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: autorun.inf.exe
Source: kthiokadjg.exe, 00000000.00000000.1653146683.00000000003C2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: [AutoRun]
Source: kthiokadjg.exe	Binary or memory string: autorun.inf.exe
Source: kthiokadjg.exe	Binary or memory string: [AutoRun]

Source: kthiokadjg.exe	String found in binary or memory: http://api.ipify.org/
Source: kthiokadjg.exe	String found in binary or memory: http://freegeoip.net/xml/
Source: kthiokadjg.exe	String found in binary or memory: http://ip-api.com/json/
Source: kthiokadjg.exe, 00000000.00000002.4106164254.0000000002889000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: kthiokadjg.exe, 00000000.00000002.4106164254.0000000002889000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/xClient.Core.Data
Source: kthiokadjg.exe, 00000000.00000002.4106164254.0000000002851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Source: kthiokadjg.exe, 00000000.00000000.1653146683.00000000003C2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: cmd.exeU/C vssadmin.exe Delete Shadows /All /Quiet
Source: kthiokadjg.exe	Binary or memory string: cmd.exeU/C vssadmin.exe Delete Shadows /All /Quiet

Source: kthiokadjg.exe, type: SAMPLE	Matched rule: Windows_Trojan_Quasarrat_e52df647 Author: unknown
Source: kthiokadjg.exe, type: SAMPLE	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: kthiokadjg.exe, type: SAMPLE	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: kthiokadjg.exe, type: SAMPLE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: kthiokadjg.exe, type: SAMPLE	Matched rule: Detects Vermin Keylogger Author: Florian Roth
Source: kthiokadjg.exe, type: SAMPLE	Matched rule: Detects Patchwork malware Author: Florian Roth
Source: kthiokadjg.exe, type: SAMPLE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: kthiokadjg.exe, type: SAMPLE	Matched rule: Detect QuasarRAT (reted from samples 2023-03) Author: Sekoia.io
Source: kthiokadjg.exe, type: SAMPLE	Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: kthiokadjg.exe, type: SAMPLE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: kthiokadjg.exe, type: SAMPLE	Matched rule: QuasarRAT payload Author: ditekSHen
Source: 0.0.kthiokadjg.exe.3c0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Quasarrat_e52df647 Author: unknown
Source: 0.0.kthiokadjg.exe.3c0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 0.0.kthiokadjg.exe.3c0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 0.0.kthiokadjg.exe.3c0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 0.0.kthiokadjg.exe.3c0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Vermin Keylogger Author: Florian Roth
Source: 0.0.kthiokadjg.exe.3c0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Patchwork malware Author: Florian Roth
Source: 0.0.kthiokadjg.exe.3c0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.0.kthiokadjg.exe.3c0000.0.unpack, type: UNPACKEDPE	Matched rule: Detect QuasarRAT (reted from samples 2023-03) Author: Sekoia.io
Source: 0.0.kthiokadjg.exe.3c0000.0.unpack, type: UNPACKEDPE	Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: 0.0.kthiokadjg.exe.3c0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.0.kthiokadjg.exe.3c0000.0.unpack, type: UNPACKEDPE	Matched rule: QuasarRAT payload Author: ditekSHen
Source: 00000000.00000000.1653146683.00000000003C2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Quasarrat_e52df647 Author: unknown
Source: 00000000.00000000.1653146683.00000000003C2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 00000000.00000000.1653146683.00000000003C2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detect QuasarRAT (reted from samples 2023-03) Author: Sekoia.io
Source: 00000000.00000000.1653146683.00000000003C2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group

Source: C:\Users\user\Desktop\kthiokadjg.exe	Code function: 0_2_00DBA350	0_2_00DBA350
Source: C:\Users\user\Desktop\kthiokadjg.exe	Code function: 0_2_00DB9A80	0_2_00DB9A80
Source: C:\Users\user\Desktop\kthiokadjg.exe	Code function: 0_2_00DB9738	0_2_00DB9738
Source: C:\Users\user\Desktop\kthiokadjg.exe	Code function: 0_2_0635550F	0_2_0635550F
Source: C:\Users\user\Desktop\kthiokadjg.exe	Code function: 0_2_06354230	0_2_06354230
Source: C:\Users\user\Desktop\kthiokadjg.exe	Code function: 0_2_0635BEA0	0_2_0635BEA0
Source: C:\Users\user\Desktop\kthiokadjg.exe	Code function: 0_2_0635E29B	0_2_0635E29B
Source: C:\Users\user\Desktop\kthiokadjg.exe	Code function: 3_2_013FA350	3_2_013FA350
Source: C:\Users\user\Desktop\kthiokadjg.exe	Code function: 3_2_013F9A80	3_2_013F9A80
Source: C:\Users\user\Desktop\kthiokadjg.exe	Code function: 3_2_013F9738	3_2_013F9738
Source: C:\Users\user\Desktop\kthiokadjg.exe	Code function: 3_2_013FD7B1	3_2_013FD7B1
Source: C:\Users\user\Desktop\kthiokadjg.exe	Code function: 3_2_013FD7C0	3_2_013FD7C0

Source: kthiokadjg.exe	Virustotal: Detection: 79%			Perma Link
Source: kthiokadjg.exe	ReversingLabs: Detection: 86%

Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.29.60
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.29.60
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.29.60
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.29.60
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.29.60
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.29.60
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.29.60
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.29.60
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.29.60
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.29.60
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.29.60
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.29.60
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.29.60
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.29.60
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.29.60
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: kthiokadjg.exe, 00000000.00000002.4108902295.0000000006279000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs kthiokadjg.exe
Source: kthiokadjg.exe, 00000000.00000000.1653146683.00000000003C2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameClient.exe" vs kthiokadjg.exe
Source: kthiokadjg.exe	Binary or memory string: OriginalFilenameClient.exe" vs kthiokadjg.exe

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report kthiokadjg.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\kthiokadjg.exe.log

C:\Users\user\AppData\Roaming\Logs\01-03-2025

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Windows Analysis Report
kthiokadjg.exe

Function 0635550F Relevance: 1.9, APIs: 1, Instructions: 366
COMMON

Function 06354230 Relevance: 1.6, Strings: 1, Instructions: 393
COMMON

Function 00DB3334 Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Function 00DB1FA4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre