Edit tour

Windows Analysis Report
7fqul5Zr8Y.exe

Overview

General Information

Sample name:	7fqul5Zr8Y.exe renamed because original name is a hash value
Original sample name:	3eedbe2eb477c09502ef6f9b609248f8.exe
Analysis ID:	1585774
MD5:	3eedbe2eb477c09502ef6f9b609248f8
SHA1:	1463b762d176f593fc098fb5e7433d02fd8afba1
SHA256:	5fdd2c9b92870b41096efa398f9d5f5e4fbbcb0938704fe4370f40d10b6e1149
Tags:	exeuser-abuse_ch
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

.NET source code contains potential unpacker

AI detected suspicious sample

Contains functionality to capture screen (.Net source)

Machine Learning detection for sample

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file does not import any functions

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

7fqul5Zr8Y.exe (PID: 6732 cmdline: "C:\Users\user\Desktop\7fqul5Zr8Y.exe" MD5: 3EEDBE2EB477C09502EF6F9B609248F8)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 7fqul5Zr8Y.exe

ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 7fqul5Zr8Y.exe

Joe Sandbox ML: detected

Source: 7fqul5Zr8Y.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: global traffic

TCP traffic: 192.168.2.8:49705 -> 147.185.221.24:58068

Source: Joe Sandbox View

IP Address: 147.185.221.24 147.185.221.24

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: coprophile.bounceme.net
Source: global traffic	DNS traffic detected: DNS query: board-proceeding.gl.at.ply.gg

Source: 7fqul5Zr8Y.exe, 00000000.00000002.2653812464.00000000036A6000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture screen (.Net source)

Source: 7fqul5Zr8Y.exe, Methods.cs

.Net Code: CaptureResizeReduceQuality

Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Code function: 0_2_00007FFB4B2578E0 NtProtectVirtualMemory,		0_2_00007FFB4B2578E0
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Code function: 0_2_00007FFB4B25ACD9 NtProtectVirtualMemory,		0_2_00007FFB4B25ACD9

Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Code function: 0_2_00007FFB4B2505D0	0_2_00007FFB4B2505D0
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Code function: 0_2_00007FFB4B25A450	0_2_00007FFB4B25A450
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Code function: 0_2_00007FFB4B2562A2	0_2_00007FFB4B2562A2
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Code function: 0_2_00007FFB4B2554F6	0_2_00007FFB4B2554F6
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Code function: 0_2_00007FFB4B2580E9	0_2_00007FFB4B2580E9
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Code function: 0_2_00007FFB4B251750	0_2_00007FFB4B251750
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Code function: 0_2_00007FFB4B2589B6	0_2_00007FFB4B2589B6
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Code function: 0_2_00007FFB4B253A14	0_2_00007FFB4B253A14
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Code function: 0_2_00007FFB4B25A43D	0_2_00007FFB4B25A43D
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Code function: 0_2_00007FFB4B25B248	0_2_00007FFB4B25B248
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Code function: 0_2_00007FFB4B2594EE	0_2_00007FFB4B2594EE
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Code function: 0_2_00007FFB4B25953D	0_2_00007FFB4B25953D
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Code function: 0_2_00007FFB4B251739	0_2_00007FFB4B251739

Source: 7fqul5Zr8Y.exe

Static PE information: No import functions for PE file found

Source: 7fqul5Zr8Y.exe, 00000000.00000000.1405271512.0000000000358000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameClient.exe. vs 7fqul5Zr8Y.exe
Source: 7fqul5Zr8Y.exe	Binary or memory string: OriginalFilenameClient.exe. vs 7fqul5Zr8Y.exe

Source: 7fqul5Zr8Y.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 7fqul5Zr8Y.exe, Config.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 7fqul5Zr8Y.exe, Config.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 7fqul5Zr8Y.exe, SecrityHidden.cs	Security API names: File.GetAccessControl
Source: 7fqul5Zr8Y.exe, SecrityHidden.cs	Security API names: File.SetAccessControl
Source: 7fqul5Zr8Y.exe, SecrityHidden.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)

Source: classification engine

Classification label: mal76.spyw.evad.winEXE@1/0@2/1

Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Mutant created: \Sessions\1\BaseNamedObjects\NULL

Source: 7fqul5Zr8Y.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 7fqul5Zr8Y.exe

Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%

Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 7fqul5Zr8Y.exe

ReversingLabs: Detection: 55%

Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Section loaded: schannel.dll	Jump to behavior

Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: 7fqul5Zr8Y.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 7fqul5Zr8Y.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 7fqul5Zr8Y.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: 7fqul5Zr8Y.exe, PluginLoader.cs	.Net Code: Load System.AppDomain.Load(byte[])
Source: 7fqul5Zr8Y.exe, PluginLoader.cs	.Net Code: Load
Source: 7fqul5Zr8Y.exe, EncryptString.cs	.Net Code: MoveNext System.Reflection.Assembly.Load(byte[])
Source: 7fqul5Zr8Y.exe, AsmiAndETW.cs	.Net Code: AggresivAmsiActivate System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Code function: 0_2_00007FFB4B2500BD pushad ; iretd	0_2_00007FFB4B2500C1
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Code function: 0_2_00007FFB4B25B4FD push eax; retn 0040h	0_2_00007FFB4B25B4FE
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Code function: 0_2_00007FFB4B25B505 push esp; retn 0040h	0_2_00007FFB4B25B506

Source: 7fqul5Zr8Y.exe

Static PE information: section name: .text entropy: 7.41686521078192

Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE PNPClass = 'Camera'

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Memory allocated: C80000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	Memory allocated: 1B690000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe

Window / User API: threadDelayed 391

Jump to behavior

Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe TID: 3568	Thread sleep count: 391 > 30			Jump to behavior
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe TID: 3568	Thread sleep count: 91 > 30			Jump to behavior

Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: 7fqul5Zr8Y.exe, 00000000.00000002.2653714619.0000000003180000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll #

Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe

Queries volume information: C:\Users\user\Desktop\7fqul5Zr8Y.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: 7fqul5Zr8Y.exe, 00000000.00000002.2653357165.0000000000C54000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\7fqul5Zr8Y.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	OS Credential Dumping	331 Security Software Discovery	Remote Services	1 Screen Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	33 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	213 System Information Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
7fqul5Zr8Y.exe	55%	ReversingLabs	ByteCode-MSIL.Backdoor.Crysan
7fqul5Zr8Y.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
board-proceeding.gl.at.ply.gg	147.185.221.24	true	false		unknown
coprophile.bounceme.net	unknown	unknown	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	7fqul5Zr8Y.exe, 00000000.00000002.2653812464.00000000036A6000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
147.185.221.24	board-proceeding.gl.at.ply.gg	United States		12087	SALSGIVERUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585774
Start date and time:	2025-01-08 08:48:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	7fqul5Zr8Y.exe renamed because original name is a hash value
Original Sample Name:	3eedbe2eb477c09502ef6f9b609248f8.exe
Detection:	MAL
Classification:	mal76.spyw.evad.winEXE@1/0@2/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 11 Number of non-executed functions: 4
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: 7fqul5Zr8Y.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
147.185.221.24	loader.exe	Get hash	malicious	Unknown	Browse
	loader.exe	Get hash	malicious	Unknown	Browse
	P3A946MOFP.exe	Get hash	malicious	XWorm	Browse
	BootstrapperV1.16.exe	Get hash	malicious	XWorm	Browse
	SharkHack.exe	Get hash	malicious	XWorm	Browse
	avaydna.exe	Get hash	malicious	Njrat	Browse
	ddos tool.exe	Get hash	malicious	XWorm	Browse
	L988Ph5sKX.exe	Get hash	malicious	XWorm	Browse
	ANuh30XoVu.exe	Get hash	malicious	XWorm	Browse
	p59UXHJRX3.exe	Get hash	malicious	XenoRAT	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SALSGIVERUS	miori.arm.elf	Get hash	malicious	Unknown	Browse	147.168.252.34
	miori.m68k.elf	Get hash	malicious	Unknown	Browse	147.184.86.253
	loader.exe	Get hash	malicious	Unknown	Browse	147.185.221.24
	loader.exe	Get hash	malicious	Unknown	Browse	147.185.221.24
	My33xbeYIX.exe	Get hash	malicious	Njrat	Browse	147.185.221.16
	YPzNsfg4nR.exe	Get hash	malicious	XWorm	Browse	147.185.221.21
	sela.exe	Get hash	malicious	Njrat	Browse	147.185.221.17
	P3A946MOFP.exe	Get hash	malicious	XWorm	Browse	147.185.221.24
	BootstrapperV1.16.exe	Get hash	malicious	XWorm	Browse	147.185.221.24
	SharkHack.exe	Get hash	malicious	XWorm	Browse	147.185.221.24

File type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.396305667741602
TrID:	Win64 Executable GUI Net Framework (217006/5) 49.88% Win64 Executable GUI (202006/5) 46.43% Win64 Executable (generic) (12005/4) 2.76% Generic Win/DOS Executable (2004/3) 0.46% DOS Executable Generic (2002/1) 0.46%
File name:	7fqul5Zr8Y.exe
File size:	218'112 bytes
MD5:	3eedbe2eb477c09502ef6f9b609248f8
SHA1:	1463b762d176f593fc098fb5e7433d02fd8afba1
SHA256:	5fdd2c9b92870b41096efa398f9d5f5e4fbbcb0938704fe4370f40d10b6e1149
SHA512:	615f4b5c5d265d50f8231086e7d0b3999e34ba5a4c45268d1ce4d3e5f34e1c57164ede5cbe69859fe6458520ffca8c32acdc308a316bcb70ff70e337389cfcad
SSDEEP:	6144:N/zEiqKNsqA+sPn1TOuXnzJwwgdiK1OG85G6b:hjX+173trgdiKq5G
TLSH:	16248D0A7E41E714C84A3E7783DF190147B2A5E31671D2443F8EDFE097452AB6E2AB6C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...a..f.........."...0..L............... .....@..... ....................................@...@......@............... .....

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140000000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66CCF161 [Mon Aug 26 21:19:29 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x38000	0x596	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x34ae8	0x34c00	355fd9474dc51238d24ce3082a66731d	False	0.7980366928317536	data	7.41686521078192	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x38000	0x596	0x600	f6b3b3ee59efb2408068efe50f586edd	False	0.4134114583333333	data	4.028240003183883	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x380a0	0x30c	data			0.4269230769230769
RT_MANIFEST	0x383ac	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 08:49:07.164968014 CET	49705	58068	192.168.2.8	147.185.221.24
Jan 8, 2025 08:49:07.169846058 CET	58068	49705	147.185.221.24	192.168.2.8
Jan 8, 2025 08:49:07.169960976 CET	49705	58068	192.168.2.8	147.185.221.24
Jan 8, 2025 08:49:07.195135117 CET	49705	58068	192.168.2.8	147.185.221.24
Jan 8, 2025 08:49:07.199933052 CET	58068	49705	147.185.221.24	192.168.2.8
Jan 8, 2025 08:49:28.511873960 CET	58068	49705	147.185.221.24	192.168.2.8
Jan 8, 2025 08:49:28.512131929 CET	49705	58068	192.168.2.8	147.185.221.24
Jan 8, 2025 08:49:28.734189987 CET	49705	58068	192.168.2.8	147.185.221.24
Jan 8, 2025 08:49:28.739010096 CET	58068	49705	147.185.221.24	192.168.2.8
Jan 8, 2025 08:49:28.739192963 CET	49708	58068	192.168.2.8	147.185.221.24
Jan 8, 2025 08:49:28.744019032 CET	58068	49708	147.185.221.24	192.168.2.8
Jan 8, 2025 08:49:28.744143963 CET	49708	58068	192.168.2.8	147.185.221.24
Jan 8, 2025 08:49:28.748745918 CET	49708	58068	192.168.2.8	147.185.221.24
Jan 8, 2025 08:49:28.753643036 CET	58068	49708	147.185.221.24	192.168.2.8
Jan 8, 2025 08:49:50.124375105 CET	58068	49708	147.185.221.24	192.168.2.8
Jan 8, 2025 08:49:50.124516964 CET	49708	58068	192.168.2.8	147.185.221.24
Jan 8, 2025 08:49:50.327557087 CET	49708	58068	192.168.2.8	147.185.221.24
Jan 8, 2025 08:49:50.328876019 CET	49709	58068	192.168.2.8	147.185.221.24
Jan 8, 2025 08:49:50.332366943 CET	58068	49708	147.185.221.24	192.168.2.8
Jan 8, 2025 08:49:50.333729982 CET	58068	49709	147.185.221.24	192.168.2.8
Jan 8, 2025 08:49:50.333842993 CET	49709	58068	192.168.2.8	147.185.221.24
Jan 8, 2025 08:49:50.334232092 CET	49709	58068	192.168.2.8	147.185.221.24
Jan 8, 2025 08:49:50.339063883 CET	58068	49709	147.185.221.24	192.168.2.8
Jan 8, 2025 08:50:11.716499090 CET	58068	49709	147.185.221.24	192.168.2.8
Jan 8, 2025 08:50:11.716624022 CET	49709	58068	192.168.2.8	147.185.221.24
Jan 8, 2025 08:50:11.921246052 CET	49709	58068	192.168.2.8	147.185.221.24
Jan 8, 2025 08:50:11.922180891 CET	49711	58068	192.168.2.8	147.185.221.24
Jan 8, 2025 08:50:11.926079035 CET	58068	49709	147.185.221.24	192.168.2.8
Jan 8, 2025 08:50:11.927001953 CET	58068	49711	147.185.221.24	192.168.2.8
Jan 8, 2025 08:50:11.927076101 CET	49711	58068	192.168.2.8	147.185.221.24
Jan 8, 2025 08:50:11.927361012 CET	49711	58068	192.168.2.8	147.185.221.24
Jan 8, 2025 08:50:11.932116985 CET	58068	49711	147.185.221.24	192.168.2.8
Jan 8, 2025 08:50:33.277769089 CET	58068	49711	147.185.221.24	192.168.2.8
Jan 8, 2025 08:50:33.277923107 CET	49711	58068	192.168.2.8	147.185.221.24
Jan 8, 2025 08:50:33.483798027 CET	49711	58068	192.168.2.8	147.185.221.24
Jan 8, 2025 08:50:33.484945059 CET	49714	58068	192.168.2.8	147.185.221.24
Jan 8, 2025 08:50:33.488540888 CET	58068	49711	147.185.221.24	192.168.2.8
Jan 8, 2025 08:50:33.489762068 CET	58068	49714	147.185.221.24	192.168.2.8
Jan 8, 2025 08:50:33.489835978 CET	49714	58068	192.168.2.8	147.185.221.24
Jan 8, 2025 08:50:33.490195036 CET	49714	58068	192.168.2.8	147.185.221.24
Jan 8, 2025 08:50:33.495153904 CET	58068	49714	147.185.221.24	192.168.2.8
Jan 8, 2025 08:50:54.888149023 CET	58068	49714	147.185.221.24	192.168.2.8
Jan 8, 2025 08:50:54.888263941 CET	49714	58068	192.168.2.8	147.185.221.24
Jan 8, 2025 08:50:55.093413115 CET	49714	58068	192.168.2.8	147.185.221.24
Jan 8, 2025 08:50:55.094448090 CET	49715	58068	192.168.2.8	147.185.221.24
Jan 8, 2025 08:50:55.098210096 CET	58068	49714	147.185.221.24	192.168.2.8
Jan 8, 2025 08:50:55.099267960 CET	58068	49715	147.185.221.24	192.168.2.8
Jan 8, 2025 08:50:55.099345922 CET	49715	58068	192.168.2.8	147.185.221.24
Jan 8, 2025 08:50:55.099729061 CET	49715	58068	192.168.2.8	147.185.221.24
Jan 8, 2025 08:50:55.104543924 CET	58068	49715	147.185.221.24	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 08:49:07.044029951 CET	63538	53	192.168.2.8	1.1.1.1
Jan 8, 2025 08:49:07.052315950 CET	53	63538	1.1.1.1	192.168.2.8
Jan 8, 2025 08:49:07.147067070 CET	61932	53	192.168.2.8	1.1.1.1
Jan 8, 2025 08:49:07.160196066 CET	53	61932	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 8, 2025 08:49:07.044029951 CET	192.168.2.8	1.1.1.1	0x90b7	Standard query (0)	coprophile.bounceme.net	A (IP address)	IN (0x0001)	false
Jan 8, 2025 08:49:07.147067070 CET	192.168.2.8	1.1.1.1	0xead	Standard query (0)	board-proceeding.gl.at.ply.gg	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 8, 2025 08:49:07.160196066 CET	1.1.1.1	192.168.2.8	0xead	No error (0)	board-proceeding.gl.at.ply.gg		147.185.221.24	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	02:49:05
Start date:	08/01/2025
Path:	C:\Users\user\Desktop\7fqul5Zr8Y.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\7fqul5Zr8Y.exe"
Imagebase:	0x320000
File size:	218'112 bytes
MD5 hash:	3EEDBE2EB477C09502EF6F9B609248F8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	18.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	33.3%
Total number of Nodes:	24
Total number of Limit Nodes:	2

Executed Functions

Function 00007FFB4B2578E0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 233
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL ref: 00007FFB4B25ADA4

Strings

@, xrefs: 00007FFB4B25ACB6
@, xrefs: 00007FFB4B25ACBE

Memory Dump Source

Source File: 00000000.00000002.2658099884.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b250000_7fqul5Zr8Y.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID: @$@
API String ID: 2706961497-149943524
Opcode ID: ffb124adb3070e80d7dc16ca247306ae7d8c86d0cca1c59a027e87ce6ed0d10b
Instruction ID: 08a5c659f2b65116fe55d6844a6d04d8cdd225329942261d9d1d0661677128b6
Opcode Fuzzy Hash: ffb124adb3070e80d7dc16ca247306ae7d8c86d0cca1c59a027e87ce6ed0d10b
Instruction Fuzzy Hash: 32712971D0D7494FDB25BB38D8466B97FE0EF56311F0442BBD549C32A2DA386C468782

Function 00007FFB4B25ACD9 Relevance: 1.7, APIs: 1, Instructions: 156
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL ref: 00007FFB4B25ADA4

Memory Dump Source

Source File: 00000000.00000002.2658099884.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b250000_7fqul5Zr8Y.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: cbf505c8d49ff4076800b85ca2c7de294aedbc6c1211b51797fa2bf54ea34401
Instruction ID: 705d6d57ccdf5bbc56bc23b269ddf634555e1a18f55b57e697ebf8f6f475c804
Opcode Fuzzy Hash: cbf505c8d49ff4076800b85ca2c7de294aedbc6c1211b51797fa2bf54ea34401
Instruction Fuzzy Hash: 87410B7190DB484FDB19AF6CD8466F97BE1EB95320F0442BFD449D3292CA746846C7C2

Function 00007FFB4B2580E9 Relevance: .8, Instructions: 770
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2658099884.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b250000_7fqul5Zr8Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95e325c447dd0f84c9784137d22629996520957c4a684e4a082efb092e2e1ec8
Instruction ID: c76f0ee7d6c830dd75e37befef7b51a7f354270577f9ebaf328d99209f70b19b
Opcode Fuzzy Hash: 95e325c447dd0f84c9784137d22629996520957c4a684e4a082efb092e2e1ec8
Instruction Fuzzy Hash: 8542B470A1C94A8FDB95FF28C455ABA7BE1FF58310F108579D51DCB2A2CE78A842C781

Function 00007FFB4B251750 Relevance: .6, Instructions: 550COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2658099884.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b250000_7fqul5Zr8Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe3218bcb44e830d3c5368ecef7586aab87d025bb516df7321deb9ad5700fcc2
Instruction ID: 33ff63eea723484400ac3ef79b8a813793e869cce68cbdaa3cbe4674bf4a70d5
Opcode Fuzzy Hash: fe3218bcb44e830d3c5368ecef7586aab87d025bb516df7321deb9ad5700fcc2
Instruction Fuzzy Hash: 9B02EAA1D0D2860EF76ABA34C9159B53FA0DF1231AF0585FAC68CD70F3ED1C686A8351

Function 00007FFB4B2554F6 Relevance: .5, Instructions: 472
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2658099884.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b250000_7fqul5Zr8Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89be24bd7421b9a5792e95d645c47ce97387e7d796daf0e07d7024ad63b3510e
Instruction ID: a065c951954dcc627b8ec542ea8ff1d220300a26c432639e4b4b72dbc7661d3f
Opcode Fuzzy Hash: 89be24bd7421b9a5792e95d645c47ce97387e7d796daf0e07d7024ad63b3510e
Instruction Fuzzy Hash: 5BF1A67091CA8E8FEBA9EF28C855BE97BD1FF54310F04826AD84DC7291DF3899458781

Function 00007FFB4B2562A2 Relevance: .5, Instructions: 458
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2658099884.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b250000_7fqul5Zr8Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 973707485c943df5e06001f933f00dcb3386fb14ab9cdd8bd0858e426cac27f1
Instruction ID: bab321dff5fc05670e8d6316b5a8980e6f03c52875b0fa085cd9c2728833cc1f
Opcode Fuzzy Hash: 973707485c943df5e06001f933f00dcb3386fb14ab9cdd8bd0858e426cac27f1
Instruction Fuzzy Hash: 77E1E77090CA4E8FEBA9EF28C855BE97BD1EF54350F04826ED84DC72A5CE7499418781

Function 00007FFB4B2505D0 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2658099884.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b250000_7fqul5Zr8Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a337ea542b68ec4d86880986aae41821a41227d325f0fc92427e73eb8409951
Instruction ID: 95ec7f38f9ac79be3a173e6a49bec0afafdf7618e874051fbd486a129ae4e545
Opcode Fuzzy Hash: 7a337ea542b68ec4d86880986aae41821a41227d325f0fc92427e73eb8409951
Instruction Fuzzy Hash: 4CA163B0C1D2C68EF76ABE34C919A753F605F12305F5485BAC68CD64F3EA5C641A8363

Function 00007FFB4B25A450 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2658099884.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b250000_7fqul5Zr8Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02f4c1c108b6bc2de2862b3b3c0033d64e1cfea829df59f5bafc27e1a1445610
Instruction ID: df2bbe1ec14b0d0d82bea3636fac946d7387635a328d4eb88a5cb1efe6f0e268
Opcode Fuzzy Hash: 02f4c1c108b6bc2de2862b3b3c0033d64e1cfea829df59f5bafc27e1a1445610
Instruction Fuzzy Hash: D85124B1D2A90A4AF71DBA74C4925FAB2D1EF95310F44847DD88B838D6EC2CB8074680

Function 00007FFB4B251739 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2658099884.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b250000_7fqul5Zr8Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 503e9150f702281fe71baeeb90447d776770ffce6276bbf30b17263339083ac7
Instruction ID: 0fef70d70428c67cbf601eef11f72477bef0584053d5786175f029d906266ba5
Opcode Fuzzy Hash: 503e9150f702281fe71baeeb90447d776770ffce6276bbf30b17263339083ac7
Instruction Fuzzy Hash: 16612AB1D1C01705FB7DB938CA4AABA39449F5135FF54DA38C748E20F1AE2DB87A4191

Function 00007FFB4B25A43D Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2658099884.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b250000_7fqul5Zr8Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52e4210dbaa09755e586e52642fb9501c1b77ff5d6b69b530617daf0dd16b2f3
Instruction ID: 394d264064e3baad92f8b4ecfd274d6dea91717ba9b8b137b7fb6ea725aab7e5
Opcode Fuzzy Hash: 52e4210dbaa09755e586e52642fb9501c1b77ff5d6b69b530617daf0dd16b2f3
Instruction Fuzzy Hash: 635114B1D2EA094AF71DBA34C4965FAB6D1EF55310F4584BDD98B838D2ED28B8078680

Function 00007FFB4B25B248 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2658099884.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b250000_7fqul5Zr8Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70b84fa336aef720437fffc5f0061df291d2be96d1fcbc04aaa28cb4cf8e222c
Instruction ID: 7b4f07b522b01c0b3455ad22972299ec7d2face5bf60efc799bb5f05b5f7ba43
Opcode Fuzzy Hash: 70b84fa336aef720437fffc5f0061df291d2be96d1fcbc04aaa28cb4cf8e222c
Instruction Fuzzy Hash: 215159B0D1C5079AFBBDFD34C61EA7A3A80AF10315F509538C64CD24F1EA1DB41A42A2

Non-executed Functions

Function 00007FFB4B2589B6 Relevance: 5.2, Strings: 4, Instructions: 244COMMON

Download Yara Rule

Strings

K_^, xrefs: 00007FFB4B258BC9
K_^, xrefs: 00007FFB4B258B22
K_^, xrefs: 00007FFB4B258B62
K_^, xrefs: 00007FFB4B258B12

Memory Dump Source

Source File: 00000000.00000002.2658099884.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b250000_7fqul5Zr8Y.jbxd

Similarity

API ID:
String ID: K_^$K_^$K_^$K_^
API String ID: 0-4267328068
Opcode ID: 44fd8c4286c49499147198ee262fbe54befbd5b209d58b68ef37945b39a3316d
Instruction ID: eec00bde62654c8ad01b453c8911896ad8d1a8313c6f7ece26cd178baf469956
Opcode Fuzzy Hash: 44fd8c4286c49499147198ee262fbe54befbd5b209d58b68ef37945b39a3316d
Instruction Fuzzy Hash: 0281B6E280E7C21FE74767788CA55957FA5EF5326870E41EBC5C4CE0A7E949580BC322

Function 00007FFB4B2594EE Relevance: .9, Instructions: 879COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2658099884.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b250000_7fqul5Zr8Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 080bb032303c1eee17571ed6797017580df2ae52383dbb1b31a1d84a2649063b
Instruction ID: f116b65497b5f4aa914f26d81bb2688cdb66cb21ad76e4c752c38eecb9368190
Opcode Fuzzy Hash: 080bb032303c1eee17571ed6797017580df2ae52383dbb1b31a1d84a2649063b
Instruction Fuzzy Hash: B45218B092C7454FE719FF28C585679BBE1FFA9300F54867DD6CE83196DA38A8028742

Function 00007FFB4B25953D Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2658099884.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b250000_7fqul5Zr8Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78567bf2c2967c293fe7e1f1240c7b9799df3857e59728aee48e8527b912c269
Instruction ID: 0be0fa82149af32ac05a330e2fad96bcb5e98337f226e60ad44869c441b7b2ae
Opcode Fuzzy Hash: 78567bf2c2967c293fe7e1f1240c7b9799df3857e59728aee48e8527b912c269
Instruction Fuzzy Hash: 8622F97092C3514FE319EF28C5C5639BBE1FB99300F54867DDADE83196DA3CA8428643

Function 00007FFB4B253A14 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2658099884.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b250000_7fqul5Zr8Y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6111d6084acbdcd183820e8f32c61df8986b6011bff7ff77a10a78297e93b0
Instruction ID: 115c41c1e56f80110ee3a39df8b2e5bc02f1695704912977a74af1a807809c85
Opcode Fuzzy Hash: 1d6111d6084acbdcd183820e8f32c61df8986b6011bff7ff77a10a78297e93b0
Instruction Fuzzy Hash: C991D57190C74C8FDB59EFA8D8496E9BBE1EB95321F0482AFD049D3252CA749845CB81

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 7fqul5Zr8Y.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: 7fqul5Zr8Y.exePID: 6732, Parent PID: 4084

General

Chronological Activities

Windows Analysis Report
7fqul5Zr8Y.exe

Function 00007FFB4B2578E0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 233
nativeCOMMON

Function 00007FFB4B25ACD9 Relevance: 1.7, APIs: 1, Instructions: 156
nativeCOMMON

Function 00007FFB4B2580E9 Relevance: .8, Instructions: 770
COMMON

Function 00007FFB4B2554F6 Relevance: .5, Instructions: 472
COMMON

Function 00007FFB4B2562A2 Relevance: .5, Instructions: 458
COMMON