Edit tour

Windows Analysis Report
173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Overview

General Information

Sample name:	173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe
Analysis ID:	1586003
MD5:	388c9d6483cf4532b2c121761895d3c3
SHA1:	ff6b2257bcebfcf4a71c907d858b5669d1ce5fa0
SHA256:	d151b029f2be0e159398119ba1230297086ec636afe5fe03e09207e12eabe57c
Tags:	base64-decodedexeuser-abuse_ch
Infos:

Detection

Remcos

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Contains functionality to bypass UAC (CMSTPLUA)

Detected Remcos RAT

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Remcos

Suricata IDS alerts for network traffic

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to register a low level keyboard hook

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Contains functionalty to change the wallpaper

Delayed program exit found

Installs a global keyboard hook

Machine Learning detection for sample

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to download and launch executables

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to enumerate running services

Contains functionality to launch a control a shell (cmd.exe)

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe (PID: 3128 cmdline: "C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe" MD5: 388C9D6483CF4532B2C121761895D3C3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Remcos, RemcosRAT	Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.	APT33 The Gorgon Group UAC-0050	http://malware-traffic-analysis.net/2017/12/22/index.html https://0xmrmagnezi.github.io/malware%20analysis/RemcosRAT/ https://asec.ahnlab.com/en/32376/ https://asec.ahnlab.com/ko/25837/ https://asec.ahnlab.com/ko/32101/	https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": ["municipioalcidiadechicamocha.ddnsgeek.com:1997:1"], "Assigned name": "08-01-25", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-DCXXDI", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6ad08:$a1: Remcos restarted by watchdog! 0x6b280:$a3: %02i:%02i:%02i:%03i
173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	REMCOS_RAT_variants	unknown	unknown	0x64f94:$str_a1: C:\Windows\System32\cmd.exe 0x64f10:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64f10:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65410:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x65a10:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x65004:$str_b2: Executing file: 0x65e4c:$str_b3: GetDirectListeningPort 0x65800:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65980:$str_b7: \update.vbs 0x6502c:$str_b9: Downloaded file: 0x65018:$str_b10: Downloading file: 0x650bc:$str_b12: Failed to upload file: 0x65e14:$str_b13: StartForward 0x65e34:$str_b14: StopForward 0x658d8:$str_b15: fso.DeleteFile " 0x6586c:$str_b16: On Error Resume Next 0x65908:$str_b17: fso.DeleteFolder " 0x650ac:$str_b18: Uploaded file: 0x6506c:$str_b19: Unable to delete: 0x658a0:$str_b20: while fso.FileExists(" 0x65549:$str_c0: [Firefox StoredLogins not found]
173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x64e80:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x64e10:$s1: CoGetObject 0x64e24:$s1: CoGetObject 0x64e40:$s1: CoGetObject 0x6ea80:$s1: CoGetObject 0x64dd0:$s2: Elevation:Administrator!new:
Click to see the 1 entries

Dropped Files

Source	Rule	Description	Author	Strings
C:\ProgramData\remcos\logs.dat	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.4512357235.000000000229F000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.4512096897.0000000000603000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x14708:$a1: Remcos restarted by watchdog! 0x14c80:$a3: %02i:%02i:%02i:%03i
00000000.00000000.2054430444.0000000000458000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000000.00000000.2054430444.0000000000458000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000000.2054430444.0000000000458000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000000.2054430444.0000000000458000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x14708:$a1: Remcos restarted by watchdog! 0x14c80:$a3: %02i:%02i:%02i:%03i
00000000.00000002.4512096897.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe PID: 3128	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe PID: 3128	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe PID: 3128	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe PID: 3128	Windows_Trojan_Remcos_b296e965	unknown	unknown	0xc543:$a1: Remcos restarted by watchdog! 0x18c1f:$a1: Remcos restarted by watchdog! 0xcaa0:$a3: %02i:%02i:%02i:%03i 0xce58:$a3: %02i:%02i:%02i:%03i 0x1917c:$a3: %02i:%02i:%02i:%03i 0x19534:$a3: %02i:%02i:%02i:%03i
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe.400000.0.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.0.173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe.400000.0.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0.0.173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.0.173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe.400000.0.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6ad08:$a1: Remcos restarted by watchdog! 0x6b280:$a3: %02i:%02i:%02i:%03i
0.0.173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe.400000.0.unpack	REMCOS_RAT_variants	unknown	unknown	0x64f94:$str_a1: C:\Windows\System32\cmd.exe 0x64f10:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64f10:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65410:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x65a10:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x65004:$str_b2: Executing file: 0x65e4c:$str_b3: GetDirectListeningPort 0x65800:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65980:$str_b7: \update.vbs 0x6502c:$str_b9: Downloaded file: 0x65018:$str_b10: Downloading file: 0x650bc:$str_b12: Failed to upload file: 0x65e14:$str_b13: StartForward 0x65e34:$str_b14: StopForward 0x658d8:$str_b15: fso.DeleteFile " 0x6586c:$str_b16: On Error Resume Next 0x65908:$str_b17: fso.DeleteFolder " 0x650ac:$str_b18: Uploaded file: 0x6506c:$str_b19: Unable to delete: 0x658a0:$str_b20: while fso.FileExists(" 0x65549:$str_c0: [Firefox StoredLogins not found]
0.0.173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x64e80:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x64e10:$s1: CoGetObject 0x64e24:$s1: CoGetObject 0x64e40:$s1: CoGetObject 0x6ea80:$s1: CoGetObject 0x64dd0:$s2: Elevation:Administrator!new:
0.2.173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe.400000.0.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.2.173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe.400000.0.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0.2.173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe.400000.0.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6ad08:$a1: Remcos restarted by watchdog! 0x6b280:$a3: %02i:%02i:%02i:%03i
0.2.173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe.400000.0.unpack	REMCOS_RAT_variants	unknown	unknown	0x64f94:$str_a1: C:\Windows\System32\cmd.exe 0x64f10:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64f10:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65410:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x65a10:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x65004:$str_b2: Executing file: 0x65e4c:$str_b3: GetDirectListeningPort 0x65800:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65980:$str_b7: \update.vbs 0x6502c:$str_b9: Downloaded file: 0x65018:$str_b10: Downloading file: 0x650bc:$str_b12: Failed to upload file: 0x65e14:$str_b13: StartForward 0x65e34:$str_b14: StopForward 0x658d8:$str_b15: fso.DeleteFile " 0x6586c:$str_b16: On Error Resume Next 0x65908:$str_b17: fso.DeleteFolder " 0x650ac:$str_b18: Uploaded file: 0x6506c:$str_b19: Unable to delete: 0x658a0:$str_b20: while fso.FileExists(" 0x65549:$str_c0: [Firefox StoredLogins not found]
0.2.173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x64e80:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x64e10:$s1: CoGetObject 0x64e24:$s1: CoGetObject 0x64e40:$s1: CoGetObject 0x6ea80:$s1: CoGetObject 0x64dd0:$s2: Elevation:Administrator!new:
Click to see the 7 entries

Sigma Signatures

Stealing of Sensitive Information

Sigma detected: Remcos

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, ProcessId: 3128, TargetFilename: C:\ProgramData\remcos\logs.dat

Suricata Signatures

ET JA3 Hash - Remcos 3.x/4.x TLS Connection

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T16:06:43.186538+0100	2036594	1	Malware Command and Control Activity Detected	192.168.2.5	49705	179.15.136.6	1997	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T16:06:44.528186+0100	2803304	3	Unknown Traffic	192.168.2.5	49706	178.237.33.50	80	TCP

ETPRO MALWARE Observed DNS Query to Abused DDNS (ddnsgeek .com)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T16:06:42.258168+0100	2834936	1	A Network Trojan was detected	192.168.2.5	53042	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Avira: detected

Antivirus detection for URL or domain

Source: municipioalcidiadechicamocha.ddnsgeek.com

Avira URL Cloud: Label: malware

Found malware configuration

Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Malware Configuration Extractor: Remcos {"Host:Port:Password": ["municipioalcidiadechicamocha.ddnsgeek.com:1997:1"], "Assigned name": "08-01-25", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-DCXXDI", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos"}

Multi AV Scanner detection for submitted file

Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

ReversingLabs: Detection: 65%

Yara detected Remcos RAT

Source: Yara match	File source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, type: SAMPLE
Source: Yara match	File source: 0.0.173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4512357235.000000000229F000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4512096897.0000000000603000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2054430444.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4512096897.00000000005BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe PID: 3128, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Code function: 0_2_00432B45 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

0_2_00432B45

Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000000.2054430444.0000000000458000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_7e460bfa-4

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, type: SAMPLE
Source: Yara match	File source: 0.0.173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2054430444.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe PID: 3128, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Code function: 0_2_00406764 _wcslen,CoGetObject,

0_2_00406764

Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_0040B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	0_2_0040B335
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_0040B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	0_2_0040B53A
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_0041B63A FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,	0_2_0041B63A
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_0044D7F9 FindFirstFileExA,	0_2_0044D7F9
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_004089A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,	0_2_004089A9
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_00406AC2 FindFirstFileW,FindNextFileW,	0_2_00406AC2
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_00407A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,	0_2_00407A8C
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_00408DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,	0_2_00408DA7
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_00418E5F FindFirstFileW,FindNextFileW,FindNextFileW,	0_2_00418E5F

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Code function: 0_2_00406F06 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

0_2_00406F06

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2834936 - Severity 1 - ETPRO MALWARE Observed DNS Query to Abused DDNS (ddnsgeek .com) : 192.168.2.5:53042 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.5:49705 -> 179.15.136.6:1997

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: municipioalcidiadechicamocha.ddnsgeek.com

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 179.15.136.6:1997

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 179.15.136.6 179.15.136.6
Source: Joe Sandbox View	IP Address: 178.237.33.50 178.237.33.50

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49706 -> 178.237.33.50:80

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Code function: 0_2_00426302 recv,

0_2_00426302

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: municipioalcidiadechicamocha.ddnsgeek.com
Source: global traffic	DNS traffic detected: DNS query: geoplugin.net

Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000002.4512096897.0000000000603000.00000004.00000020.00020000.00000000.sdmp, 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000002.4512096897.00000000005BE000.00000004.00000020.00020000.00000000.sdmp, 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000003.2077942586.0000000000632000.00000004.00000020.00020000.00000000.sdmp, 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000002.4512096897.0000000000633000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp
Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000003.2077860657.0000000000603000.00000004.00000020.00020000.00000000.sdmp, 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000002.4512096897.0000000000603000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpF&
Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000003.2077860657.0000000000603000.00000004.00000020.00020000.00000000.sdmp, 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000002.4512096897.0000000000603000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpQ#
Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000002.4512096897.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpSystem32
Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000003.2077860657.0000000000603000.00000004.00000020.00020000.00000000.sdmp, 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000002.4512096897.0000000000603000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpT&

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Code function: 0_2_004099E4 SetWindowsHookExA 0000000D,004099D0,00000000

0_2_004099E4

Installs a global keyboard hook

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Jump to behavior

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Code function: 0_2_00415B5E OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

0_2_00415B5E

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Code function: 0_2_00415B5E OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

0_2_00415B5E

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Code function: 0_2_00415B5E OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

0_2_00415B5E

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Code function: 0_2_00409B10 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,

0_2_00409B10

Source: Yara match	File source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, type: SAMPLE
Source: Yara match	File source: 0.0.173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2054430444.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe PID: 3128, type: MEMORYSTR

E-Banking Fraud

Yara detected Remcos RAT

Source: Yara match	File source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, type: SAMPLE
Source: Yara match	File source: 0.0.173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4512357235.000000000229F000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4512096897.0000000000603000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2054430444.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4512096897.00000000005BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe PID: 3128, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Contains functionalty to change the wallpaper

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Code function: 0_2_0041BD82 SystemParametersInfoW,

0_2_0041BD82

System Summary

Malicious sample detected (through community Yara rule)

Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, type: SAMPLE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, type: SAMPLE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, type: SAMPLE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.0.173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.0.173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.0.173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000000.00000000.2054430444.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe PID: 3128, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_0041AECC OpenProcess,NtSuspendProcess,CloseHandle,		0_2_0041AECC
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_0041AEF8 OpenProcess,NtResumeProcess,CloseHandle,		0_2_0041AEF8

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Code function: 0_2_00415A51 ExitWindowsEx,LoadLibraryA,GetProcAddress,

0_2_00415A51

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_0043D04B	0_2_0043D04B
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_0042707E	0_2_0042707E
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_0041301D	0_2_0041301D
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_00441030	0_2_00441030
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_00453110	0_2_00453110
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_004271B8	0_2_004271B8
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_0041D27C	0_2_0041D27C
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_004522E2	0_2_004522E2
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_0043D2A8	0_2_0043D2A8
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_00437360	0_2_00437360
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_004363BA	0_2_004363BA
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_0042645F	0_2_0042645F
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_00431582	0_2_00431582
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_0043672C	0_2_0043672C
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_0041E7EA	0_2_0041E7EA
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_0044C949	0_2_0044C949
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_004269D6	0_2_004269D6
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_004369D6	0_2_004369D6
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_0043CBED	0_2_0043CBED
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_00432C54	0_2_00432C54
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_00436C9D	0_2_00436C9D
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_0043CE1C	0_2_0043CE1C
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_00436F58	0_2_00436F58
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_00434F32	0_2_00434F32

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: String function: 00401F66 appears 50 times
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: String function: 004020E7 appears 40 times
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: String function: 00433AB0 appears 42 times
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: String function: 004341C0 appears 55 times

Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, type: SAMPLE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, type: SAMPLE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.0.173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.0.173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.0.173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000000.00000000.2054430444.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe PID: 3128, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@1/2@2/2

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Code function: 0_2_00416C9D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

0_2_00416C9D

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Code function: 0_2_0040E2F1 GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,

0_2_0040E2F1

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Code function: 0_2_0041A84A FindResourceA,LoadResource,LockResource,SizeofResource,

0_2_0041A84A

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Code function: 0_2_00419DBA OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

0_2_00419DBA

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\json[1].json

Jump to behavior

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Mutant created: \Sessions\1\BaseNamedObjects\Rmc-DCXXDI

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Command line argument: Software\	0_2_0040D83A
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Command line argument: Rmc-DCXXDI	0_2_0040D83A
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Command line argument: Exe	0_2_0040D83A
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Command line argument: Exe	0_2_0040D83A
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Command line argument: Rmc-DCXXDI	0_2_0040D83A
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Command line argument: 0TG	0_2_0040D83A
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Command line argument: Inj	0_2_0040D83A
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Command line argument: Inj	0_2_0040D83A
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Command line argument: PSG	0_2_0040D83A
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Command line argument: exepath	0_2_0040D83A
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Command line argument: PSG	0_2_0040D83A
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Command line argument: exepath	0_2_0040D83A
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Command line argument: licence	0_2_0040D83A
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Command line argument: dMG	0_2_0040D83A
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Command line argument: hSG	0_2_0040D83A
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Command line argument: Administrator	0_2_0040D83A
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Command line argument: User	0_2_0040D83A
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Command line argument: del	0_2_0040D83A
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Command line argument: del	0_2_0040D83A
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Command line argument: del	0_2_0040D83A

Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

ReversingLabs: Detection: 65%

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Section loaded: winnsi.dll	Jump to behavior

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Code function: 0_2_0041BEEE LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

0_2_0041BEEE

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_004560BF push ecx; ret	0_2_004560D2
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_00434206 push ecx; ret	0_2_00434219
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_004569F0 push eax; ret	0_2_00456A0E

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Code function: 0_2_00406128 ShellExecuteW,URLDownloadToFileW,

0_2_00406128

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Code function: 0_2_00419DBA OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

0_2_00419DBA

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

0_2_0041BEEE

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Delayed program exit found

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Code function: 0_2_0040E627 Sleep,ExitProcess,

0_2_0040E627

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,

0_2_00419AB8

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Window / User API: threadDelayed 4025	Jump to behavior
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Window / User API: threadDelayed 5442	Jump to behavior
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Window / User API: foregroundWindowGot 1769	Jump to behavior

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe TID: 2748	Thread sleep count: 262 > 30	Jump to behavior
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe TID: 2748	Thread sleep time: -131000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe TID: 2704	Thread sleep count: 4025 > 30	Jump to behavior
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe TID: 2704	Thread sleep time: -12075000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe TID: 2704	Thread sleep count: 5442 > 30	Jump to behavior
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe TID: 2704	Thread sleep time: -16326000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_0040B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	0_2_0040B335
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_0040B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	0_2_0040B53A
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_0041B63A FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,	0_2_0041B63A
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_0044D7F9 FindFirstFileExA,	0_2_0044D7F9
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_004089A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,	0_2_004089A9
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_00406AC2 FindFirstFileW,FindNextFileW,	0_2_00406AC2
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_00407A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,	0_2_00407A8C
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_00408DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,	0_2_00408DA7
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_00418E5F FindFirstFileW,FindNextFileW,FindNextFileW,	0_2_00418E5F

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Code function: 0_2_00406F06 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

0_2_00406F06

Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000002.4512096897.0000000000639000.00000004.00000020.00020000.00000000.sdmp, 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000003.2077942586.0000000000639000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW.
Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000002.4512096897.0000000000639000.00000004.00000020.00020000.00000000.sdmp, 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000003.2077942586.0000000000639000.00000004.00000020.00020000.00000000.sdmp, 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000002.4512096897.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

API call chain: ExitProcess graph end node

graph_0-48131

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Code function: 0_2_0043A86D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0043A86D

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

0_2_0041BEEE

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Code function: 0_2_00442764 mov eax, dword ptr fs:[00000030h]

0_2_00442764

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Code function: 0_2_0044EB3E GetProcessHeap,

0_2_0044EB3E

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_00434378 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00434378
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_0043A86D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0043A86D
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_00433D4F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00433D4F
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: 0_2_00433EE2 SetUnhandledExceptionFilter,	0_2_00433EE2

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe

0_2_0041100E

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Code function: 0_2_0041894A mouse_event,

0_2_0041894A

Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000002.4512096897.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerGl
Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000002.4512096897.0000000000633000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managery]
Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000002.4512096897.00000000005BE000.00000004.00000020.00020000.00000000.sdmp, 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000002.4512096897.0000000000633000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000002.4512096897.0000000000633000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerP]
Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000002.4512096897.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerDI\
Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000002.4512096897.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerr\|
Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000002.4512096897.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerDI\2
Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000002.4512096897.0000000000633000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerU]
Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000003.2077860657.0000000000629000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managernet/
Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000002.4512096897.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000002.4512096897.0000000000603000.00000004.00000020.00020000.00000000.sdmp, 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000002.4512096897.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|
Source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000002.4512096897.00000000005BE000.00000004.00000020.00020000.00000000.sdmp, logs.dat.0.dr	Binary or memory string: [Program Manager]

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Code function: 0_2_00434015 cpuid

0_2_00434015

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: GetLocaleInfoA,	0_2_0040E751
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_0045107A
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: GetLocaleInfoW,	0_2_004512CA
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: EnumSystemLocalesW,	0_2_004472BE
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_004513F3
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: GetLocaleInfoW,	0_2_004514FA
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_004515C7
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: GetLocaleInfoW,	0_2_004477A7
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_00450C8F
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: EnumSystemLocalesW,	0_2_00450F52
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: EnumSystemLocalesW,	0_2_00450F07
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: EnumSystemLocalesW,	0_2_00450FED

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Code function: 0_2_00404915 GetLocalTime,CreateEventA,CreateThread,

0_2_00404915

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Code function: 0_2_0041A9AD GetComputerNameExW,GetUserNameW,

0_2_0041A9AD

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Code function: 0_2_0044804A _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

0_2_0044804A

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Remcos RAT

Source: Yara match	File source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, type: SAMPLE
Source: Yara match	File source: 0.0.173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4512357235.000000000229F000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4512096897.0000000000603000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2054430444.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4512096897.00000000005BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe PID: 3128, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Contains functionality to steal Chrome passwords or cookies

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

0_2_0040B21B

Contains functionality to steal Firefox passwords or cookies

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\		0_2_0040B335
Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	Code function: \key3.db		0_2_0040B335

Remote Access Functionality

Detected Remcos RAT

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Mutex created: \Sessions\1\BaseNamedObjects\Rmc-DCXXDI

Jump to behavior

Yara detected Remcos RAT

Source: Yara match	File source: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, type: SAMPLE
Source: Yara match	File source: 0.0.173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4512357235.000000000229F000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4512096897.0000000000603000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2054430444.0000000000458000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4512096897.00000000005BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe PID: 3128, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Code function: cmd.exe

0_2_00405042

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 Windows Service	1 Bypass User Account Control	2 Obfuscated Files or Information	211 Input Capture	1 Account Discovery	Remote Desktop Protocol	211 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	Logon Script (Windows)	1 Access Token Manipulation	1 DLL Side-Loading	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Windows Service	1 Bypass User Account Control	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Process Injection	1 Masquerading	LSA Secrets	23 System Information Discovery	SSH	Keylogging	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Virtualization/Sandbox Evasion	Cached Domain Credentials	21 Security Software Discovery	VNC	GUI Input Capture	12 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	1 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	66%	ReversingLabs	Win32.Backdoor.Remcos
173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	100%	Avira	BDS/Backdoor.Gen
173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
municipioalcidiadechicamocha.ddnsgeek.com	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
geoplugin.net	178.237.33.50	true	false		high
municipioalcidiadechicamocha.ddnsgeek.com	179.15.136.6	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp	false		high
municipioalcidiadechicamocha.ddnsgeek.com	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://geoplugin.net/json.gp/C	173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe	false	high
http://geoplugin.net/json.gpF&	173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000003.2077860657.0000000000603000.00000004.00000020.00020000.00000000.sdmp, 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000002.4512096897.0000000000603000.00000004.00000020.00020000.00000000.sdmp	false	high
http://geoplugin.net/json.gpSystem32	173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000002.4512096897.00000000005BE000.00000004.00000020.00020000.00000000.sdmp	false	high
http://geoplugin.net/json.gpQ#	173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000003.2077860657.0000000000603000.00000004.00000020.00020000.00000000.sdmp, 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000002.4512096897.0000000000603000.00000004.00000020.00020000.00000000.sdmp	false	high
http://geoplugin.net/json.gpT&	173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000003.2077860657.0000000000603000.00000004.00000020.00020000.00000000.sdmp, 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, 00000000.00000002.4512096897.0000000000603000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
179.15.136.6	municipioalcidiadechicamocha.ddnsgeek.com	Colombia		27831	ColombiaMovilCO	false
178.237.33.50	geoplugin.net	Netherlands		8455	ATOM86-ASATOM86NL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1586003
Start date and time:	2025-01-08 16:05:49 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winEXE@1/2@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 38 Number of non-executed functions: 207
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 172.202.163.200
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Simulations

Behavior and APIs

Time	Type	Description
10:07:13	API Interceptor	7368541x Sleep call for process: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
179.15.136.6	1736348224ad77cf86e491faad27e4b5decf1eb0bb26f16b0527e5ef488389ba353aa3db79582.dat-decoded.exe	Get hash	malicious	Remcos	Browse
	17363482247f60133f013d62aae38c531ac95bb55a200a243b0e15fa7cf8e8923b2a10590f952.dat-decoded.exe	Get hash	malicious	Remcos	Browse
	1736348224f7603a5c535b2b2f6cc29730626d73a967c67551d2d14f73b547fe7b5fc10393994.dat-decoded.exe	Get hash	malicious	Remcos	Browse
	1736348224bd83df4c8d79407f8e7ac5cf8c08b59746ce37ff95772daa0a6283b50e2b0882115.dat-decoded.exe	Get hash	malicious	Remcos	Browse
	17363482249a873460757a9239193679567953c11d17b898ff9845034e34f5d2e7f4521342673.dat-decoded.exe	Get hash	malicious	Remcos	Browse
178.237.33.50	1736348224ad77cf86e491faad27e4b5decf1eb0bb26f16b0527e5ef488389ba353aa3db79582.dat-decoded.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	17363482247f60133f013d62aae38c531ac95bb55a200a243b0e15fa7cf8e8923b2a10590f952.dat-decoded.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	1736348224f7603a5c535b2b2f6cc29730626d73a967c67551d2d14f73b547fe7b5fc10393994.dat-decoded.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	1736348224bd83df4c8d79407f8e7ac5cf8c08b59746ce37ff95772daa0a6283b50e2b0882115.dat-decoded.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	17363482249a873460757a9239193679567953c11d17b898ff9845034e34f5d2e7f4521342673.dat-decoded.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exe	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	c2.hta	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	c2.hta	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	RailProvides_nopump.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	c2.hta	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
municipioalcidiadechicamocha.ddnsgeek.com	1736348224ad77cf86e491faad27e4b5decf1eb0bb26f16b0527e5ef488389ba353aa3db79582.dat-decoded.exe	Get hash	malicious	Remcos	Browse	179.15.136.6
	1736348224f7603a5c535b2b2f6cc29730626d73a967c67551d2d14f73b547fe7b5fc10393994.dat-decoded.exe	Get hash	malicious	Remcos	Browse	179.15.136.6
	1736348224bd83df4c8d79407f8e7ac5cf8c08b59746ce37ff95772daa0a6283b50e2b0882115.dat-decoded.exe	Get hash	malicious	Remcos	Browse	179.15.136.6
	17363482249a873460757a9239193679567953c11d17b898ff9845034e34f5d2e7f4521342673.dat-decoded.exe	Get hash	malicious	Remcos	Browse	179.15.136.6
geoplugin.net	1736348224ad77cf86e491faad27e4b5decf1eb0bb26f16b0527e5ef488389ba353aa3db79582.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	17363482247f60133f013d62aae38c531ac95bb55a200a243b0e15fa7cf8e8923b2a10590f952.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	1736348224f7603a5c535b2b2f6cc29730626d73a967c67551d2d14f73b547fe7b5fc10393994.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	1736348224bd83df4c8d79407f8e7ac5cf8c08b59746ce37ff95772daa0a6283b50e2b0882115.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	17363482249a873460757a9239193679567953c11d17b898ff9845034e34f5d2e7f4521342673.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	c2.hta	Get hash	malicious	Remcos	Browse	178.237.33.50
	c2.hta	Get hash	malicious	Remcos	Browse	178.237.33.50
	RailProvides_nopump.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	c2.hta	Get hash	malicious	Remcos	Browse	178.237.33.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ATOM86-ASATOM86NL	1736348224ad77cf86e491faad27e4b5decf1eb0bb26f16b0527e5ef488389ba353aa3db79582.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	17363482247f60133f013d62aae38c531ac95bb55a200a243b0e15fa7cf8e8923b2a10590f952.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	1736348224f7603a5c535b2b2f6cc29730626d73a967c67551d2d14f73b547fe7b5fc10393994.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	1736348224bd83df4c8d79407f8e7ac5cf8c08b59746ce37ff95772daa0a6283b50e2b0882115.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	17363482249a873460757a9239193679567953c11d17b898ff9845034e34f5d2e7f4521342673.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	c2.hta	Get hash	malicious	Remcos	Browse	178.237.33.50
	c2.hta	Get hash	malicious	Remcos	Browse	178.237.33.50
	RailProvides_nopump.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	c2.hta	Get hash	malicious	Remcos	Browse	178.237.33.50
ColombiaMovilCO	1736348224ad77cf86e491faad27e4b5decf1eb0bb26f16b0527e5ef488389ba353aa3db79582.dat-decoded.exe	Get hash	malicious	Remcos	Browse	179.15.136.6
	17363482247f60133f013d62aae38c531ac95bb55a200a243b0e15fa7cf8e8923b2a10590f952.dat-decoded.exe	Get hash	malicious	Remcos	Browse	179.15.136.6
	1736348224f7603a5c535b2b2f6cc29730626d73a967c67551d2d14f73b547fe7b5fc10393994.dat-decoded.exe	Get hash	malicious	Remcos	Browse	179.15.136.6
	1736348224bd83df4c8d79407f8e7ac5cf8c08b59746ce37ff95772daa0a6283b50e2b0882115.dat-decoded.exe	Get hash	malicious	Remcos	Browse	179.15.136.6
	17363482249a873460757a9239193679567953c11d17b898ff9845034e34f5d2e7f4521342673.dat-decoded.exe	Get hash	malicious	Remcos	Browse	179.15.136.6
	sh4.elf	Get hash	malicious	Mirai	Browse	177.252.126.19
	armv5l.elf	Get hash	malicious	Unknown	Browse	191.93.155.250
	Fantazy.x86.elf	Get hash	malicious	Unknown	Browse	179.12.199.43
	armv5l.elf	Get hash	malicious	Unknown	Browse	191.91.160.57
	kwari.arm.elf	Get hash	malicious	Unknown	Browse	181.204.131.174

Process:	C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe
File Type:	data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	3.3683413243328855
Encrypted:	false
SSDEEP:	3:rgls1MNrlKel5JWRal2Jl+7R0DAlBG45klovDl6v:MlsaNM65YcIeeDAlOWAv
MD5:	95B9E5F5BFFDDDC61FB522A85F96805E
SHA1:	CDEB1CBA21B9200A05385B223EC7C54C9AFECC54
SHA-256:	4DA2D7B6E8CF24020522184C8C668B46120CB6C1BD9E049E09B67EC83D9F22A4
SHA-512:	B4AD4FBF3B4E0E21186D8E0EC9D61E2D96C9E5774DC3EEBDEF1DC539AFE322EC1654109D57357F3377272604CF690BAC60BFD1E68861FE72C0AD885BF1EA8385
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\ProgramData\remcos\logs.dat, Author: Joe Security
Reputation:	low
Preview:	....[.2.0.2.5./.0.1./.0.8. .1.0.:.0.6.:.4.1. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\json[1].json

Download File

Process:	C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	5.019205124979377
Encrypted:	false
SSDEEP:	12:tkluWJmnd6UGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkk:qlupdVauKyGX85jvXhNlT3/7AcV9Wro
MD5:	B62617530A8532F9AECAA939B6AB93BB
SHA1:	E4DE9E9838052597EB2A5B363654C737BA1E6A66
SHA-256:	508F952EF83C41861ECD44FB821F7BB73535BFF89F54D54C3549127DCA004E70
SHA-512:	A0B385593B721313130CF14182F3B6EE5FF29D2A36FED99139FA2EE838002DFEEC83285DEDEAE437A53D053FCC631AEAD001D3E804386211BBA2F174134EA70D
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	{. "geoplugin_request":"8.46.123.189",. "geoplugin_status":200,. "geoplugin_delay":"2ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7123",. "geoplugin_longitude":"-74.0068",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.589872065697318
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe
File size:	493'568 bytes
MD5:	388c9d6483cf4532b2c121761895d3c3
SHA1:	ff6b2257bcebfcf4a71c907d858b5669d1ce5fa0
SHA256:	d151b029f2be0e159398119ba1230297086ec636afe5fe03e09207e12eabe57c
SHA512:	1888fe84f6549975a2352ffcffcaab37cff4a6b17560dff4d07a483ee95a145344c0bf46a307a854142db9a3552da5c00cbb2b8653fe59ada2800482c3a91c34
SSDEEP:	12288:x13ak/mBXTG4/1v08KI7ZnMEF76JqmsvZQzS:jak/mBXTV/R0nEF76gFZU
TLSH:	0AA4BF01BAD2C072D57654300C3AE775DEBDBD212839897BB3D61D97FD30190A63AAB2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........)...H...H...H....(..H....*..H....+..H...0]..H..&....H... ...H... ...H... ...H...0J..H...H...I...!...H...!&..H...!...H..Rich.H.

File Icon


Icon Hash:	95694d05214c1b33

Static PE Info

General

Entrypoint:	0x433d45
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x677C5D61 [Mon Jan 6 22:46:57 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	e77512f955eaf60ccff45e02d69234de

Entrypoint Preview

Instruction
call 00007F1254DF86F8h
jmp 00007F1254DF804Fh
push ebp
mov ebp, esp
sub esp, 00000324h
push ebx
push 00000017h
call 00007F1254E1A52Eh
test eax, eax
je 00007F1254DF81D7h
mov ecx, dword ptr [ebp+08h]
int 29h
push 00000003h
call 00007F1254DF8394h
mov dword ptr [esp], 000002CCh
lea eax, dword ptr [ebp-00000324h]
push 00000000h
push eax
call 00007F1254DFA6B0h
add esp, 0Ch
mov dword ptr [ebp-00000274h], eax
mov dword ptr [ebp-00000278h], ecx
mov dword ptr [ebp-0000027Ch], edx
mov dword ptr [ebp-00000280h], ebx
mov dword ptr [ebp-00000284h], esi
mov dword ptr [ebp-00000288h], edi
mov word ptr [ebp-0000025Ch], ss
mov word ptr [ebp-00000268h], cs
mov word ptr [ebp-0000028Ch], ds
mov word ptr [ebp-00000290h], es
mov word ptr [ebp-00000294h], fs
mov word ptr [ebp-00000298h], gs
pushfd
pop dword ptr [ebp-00000264h]
mov eax, dword ptr [ebp+04h]
mov dword ptr [ebp-0000026Ch], eax
lea eax, dword ptr [ebp+04h]
mov dword ptr [ebp-00000260h], eax
mov dword ptr [ebp-00000324h], 00010001h
mov eax, dword ptr [eax-04h]
push 00000050h
mov dword ptr [ebp-00000270h], eax
lea eax, dword ptr [ebp-58h]
push 00000000h
push eax
call 00007F1254DFA626h

Rich Headers

Programming Language:

[C++] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6f030	0x104	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x77000	0x4b84	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7c000	0x3b9c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x6d520	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x6d5f8	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x6d558	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x58000	0x4f4	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5612d	0x56200	5c74fad187ce0ec180ec04ec1b2886cc	False	0.5738587400217707	data	6.626093338563234	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x58000	0x18b10	0x18c00	6a99ef6306230cc107eebd633ea523fe	False	0.49747474747474746	data	5.749671721823548	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x71000	0x5d94	0xe00	f36050cd29c9ed45c5f5146a79631724	False	0.22712053571428573	data	3.113812036269812	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x77000	0x4b84	0x4c00	a2492825c3d1de75366bed21454b3528	False	0.2866981907894737	data	3.9942440475546364	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7c000	0x3b9c	0x3c00	1ed637208bbcc0435870762eae94c19a	False	0.759375	data	6.709901047445024	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x7718c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.3421985815602837
RT_ICON	0x775f4	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.27704918032786885
RT_ICON	0x77f7c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.23686679174484052
RT_ICON	0x79024	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.22977178423236513
RT_RCDATA	0x7b5cc	0x575	data			1.0078740157480315
RT_GROUP_ICON	0x7bb44	0x3e	data	English	United States	0.8064516129032258

Imports

DLL	Import
KERNEL32.dll	ExpandEnvironmentStringsA, GetLongPathNameW, CopyFileW, GetLocaleInfoA, CreateToolhelp32Snapshot, Process32NextW, Process32FirstW, VirtualProtect, SetLastError, VirtualFree, VirtualAlloc, LoadLibraryA, GetNativeSystemInfo, HeapAlloc, GetProcessHeap, FreeLibrary, IsBadReadPtr, GetTempPathW, OpenProcess, OpenMutexA, lstrcatW, GetCurrentProcessId, GetTempFileNameW, GetSystemDirectoryA, GlobalAlloc, GlobalLock, GetTickCount, GlobalUnlock, WriteProcessMemory, ResumeThread, GetThreadContext, ReadProcessMemory, CreateProcessW, SetThreadContext, LocalAlloc, GlobalFree, MulDiv, SizeofResource, QueryDosDeviceW, FindFirstVolumeW, GetConsoleScreenBufferInfo, SetConsoleTextAttribute, lstrlenW, GetStdHandle, SetFilePointer, FindResourceA, LockResource, LoadResource, LocalFree, FindVolumeClose, GetVolumePathNamesForVolumeNameW, lstrcpyW, SetConsoleOutputCP, FormatMessageA, FindFirstFileA, AllocConsole, lstrcmpW, GetModuleFileNameA, lstrcpynA, QueryPerformanceFrequency, QueryPerformanceCounter, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSection, DeleteCriticalSection, HeapSize, WriteConsoleW, SetStdHandle, SetEnvironmentVariableW, SetEnvironmentVariableA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, GetOEMCP, IsValidCodePage, FindFirstFileExA, HeapReAlloc, ReadConsoleW, GetConsoleMode, GetConsoleCP, FlushFileBuffers, GetFileType, GetTimeZoneInformation, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetTimeFormatW, GetDateFormatW, GetACP, GetModuleHandleExW, MoveFileExW, LoadLibraryExW, RaiseException, RtlUnwind, GetCPInfo, GetStringTypeW, GetLocaleInfoW, LCMapStringW, CompareStringW, MultiByteToWideChar, DecodePointer, EncodePointer, TlsFree, TlsSetValue, GetFileSize, TerminateThread, GetLastError, GetModuleHandleA, RemoveDirectoryW, MoveFileW, SetFilePointerEx, CreateDirectoryW, GetLogicalDriveStringsA, DeleteFileW, FindNextFileA, DeleteFileA, SetFileAttributesW, GetFileAttributesW, FindClose, lstrlenA, GetDriveTypeA, FindNextFileW, GetFileSizeEx, FindFirstFileW, GetModuleHandleW, ExitProcess, GetProcAddress, CreateMutexA, GetCurrentProcess, CreateProcessA, PeekNamedPipe, CreatePipe, TerminateProcess, ReadFile, HeapFree, HeapCreate, CreateEventA, GetLocalTime, CreateThread, SetEvent, CreateEventW, WaitForSingleObject, Sleep, GetModuleFileNameW, CloseHandle, ExitThread, CreateFileW, WriteFile, FindNextVolumeW, TlsGetValue, TlsAlloc, SwitchToThread, WideCharToMultiByte, InitializeSListHead, GetSystemTimeAsFileTime, GetCurrentThreadId, IsProcessorFeaturePresent, GetStartupInfoW, SetUnhandledExceptionFilter, UnhandledExceptionFilter, IsDebuggerPresent, WaitForSingleObjectEx, ResetEvent, InitializeCriticalSectionAndSpinCount, SetEndOfFile
USER32.dll	DefWindowProcA, TranslateMessage, DispatchMessageA, GetMessageA, GetWindowTextW, wsprintfW, GetClipboardData, UnhookWindowsHookEx, GetForegroundWindow, ToUnicodeEx, GetKeyboardLayout, SetWindowsHookExA, CloseClipboard, OpenClipboard, GetKeyboardState, CallNextHookEx, GetKeyboardLayoutNameA, GetKeyState, GetWindowTextLengthW, GetWindowThreadProcessId, SetForegroundWindow, SetClipboardData, EnumWindows, ExitWindowsEx, EmptyClipboard, ShowWindow, SetWindowTextW, MessageBoxW, IsWindowVisible, CreateWindowExA, SendInput, EnumDisplaySettingsW, mouse_event, MapVirtualKeyA, TrackPopupMenu, CreatePopupMenu, AppendMenuA, RegisterClassExA, GetCursorPos, SystemParametersInfoW, GetIconInfo, GetSystemMetrics, CloseWindow, DrawIcon
GDI32.dll	BitBlt, CreateCompatibleBitmap, CreateCompatibleDC, StretchBlt, GetDIBits, DeleteDC, DeleteObject, CreateDCA, GetObjectA, SelectObject
ADVAPI32.dll	LookupPrivilegeValueA, CryptAcquireContextA, CryptGenRandom, CryptReleaseContext, GetUserNameW, RegEnumKeyExA, QueryServiceStatus, CloseServiceHandle, OpenSCManagerW, OpenSCManagerA, ControlService, StartServiceW, QueryServiceConfigW, ChangeServiceConfigW, OpenServiceW, EnumServicesStatusW, AdjustTokenPrivileges, RegDeleteKeyA, OpenProcessToken, RegCreateKeyA, RegCloseKey, RegQueryInfoKeyW, RegQueryValueExA, RegCreateKeyExW, RegEnumKeyExW, RegSetValueExW, RegSetValueExA, RegOpenKeyExA, RegOpenKeyExW, RegCreateKeyW, RegDeleteValueW, RegEnumValueW, RegQueryValueExW
SHELL32.dll	ShellExecuteExA, Shell_NotifyIconA, ExtractIconA, ShellExecuteW
ole32.dll	CoInitializeEx, CoGetObject, CoUninitialize
SHLWAPI.dll	StrToIntA, PathFileExistsW, PathFileExistsA
WINMM.dll	mciSendStringA, mciSendStringW, waveInClose, waveInStop, waveInStart, waveInUnprepareHeader, waveInOpen, waveInAddBuffer, waveInPrepareHeader, PlaySoundW
WS2_32.dll	send, WSAStartup, socket, connect, WSAGetLastError, recv, closesocket, inet_ntoa, htons, htonl, getservbyname, ntohs, getservbyport, gethostbyaddr, inet_addr, WSASetLastError, gethostbyname
urlmon.dll	URLOpenBlockingStreamW, URLDownloadToFileW
gdiplus.dll	GdipAlloc, GdiplusStartup, GdipGetImageEncoders, GdipLoadImageFromStream, GdipSaveImageToStream, GdipGetImageEncodersSize, GdipFree, GdipDisposeImage, GdipCloneImage
WININET.dll	InternetOpenUrlW, InternetOpenW, InternetCloseHandle, InternetReadFile

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-08T16:06:42.258168+0100	2834936	ETPRO MALWARE Observed DNS Query to Abused DDNS (ddnsgeek .com)	1	192.168.2.5	53042	1.1.1.1	53	UDP
2025-01-08T16:06:43.186538+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.5	49705	179.15.136.6	1997	TCP
2025-01-08T16:06:44.528186+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49706	178.237.33.50	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 16:06:42.486702919 CET	49705	1997	192.168.2.5	179.15.136.6
Jan 8, 2025 16:06:42.491616964 CET	1997	49705	179.15.136.6	192.168.2.5
Jan 8, 2025 16:06:42.491741896 CET	49705	1997	192.168.2.5	179.15.136.6
Jan 8, 2025 16:06:42.497592926 CET	49705	1997	192.168.2.5	179.15.136.6
Jan 8, 2025 16:06:42.502542973 CET	1997	49705	179.15.136.6	192.168.2.5
Jan 8, 2025 16:06:43.139400005 CET	1997	49705	179.15.136.6	192.168.2.5
Jan 8, 2025 16:06:43.186537981 CET	49705	1997	192.168.2.5	179.15.136.6
Jan 8, 2025 16:06:43.283458948 CET	1997	49705	179.15.136.6	192.168.2.5
Jan 8, 2025 16:06:43.287899971 CET	49705	1997	192.168.2.5	179.15.136.6
Jan 8, 2025 16:06:43.292690039 CET	1997	49705	179.15.136.6	192.168.2.5
Jan 8, 2025 16:06:43.292769909 CET	49705	1997	192.168.2.5	179.15.136.6
Jan 8, 2025 16:06:43.297583103 CET	1997	49705	179.15.136.6	192.168.2.5
Jan 8, 2025 16:06:43.613594055 CET	1997	49705	179.15.136.6	192.168.2.5
Jan 8, 2025 16:06:43.615358114 CET	49705	1997	192.168.2.5	179.15.136.6
Jan 8, 2025 16:06:43.620157003 CET	1997	49705	179.15.136.6	192.168.2.5
Jan 8, 2025 16:06:43.777409077 CET	1997	49705	179.15.136.6	192.168.2.5
Jan 8, 2025 16:06:43.827285051 CET	49705	1997	192.168.2.5	179.15.136.6
Jan 8, 2025 16:06:43.899719954 CET	49706	80	192.168.2.5	178.237.33.50
Jan 8, 2025 16:06:43.904589891 CET	80	49706	178.237.33.50	192.168.2.5
Jan 8, 2025 16:06:43.904669046 CET	49706	80	192.168.2.5	178.237.33.50
Jan 8, 2025 16:06:43.904781103 CET	49706	80	192.168.2.5	178.237.33.50
Jan 8, 2025 16:06:43.909538031 CET	80	49706	178.237.33.50	192.168.2.5
Jan 8, 2025 16:06:44.528053999 CET	80	49706	178.237.33.50	192.168.2.5
Jan 8, 2025 16:06:44.528186083 CET	49706	80	192.168.2.5	178.237.33.50
Jan 8, 2025 16:06:44.548341990 CET	49705	1997	192.168.2.5	179.15.136.6
Jan 8, 2025 16:06:44.553242922 CET	1997	49705	179.15.136.6	192.168.2.5
Jan 8, 2025 16:06:45.527940989 CET	80	49706	178.237.33.50	192.168.2.5
Jan 8, 2025 16:06:45.528145075 CET	49706	80	192.168.2.5	178.237.33.50
Jan 8, 2025 16:07:08.108933926 CET	1997	49705	179.15.136.6	192.168.2.5
Jan 8, 2025 16:07:08.122256041 CET	49705	1997	192.168.2.5	179.15.136.6
Jan 8, 2025 16:07:08.127245903 CET	1997	49705	179.15.136.6	192.168.2.5
Jan 8, 2025 16:07:38.304604053 CET	1997	49705	179.15.136.6	192.168.2.5
Jan 8, 2025 16:07:38.306225061 CET	49705	1997	192.168.2.5	179.15.136.6
Jan 8, 2025 16:07:38.311053991 CET	1997	49705	179.15.136.6	192.168.2.5
Jan 8, 2025 16:08:08.440021992 CET	1997	49705	179.15.136.6	192.168.2.5
Jan 8, 2025 16:08:08.627506018 CET	49705	1997	192.168.2.5	179.15.136.6
Jan 8, 2025 16:08:08.632360935 CET	1997	49705	179.15.136.6	192.168.2.5
Jan 8, 2025 16:08:33.874387980 CET	49706	80	192.168.2.5	178.237.33.50
Jan 8, 2025 16:08:34.358438969 CET	49706	80	192.168.2.5	178.237.33.50
Jan 8, 2025 16:08:34.967808008 CET	49706	80	192.168.2.5	178.237.33.50
Jan 8, 2025 16:08:36.170949936 CET	49706	80	192.168.2.5	178.237.33.50
Jan 8, 2025 16:08:38.484699965 CET	1997	49705	179.15.136.6	192.168.2.5
Jan 8, 2025 16:08:38.486452103 CET	49705	1997	192.168.2.5	179.15.136.6
Jan 8, 2025 16:08:38.491265059 CET	1997	49705	179.15.136.6	192.168.2.5
Jan 8, 2025 16:08:38.670944929 CET	49706	80	192.168.2.5	178.237.33.50
Jan 8, 2025 16:08:43.670949936 CET	49706	80	192.168.2.5	178.237.33.50
Jan 8, 2025 16:08:53.358459949 CET	49706	80	192.168.2.5	178.237.33.50
Jan 8, 2025 16:09:08.543373108 CET	1997	49705	179.15.136.6	192.168.2.5
Jan 8, 2025 16:09:08.544770956 CET	49705	1997	192.168.2.5	179.15.136.6
Jan 8, 2025 16:09:08.549618006 CET	1997	49705	179.15.136.6	192.168.2.5
Jan 8, 2025 16:09:38.539695024 CET	1997	49705	179.15.136.6	192.168.2.5
Jan 8, 2025 16:09:38.546272039 CET	49705	1997	192.168.2.5	179.15.136.6
Jan 8, 2025 16:09:38.551090956 CET	1997	49705	179.15.136.6	192.168.2.5
Jan 8, 2025 16:10:08.556097031 CET	1997	49705	179.15.136.6	192.168.2.5
Jan 8, 2025 16:10:08.558398008 CET	49705	1997	192.168.2.5	179.15.136.6
Jan 8, 2025 16:10:08.563407898 CET	1997	49705	179.15.136.6	192.168.2.5
Jan 8, 2025 16:10:38.655735016 CET	1997	49705	179.15.136.6	192.168.2.5
Jan 8, 2025 16:10:38.657531977 CET	49705	1997	192.168.2.5	179.15.136.6
Jan 8, 2025 16:10:38.662319899 CET	1997	49705	179.15.136.6	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 16:06:42.258167982 CET	53042	53	192.168.2.5	1.1.1.1
Jan 8, 2025 16:06:42.482961893 CET	53	53042	1.1.1.1	192.168.2.5
Jan 8, 2025 16:06:43.889240026 CET	60948	53	192.168.2.5	1.1.1.1
Jan 8, 2025 16:06:43.896301031 CET	53	60948	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 8, 2025 16:06:42.258167982 CET	192.168.2.5	1.1.1.1	0xe8cc	Standard query (0)	municipioalcidiadechicamocha.ddnsgeek.com	A (IP address)	IN (0x0001)	false
Jan 8, 2025 16:06:43.889240026 CET	192.168.2.5	1.1.1.1	0xb040	Standard query (0)	geoplugin.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 8, 2025 16:06:42.482961893 CET	1.1.1.1	192.168.2.5	0xe8cc	No error (0)	municipioalcidiadechicamocha.ddnsgeek.com		179.15.136.6	A (IP address)	IN (0x0001)	false
Jan 8, 2025 16:06:43.896301031 CET	1.1.1.1	192.168.2.5	0xb040	No error (0)	geoplugin.net		178.237.33.50	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

geoplugin.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	178.237.33.50	80	3128	C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 16:06:43.904781103 CET	71	OUT	GET /json.gp HTTP/1.1 Host: geoplugin.net Cache-Control: no-cache
Jan 8, 2025 16:06:44.528053999 CET	1171	IN	HTTP/1.1 200 OK date: Wed, 08 Jan 2025 15:06:44 GMT server: Apache content-length: 963 content-type: application/json; charset=utf-8 cache-control: public, max-age=300 access-control-allow-origin: * Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 32 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 [TRUNCATED] Data Ascii: { "geoplugin_request":"8.46.123.189", "geoplugin_status":200, "geoplugin_delay":"2ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7123", "geoplugin_longitude":"-74.0068", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}

Analysis Process: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exePID: 3128, Parent PID: 1028

General

Target ID:	0
Start time:	10:06:41
Start date:	08/01/2025
Path:	C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe"
Imagebase:	0x400000
File size:	493'568 bytes
MD5 hash:	388C9D6483CF4532B2C121761895D3C3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.4512357235.000000000229F000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.4512096897.0000000000603000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000000.2054430444.0000000000458000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000000.2054430444.0000000000458000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000000.2054430444.0000000000458000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000000.2054430444.0000000000458000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.4512096897.00000000005BE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exePID: 3128, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	4.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	21.6%
Total number of Nodes:	1395
Total number of Limit Nodes:	67

Executed Functions

Function 0041BEEE Relevance: 115.6, APIs: 40, Strings: 26, Instructions: 140
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Psapi,GetProcessImageFileNameW,?,?,?,?,0040D856), ref: 0041BF03
GetProcAddress.KERNEL32(00000000), ref: 0041BF0C
GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040D856), ref: 0041BF23
GetProcAddress.KERNEL32(00000000), ref: 0041BF26
LoadLibraryA.KERNEL32(shcore,SetProcessDpiAwareness,?,?,?,?,0040D856), ref: 0041BF38
GetProcAddress.KERNEL32(00000000), ref: 0041BF3B
LoadLibraryA.KERNEL32(user32,SetProcessDpiAwareness,?,?,?,?,0040D856), ref: 0041BF4C
GetProcAddress.KERNEL32(00000000), ref: 0041BF4F
LoadLibraryA.KERNEL32(ntdll,NtUnmapViewOfSection,?,?,?,?,0040D856), ref: 0041BF60
GetProcAddress.KERNEL32(00000000), ref: 0041BF63
LoadLibraryA.KERNEL32(kernel32,GlobalMemoryStatusEx,?,?,?,?,0040D856), ref: 0041BF70
GetProcAddress.KERNEL32(00000000), ref: 0041BF73
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040D856), ref: 0041BF80
GetProcAddress.KERNEL32(00000000), ref: 0041BF83
GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040D856), ref: 0041BF90
GetProcAddress.KERNEL32(00000000), ref: 0041BF93
LoadLibraryA.KERNEL32(Shell32,IsUserAnAdmin,?,?,?,?,0040D856), ref: 0041BFA4
GetProcAddress.KERNEL32(00000000), ref: 0041BFA7
GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040D856), ref: 0041BFB4
GetProcAddress.KERNEL32(00000000), ref: 0041BFB7
GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040D856), ref: 0041BFC8
GetProcAddress.KERNEL32(00000000), ref: 0041BFCB
GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040D856), ref: 0041BFDC
GetProcAddress.KERNEL32(00000000), ref: 0041BFDF
GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040D856), ref: 0041BFF0
GetProcAddress.KERNEL32(00000000), ref: 0041BFF3
GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040D856), ref: 0041C000
GetProcAddress.KERNEL32(00000000), ref: 0041C003
LoadLibraryA.KERNEL32(Shlwapi,0000000C,?,?,?,?,0040D856), ref: 0041C011
GetProcAddress.KERNEL32(00000000), ref: 0041C014
LoadLibraryA.KERNEL32(kernel32,GetConsoleWindow,?,?,?,?,0040D856), ref: 0041C021
GetProcAddress.KERNEL32(00000000), ref: 0041C024
GetModuleHandleA.KERNEL32(ntdll,NtSuspendProcess,?,?,?,?,0040D856), ref: 0041C036
GetProcAddress.KERNEL32(00000000), ref: 0041C039
GetModuleHandleA.KERNEL32(ntdll,NtResumeProcess,?,?,?,?,0040D856), ref: 0041C046
GetProcAddress.KERNEL32(00000000), ref: 0041C049
LoadLibraryA.KERNEL32(Iphlpapi,GetExtendedTcpTable,?,?,?,?,0040D856), ref: 0041C05B
GetProcAddress.KERNEL32(00000000), ref: 0041C05E
LoadLibraryA.KERNEL32(Iphlpapi,GetExtendedUdpTable,?,?,?,?,0040D856), ref: 0041C06B
GetProcAddress.KERNEL32(00000000), ref: 0041C06E

Strings

EnumDisplayMonitors, xrefs: 0041BFCD
NtSuspendProcess, xrefs: 0041C026
kernel32, xrefs: 0041BF6A, 0041BF6F, 0041BF7A, 0041BF8A, 0041BFAE, 0041BFFA, 0041C01B
GetExtendedUdpTable, xrefs: 0041C060
SetProcessDEPPolicy, xrefs: 0041BFA9
Kernel32, xrefs: 0041BF1E
SetProcessDpiAwareness, xrefs: 0041BF2D, 0041BF32, 0041BF46
EnumDisplayDevicesW, xrefs: 0041BFB9
IsWow64Process, xrefs: 0041BF75
GetComputerNameExW, xrefs: 0041BF85
Shell32, xrefs: 0041BF9A
NtResumeProcess, xrefs: 0041C03B
user32, xrefs: 0041BF47, 0041BFBE, 0041BFD2, 0041BFE6
ntdll, xrefs: 0041BF5B, 0041C02B, 0041C035, 0041C045
GlobalMemoryStatusEx, xrefs: 0041BF65
shcore, xrefs: 0041BF33
GetMonitorInfoW, xrefs: 0041BFE1
IsUserAnAdmin, xrefs: 0041BF95
GetExtendedTcpTable, xrefs: 0041C04B
NtUnmapViewOfSection, xrefs: 0041BF56
GetProcessImageFileNameW, xrefs: 0041BEF8, 0041BEFD, 0041BF1D
Psapi, xrefs: 0041BEFE
Iphlpapi, xrefs: 0041C050, 0041C05A, 0041C065
Shlwapi, xrefs: 0041C007
GetConsoleWindow, xrefs: 0041C016
GetSystemTimes, xrefs: 0041BFF5

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: EnumDisplayDevicesW$EnumDisplayMonitors$GetComputerNameExW$GetConsoleWindow$GetExtendedTcpTable$GetExtendedUdpTable$GetMonitorInfoW$GetProcessImageFileNameW$GetSystemTimes$GlobalMemoryStatusEx$Iphlpapi$IsUserAnAdmin$IsWow64Process$Kernel32$NtResumeProcess$NtSuspendProcess$NtUnmapViewOfSection$Psapi$SetProcessDEPPolicy$SetProcessDpiAwareness$Shell32$Shlwapi$kernel32$ntdll$shcore$user32
API String ID: 384173800-625181639
Opcode ID: b0b2e61fc073e98d70dce9ef4f7eaaaad63808f39ef958059982ad015adeb2a9
Instruction ID: 91c85bc0cfa8e625a7056272f5779649be84715ca0db9f9d819234a6a75bf275
Opcode Fuzzy Hash: b0b2e61fc073e98d70dce9ef4f7eaaaad63808f39ef958059982ad015adeb2a9
Instruction Fuzzy Hash: 4C31E2A0E8035C7ADB207BB69CC9F3B7E6DD9847953510427B54893190EB7DEC408EAE

Function 0040D83A Relevance: 60.3, APIs: 13, Strings: 21, Instructions: 800
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041BEEE: LoadLibraryA.KERNEL32(Psapi,GetProcessImageFileNameW,?,?,?,?,0040D856), ref: 0041BF03
Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BF0C
Part of subcall function 0041BEEE: GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040D856), ref: 0041BF23
Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BF26
Part of subcall function 0041BEEE: LoadLibraryA.KERNEL32(shcore,SetProcessDpiAwareness,?,?,?,?,0040D856), ref: 0041BF38
Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BF3B
Part of subcall function 0041BEEE: LoadLibraryA.KERNEL32(user32,SetProcessDpiAwareness,?,?,?,?,0040D856), ref: 0041BF4C
Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BF4F
Part of subcall function 0041BEEE: LoadLibraryA.KERNEL32(ntdll,NtUnmapViewOfSection,?,?,?,?,0040D856), ref: 0041BF60
Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BF63
Part of subcall function 0041BEEE: LoadLibraryA.KERNEL32(kernel32,GlobalMemoryStatusEx,?,?,?,?,0040D856), ref: 0041BF70
Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BF73
Part of subcall function 0041BEEE: GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040D856), ref: 0041BF80
Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BF83
Part of subcall function 0041BEEE: GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040D856), ref: 0041BF90
Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BF93
Part of subcall function 0041BEEE: LoadLibraryA.KERNEL32(Shell32,IsUserAnAdmin,?,?,?,?,0040D856), ref: 0041BFA4
Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BFA7
Part of subcall function 0041BEEE: GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040D856), ref: 0041BFB4
Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BFB7
Part of subcall function 0041BEEE: GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040D856), ref: 0041BFC8
Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BFCB
Part of subcall function 0041BEEE: GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040D856), ref: 0041BFDC
Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BFDF
Part of subcall function 0041BEEE: GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040D856), ref: 0041BFF0
Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041BFF3
Part of subcall function 0041BEEE: GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040D856), ref: 0041C000
Part of subcall function 0041BEEE: GetProcAddress.KERNEL32(00000000), ref: 0041C003
Part of subcall function 0041BEEE: LoadLibraryA.KERNEL32(Shlwapi,0000000C,?,?,?,?,0040D856), ref: 0041C011

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe,00000104), ref: 0040D863

Part of subcall function 0040FD92: __EH_prolog.LIBCMT ref: 0040FD97

Strings

Rmc-DCXXDI, xrefs: 0040D97A, 0040D9D7
exepath, xrefs: 0040DD07, 0040DDB1
User, xrefs: 0040E10B
del, xrefs: 0040E167, 0040E1C7
Access Level: , xrefs: 0040E11A
Exe, xrefs: 0040D989
Software\, xrefs: 0040D938
Exe, xrefs: 0040D984
licence, xrefs: 0040DDF8
license_code.txt, xrefs: 0040D8C2
Administrator, xrefs: 0040E0FF
del, xrefs: 0040E14B
PSG, xrefs: 0040DD91
dMG, xrefs: 0040E01B
hSG, xrefs: 0040E097
SG, xrefs: 0040DBDD
PSG, xrefs: 0040DCDA
Remcos Agent initialized, xrefs: 0040DE5F
Inj, xrefs: 0040DA4A, 0040DA61
0TG, xrefs: 0040D9E7
C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, xrefs: 0040D85B, 0040DC84

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: AddressProc$Module$Handle$LibraryLoad$FileH_prologName
String ID: SG$0TG$Access Level: $Administrator$C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe$Exe$Exe$Inj$PSG$PSG$Remcos Agent initialized$Rmc-DCXXDI$Software\$User$dMG$del$del$exepath$hSG$licence$license_code.txt
API String ID: 2830904901-1286219514
Opcode ID: 725633127e4b77860ee352cd58d9fd0f2a9b5a5623a9bf6990050f69c27e9e3b
Instruction ID: b96e9d53b64ce9762df997b7c443b274fb73bccd3fe431706256fac2145036cf
Opcode Fuzzy Hash: 725633127e4b77860ee352cd58d9fd0f2a9b5a5623a9bf6990050f69c27e9e3b
Instruction Fuzzy Hash: 2E32C760B043406ADA14B776DC57BBE259A9F81748F00483FB9467B2E2DEBC9D44C39E

Function 004099E4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 65
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000), ref: 00409A01
SetWindowsHookExA.USER32(0000000D,004099D0,00000000), ref: 00409A0F
GetLastError.KERNEL32 ref: 00409A1B

Part of subcall function 0041A891: GetLocalTime.KERNEL32(00000000), ref: 0041A8AB

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00409A6B
TranslateMessage.USER32(?), ref: 00409A7A
DispatchMessageA.USER32(?), ref: 00409A85

Strings

Keylogger initialization failure: error , xrefs: 00409A32

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Message$DispatchErrorHandleHookLastLocalModuleTimeTranslateWindows
String ID: Keylogger initialization failure: error
API String ID: 3219506041-952744263
Opcode ID: c6ad27a1f32c7b35bd706965db4ad972d695f79b56ef0d389dbfdbb6ef8f6fa1
Instruction ID: 916e88852ed13b3ab14e3660f0b3d121b0d8821096f38c6baae7fa71b0b7a026
Opcode Fuzzy Hash: c6ad27a1f32c7b35bd706965db4ad972d695f79b56ef0d389dbfdbb6ef8f6fa1
Instruction Fuzzy Hash: 6D118271604301AFC710BB7A9C4996B77ECAB94B15B10057EFC45E2191EE34DA01CBAA

Function 0040E627 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 88
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041258F: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 004125AF
Part of subcall function 0041258F: RegQueryValueExA.KERNEL32(?,?,00000000,00000000,00000000,?,00475308), ref: 004125CD
Part of subcall function 0041258F: RegCloseKey.KERNEL32(?), ref: 004125D8

Sleep.KERNEL32(00000BB8), ref: 0040E6DB
ExitProcess.KERNEL32 ref: 0040E74A

Strings

override, xrefs: 0040E64C
6.0.0 Pro, xrefs: 0040E6B6, 0040E723
pth_unenc, xrefs: 0040E63D, 0040E684, 0040E6F1

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: CloseExitOpenProcessQuerySleepValue
String ID: 6.0.0 Pro$override$pth_unenc
API String ID: 2281282204-4012039065
Opcode ID: e48c5bd0e5f8f7b978d8bdbd670fe216713c81f394539d974a824bf7a4ef8053
Instruction ID: 41eca1b412dc6cb4cbd69e66e1420b1d2a9bda06de9f36a729d5cd10817e4b5d
Opcode Fuzzy Hash: e48c5bd0e5f8f7b978d8bdbd670fe216713c81f394539d974a824bf7a4ef8053
Instruction Fuzzy Hash: A821D131F1420027D60876778857B6F399A9B81719F90052EF819A72E7EEBD9E1083DF

Function 00404915 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60
timethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLocalTime.KERNEL32(00000001,00474EE0,004755B0,00000000,?,?,?,?,?,00414F1C,?,00000001), ref: 00404946
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00474EE0,004755B0,00000000,?,?,?,?,?,00414F1C,?,00000001), ref: 00404994
CreateThread.KERNEL32(00000000,00000000,00404B1D,?,00000000,00000000), ref: 004049A7

Strings

KeepAlive | Enabled | Timeout: , xrefs: 0040495C

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Create$EventLocalThreadTime
String ID: KeepAlive | Enabled | Timeout:
API String ID: 2532271599-1507639952
Opcode ID: 3706b51fedfb6b17057c05fa2c189eb69b55955f33b2a26d59dd23dd1e9d912a
Instruction ID: 334fa9fd2124ebc6c4f40b6d461b17bc354faf393a4ed588a06a33f3771f6744
Opcode Fuzzy Hash: 3706b51fedfb6b17057c05fa2c189eb69b55955f33b2a26d59dd23dd1e9d912a
Instruction Fuzzy Hash: 1611E3B19052547ACB10A7BA8849BDB7F9CAB86364F00007FF50462292DA789845CBFA

Function 00432B45 Relevance: 4.5, APIs: 3, Instructions: 30encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,?,00000001,004328CD,00000024,?,?,?), ref: 00432B57
CryptGenRandom.ADVAPI32(?,?,?,?,?,?,?,?,?,0042CDC9,?), ref: 00432B6D
CryptReleaseContext.ADVAPI32(?,00000000,?,?,?,?,?,?,0042CDC9,?), ref: 00432B7F

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID:
API String ID: 1815803762-0
Opcode ID: 35a60dd61fd8b237ab80bed8c3b3b6d5f5cecafcaafe6d2ae27acd69f3d7963f
Instruction ID: 69441ad90531868046e0b1178e1924530c202fcb63ed7aa5228c64bcbe668f15
Opcode Fuzzy Hash: 35a60dd61fd8b237ab80bed8c3b3b6d5f5cecafcaafe6d2ae27acd69f3d7963f
Instruction Fuzzy Hash: ADE09231608350FFFB300F25AC08F177B94EB89B65F21063AF155E40E4CAA59805961C

Function 0041A9AD Relevance: 3.0, APIs: 2, Instructions: 40COMMON

Download Yara Rule

APIs

GetComputerNameExW.KERNEL32(00000001,?,0000002B,004750FC), ref: 0041A9CA
GetUserNameW.ADVAPI32(?,0040E096), ref: 0041A9E2

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Name$ComputerUser
String ID:
API String ID: 4229901323-0
Opcode ID: c38e36c8d41ee46761b6a4ad2d0e2b40601694a6c822a335d006f55048ef3fa5
Instruction ID: dd4171341b6269d20eef4dfb17ad31a68228dcd82fcdc0eb213b330dd994abd5
Opcode Fuzzy Hash: c38e36c8d41ee46761b6a4ad2d0e2b40601694a6c822a335d006f55048ef3fa5
Instruction Fuzzy Hash: 16014F7290011CAADB00EB90DC49ADDBB7CEF44315F10016AB502B3195EFB4AB898A98

Function 0040E751 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000800,0000005A,00000000,00000003,?,?,?,004146BA,00474EE0,00475A38,00474EE0,00000000,00474EE0,?,00474EE0,6.0.0 Pro), ref: 0040E765

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 4f63efff100e8568bd7427ee403b69b99ebb5287ae6166f5ca37386f2dc94b8d
Instruction ID: 426317967f55bc2b8d076a22fb2a8dcf1c85f3a8f112093483d3870effb55d88
Opcode Fuzzy Hash: 4f63efff100e8568bd7427ee403b69b99ebb5287ae6166f5ca37386f2dc94b8d
Instruction Fuzzy Hash: A6D05E607002197BEA109691CC0AE9B7A9CE700B66F000165BA01E72C0E9A0AF048AE1

Function 00426302 Relevance: 1.5, APIs: 1, Instructions: 7networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,?,?), ref: 0042630C

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: e479f6d312995adc38c95d140b7cef8bd4a3583c6482d3884fe68aabfa392038
Instruction ID: 85cd51724732601f8c8003b199973b8832ebbe95acea7078dd2fcbbf2f3153fb
Opcode Fuzzy Hash: e479f6d312995adc38c95d140b7cef8bd4a3583c6482d3884fe68aabfa392038
Instruction Fuzzy Hash: FCB09279118202FFCA051B60CC0887ABEB6ABCC381F108D2DB986A01B0DE37C451AB26

Function 004140AC Relevance: 51.6, APIs: 5, Strings: 24, Instructions: 855
sleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,00000029,00475308,?,00000000), ref: 00414100
WSAGetLastError.WS2_32 ref: 00414321
Sleep.KERNEL32(00000000,00000002), ref: 00414D1A

Part of subcall function 0041A891: GetLocalTime.KERNEL32(00000000), ref: 0041A8AB

Strings

Connecting | , xrefs: 00414298
Connection Error: , xrefs: 00414332
Rmc-DCXXDI, xrefs: 004145ED
hlight, xrefs: 0041451F
Connection Error: Unable to create socket, xrefs: 0041437C
VG, xrefs: 00414695
PhNG, xrefs: 0041456F
| , xrefs: 004142A2, 004143E8
TeF, xrefs: 00414146
6.0.0 Pro, xrefs: 00414689
TLS Off, xrefs: 0041426B, 0041427E
Exe, xrefs: 004145B1
Disconnected, xrefs: 00414C8A
PSG, xrefs: 004144CC
dMG, xrefs: 00414657
name, xrefs: 004144F2
%I64u, xrefs: 00414485
NG, xrefs: 004145A6
hSG, xrefs: 004146BC
NG, xrefs: 004145E4
Connected | , xrefs: 004143E3
TLS On , xrefs: 00414279
], xrefs: 00414230, 0041429D
C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, xrefs: 0041454C

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Sleep$ErrorLastLocalTime
String ID: | $ ]$%I64u$6.0.0 Pro$C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe$Connected | $Connecting | $Connection Error: $Connection Error: Unable to create socket$Disconnected$Exe$PSG$PhNG$Rmc-DCXXDI$TLS Off$TLS On $TeF$dMG$hSG$hlight$name$NG$NG$VG
API String ID: 524882891-2701970350
Opcode ID: 918bc987664b8491f60aceb4f06e3f4d68d9346336c78d86623a22e9571963aa
Instruction ID: c3263a97f07b8ae9d11225c8127e62ab27a72c03ae3a8f764161ebb565a1ac44
Opcode Fuzzy Hash: 918bc987664b8491f60aceb4f06e3f4d68d9346336c78d86623a22e9571963aa
Instruction Fuzzy Hash: EE625E71A001145ACB18F771DDA6AEE73659FA0308F1041BFB80A771E2EF785E85CA9D

Function 0040A3F4 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 158
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__Init_thread_footer.LIBCMT ref: 0040A456
Sleep.KERNEL32(000001F4), ref: 0040A461
GetForegroundWindow.USER32 ref: 0040A467
GetWindowTextLengthW.USER32(00000000), ref: 0040A470
GetWindowTextW.USER32(00000000,00000000,00000000), ref: 0040A4A4
Sleep.KERNEL32(000003E8), ref: 0040A574

Part of subcall function 00409D58: SetEvent.KERNEL32(?,?,?,0040AF3F,?,?,?,?,?,00000000), ref: 00409D84

Strings

], xrefs: 0040A508
<mG, xrefs: 0040A43B
[, xrefs: 0040A50E
minutes }, xrefs: 0040A59F
<mG, xrefs: 0040A4C0
{ User has been idle for , xrefs: 0040A5AB
<mG, xrefs: 0040A4AA

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Window$SleepText$EventForegroundInit_thread_footerLength
String ID: [${ User has been idle for $ minutes }$<mG$<mG$<mG$]
API String ID: 911427763-3636820255
Opcode ID: 0c0e445e6939d6f7940a0c5a45d91b61cd855127d753689433e6956e50b99563
Instruction ID: ab9145b4e211f5f3da3af6290e6e7a2c9d96cae7f6b46a2c86e206227f6ebbf0
Opcode Fuzzy Hash: 0c0e445e6939d6f7940a0c5a45d91b61cd855127d753689433e6956e50b99563
Instruction Fuzzy Hash: 1951D0716043409BC324FB25D886AAE7795AF84718F00093FF446A32E2DF7C9E55868F

Function 0040428C Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 147
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

connect.WS2_32(?,?,?), ref: 004042A5
CreateEventW.KERNEL32(00000000,00000000,00000001,00000000,?,?,?,0040192B), ref: 004043CB
CreateEventW.KERNEL32(00000000,00000000,00000001,00000000,?,?,?,0040192B), ref: 004043D5
WSAGetLastError.WS2_32(?,?,?,0040192B), ref: 004043E7

Part of subcall function 0041A891: GetLocalTime.KERNEL32(00000000), ref: 0041A8AB

Strings

TLS Error 3, xrefs: 0040439D
Connection Failed: , xrefs: 0040440C
TLS Handshake... | , xrefs: 004042C9
TLS Error 2, xrefs: 0040431A
TLS Error 1, xrefs: 004042FC
TLS Authentication Failed, xrefs: 0040435E
Connection Refused, xrefs: 0040443E

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: CreateEvent$ErrorLastLocalTimeconnect
String ID: Connection Failed: $Connection Refused$TLS Authentication Failed$TLS Error 1$TLS Error 2$TLS Error 3$TLS Handshake... |
API String ID: 994465650-2151626615
Opcode ID: cf49c6f555c49f8e19da3bd343099bda81994a7576a786df9d473324a29203c1
Instruction ID: 8d860672b69a19ae3c360ccb47b0a38bc4e99592ce22fc56bfe6acc5d0e7da0a
Opcode Fuzzy Hash: cf49c6f555c49f8e19da3bd343099bda81994a7576a786df9d473324a29203c1
Instruction Fuzzy Hash: D54109B0B0020277CA04B77A884766E7A55AB85314B80012FE901A7AD3FE3DAD2587DF

Function 0040C89E Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLongPathNameW.KERNEL32(00000000,?,00000208), ref: 0040CA04

Strings

UserProfile, xrefs: 0040C9C2
AppData, xrefs: 0040C9BB
ProgramData, xrefs: 0040C9C9
WinDir, xrefs: 0040C905, 0040C927, 0040C979
SystemDrive, xrefs: 0040C8FB
ProgramFiles, xrefs: 0040C9D8
Temp, xrefs: 0040C8D0
\system32, xrefs: 0040C918
\SysWOW64, xrefs: 0040C96A

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: LongNamePath
String ID: AppData$ProgramData$ProgramFiles$SystemDrive$Temp$UserProfile$WinDir$\SysWOW64$\system32
API String ID: 82841172-425784914
Opcode ID: 4c2cb8f42a11c4837a933b64665c4adbebb485c1a13128294ca0300166a406df
Instruction ID: f058a63a2e06dcb2b247864a9289bab0e783a4957c20bc3838a58b63f1508e50
Opcode Fuzzy Hash: 4c2cb8f42a11c4837a933b64665c4adbebb485c1a13128294ca0300166a406df
Instruction Fuzzy Hash: F0415C721482009AC214F721DC97DAFB7A4AE90759F10063FF546720E2EE7CAA59C69F

Function 00409E48 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 163
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00001388), ref: 00409E62

Part of subcall function 00409D97: CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,00409E6F), ref: 00409DCD
Part of subcall function 00409D97: GetFileSize.KERNEL32(00000000,00000000,?,?,?,00409E6F), ref: 00409DDC
Part of subcall function 00409D97: Sleep.KERNEL32(00002710,?,?,?,00409E6F), ref: 00409E09
Part of subcall function 00409D97: CloseHandle.KERNEL32(00000000,?,?,?,00409E6F), ref: 00409E10

CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00409E9E
GetFileAttributesW.KERNEL32(00000000), ref: 00409EAF
SetFileAttributesW.KERNEL32(00000000,00000080), ref: 00409EC6
PathFileExistsW.SHLWAPI(00000000,00000000,00000000,00000012), ref: 00409F40

Part of subcall function 0041B825: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,00000000,00409F65), ref: 0041B83E

SetFileAttributesW.KERNEL32(00000000,00000006,00000013,00466900,?,00000000,00000000,00000000,00000000,00000000), ref: 0040A049

Strings

], xrefs: 00409E83, 00409E93
PSG, xrefs: 00409F19
PSG, xrefs: 00409F24

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: File$AttributesCreate$Sleep$CloseDirectoryExistsHandlePathSize
String ID: PSG$PSG$]
API String ID: 3795512280-3325506286
Opcode ID: 59d6eda1dc5a04f955d13a7f06d1206386346812c1dd96bd75aa56d1c89d0c36
Instruction ID: 2e46ee78bd67d64478951c63fc585b7447d0c94e1b250d5b4a4871e09aa14890
Opcode Fuzzy Hash: 59d6eda1dc5a04f955d13a7f06d1206386346812c1dd96bd75aa56d1c89d0c36
Instruction Fuzzy Hash: 68517F716043005ACB05BB71C866ABF779AAF81309F00453FF886B71E2DE7D9D45C69A

Function 0041A66E Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041B366: GetCurrentProcess.KERNEL32(?,?,?,0040C914,WinDir,00000000,00000000), ref: 0041B377
Part of subcall function 0041B366: IsWow64Process.KERNEL32(00000000,?,?,0040C914,WinDir,00000000,00000000), ref: 0041B37E

Part of subcall function 004125EB: RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 0041260F
Part of subcall function 004125EB: RegQueryValueExA.KERNEL32(?,?,00000000,00000000,?,00000400), ref: 0041262C
Part of subcall function 004125EB: RegCloseKey.KERNEL32(?), ref: 00412637

StrToIntA.SHLWAPI(00000000,0046CC58,?,00000000,00000000,004750FC,00000003,Exe,00000000,0000000E,00000000,0046656C,00000003,00000000), ref: 0041A6E4

Strings

CurrentBuildNumber, xrefs: 0041A6C5
ProductName, xrefs: 0041A67D
(64 bit), xrefs: 0041A711, 0041A71B
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 0041A682, 0041A68C, 0041A6CA
8ZG, xrefs: 0041A69D
(32 bit), xrefs: 0041A70C

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Process$CloseCurrentOpenQueryValueWow64
String ID: (32 bit)$ (64 bit)$8ZG$CurrentBuildNumber$ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 782494840-1475859423
Opcode ID: f7a85f495538476fd04f4c990f04aa920c7271ab473fda262265197c8bc14782
Instruction ID: 1adcdd06a104af508aeef54d465e0c78d2d81651f2e3fe11076ab4bcd17b792f
Opcode Fuzzy Hash: f7a85f495538476fd04f4c990f04aa920c7271ab473fda262265197c8bc14782
Instruction Fuzzy Hash: 1811C660A001012AC704B3A6DCDBDBF765A9B91304F44413FB856A71E2FB6C9D9583EE

Function 0041A726 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0041A749
InternetOpenUrlW.WININET(00000000,http://geoplugin.net/json.gp,00000000,00000000,80000000,00000000), ref: 0041A75F
InternetReadFile.WININET(00000000,00000000,0000FFFF,00000000), ref: 0041A778
InternetCloseHandle.WININET(00000000), ref: 0041A7BE
InternetCloseHandle.WININET(00000000), ref: 0041A7C1

Strings

http://geoplugin.net/json.gp, xrefs: 0041A759

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead
String ID: http://geoplugin.net/json.gp
API String ID: 3121278467-91888290
Opcode ID: d708bf57c9bcdd1f8a7a65ae69f1350cab0609a96e180bb87bda40cc4cda5db0
Instruction ID: dd066ffe0ad47051801ff1a9504fa95a24023bf504f9cdcf24902ddc36d2e50e
Opcode Fuzzy Hash: d708bf57c9bcdd1f8a7a65ae69f1350cab0609a96e180bb87bda40cc4cda5db0
Instruction Fuzzy Hash: C311947110A3126BD624EB169C85DBF7BECEF86765F00043EF845A2191DF68D848C6BA

Function 00409D97 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,00409E6F), ref: 00409DCD
GetFileSize.KERNEL32(00000000,00000000,?,?,?,00409E6F), ref: 00409DDC
Sleep.KERNEL32(00002710,?,?,?,00409E6F), ref: 00409E09
CloseHandle.KERNEL32(00000000,?,?,?,00409E6F), ref: 00409E10

Strings

pQG, xrefs: 00409DC2

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSizeSleep
String ID: pQG
API String ID: 1958988193-3769108836
Opcode ID: 0f98f6b2fa3e8daa10c794e4e90518561bdac5fa53dda9530c93ee6adae91d98
Instruction ID: 007c54a35b5ab6fada7f5b2b4f31fda992404cc28ee9ac254c5285dcec39f6dc
Opcode Fuzzy Hash: 0f98f6b2fa3e8daa10c794e4e90518561bdac5fa53dda9530c93ee6adae91d98
Instruction Fuzzy Hash: 0911E730640B406AE720E724D88972F7B9AAB81316F44047EF18566AE3CA799CD5C29D

Function 004127AA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyA.ADVAPI32(80000001,00000000,?), ref: 004127B9
RegSetValueExA.KERNEL32(?,XwF,00000000,?,00000000,00000000,00475308,?,?,0040E6D3,00467758,6.0.0 Pro), ref: 004127E1
RegCloseKey.KERNEL32(?,?,?,0040E6D3,00467758,6.0.0 Pro), ref: 004127EC

Strings

XwF, xrefs: 004127DB
pth_unenc, xrefs: 004127AE

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID: XwF$pth_unenc
API String ID: 1818849710-1649331827
Opcode ID: a33492682faf8f4a7bd2e45a582a8398943db92faccb4fb8927a7d9da3d413cc
Instruction ID: b42ea712bc7a6ff48bd64609183fdbccf638e423d93a2202917fd6756948167f
Opcode Fuzzy Hash: a33492682faf8f4a7bd2e45a582a8398943db92faccb4fb8927a7d9da3d413cc
Instruction Fuzzy Hash: 27F06D32140204BBCB00AFA1DD45AEF3768EF00751B108169B916B60A1EE759E04EBA4

Function 004098A5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(00000000,00000000,004099A9,?,00000000,00000000), ref: 0040992A
CreateThread.KERNEL32(00000000,00000000,Function_00009993,?,00000000,00000000), ref: 0040993A
CreateThread.KERNEL32(00000000,00000000,Function_000099B5,?,00000000,00000000), ref: 00409946

Part of subcall function 0040A876: GetLocalTime.KERNEL32(?,?,00000000), ref: 0040A884
Part of subcall function 0040A876: wsprintfW.USER32 ref: 0040A905

Strings

Offline Keylogger Started, xrefs: 004098C7, 004098CE, 004098FB

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: CreateThread$LocalTimewsprintf
String ID: Offline Keylogger Started
API String ID: 465354869-4114347211
Opcode ID: 413225cce52aee32b715eff5e13c65a485cf973104212bdc3a05f84c9635596c
Instruction ID: 15e43fcc554e39227c644a0273f32637653ac1eeca6ef832bd6c9a92d0497390
Opcode Fuzzy Hash: 413225cce52aee32b715eff5e13c65a485cf973104212bdc3a05f84c9635596c
Instruction Fuzzy Hash: 0A1198B15003097AD224BA36CC86DBF7A5CDA813A8B40053EB845622D3EA785E14C6FB

Function 004128AD Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31registryCOMMON

Download Yara Rule

APIs

RegCreateKeyA.ADVAPI32(80000001,00000000,TeF), ref: 004128BB
RegSetValueExA.KERNEL32(TeF,000000AF,00000000,00000004,00000001,00000004,?,?,?,0040B94C,004670E0,00000001,000000AF,00466554), ref: 004128D6
RegCloseKey.KERNEL32(?,?,?,?,0040B94C,004670E0,00000001,000000AF,00466554), ref: 004128E1

Strings

TeF, xrefs: 004128B1, 004128D3, 004128B4

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID: TeF
API String ID: 1818849710-331424825
Opcode ID: 69388a3f5ca785ef31159ee28a7932d701a8b17d3c2adace4bd37096d90c6bf5
Instruction ID: 5082c9e4fe043c0a9a82c1e0a3a4def458545ef8caf92c2e29ea1f35f3ad8a86
Opcode Fuzzy Hash: 69388a3f5ca785ef31159ee28a7932d701a8b17d3c2adace4bd37096d90c6bf5
Instruction Fuzzy Hash: C9E03971640308BFDF119B919C05FDB3BA8EB04B95F004165FA05F61A1DAB1DE18EBA8

Function 00404688 Relevance: 6.1, APIs: 4, Instructions: 121synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,00000000,?,00000000,?,?,000000FF,00000000,?,?), ref: 00404778
CreateThread.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 0040478C
WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,00000000,?,?,00000000), ref: 00404797
CloseHandle.KERNEL32(?,?,00000000,00000000,?,?,00000000), ref: 004047A0

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Create$CloseEventHandleObjectSingleThreadWait
String ID:
API String ID: 3360349984-0
Opcode ID: eceb8113e26336935bf5c75f2de3c1b2d8d60dab3ee53c9ce013581b5c88e7f2
Instruction ID: 5371640f48c6a0368c7cea64887978d4ac2a240c02499e3407376e9d4191e8ff
Opcode Fuzzy Hash: eceb8113e26336935bf5c75f2de3c1b2d8d60dab3ee53c9ce013581b5c88e7f2
Instruction Fuzzy Hash: 10417171504301ABC700FB61CC55D7FBBE9AFD5315F00093EF892A32E2EE389909866A

Function 0041B79A Relevance: 6.1, APIs: 4, Instructions: 64fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,00466900,00000000,00000000,0040C267,00000000,00000000,fso.DeleteFile(Wscript.ScriptFullName)), ref: 0041B7D9
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0041B7F6
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0041B80A
CloseHandle.KERNEL32(00000000), ref: 0041B817

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID:
API String ID: 3604237281-0
Opcode ID: 801f75d00fac8da0c66411ebabb5881698d5c73b15829ac97cd3568d121a9cb6
Instruction ID: fca0af3f27241acfb9d15a16a542bc487c24adb9e916811621f81636ea96e045
Opcode Fuzzy Hash: 801f75d00fac8da0c66411ebabb5881698d5c73b15829ac97cd3568d121a9cb6
Instruction Fuzzy Hash: 1501F5712052057FE6105E249CC9EBB739CEB82B75F10063EF662D23C1DB25CC8686B9

Function 00414D2D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?), ref: 00414D52
GetTickCount.KERNEL32 ref: 00414DCE

Strings

NG, xrefs: 00414D81

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: CountEventTick
String ID: NG
API String ID: 180926312-1651712548
Opcode ID: 2dd0ccaeec8dff5bc5cefe6a82063f4aebaa20f84b08a88131a51017049765b7
Instruction ID: 085b2f02be9ab0868ba51c73fb921716b1faa5b055701b3286f453889ed4f7a0
Opcode Fuzzy Hash: 2dd0ccaeec8dff5bc5cefe6a82063f4aebaa20f84b08a88131a51017049765b7
Instruction Fuzzy Hash: C85182321042409AC624FB71D8A2AEF73E5AFD0304F00453FB94A671E2EF789949C69E

Function 0040BED7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000001,00000000,0040DA7D,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E,00000000,0046656C,00000003,00000000), ref: 0040BEE6
GetLastError.KERNEL32 ref: 0040BEF1

Strings

Rmc-DCXXDI, xrefs: 0040BED7

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: CreateErrorLastMutex
String ID: Rmc-DCXXDI
API String ID: 1925916568-2144396903
Opcode ID: a3b1be1148cb3973ecd705bae41f9902d0fcd13797bcadbc01d9bc0dca2f87b2
Instruction ID: 2210f0ff69d3cac9d22e7a3f14049619627ec1602d204fa864a150733b7892bf
Opcode Fuzzy Hash: a3b1be1148cb3973ecd705bae41f9902d0fcd13797bcadbc01d9bc0dca2f87b2
Instruction Fuzzy Hash: B9D012702057009BE70817709D4E76D3951D784703F00407DB90BE51E1CEA488409519

Function 004125EB Relevance: 4.5, APIs: 3, Instructions: 42registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 0041260F
RegQueryValueExA.KERNEL32(?,?,00000000,00000000,?,00000400), ref: 0041262C
RegCloseKey.KERNEL32(?), ref: 00412637

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 3cd3d7d3008c69d15b158efa000f5de0851c37b6ec12a2d5daac047773a23bf0
Instruction ID: 14faf112d3046a25d46051106a5b1d66d342437105d793e51b0bcc882fecfd0c
Opcode Fuzzy Hash: 3cd3d7d3008c69d15b158efa000f5de0851c37b6ec12a2d5daac047773a23bf0
Instruction Fuzzy Hash: D8F0D176900118BBCB209B91DD09EDF7B7CEB44B50F00406ABA05F2190DA749E599BA8

Function 00412735 Relevance: 4.5, APIs: 3, Instructions: 41registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,00000000,00475308), ref: 00412751
RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,00000208,?), ref: 0041276A
RegCloseKey.KERNEL32(00000000), ref: 00412775

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 2290404c5028f19351fda844a65f428930317fa0cea8d3593e6495ca7ac6aa60
Instruction ID: 218a6bf298efa18a53fa985214dbde7e418f837aa6fd6996b0f70a828ecfe766
Opcode Fuzzy Hash: 2290404c5028f19351fda844a65f428930317fa0cea8d3593e6495ca7ac6aa60
Instruction Fuzzy Hash: 6501AD35800229BFDF215F91DC09DDF7F38EF05760F004065BA08A20A0EB3589A9DBA4

Function 0041258F Relevance: 4.5, APIs: 3, Instructions: 38registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 004125AF
RegQueryValueExA.KERNEL32(?,?,00000000,00000000,00000000,?,00475308), ref: 004125CD
RegCloseKey.KERNEL32(?), ref: 004125D8

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: f2bc15ec1dd87dd5d2b8e96f704feec537dddf8cd8f352820b88cb246238aa27
Instruction ID: f1b1b21d3432ee16d2560aa6e8f8b6fc3b679f7482eced78fea8614e15db81c1
Opcode Fuzzy Hash: f2bc15ec1dd87dd5d2b8e96f704feec537dddf8cd8f352820b88cb246238aa27
Instruction Fuzzy Hash: B4F03075A00208BFDF119FA09C45FDEBBB8EB04B55F104065FA05F6191D670DA54DB94

Function 00412546 Relevance: 4.5, APIs: 3, Instructions: 32registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?,00000000,?,?,0040B996,004670E0), ref: 0041255D
RegQueryValueExA.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,0040B996,004670E0), ref: 00412571
RegCloseKey.KERNEL32(?,?,?,0040B996,004670E0), ref: 0041257C

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 90b816baf6681459c689896bd7ee7621983de5913a9f55156db5b466bfdb1e74
Instruction ID: da5e3a6b8615f7fc9763e362b131f946d251b316bd2acc507b7b22157b73f9fc
Opcode Fuzzy Hash: 90b816baf6681459c689896bd7ee7621983de5913a9f55156db5b466bfdb1e74
Instruction Fuzzy Hash: 1BE03931941224BB9B200BA29D09EDB7F6DEF06BA1B010455B809A2111DAA18E54EAF4

Function 00409517 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00409531

Strings

], xrefs: 00409561

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: _wcslen
String ID: ]
API String ID: 176396367-1876980090
Opcode ID: 025e3e4768cc8a802bf55c327d7a2483ad7764abdea9560a4cc63c803d4be503
Instruction ID: 7b719d08391bbb12b01dd12fa1e9474f3c31e37c6e717f7fed2b29792a4b3228
Opcode Fuzzy Hash: 025e3e4768cc8a802bf55c327d7a2483ad7764abdea9560a4cc63c803d4be503
Instruction Fuzzy Hash: B71193329002059BCB05FF66D8529EE77A4EF54319B10443FF842662E2EF78A915CB98

Function 0041AB50 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?), ref: 0041AB64

Strings

@, xrefs: 0041AB5A

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: GlobalMemoryStatus
String ID: @
API String ID: 1890195054-2766056989
Opcode ID: a4fe8e15525f2be1febd29730eb74c732a6063ed027868c332be47892e1af589
Instruction ID: b665d68c061e3f9f56ba9c4249da2251c097319f67e9030db6e937b6cf7da2fa
Opcode Fuzzy Hash: a4fe8e15525f2be1febd29730eb74c732a6063ed027868c332be47892e1af589
Instruction Fuzzy Hash: 00D067B59013189FCB20DFA8E945A8DBBF8EB48214F004529E946E3744E774E945CB94

Function 0044BBCE Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0044BBEF

Part of subcall function 00446D0F: RtlAllocateHeap.NTDLL(00000000,00434613,?,?,00437437,?,?,?,?,?,0040CD5A,00434613,?,?,?,?), ref: 00446D41

RtlReAllocateHeap.NTDLL(00000000,00476D58,?,00000004,00000000,?,0044EB1A,00476D58,00000004,?,00476D58,?,?,00443335,00476D58,?), ref: 0044BC2B

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: AllocateHeap$_free
String ID:
API String ID: 1482568997-0
Opcode ID: c663a77da406be6e54bbe5e4694e400583292b09c8c587c623d78d47e3d5e62a
Instruction ID: 767aa377775814b37deb1c17d78f1b9627af84273febb40deea43816b68d1426
Opcode Fuzzy Hash: c663a77da406be6e54bbe5e4694e400583292b09c8c587c623d78d47e3d5e62a
Instruction Fuzzy Hash: D3F0C23160051166FB212A679C81F6B2B59CF82B74B15402FF805AA691DF3CD841A1ED

Function 004041F1 Relevance: 3.0, APIs: 2, Instructions: 40networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(?,00000001,00000006), ref: 00404212

Part of subcall function 00404262: WSAStartup.WS2_32(00000202,00000000), ref: 00404277

CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 00404252

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: CreateEventStartupsocket
String ID:
API String ID: 1953588214-0
Opcode ID: 9dcc25316a99288ac387cf2e613c868b0e107fead0b532e7680f1acbcbd447ec
Instruction ID: e62a462d4859cb901c95814de100b0ae44c334504336dc08fc7633b5118be932
Opcode Fuzzy Hash: 9dcc25316a99288ac387cf2e613c868b0e107fead0b532e7680f1acbcbd447ec
Instruction Fuzzy Hash: 100171B0508B809FD7358F38B8456977FE0AB15314F044DAEF1D697BA1C7B5A481CB18

Function 00433818 Relevance: 3.0, APIs: 2, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00433FF2

Part of subcall function 00437DE7: RaiseException.KERNEL32(?,?,00434621,?,?,?,?,?,?,?,?,00434621,?,0046E654,0041AF80,?), ref: 00437E47

__CxxThrowException@8.LIBVCRUNTIME ref: 0043400F

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID:
API String ID: 3476068407-0
Opcode ID: 2f8450b131b2c7cae6b2994a14d2746b0b5bc3d5d5124e6b0ed98aed2215fcc2
Instruction ID: 1c2073f64fee591a786a8a3f9c67cac18272885bad9296719f7a79fda1cbf913
Opcode Fuzzy Hash: 2f8450b131b2c7cae6b2994a14d2746b0b5bc3d5d5124e6b0ed98aed2215fcc2
Instruction Fuzzy Hash: 1BF0BB25C0430D768B04BEA6E80A9AD33BC5E08329F50513BB825914D1FB7C9759C5CD

Function 0041AE5D Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0041AE7F
GetWindowTextW.USER32(00000000,?,00000100), ref: 0041AE92

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Window$ForegroundText
String ID:
API String ID: 29597999-0
Opcode ID: 27a61dc13c3baf2ab93a997f5cd2cb0d43e4b22d1e77ef92c0de48519faa66db
Instruction ID: 7a6786a6daea7d79da8b38e9164549a295f8c3929764bf887eb2819544a3ffc0
Opcode Fuzzy Hash: 27a61dc13c3baf2ab93a997f5cd2cb0d43e4b22d1e77ef92c0de48519faa66db
Instruction Fuzzy Hash: 4AE04875A0031867FB20B7659C4EFD6766C9704B05F0400ADB619E21C3EDB4EA048BE4

Function 00414072 Relevance: 3.0, APIs: 2, Instructions: 21networkCOMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(00000000,00000000,00000000,00472B28,004750FC,00000000,00414318,00000000,00000001), ref: 00414094
WSASetLastError.WS2_32(00000000), ref: 00414099

Part of subcall function 00413F0F: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00413F5E
Part of subcall function 00413F0F: LoadLibraryA.KERNEL32(?), ref: 00413FA0
Part of subcall function 00413F0F: GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00413FC0
Part of subcall function 00413F0F: FreeLibrary.KERNEL32(00000000), ref: 00413FC7
Part of subcall function 00413F0F: LoadLibraryA.KERNEL32(?), ref: 00413FFF
Part of subcall function 00413F0F: GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414011
Part of subcall function 00413F0F: FreeLibrary.KERNEL32(00000000), ref: 00414018
Part of subcall function 00413F0F: GetProcAddress.KERNEL32(00000000,?), ref: 00414027

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Library$AddressProc$FreeLoad$DirectoryErrorLastSystemgetaddrinfo
String ID:
API String ID: 1170566393-0
Opcode ID: 82e440812e84df215c52e3f2a247b94cffd3b5d9bcffb41726cfdd66b840233f
Instruction ID: e2cb8cd332084910a557c38b5932e5372e8318120e5bc29c0191cd414ba32ecd
Opcode Fuzzy Hash: 82e440812e84df215c52e3f2a247b94cffd3b5d9bcffb41726cfdd66b840233f
Instruction Fuzzy Hash: F4D012326406216B93506B6D5D01EBB5AEDDF96761B06003BF508D6111DA946C4142A8

Function 00446D0F Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00434613,?,?,00437437,?,?,?,?,?,0040CD5A,00434613,?,?,?,?), ref: 00446D41

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0df71086ebe011a22fdff847967a9c5229befe104b2723ee1c4cd472e7f23894
Instruction ID: 40638bbf90b8c7646580dfe44e72c34c865d7c07d7b9b06d8b79509a7ad90776
Opcode Fuzzy Hash: 0df71086ebe011a22fdff847967a9c5229befe104b2723ee1c4cd472e7f23894
Instruction Fuzzy Hash: 52E0E5B1B00220A6FB202A6A8C02B5B36498F437B4F070033AC0A9A291CE6CCC4081AF

Function 00404262 Relevance: 1.5, APIs: 1, Instructions: 15networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,00000000), ref: 00404277

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: 512c305c5d81d862cf08042479f934390d4c65f7aad148c3c3ac63496dcf4775
Instruction ID: a6df37c1a3c4b0bfee4e794801b63ea3b6ec8424062e123ecf3ffc10766d7ffb
Opcode Fuzzy Hash: 512c305c5d81d862cf08042479f934390d4c65f7aad148c3c3ac63496dcf4775
Instruction Fuzzy Hash: F7D012325586094ED620AAB5AD0F8A4775CD317611F0003BA6CB5825D3FA84561CC6AB

Function 00426319 Relevance: 1.5, APIs: 1, Instructions: 7networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,?), ref: 00426323

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 733b60b5868be77d00c88bb6e02a93299a3caf11162c6b1e2887e039244bfe1f
Instruction ID: aaa3dbc129b5069e484ee587900df28e469ef685d0a3e158187009c9450646dc
Opcode Fuzzy Hash: 733b60b5868be77d00c88bb6e02a93299a3caf11162c6b1e2887e039244bfe1f
Instruction Fuzzy Hash: 30B09279118302BFCA051B60CC0887A7EB6ABC9381B108C2CB546611B0DE37C490EB36

Non-executed Functions

Function 00406F06 Relevance: 48.1, APIs: 10, Strings: 17, Instructions: 849filesleepCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?), ref: 00406F28
GetFileAttributesW.KERNEL32(00000000,00000000,00000000), ref: 00406FF8
DeleteFileW.KERNEL32(00000000), ref: 00407018

Part of subcall function 0041B63A: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,004752F0,00475308), ref: 0041B694
Part of subcall function 0041B63A: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,004752F0,00475308), ref: 0041B6C6
Part of subcall function 0041B63A: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,?,004752F0,00475308), ref: 0041B717
Part of subcall function 0041B63A: FindClose.KERNEL32(00000000,?,?,?,?,?,?,004752F0,00475308), ref: 0041B76C
Part of subcall function 0041B63A: RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,?,004752F0,00475308), ref: 0041B773

Part of subcall function 00404468: send.WS2_32(000002FC,00000000,00000000,00000000), ref: 004044FD

Part of subcall function 00406BE9: CreateFileW.KERNEL32(00000000,00000004,00000000,00000000,00000002,00000080,00000000,00466454,?,?,00000000,00407273,00000000,?,0000000A,00000000), ref: 00406C38
Part of subcall function 00406BE9: WriteFile.KERNEL32(00000000,?,00000000,?,00000000,?,000186A0,?,?,?,00000000,00407273,00000000,?,0000000A,00000000), ref: 00406C80
Part of subcall function 00406BE9: CloseHandle.KERNEL32(00000000,?,?,00000000,00407273,00000000,?,0000000A,00000000,00000000), ref: 00406CC0
Part of subcall function 00406BE9: MoveFileW.KERNEL32(00000000,00000000), ref: 00406CDD

Part of subcall function 0041A891: GetLocalTime.KERNEL32(00000000), ref: 0041A8AB

Part of subcall function 00404468: WaitForSingleObject.KERNEL32(00000330,00000000,{NAL,?,?,00000004,?,?,00000004,00474EE0,004755B0,00000000), ref: 0040450E
Part of subcall function 00404468: SetEvent.KERNEL32(00000330,?,?,00000004,?,?,00000004,00474EE0,004755B0,00000000,?,?,?,?,?,00414E7B), ref: 0040453C

ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00407416
GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 004074F5
SetFileAttributesW.KERNEL32(00000000,?,00000000,00000001), ref: 0040773A
DeleteFileA.KERNEL32(?), ref: 004078CC

Part of subcall function 00407A8C: __EH_prolog.LIBCMT ref: 00407A91
Part of subcall function 00407A8C: FindFirstFileW.KERNEL32(00000000,?,00466AA0,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00407B4A
Part of subcall function 00407A8C: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00407B6E

Sleep.KERNEL32(000007D0), ref: 00407976
StrToIntA.SHLWAPI(00000000,00000000), ref: 004079BA

Part of subcall function 0041BD82: SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 0041BE77

Strings

Downloading file: , xrefs: 004071F3
Downloaded file: , xrefs: 004072A8
VNG, xrefs: 004071C6
Unable to rename file!, xrefs: 0040768F
Executing file: , xrefs: 0040742F
@PG, xrefs: 00407473
open, xrefs: 00407410
NG, xrefs: 00406F54
pPG, xrefs: 0040705B
pPG, xrefs: 00407563
TdF, xrefs: 00407202
pPG, xrefs: 00407998
Unable to delete: , xrefs: 00407078
Browsing directory: , xrefs: 004074B6
pPG, xrefs: 004076A6
Deleted file: , xrefs: 0040703A
Failed to download file: , xrefs: 00407321

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: File$Find$AttributesCloseDeleteDirectoryEventFirstNextRemove$CreateDriveExecuteH_prologHandleInfoLocalLogicalMoveObjectParametersShellSingleSleepStringsSystemTimeWaitWritesend
String ID: @PG$Browsing directory: $Deleted file: $Downloaded file: $Downloading file: $Executing file: $Failed to download file: $TdF$Unable to delete: $Unable to rename file!$VNG$open$pPG$pPG$pPG$pPG$NG
API String ID: 2918587301-2537973685
Opcode ID: 8c9b85b3cc5fd76c67877238ae870cf5e1538384d5724b3e5923403a166763a5
Instruction ID: 1d2e2627ec10ef381271a766c0004beadc8049fa085ae304c46d09a1b017b010
Opcode Fuzzy Hash: 8c9b85b3cc5fd76c67877238ae870cf5e1538384d5724b3e5923403a166763a5
Instruction Fuzzy Hash: 0F42A271A043005BC614FB76C8979AE76A59F90708F40493FF946771E2EE3CAA09C6DB

Function 00405042 Relevance: 47.5, APIs: 15, Strings: 12, Instructions: 280pipesleepfileCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0040508E

Part of subcall function 004336DA: EnterCriticalSection.KERNEL32(00471D18,00476D54,?,0040AEAC,00476D54,00456FA7,?,00000000,00000000), ref: 004336E4
Part of subcall function 004336DA: LeaveCriticalSection.KERNEL32(00471D18,?,0040AEAC,00476D54,00456FA7,?,00000000,00000000), ref: 00433717

Part of subcall function 00404468: send.WS2_32(000002FC,00000000,00000000,00000000), ref: 004044FD

__Init_thread_footer.LIBCMT ref: 004050CB
CreatePipe.KERNEL32(00476D14,00476CFC,00476C20,00000000,0046656C,00000000), ref: 0040515E
CreatePipe.KERNEL32(00476D00,00476D1C,00476C20,00000000), ref: 00405174
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00476C30,00476D04), ref: 004051E7

Part of subcall function 00433724: EnterCriticalSection.KERNEL32(00471D18,?,00476D54,?,0040AE8B,00476D54,?,00000000,00000000), ref: 0043372F
Part of subcall function 00433724: LeaveCriticalSection.KERNEL32(00471D18,?,0040AE8B,00476D54,?,00000000,00000000), ref: 0043376C

Sleep.KERNEL32(0000012C,00000093,?), ref: 0040523F
PeekNamedPipe.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00405264
ReadFile.KERNEL32(00000000,?,?,00000000), ref: 00405291

Part of subcall function 00433AB0: __onexit.LIBCMT ref: 00433AB6

WriteFile.KERNEL32(00000000,00000000,?,00000000,00474F90,00466570,00000062,00466554), ref: 0040538E
Sleep.KERNEL32(00000064,00000062,00466554), ref: 004053A8
TerminateProcess.KERNEL32(00000000), ref: 004053C1
CloseHandle.KERNEL32 ref: 004053CD
CloseHandle.KERNEL32 ref: 004053D5
CloseHandle.KERNEL32 ref: 004053E7
CloseHandle.KERNEL32 ref: 004053EF

Strings

lG, xrefs: 00405133
SystemDrive, xrefs: 00405109
xlG, xrefs: 00405332
xlG, xrefs: 004052FE
mG, xrefs: 00405114
cmd.exe, xrefs: 004050F5
xlG, xrefs: 004053D7
xlG, xrefs: 00405202
mG, xrefs: 004050B5
0lG, xrefs: 00405183
mG, xrefs: 004051A9
xlG, xrefs: 00405078

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: CloseCriticalHandleSection$CreatePipe$EnterFileInit_thread_footerLeaveProcessSleep$NamedPeekReadTerminateWrite__onexitsend
String ID: lG$ mG$ mG$ mG$0lG$SystemDrive$cmd.exe$xlG$xlG$xlG$xlG$xlG
API String ID: 3815868655-3731297122
Opcode ID: 68d87144457253b08b549f4ac4b550c69573f0e79a638d518ea1dc6d308e707a
Instruction ID: f3d75f47542da312923ddfb9c6ddab2c5323933c8a72fe1ed5abf95ef94fff6a
Opcode Fuzzy Hash: 68d87144457253b08b549f4ac4b550c69573f0e79a638d518ea1dc6d308e707a
Instruction Fuzzy Hash: 3491C571600605AFC610BB65ED42A6F3BAAEB84344F01443FF949A22E2DF7D9C448F6D

Function 0041100E Relevance: 33.5, APIs: 7, Strings: 12, Instructions: 238threadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0041101D

Part of subcall function 004128AD: RegCreateKeyA.ADVAPI32(80000001,00000000,TeF), ref: 004128BB
Part of subcall function 004128AD: RegSetValueExA.KERNEL32(TeF,000000AF,00000000,00000004,00000001,00000004,?,?,?,0040B94C,004670E0,00000001,000000AF,00466554), ref: 004128D6
Part of subcall function 004128AD: RegCloseKey.KERNEL32(?,?,?,?,0040B94C,004670E0,00000001,000000AF,00466554), ref: 004128E1

OpenMutexA.KERNEL32(00100000,00000000,00000000), ref: 00411059
CreateThread.KERNEL32(00000000,00000000,0041170F,00000000,00000000,00000000), ref: 004110BE

Part of subcall function 0041258F: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 004125AF
Part of subcall function 0041258F: RegQueryValueExA.KERNEL32(?,?,00000000,00000000,00000000,?,00475308), ref: 004125CD
Part of subcall function 0041258F: RegCloseKey.KERNEL32(?), ref: 004125D8

CloseHandle.KERNEL32(00000000), ref: 00411068

Part of subcall function 0041A891: GetLocalTime.KERNEL32(00000000), ref: 0041A8AB

OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 00411332

Strings

Remcos restarted by watchdog!, xrefs: 00411073
fsutil.exe, xrefs: 00411222
\system32\, xrefs: 0041111C
\SysWOW64\, xrefs: 00411174
Watchdog launch failed!, xrefs: 00411296
WinDir, xrefs: 0041112E, 00411183
TdF, xrefs: 00411080
rmclient.exe, xrefs: 004111FD
WDH, xrefs: 004110C8, 004110CE, 00411338
Watchdog module activated, xrefs: 00411097, 004112E8
svchost.exe, xrefs: 004111D8
0TG, xrefs: 00411046

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: CloseOpen$CreateProcessValue$CurrentHandleLocalMutexQueryThreadTime
String ID: 0TG$Remcos restarted by watchdog!$TdF$WDH$Watchdog launch failed!$Watchdog module activated$WinDir$\SysWOW64\$\system32\$fsutil.exe$rmclient.exe$svchost.exe
API String ID: 65172268-4169584339
Opcode ID: 372d1b824043999fb3ea61122839910be527bab052fefb095489169812ad4faf
Instruction ID: de889ccbd4d484bbc366ed6bf297281231fcf4352047712fae5372da0dd81bf3
Opcode Fuzzy Hash: 372d1b824043999fb3ea61122839910be527bab052fefb095489169812ad4faf
Instruction Fuzzy Hash: 3D717E3160420157C214FB72CC579AE77A8AF94719F40053FF986A21E2EF7C9A49C6AF

Function 0040B335 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 145fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040B3B4
FindClose.KERNEL32(00000000), ref: 0040B3CE
FindNextFileA.KERNEL32(00000000,?), ref: 0040B4F1
FindClose.KERNEL32(00000000), ref: 0040B517

Strings

\key3.db, xrefs: 0040B47B
\AppData\Roaming\Mozilla\Firefox\Profiles\, xrefs: 0040B357
UserProfile, xrefs: 0040B365
[Firefox StoredLogins not found], xrefs: 0040B3D9
[Firefox StoredLogins Cleared!], xrefs: 0040B504
\logins.json, xrefs: 0040B439

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Find$CloseFile$FirstNext
String ID: [Firefox StoredLogins Cleared!]$[Firefox StoredLogins not found]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\key3.db$\logins.json
API String ID: 1164774033-3681987949
Opcode ID: 6c2aa191b7658a53db036245a9cdec4fec9e324b839b32eec9595b3f4300475a
Instruction ID: 4260ee55bd24f38cfaff6d718e7bb7aae0563b8f0cd35122f003610daf392ab1
Opcode Fuzzy Hash: 6c2aa191b7658a53db036245a9cdec4fec9e324b839b32eec9595b3f4300475a
Instruction Fuzzy Hash: 0A510B319042195ADB14F7A2DC96AEE7764EF50318F50017FF806B30E2EF789A45CA9D

Function 0040B53A Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 130fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040B5B2
FindClose.KERNEL32(00000000), ref: 0040B5CC
FindNextFileA.KERNEL32(00000000,?), ref: 0040B68C
FindClose.KERNEL32(00000000), ref: 0040B6B2
FindClose.KERNEL32(00000000), ref: 0040B6D1

Strings

\AppData\Roaming\Mozilla\Firefox\Profiles\, xrefs: 0040B555
UserProfile, xrefs: 0040B563
\cookies.sqlite, xrefs: 0040B62F
[Firefox cookies found, cleared!], xrefs: 0040B6E0
[Firefox Cookies not found], xrefs: 0040B5D7, 0040B69F

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Find$Close$File$FirstNext
String ID: [Firefox Cookies not found]$[Firefox cookies found, cleared!]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\cookies.sqlite
API String ID: 3527384056-432212279
Opcode ID: c29a3aa1853b92e95312d94e519dd42d8e7ed5a614533796f0446510dfd501b9
Instruction ID: 1e8de758c2b97f43aed4804fc6a56dd8ce4d3e4bc3adeefe5a602588f19c01c2
Opcode Fuzzy Hash: c29a3aa1853b92e95312d94e519dd42d8e7ed5a614533796f0446510dfd501b9
Instruction Fuzzy Hash: F4412C319042196ACB14F7A5EC569EE7768EE11318F50017FF802B31E2EF399A458A9E

Function 00415B5E Relevance: 18.1, APIs: 12, Instructions: 80clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00415B5F
EmptyClipboard.USER32 ref: 00415B6D
GlobalAlloc.KERNEL32(00002000,-00000002), ref: 00415B8D
GlobalLock.KERNEL32(00000000), ref: 00415B96
GlobalUnlock.KERNEL32(00000000), ref: 00415BCC
SetClipboardData.USER32(0000000D,00000000), ref: 00415BD5
CloseClipboard.USER32 ref: 00415BF2
OpenClipboard.USER32 ref: 00415BF9
GetClipboardData.USER32(0000000D), ref: 00415C09
GlobalLock.KERNEL32(00000000), ref: 00415C12
GlobalUnlock.KERNEL32(00000000), ref: 00415C1B
CloseClipboard.USER32 ref: 00415C21

Part of subcall function 00404468: send.WS2_32(000002FC,00000000,00000000,00000000), ref: 004044FD

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Clipboard$Global$CloseDataLockOpenUnlock$AllocEmptysend
String ID:
API String ID: 3520204547-0
Opcode ID: b6601ed24abfed9cf7fe240a2c5566a7417a315aa523f1e37220b92a7528f2ec
Instruction ID: a6dc46a1ac747b1df6f49b20b287b9a63e2ec98da8de7deae82efe0a0170cbcd
Opcode Fuzzy Hash: b6601ed24abfed9cf7fe240a2c5566a7417a315aa523f1e37220b92a7528f2ec
Instruction Fuzzy Hash: A82137711047009BC714BBB1DC5AAAF7669AF94B06F00443FF907A61E2EF38C945C76A

Function 0040E2F1 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 212processCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,?,?,004750FC), ref: 0040E30B
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,004750FC), ref: 0040E336
Process32FirstW.KERNEL32(00000000,0000022C), ref: 0040E352
Process32NextW.KERNEL32(00000000,0000022C), ref: 0040E3D5
CloseHandle.KERNEL32(00000000,?,?,004750FC), ref: 0040E3E4

Part of subcall function 004128AD: RegCreateKeyA.ADVAPI32(80000001,00000000,TeF), ref: 004128BB
Part of subcall function 004128AD: RegSetValueExA.KERNEL32(TeF,000000AF,00000000,00000004,00000001,00000004,?,?,?,0040B94C,004670E0,00000001,000000AF,00466554), ref: 004128D6
Part of subcall function 004128AD: RegCloseKey.KERNEL32(?,?,?,?,0040B94C,004670E0,00000001,000000AF,00466554), ref: 004128E1

CloseHandle.KERNEL32(00000000,?,?,004750FC), ref: 0040E449

Strings

ieinstal.exe, xrefs: 0040E4AE
ielowutil.exe, xrefs: 0040E4EF
C:\Program Files(x86)\Internet Explorer\, xrefs: 0040E497
Inj, xrefs: 0040E5ED

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Close$CreateHandleProcess32$FileFirstModuleNameNextSnapshotToolhelp32Value
String ID: C:\Program Files(x86)\Internet Explorer\$Inj$ieinstal.exe$ielowutil.exe
API String ID: 726551946-1743721670
Opcode ID: fe7551fdfbdcf3ebe62b75ae427e45e4e23c61079ab323ff6510b1fdea246979
Instruction ID: 57de327b15d82dbd2eac346b6cac6cdabb084366653080b34320caf9a24139d1
Opcode Fuzzy Hash: fe7551fdfbdcf3ebe62b75ae427e45e4e23c61079ab323ff6510b1fdea246979
Instruction Fuzzy Hash: A17150311043419BC714FB62D8529AFB7A5AFD1358F400D3EF986631E2EF389919CA9A

Function 0044804A Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 370timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 004480CC
_free.LIBCMT ref: 004480F0
_free.LIBCMT ref: 00448277
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045E478), ref: 00448289
WideCharToMultiByte.KERNEL32(00000000,00000000,0047279C,000000FF,00000000,0000003F,00000000,?,?), ref: 00448301
WideCharToMultiByte.KERNEL32(00000000,00000000,004727F0,000000FF,?,0000003F,00000000,?), ref: 0044832E
_free.LIBCMT ref: 00448443

Strings

xE, xrefs: 00448232, 00448238
xE, xrefs: 004483A6

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID: xE$xE
API String ID: 314583886-1741595589
Opcode ID: d596b97672170a59560d370264e130457457ea9fa8a9b0ba60a97bf2640f5a79
Instruction ID: 53eab31d398634ed2913b9f897b2f59caf849b5b19a8cc02276c673e3ebcc531
Opcode Fuzzy Hash: d596b97672170a59560d370264e130457457ea9fa8a9b0ba60a97bf2640f5a79
Instruction Fuzzy Hash: 24C14731904205ABFB249F698D81AAF7BB8EF41310F2441AFE88497351EF798E42C75C

Function 0041894A Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 197COMMON

Download Yara Rule

Strings

1, xrefs: 004189AC
3, xrefs: 00418A6C
6, xrefs: 00418B2B
7, xrefs: 00418B42
2, xrefs: 00418A0C
0, xrefs: 00418973
5, xrefs: 00418B21
4, xrefs: 00418AD0

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID:
String ID: 0$1$2$3$4$5$6$7
API String ID: 0-3177665633
Opcode ID: 52b676760061c84767d297b93dc47341045c93b1f976ba96d1747faf8790e9a2
Instruction ID: a206eb20bee8e87b23b85030021c48398d73e585fead2f4b7fd4ae1d02439eb2
Opcode Fuzzy Hash: 52b676760061c84767d297b93dc47341045c93b1f976ba96d1747faf8790e9a2
Instruction Fuzzy Hash: EA61D5B4108301AEDB00EF21C862FEA77E4AF95750F44485EF591672E2DF78AA48C797

Function 00409B10 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 108keyboardthreadCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00475108), ref: 00409B3F
GetWindowThreadProcessId.USER32(00000000,?), ref: 00409B4B
GetKeyboardLayout.USER32(00000000), ref: 00409B52
GetKeyState.USER32(00000010), ref: 00409B5C
GetKeyboardState.USER32(?,?,00475108), ref: 00409B67
ToUnicodeEx.USER32(0047515C,00000000,?,?,00000010,00000000,00000000), ref: 00409B8A
ToUnicodeEx.USER32(?,?,00000010,00000000,00000000), ref: 00409BE3
ToUnicodeEx.USER32(0047515C,?,?,?,00000010,00000000,00000000), ref: 00409C1C

Strings

`kG, xrefs: 00409BFD

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Unicode$KeyboardStateWindow$ForegroundLayoutProcessThread
String ID: `kG
API String ID: 1888522110-3643241581
Opcode ID: c97b305c4e5192c039be4b57959f7d148ad44e176559ca20096398a0f42faa8b
Instruction ID: 5852d3e9e60d78bbc7fecef5f6baa999b7b2ba0a9f64a262714a670a3ee03c46
Opcode Fuzzy Hash: c97b305c4e5192c039be4b57959f7d148ad44e176559ca20096398a0f42faa8b
Instruction Fuzzy Hash: 3B318F72504308AFD700DF91DC45FDBB7ECEB88715F01083AB645D61A1DBB5E9488B9A

Function 00406764 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 55COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00406788
CoGetObject.OLE32(?,00000024,004669B0,00000000), ref: 004067E9

Strings

[+] ucmAllocateElevatedObject, xrefs: 0040676F
[-] CoGetObject FAILURE, xrefs: 004067F1, 00406800
{3E5FC7F9-9A51-4367-9063-A120244FBEC7}, xrefs: 0040677D, 00406782, 004067C1
$, xrefs: 004067A2
[+] CoGetObject SUCCESS, xrefs: 004067F8
Elevation:Administrator!new:, xrefs: 004067A9
[+] CoGetObject, xrefs: 004067C8

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Object_wcslen
String ID: $$Elevation:Administrator!new:$[+] CoGetObject$[+] CoGetObject SUCCESS$[+] ucmAllocateElevatedObject$[-] CoGetObject FAILURE${3E5FC7F9-9A51-4367-9063-A120244FBEC7}
API String ID: 240030777-3166923314
Opcode ID: 37d5bffcbb8f4b2cbb961f9636bb3800fd08e5c8d40d037755d6192962cbe9cf
Instruction ID: 6c9b37094527eb08cc4748ecdfbd23cbc672ad5faa28133fe458ce4522bc368c
Opcode Fuzzy Hash: 37d5bffcbb8f4b2cbb961f9636bb3800fd08e5c8d40d037755d6192962cbe9cf
Instruction Fuzzy Hash: B11133B29011186ADB10FAA58955A9E77BCDB48714F11047FF905F3281E77C9A0486BD

Function 00419AB8 Relevance: 15.2, APIs: 10, Instructions: 228serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,00000004,00475920), ref: 00419ACE
EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,?,00000000,?,?,?), ref: 00419B1D
GetLastError.KERNEL32 ref: 00419B2B
EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,00000000,?,?,?,?), ref: 00419B63

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: EnumServicesStatus$ErrorLastManagerOpen
String ID:
API String ID: 3587775597-0
Opcode ID: b6999ea4fecf3263421b7913bbd2d185f7a70e8b7a5c33fd228c391ba2809cc5
Instruction ID: 410433f0f292194423399e5208e7b63ee2478b974df0930e3a7ace9da88798fe
Opcode Fuzzy Hash: b6999ea4fecf3263421b7913bbd2d185f7a70e8b7a5c33fd228c391ba2809cc5
Instruction Fuzzy Hash: C28142311043049BC314FB21DC95DAFB7A8BF94718F50492EF582621D2EF78EA09CB9A

Function 0041B63A Relevance: 13.6, APIs: 9, Instructions: 105fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,004752F0,00475308), ref: 0041B694
FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,004752F0,00475308), ref: 0041B6C6
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,?,004752F0,00475308), ref: 0041B734
DeleteFileW.KERNEL32(?,?,?,?,?,?,?,004752F0,00475308), ref: 0041B741

Part of subcall function 0041B63A: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,?,004752F0,00475308), ref: 0041B717

FindClose.KERNEL32(00000000,?,?,?,?,?,?,004752F0,00475308), ref: 0041B76C
RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,?,004752F0,00475308), ref: 0041B773
GetLastError.KERNEL32(?,?,?,?,?,?,004752F0,00475308), ref: 0041B77B
FindClose.KERNEL32(00000000,?,?,?,?,?,?,004752F0,00475308), ref: 0041B78E

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: FileFind$CloseDirectoryRemove$AttributesDeleteErrorFirstLastNext
String ID:
API String ID: 2341273852-0
Opcode ID: 29d361786a175de539fdf9d753c964fcdbe74632238a9f507c15aa3fc292f646
Instruction ID: 009c1ade3c0c7cd9a9baeecb78710ce3116f293085b5e5d3e47bbce280e6f24a
Opcode Fuzzy Hash: 29d361786a175de539fdf9d753c964fcdbe74632238a9f507c15aa3fc292f646
Instruction Fuzzy Hash: 2931937180521CAACB20E7B19C89FDA777CAF55304F0404EBF515E2181EF799AC4CB69

Function 0041301D Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 391registrylibraryloaderCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 004130F2
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000001), ref: 004130FE

Part of subcall function 00404468: send.WS2_32(000002FC,00000000,00000000,00000000), ref: 004044FD

LoadLibraryA.KERNEL32(Shlwapi.dll,SHDeleteKeyW,00000000,00000001), ref: 004132C5
GetProcAddress.KERNEL32(00000000), ref: 004132CC

Strings

SHDeleteKeyW, xrefs: 004132BB
Shlwapi.dll, xrefs: 004132C0

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: AddressCloseCreateLibraryLoadProcsend
String ID: SHDeleteKeyW$Shlwapi.dll
API String ID: 2127411465-314212984
Opcode ID: f9d3c1334e6b58d2f1d69f0e1f1c65ab6f379f9836b455ed853577fe27a59fe1
Instruction ID: 0508f95716d3db9771c6b78d28bd3d55684df0f5bc265fe56362dad8d88080f3
Opcode Fuzzy Hash: f9d3c1334e6b58d2f1d69f0e1f1c65ab6f379f9836b455ed853577fe27a59fe1
Instruction Fuzzy Hash: CEB1A371A043006BC614FA76CC979BE76695F9471CF40063FF846B31E2EE7C9A48869B

Function 00418E5F Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 245fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?), ref: 004190B5
FindNextFileW.KERNEL32(00000000,?,?), ref: 00419181

Part of subcall function 0041B825: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,00000000,00409F65), ref: 0041B83E

Strings

NG, xrefs: 00418E8F
PSG, xrefs: 00418F55
VG, xrefs: 00418EE8
VG, xrefs: 00419094

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: File$Find$CreateFirstNext
String ID: PSG$NG$VG$VG
API String ID: 341183262-216422830
Opcode ID: 83c192f71006e540b44aec1a451125091b4ed41390244d5e4dd7200b9adb984b
Instruction ID: 0b04574543ffaf1c42473f802d0f517b04b5d48d9dde9d4f65c428d20583ff9f
Opcode Fuzzy Hash: 83c192f71006e540b44aec1a451125091b4ed41390244d5e4dd7200b9adb984b
Instruction Fuzzy Hash: AF8150315042405AC314FB71C8A6EEF73A8AFD0718F50493FF946671E2EF389A49C69A

Function 004515C7 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004470CF: GetLastError.KERNEL32(?,?,0043952C,?,00000000,?,0043BB65,00000000,00000000), ref: 004470D3
Part of subcall function 004470CF: _free.LIBCMT ref: 00447106
Part of subcall function 004470CF: SetLastError.KERNEL32(00000000,00000000,00000000), ref: 00447147
Part of subcall function 004470CF: _abort.LIBCMT ref: 0044714D

Part of subcall function 004470CF: _free.LIBCMT ref: 0044712E
Part of subcall function 004470CF: SetLastError.KERNEL32(00000000,00000000,00000000), ref: 0044713B

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 004516D3
IsValidCodePage.KERNEL32(00000000), ref: 0045172E
IsValidLocale.KERNEL32(?,00000001), ref: 0045173D
GetLocaleInfoW.KERNEL32(?,00001001,00443EFC,00000040,?,0044401C,00000055,00000000,?,?,00000055,00000000), ref: 00451785
GetLocaleInfoW.KERNEL32(?,00001002,00443F7C,00000040), ref: 004517A4

Strings

(E, xrefs: 00451680

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
String ID: (E
API String ID: 745075371-542121585
Opcode ID: a84efe1a2cce186fb5bbf2749623e7c2965abdb2206941bc4280497163ca2dcb
Instruction ID: 0c55cced660072bbdea70b00f38c40adf5ab32faa3293abc4b1f14fb3cf6f882
Opcode Fuzzy Hash: a84efe1a2cce186fb5bbf2749623e7c2965abdb2206941bc4280497163ca2dcb
Instruction Fuzzy Hash: EB5193719002059BDB10EFA5CC41BBF77B8AF04706F18056BFD11EB262DB789949CB69

Function 0040B21B Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 48fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Login Data), ref: 0040B257
GetLastError.KERNEL32 ref: 0040B261

Strings

UserProfile, xrefs: 0040B227
[Chrome StoredLogins found, cleared!], xrefs: 0040B287
[Chrome StoredLogins not found], xrefs: 0040B27B
\AppData\Local\Google\Chrome\User Data\Default\Login Data, xrefs: 0040B222

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: DeleteErrorFileLast
String ID: [Chrome StoredLogins found, cleared!]$[Chrome StoredLogins not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Login Data
API String ID: 2018770650-1062637481
Opcode ID: 485085ca9485ae7de43c789173eb7e4eeafaf3e498a45dc593bc2edb8373611b
Instruction ID: af3d5975f8ef5736f4e1f689bc2271043fd855ebe8bb8600121af3fad6928989
Opcode Fuzzy Hash: 485085ca9485ae7de43c789173eb7e4eeafaf3e498a45dc593bc2edb8373611b
Instruction Fuzzy Hash: 5C01D63168010597CA0476B6DC6F8AF3B24E921708B10017FF802731E2FF3A9905C6DE

Function 00416C9D Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 00416CAA
OpenProcessToken.ADVAPI32(00000000), ref: 00416CB1
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00416CC3
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00416CE2
GetLastError.KERNEL32 ref: 00416CE8

Strings

SeShutdownPrivilege, xrefs: 00416CBD

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
String ID: SeShutdownPrivilege
API String ID: 3534403312-3733053543
Opcode ID: 594fceb9dcf720018193b7af68db4771e8a957862718425d2e1bf0ede3cec24e
Instruction ID: cb90277d3e2bb8506008076be0b211c0c8a285b816e0fe18bd298ac82c07c5c8
Opcode Fuzzy Hash: 594fceb9dcf720018193b7af68db4771e8a957862718425d2e1bf0ede3cec24e
Instruction Fuzzy Hash: EEF0DA75901229BBDB109B91DC4DEEF7EBCEF05656F110065B805B20A2DE748A08CAA5

Function 00453110 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00453256

Strings

1#QNAN, xrefs: 0045445C
1#IND, xrefs: 0045444E
1#SNAN, xrefs: 00454455
1#INF, xrefs: 00454463

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 1bf5a653629e57a1f7b5c3ded9cb374cb4a646758b38e4d76f229b2a49b28d64
Instruction ID: c7cd0fe6fb368e325f13a714a82e3d7b4865f9b831a19f2b9b664dd372279c0a
Opcode Fuzzy Hash: 1bf5a653629e57a1f7b5c3ded9cb374cb4a646758b38e4d76f229b2a49b28d64
Instruction Fuzzy Hash: 58C27171D046288FDB25CE28DD407EAB3B5EB84346F1541EBD84DE7242E778AE898F44

Function 004089A9 Relevance: 9.3, APIs: 6, Instructions: 288fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004089AE

Part of subcall function 004041F1: socket.WS2_32(?,00000001,00000006), ref: 00404212

Part of subcall function 0040428C: connect.WS2_32(?,?,?), ref: 004042A5

FindFirstFileW.KERNEL32(00000000,?,?,?,00000064), ref: 00408A8D
FindNextFileW.KERNEL32(00000000,?), ref: 00408AE0
FindClose.KERNEL32(000000FF,?,?,?,?,?,?), ref: 00408AF7

Part of subcall function 00404468: WaitForSingleObject.KERNEL32(00000330,00000000,{NAL,?,?,00000004,?,?,00000004,00474EE0,004755B0,00000000), ref: 0040450E
Part of subcall function 00404468: SetEvent.KERNEL32(00000330,?,?,00000004,?,?,00000004,00474EE0,004755B0,00000000,?,?,?,?,?,00414E7B), ref: 0040453C

Part of subcall function 004047EB: WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,00404B8E,?,?,?,00404B26), ref: 004047FD
Part of subcall function 004047EB: SetEvent.KERNEL32(?,?,?,?,00000000,?,00404B8E,?,?,?,00404B26), ref: 00404808
Part of subcall function 004047EB: CloseHandle.KERNEL32(?,?,?,?,00000000,?,00404B8E,?,?,?,00404B26), ref: 00404811

__CxxThrowException@8.LIBVCRUNTIME ref: 00408DA1

Part of subcall function 00404468: send.WS2_32(000002FC,00000000,00000000,00000000), ref: 004044FD

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Find$CloseEventFileObjectSingleWait$Exception@8FirstH_prologHandleNextThrowconnectsendsocket
String ID:
API String ID: 4043647387-0
Opcode ID: e8707b4ec4f65b3daa3568d955911baa256536beff12142bcc10b341d26decda
Instruction ID: d6647de2ed81915fd1100427b9b1f0ab8477674b12134c2b00fdd843198b9521
Opcode Fuzzy Hash: e8707b4ec4f65b3daa3568d955911baa256536beff12142bcc10b341d26decda
Instruction Fuzzy Hash: 0DA16E719001089BCB14EBA1DD92AEDB779AF54318F10427FF506B71D2EF385E498B98

Function 00419DBA Relevance: 9.0, APIs: 6, Instructions: 39serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000010,00000000,?,?,00419A10,00000000,00000000), ref: 00419DC3
OpenServiceW.ADVAPI32(00000000,00000000,00000010,?,?,00419A10,00000000,00000000), ref: 00419DD8
CloseServiceHandle.ADVAPI32(00000000,?,?,00419A10,00000000,00000000), ref: 00419DE5
StartServiceW.ADVAPI32(00000000,00000000,00000000,?,?,00419A10,00000000,00000000), ref: 00419DF0
CloseServiceHandle.ADVAPI32(00000000,?,?,00419A10,00000000,00000000), ref: 00419E02
CloseServiceHandle.ADVAPI32(00000000,?,?,00419A10,00000000,00000000), ref: 00419E05

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ManagerStart
String ID:
API String ID: 276877138-0
Opcode ID: cfc7b607e36d21359a02d5afcedae3f84f405620953c8a7715537af6fd2295c5
Instruction ID: bfab90d9ddd5c2d56401b7e15998ac1c6a079cb4321381bf248b2ffa9e014974
Opcode Fuzzy Hash: cfc7b607e36d21359a02d5afcedae3f84f405620953c8a7715537af6fd2295c5
Instruction Fuzzy Hash: 60F0E9715403146FD2115B31EC88DBF2A6CDF85BB2B01002EF442A3191CF78CD4995B5

Function 00450C8F Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 236COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004470CF: GetLastError.KERNEL32(?,?,0043952C,?,00000000,?,0043BB65,00000000,00000000), ref: 004470D3
Part of subcall function 004470CF: _free.LIBCMT ref: 00447106
Part of subcall function 004470CF: SetLastError.KERNEL32(00000000,00000000,00000000), ref: 00447147
Part of subcall function 004470CF: _abort.LIBCMT ref: 0044714D

IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00443F03,?,?,?,?,?,?,00000004), ref: 00450D71
_wcschr.LIBVCRUNTIME ref: 00450E01
_wcschr.LIBVCRUNTIME ref: 00450E0F
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,00443F03,00000000,00444023), ref: 00450EB2

Strings

(E, xrefs: 00450D02

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_abort_free
String ID: (E
API String ID: 4212172061-542121585
Opcode ID: 59e7985f3c02f7c10489d8edf0480172058bbcb387fbadea5ac0dcfc1ce8ddaa
Instruction ID: 16e6850baad922d2e300dda2121b2fdf61a8ef58a3873fa5b3432b878cecddba
Opcode Fuzzy Hash: 59e7985f3c02f7c10489d8edf0480172058bbcb387fbadea5ac0dcfc1ce8ddaa
Instruction Fuzzy Hash: A361FC7A500306AAD725AB75CC42ABB73A8EF44316F14082FFD05D7243EB78E949C769

Function 00415A51 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 97libraryloadershutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00416C9D: GetCurrentProcess.KERNEL32(00000028,?), ref: 00416CAA
Part of subcall function 00416C9D: OpenProcessToken.ADVAPI32(00000000), ref: 00416CB1
Part of subcall function 00416C9D: LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00416CC3
Part of subcall function 00416C9D: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00416CE2
Part of subcall function 00416C9D: GetLastError.KERNEL32 ref: 00416CE8

ExitWindowsEx.USER32(00000000,00000001), ref: 00415AF3
LoadLibraryA.KERNEL32(PowrProf.dll,SetSuspendState,00000000,00000000,00000000), ref: 00415B08
GetProcAddress.KERNEL32(00000000), ref: 00415B0F

Strings

SetSuspendState, xrefs: 00415AFE
PowrProf.dll, xrefs: 00415B03

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: ProcessToken$AddressAdjustCurrentErrorExitLastLibraryLoadLookupOpenPrivilegePrivilegesProcValueWindows
String ID: PowrProf.dll$SetSuspendState
API String ID: 1589313981-1420736420
Opcode ID: e283aed8030f222677e32f677a5842ddb3918d5861ff5db7f0a7df2b8037313d
Instruction ID: be3657bdb4b9c596b700244bf1edaf45c421fe256a6f88bebcc25452880e9c8a
Opcode Fuzzy Hash: e283aed8030f222677e32f677a5842ddb3918d5861ff5db7f0a7df2b8037313d
Instruction Fuzzy Hash: 84215E71644741A6CB14FBB198A6AFF22599F80748F40483FB442771D2EF7CE889865E

Function 004513F3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(FDE8FE81,2000000B,00000000,00000002,00000000,?,?,?,00451712,?,00000000), ref: 0045148C
GetLocaleInfoW.KERNEL32(FDE8FE81,20001004,00000000,00000002,00000000,?,?,?,00451712,?,00000000), ref: 004514B5
GetACP.KERNEL32(?,?,00451712,?,00000000), ref: 004514CA

Strings

OCP, xrefs: 00451447
ACP, xrefs: 00451411

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 7de529321666405c3dbd177549b20e94864b34fdb637d578d31b634f87125a95
Instruction ID: 27270ea0035267e4249f05f4639a08e7e92d7e6a6a5113c6df6fa5280cb26525
Opcode Fuzzy Hash: 7de529321666405c3dbd177549b20e94864b34fdb637d578d31b634f87125a95
Instruction Fuzzy Hash: 0821C731600100B7DB308F54C901FA773A6AF52B67F5A9566EC0AD7223EB3ADD49C399

Function 0041A84A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(SETTINGS,0000000A,00000000), ref: 0041A85B
LoadResource.KERNEL32(00000000,?,?,0040E25B,00000000), ref: 0041A86F
LockResource.KERNEL32(00000000,?,?,0040E25B,00000000), ref: 0041A876
SizeofResource.KERNEL32(00000000,?,?,0040E25B,00000000), ref: 0041A885

Strings

SETTINGS, xrefs: 0041A84E

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Resource$FindLoadLockSizeof
String ID: SETTINGS
API String ID: 3473537107-594951305
Opcode ID: af91fd7a50235684c3f0857021386823e2c7131a01440ecb0520647964aa65c6
Instruction ID: 1fe06f9b0c9a023904624b9b61caa7bd4c13f92b8b5c35c0d543cfa28092256f
Opcode Fuzzy Hash: af91fd7a50235684c3f0857021386823e2c7131a01440ecb0520647964aa65c6
Instruction Fuzzy Hash: DAE01A76240720ABCB211BA1BD4CD073E39F7867637000039F549A2221CE75CC52CB29

Function 00407A8C Relevance: 7.7, APIs: 5, Instructions: 183fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00407A91
FindFirstFileW.KERNEL32(00000000,?,00466AA0,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00407B4A
FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00407B6E
FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00407C76

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstH_prologNext
String ID:
API String ID: 1157919129-0
Opcode ID: 44beeb7efd5a27b9ae6b5ed8b1b3fbc2cf3811c381e0606dcb53b55a88831ffb
Instruction ID: e1cc7e471fba1e38487cd482a49156f4879f85d64aa43a49cb1f79655cfb0c65
Opcode Fuzzy Hash: 44beeb7efd5a27b9ae6b5ed8b1b3fbc2cf3811c381e0606dcb53b55a88831ffb
Instruction Fuzzy Hash: 325162729001085ACB14FBA5DD969ED7B78AF50318F50417FB806B31D2EF3CAB498B99

Function 00406128 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 222filenetworkCOMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00406234
URLDownloadToFileW.URLMON(00000000,00000000,00000004,00000000,00000000), ref: 00406318

Strings

open, xrefs: 0040622E
C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, xrefs: 0040627F, 004063A7

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: DownloadExecuteFileShell
String ID: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe$open
API String ID: 2825088817-1264904375
Opcode ID: ad4cd8f0b1742ba2f271eadf04a78ea359f7dd7c98a1af5993a1802d316398a1
Instruction ID: e32f65eb076a11421f0b28df520d432f118a03887cfea0ef8c7e4d0a3f62d172
Opcode Fuzzy Hash: ad4cd8f0b1742ba2f271eadf04a78ea359f7dd7c98a1af5993a1802d316398a1
Instruction Fuzzy Hash: E361CF3160430067CA14FA76D8569BE37A59F81718F01493FBC46772E6EF3CAA05C69B

Function 00406AC2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 86fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,?,?,00000000), ref: 00406ADD
FindNextFileW.KERNEL32(00000000,?,?,?,00000000), ref: 00406BA5

Part of subcall function 00404468: send.WS2_32(000002FC,00000000,00000000,00000000), ref: 004044FD

Strings

pPG, xrefs: 00406BC0
pPG, xrefs: 00406AFD

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: FileFind$FirstNextsend
String ID: pPG$pPG
API String ID: 4113138495-3204143781
Opcode ID: 04cbaa432c918a42c53807cd0f2a3c10c6dd4e32f952d56d9836a960f393f504
Instruction ID: b94dab712156e78be0f8cc3bef15d45c6a114b58aade1ae888b20ae253cfdc5a
Opcode Fuzzy Hash: 04cbaa432c918a42c53807cd0f2a3c10c6dd4e32f952d56d9836a960f393f504
Instruction Fuzzy Hash: F42187715043015BC714FB61DC95DEF77A8AF90318F40093EF996A31E1EF38AA08CA9A

Function 0041BD82 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 83COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 0041BE77

Part of subcall function 004127AA: RegCreateKeyA.ADVAPI32(80000001,00000000,?), ref: 004127B9
Part of subcall function 004127AA: RegSetValueExA.KERNEL32(?,XwF,00000000,?,00000000,00000000,00475308,?,?,0040E6D3,00467758,6.0.0 Pro), ref: 004127E1
Part of subcall function 004127AA: RegCloseKey.KERNEL32(?,?,?,0040E6D3,00467758,6.0.0 Pro), ref: 004127EC

Strings

TileWallpaper, xrefs: 0041BE61
WallpaperStyle, xrefs: 0041BDC2, 0041BDF5, 0041BE45
Control Panel\Desktop, xrefs: 0041BDBD, 0041BDF0, 0041BE40

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: CloseCreateInfoParametersSystemValue
String ID: Control Panel\Desktop$TileWallpaper$WallpaperStyle
API String ID: 4127273184-3576401099
Opcode ID: 6c22d536f9cf41db2e3193d33a149bd53ec698417932bdd12186eb798744da75
Instruction ID: 3b74369dcb7a8544f1b55df16a592c3d868ba554001bd6a4c71ed5c97b6fc17b
Opcode Fuzzy Hash: 6c22d536f9cf41db2e3193d33a149bd53ec698417932bdd12186eb798744da75
Instruction Fuzzy Hash: F5112132B8035033D518313A5E67BBF2816D34AB60F55415FB6066A6CAFADE4AA103DF

Function 00408DA7 Relevance: 6.2, APIs: 4, Instructions: 206fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00408DAC
FindFirstFileW.KERNEL32(00000000,?), ref: 00408E24
FindNextFileW.KERNEL32(00000000,?), ref: 00408E4D

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: FileFind$FirstH_prologNext
String ID:
API String ID: 301083792-0
Opcode ID: 51940071d9f0d9280fa3336faee050b72c9abacde1575dd18f02a12ebdfc1b05
Instruction ID: 402ed7a5658d2f2a6adb961a0daa6f616ba37c5e7974c2bf040f6c8ce137202a
Opcode Fuzzy Hash: 51940071d9f0d9280fa3336faee050b72c9abacde1575dd18f02a12ebdfc1b05
Instruction Fuzzy Hash: 127141728001199BCB15EBA1DC919EE7778AF54314F10427FE846B71E2EF385E49CB98

Function 0045107A Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 004470CF: GetLastError.KERNEL32(?,?,0043952C,?,00000000,?,0043BB65,00000000,00000000), ref: 004470D3
Part of subcall function 004470CF: _free.LIBCMT ref: 00447106
Part of subcall function 004470CF: SetLastError.KERNEL32(00000000,00000000,00000000), ref: 00447147
Part of subcall function 004470CF: _abort.LIBCMT ref: 0044714D

Part of subcall function 004470CF: _free.LIBCMT ref: 0044712E
Part of subcall function 004470CF: SetLastError.KERNEL32(00000000,00000000,00000000), ref: 0044713B

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004510CE
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0045111F
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004511DF

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: ErrorInfoLastLocale$_free$_abort
String ID:
API String ID: 2829624132-0
Opcode ID: dd837d4aabf90151236531eaa8a7eeaa8db7e820d6096a7a5c305d7033fab590
Instruction ID: aee342ac21436657f5846041838c3bd09d84a4d920a4c2a145562aed062da8a9
Opcode Fuzzy Hash: dd837d4aabf90151236531eaa8a7eeaa8db7e820d6096a7a5c305d7033fab590
Instruction Fuzzy Hash: F661D8719005079BDB289F25CC82B7677A8EF04306F1041BBFD05D66A2EB78D949DB58

Function 0043A86D Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,0000000A), ref: 0043A965
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,0000000A), ref: 0043A96F
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,0000000A), ref: 0043A97C

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: af6e046c0509c32b3386d0bc76265e00dd1467fe013a3816057f721e951f2d82
Instruction ID: 2e36d9e0b5662236be867d7d52d6a22dc3a0b47d07fc7de068387a758ceea7c7
Opcode Fuzzy Hash: af6e046c0509c32b3386d0bc76265e00dd1467fe013a3816057f721e951f2d82
Instruction Fuzzy Hash: E731D6B491131CABCB21DF24D98978DB7B8BF08311F5051EAE80CA7251EB749F818F49

Function 00442764 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,0044273A,?,0046EAF0,0000000C,00442891,?,00000002,00000000), ref: 00442785
TerminateProcess.KERNEL32(00000000,?,0044273A,?,0046EAF0,0000000C,00442891,?,00000002,00000000), ref: 0044278C
ExitProcess.KERNEL32 ref: 0044279E

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 580307e7f9ed19ccdf9c10412063d8ea8bc62da0884c48fe7532ae208af4f440
Instruction ID: c8bd48e99420b6c7b8697c64d03bd4ba31791432aa3bec6fd876c0c539ce8582
Opcode Fuzzy Hash: 580307e7f9ed19ccdf9c10412063d8ea8bc62da0884c48fe7532ae208af4f440
Instruction Fuzzy Hash: 7EE04F31000704AFEF016F10DD099493F29EF50396F448469F90896132CF79DC42CA48

Function 0041AECC Relevance: 4.5, APIs: 3, Instructions: 19nativeCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000800,00000000,00000000,?,?,0041525B,00000000), ref: 0041AED7
NtSuspendProcess.NTDLL(00000000), ref: 0041AEE4
CloseHandle.KERNEL32(00000000,?,?,0041525B,00000000), ref: 0041AEED

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Process$CloseHandleOpenSuspend
String ID:
API String ID: 1999457699-0
Opcode ID: 3b5e723eaf058cf4912863f44fffedc3e3ae8a4bfc071aeb07fd662f2e304fa3
Instruction ID: cbdad53ed629db76d40e0897fbdb217e77766e02faa6d5bf56048ccc5fb15ac5
Opcode Fuzzy Hash: 3b5e723eaf058cf4912863f44fffedc3e3ae8a4bfc071aeb07fd662f2e304fa3
Instruction Fuzzy Hash: 80D05E32500222638220176A7C0D997EE68DBC1AB2702416AF404D22219E30C88186A9

Function 0041AEF8 Relevance: 4.5, APIs: 3, Instructions: 19nativeCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000800,00000000,00000000,?,?,00415280,00000000), ref: 0041AF03
NtResumeProcess.NTDLL(00000000), ref: 0041AF10
CloseHandle.KERNEL32(00000000,?,?,00415280,00000000), ref: 0041AF19

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Process$CloseHandleOpenResume
String ID:
API String ID: 3614150671-0
Opcode ID: 6d31317880465a65d63f867429a7c123c2a1788788c54349cbb6221ea43f3537
Instruction ID: 5834692e6dbfc7302e0627ffd9745f57241b902771746b5adb28784224297b78
Opcode Fuzzy Hash: 6d31317880465a65d63f867429a7c123c2a1788788c54349cbb6221ea43f3537
Instruction Fuzzy Hash: 7CD05E32504121638220176A6C0D997ED68DBC5AB3702422AF504D22219E30C881C6A8

Function 0044D7F9 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

., xrefs: 0044D98C

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 90d0b4729825bd90b6a9b0e481f721cabe6d10aefd9ef70f2d231800c5ca14c4
Instruction ID: eafca5d3f29716c6c78e4e4ea3ad02361a474eaab44c7f235df41bcab4a95e78
Opcode Fuzzy Hash: 90d0b4729825bd90b6a9b0e481f721cabe6d10aefd9ef70f2d231800c5ca14c4
Instruction Fuzzy Hash: 3431F472D00249ABEB249E79CC85EFB7BBDDB85314F0401AEF419D7251E6349E418B54

Function 004477A7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,?,?,00000004), ref: 004477FA

Strings

GetLocaleInfoEx, xrefs: 004477B8, 004477C2

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 6bd799bfac9af36fd133eb5d72b5b36b41e76e7aabeb18fd4f2c376b7933ddb9
Instruction ID: 58a0a1dc03b065be57d87c6409a63545e464c60cfee5b8c381720ea1698dad41
Opcode Fuzzy Hash: 6bd799bfac9af36fd133eb5d72b5b36b41e76e7aabeb18fd4f2c376b7933ddb9
Instruction Fuzzy Hash: A0F0F631640318B7DB056F61CC06F6E7B64DB04712F10019AFC0467252CF75AB119A9D

Function 00441030 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49a3bfabf79a65c690f97e76fe456cb77f79ea6cd6c50daa38502d700b1f7d22
Instruction ID: e2cf6eb340ac48f4c2d61266dea52d41f096047f3e1279b99095df37311d6468
Opcode Fuzzy Hash: 49a3bfabf79a65c690f97e76fe456cb77f79ea6cd6c50daa38502d700b1f7d22
Instruction Fuzzy Hash: 6A023D71E002199BEF14CFA9C9806AEB7F1FF48314F15826AD919E7354D734AE41CB94

Function 004522E2 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,004522DD,?,?,00000008,?,?,00455622,00000000), ref: 0045250F

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: d07e5f888e39d313e61fc9618f59c4e8dd55f143eba3426c2705e6c45139c68f
Instruction ID: f5116c66f7d103febd2a8608562706e5703b7900b8c4b7f838cfdcb30f3e5b5c
Opcode Fuzzy Hash: d07e5f888e39d313e61fc9618f59c4e8dd55f143eba3426c2705e6c45139c68f
Instruction Fuzzy Hash: A3B19D312106089FD714CF28C586B557BE0FF06366F29865AEC9ACF2A2C379D986CB44

Function 00432C54 Relevance: 1.8, Strings: 1, Instructions: 500COMMON

Download Yara Rule

Strings

0, xrefs: 00432C60

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: b6bf49add14664c6f8016bf54831dc2d1fc9c90be302da46ea9abcdaf86f1ea8
Instruction ID: 31134252bc459ed72560d692cedbd99cf1c15514e9e569b0755b2466d1e16266
Opcode Fuzzy Hash: b6bf49add14664c6f8016bf54831dc2d1fc9c90be302da46ea9abcdaf86f1ea8
Instruction Fuzzy Hash: 0B0285327083418BD714DF29D951B2EF3E1BFCC768F15892EF4899B381DA78A8058B85

Function 004512CA Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 004470CF: GetLastError.KERNEL32(?,?,0043952C,?,00000000,?,0043BB65,00000000,00000000), ref: 004470D3
Part of subcall function 004470CF: _free.LIBCMT ref: 00447106
Part of subcall function 004470CF: SetLastError.KERNEL32(00000000,00000000,00000000), ref: 00447147
Part of subcall function 004470CF: _abort.LIBCMT ref: 0044714D

Part of subcall function 004470CF: _free.LIBCMT ref: 0044712E
Part of subcall function 004470CF: SetLastError.KERNEL32(00000000,00000000,00000000), ref: 0044713B

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0045131E

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free$InfoLocale_abort
String ID:
API String ID: 1663032902-0
Opcode ID: bc85fdc09d4fce3dfbe50538f39d64f32c4b6099e2a05669c9b1daebb1f6e385
Instruction ID: 0b21b5069fbf1db5bec531630a8d3eee6f1f474d64bb54c6a1c44a3d8e2cc721
Opcode Fuzzy Hash: bc85fdc09d4fce3dfbe50538f39d64f32c4b6099e2a05669c9b1daebb1f6e385
Instruction Fuzzy Hash: 2221D372501206ABEB24AB25CC61B7B77ACEB04316F10017BFD01D6663EB78AD49CB58

Function 00450F52 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004470CF: GetLastError.KERNEL32(?,?,0043952C,?,00000000,?,0043BB65,00000000,00000000), ref: 004470D3
Part of subcall function 004470CF: _free.LIBCMT ref: 00447106
Part of subcall function 004470CF: SetLastError.KERNEL32(00000000,00000000,00000000), ref: 00447147
Part of subcall function 004470CF: _abort.LIBCMT ref: 0044714D

EnumSystemLocalesW.KERNEL32(0045107A,00000001,00000000,?,00443EFC,?,004516A7,00000000,?,?,?), ref: 00450FC4

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: 2806d9e87b91580947c38d8a0617f63d2b95e775220bf3e675df36a013b02c7b
Instruction ID: 451a354658792f2252a151bea30e2a99c0585190810680eeac5085bd3c0c80bb
Opcode Fuzzy Hash: 2806d9e87b91580947c38d8a0617f63d2b95e775220bf3e675df36a013b02c7b
Instruction Fuzzy Hash: FD11293B2007019FDB28AF39C8916BABB92FF8435AB14442DE94747B41D7B9B847C744

Function 004514FA Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 004470CF: GetLastError.KERNEL32(?,?,0043952C,?,00000000,?,0043BB65,00000000,00000000), ref: 004470D3
Part of subcall function 004470CF: _free.LIBCMT ref: 00447106
Part of subcall function 004470CF: SetLastError.KERNEL32(00000000,00000000,00000000), ref: 00447147
Part of subcall function 004470CF: _abort.LIBCMT ref: 0044714D

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00451298,00000000,00000000,?), ref: 00451526

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale_abort_free
String ID:
API String ID: 2692324296-0
Opcode ID: e61a00dc03fcb481ae1f4eaad0348555d58099959c5ffac150b0217cf8aecc77
Instruction ID: d2fe2c3fce417e68b0623dfb5eb434355baf81d8c10f12b7a8aa08190ad777f0
Opcode Fuzzy Hash: e61a00dc03fcb481ae1f4eaad0348555d58099959c5ffac150b0217cf8aecc77
Instruction Fuzzy Hash: 4AF0F9326102197BDB289A258C46BBB7758EB80755F04046AEC07A3251FA78FD45C6D4

Function 00450FED Relevance: 1.5, APIs: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004470CF: GetLastError.KERNEL32(?,?,0043952C,?,00000000,?,0043BB65,00000000,00000000), ref: 004470D3
Part of subcall function 004470CF: _free.LIBCMT ref: 00447106
Part of subcall function 004470CF: SetLastError.KERNEL32(00000000,00000000,00000000), ref: 00447147
Part of subcall function 004470CF: _abort.LIBCMT ref: 0044714D

EnumSystemLocalesW.KERNEL32(004512CA,00000001,?,?,00443EFC,?,0045166B,00443EFC,?,?,?,?,?,00443EFC,?,?), ref: 00451039

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: 1383e35cddf71846be5f04bfb451628eb58ff654fdb94fb85b79533aadb6d968
Instruction ID: 969c50ee721750b2a7664082bdad3607fc28c6e2ba06475257799e5d9796a5a7
Opcode Fuzzy Hash: 1383e35cddf71846be5f04bfb451628eb58ff654fdb94fb85b79533aadb6d968
Instruction Fuzzy Hash: 19F028363003045FDB245F76DC81B7B7B95EF8075DF04442EFD4187A92D6B99C828604

Function 004472BE Relevance: 1.5, APIs: 1, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00444CDC: EnterCriticalSection.KERNEL32(-00472558,?,0044246B,00000000,0046EAD0,0000000C,00442426,0000000A,?,?,00448949,0000000A,?,00447184,00000001,00000364), ref: 00444CEB

EnumSystemLocalesW.KERNEL32(00447278,00000001,0046EC58,0000000C), ref: 004472F6

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: ce5d864c7127ce76761e0cbea026e968eb5e88cd2d94c9e55423b39c5525c7e8
Instruction ID: acebf021cc54f47487df9b00313a15cc1bfd22b3d47c3c45ccbcf72c34342655
Opcode Fuzzy Hash: ce5d864c7127ce76761e0cbea026e968eb5e88cd2d94c9e55423b39c5525c7e8
Instruction Fuzzy Hash: 97F06236620200DFEB10EF79DE46B5D37E0EB44715F10816AF414DB2A1CBB89981DB4D

Function 00450F07 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004470CF: GetLastError.KERNEL32(?,?,0043952C,?,00000000,?,0043BB65,00000000,00000000), ref: 004470D3
Part of subcall function 004470CF: _free.LIBCMT ref: 00447106
Part of subcall function 004470CF: SetLastError.KERNEL32(00000000,00000000,00000000), ref: 00447147
Part of subcall function 004470CF: _abort.LIBCMT ref: 0044714D

EnumSystemLocalesW.KERNEL32(00450E5E,00000001,?,?,?,004516C9,00443EFC,?,?,?,?,?,00443EFC,?,?,?), ref: 00450F3E

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: c0752d91e59c0ec8caa35cedbb84099f1f2f8e555a7fabae98b3644acfac0ab5
Instruction ID: 7585e2e2e927d60b614fbbb7cbec4ece609ea7599c31e6a5607aeddcbc8761df
Opcode Fuzzy Hash: c0752d91e59c0ec8caa35cedbb84099f1f2f8e555a7fabae98b3644acfac0ab5
Instruction Fuzzy Hash: 89F0E53A30020557CB28AF35D845B6A7F94EFC1715B16449EFE098B252C67AD886C794

Function 00433EE2 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00033EEE,00433BBC), ref: 00433EE7

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: e588410f7d772084ad9b5e6a201b2d06307ba3208cc6e1757a1b1bd45e9a1e30
Instruction ID: 9bcc487b38fe881941be7e97ad5738302595bcb4dafebc2e14986f4c0a09dd7d
Opcode Fuzzy Hash: e588410f7d772084ad9b5e6a201b2d06307ba3208cc6e1757a1b1bd45e9a1e30
Instruction Fuzzy Hash:

Function 0042707E Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

@, xrefs: 004270CF

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 277f5b14ebfb31d9acdfcb19b599133ffeee57438103c682c3dacb2c81b16d7f
Instruction ID: 918b0ebc11a623be2c3a075c7dacafa9f372a23f1c3751216f0e188bc6ec1ae1
Opcode Fuzzy Hash: 277f5b14ebfb31d9acdfcb19b599133ffeee57438103c682c3dacb2c81b16d7f
Instruction Fuzzy Hash: 75416771A087158FC314CE29C48162BFBE1FFC8310F648A1EF98693350D679E984CB86

Function 00437360 Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

NG, xrefs: 00437360, 0043736F

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID:
String ID: NG
API String ID: 0-1651712548
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 1c32571a3dfe778fa5c185cf8bc6913e7641393edb8458615b62c9d9f031e262
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: AA11E6F724C08243D635862DC4B46BBA795EBCD321F2C626BDCC24B758D23AA945F908

Function 0044EB3E Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0044EB3E

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 92e8274eb45f99ac31ca5a7841fd9c067bc26919afa491827186e59168ab32af
Instruction ID: 07883168748708d5871df038b293f30180ed36dce4f2d3eb69edcdcf819b44e4
Opcode Fuzzy Hash: 92e8274eb45f99ac31ca5a7841fd9c067bc26919afa491827186e59168ab32af
Instruction Fuzzy Hash: 8EA01130202202CBA3008F32AB0A20A3BA8AA00AA23028038A00AC02A0EE2080808A08

Function 0044C949 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daa15e32a72831e46b3c61932d047b022fcf8146eeed5cebd1c5d41c65fd85a6
Instruction ID: 9a438bc9e2fc22055b190f670ef66c3370438dec1b294d2ef7e2678560d22162
Opcode Fuzzy Hash: daa15e32a72831e46b3c61932d047b022fcf8146eeed5cebd1c5d41c65fd85a6
Instruction Fuzzy Hash: BE325721D29F014DE7279A35C8623366689AFBB3C5F14D737F819B5AA6EF2CC5830105

Function 0041E7EA Relevance: .6, Instructions: 606COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f4af8b37f4defc4199b161d53b4d96f103fc90b589b5ac19ca4300a5eebd0f3
Instruction ID: c1435a2baeed09a5a3259e0536aa218d1a742a19b3e0efe55a8499c03c4c3cac
Opcode Fuzzy Hash: 7f4af8b37f4defc4199b161d53b4d96f103fc90b589b5ac19ca4300a5eebd0f3
Instruction Fuzzy Hash: C332A1756087569BC715DF2AC4807ABB7E1BF84304F044A2EFC958B381D778DD868B8A

Function 004269D6 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49923ba0373965d58fe21e3a4a04a2e805efb906394084f823fc6768166e364a
Instruction ID: ba505550dfe6ff667973af58f2e26a28558ab2450a604d8934fff0a0de9d4b4c
Opcode Fuzzy Hash: 49923ba0373965d58fe21e3a4a04a2e805efb906394084f823fc6768166e364a
Instruction Fuzzy Hash: E002A071B145528FE318CF2EEC90536B7E1AB8D301745867EE486C7381EB74E922CB99

Function 0042645F Relevance: .4, Instructions: 377COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14f2c04f30688e9b56e2fb3764798841ed8a236a41f0f424bf7fd8b45a1b82b0
Instruction ID: 5a71f349ba3f9fd68778d37660bff7a0658bdf00a392eb754e277e7013b3f26f
Opcode Fuzzy Hash: 14f2c04f30688e9b56e2fb3764798841ed8a236a41f0f424bf7fd8b45a1b82b0
Instruction Fuzzy Hash: 01F17171A142558FD304DF1DE89187B73E4FB89301B44092EF183D7391DA74EA19CBAA

Function 00431582 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8269e18aa3b2fd96c1213e9b8022c4c073f53bdae2f6b844dfaaafdf28db3f1
Instruction ID: a41bb019b54bfded01c7b41d156f95a2cbb072d1dd28d49048bf85c092e0f3ee
Opcode Fuzzy Hash: a8269e18aa3b2fd96c1213e9b8022c4c073f53bdae2f6b844dfaaafdf28db3f1
Instruction Fuzzy Hash: 27D191B1A083158BC721DE69C490A5FB7E4BF88354F445A2EF8D597321E738DE09CB86

Function 0041D27C Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7326b31f45d4e50c8c50174bee11f9882207dfed74e31d12f4697374e1987de
Instruction ID: 3c41eba25cca95e3826e3c7b6cd4dae3ec9239a5c93a684b18aa23140a28fc10
Opcode Fuzzy Hash: e7326b31f45d4e50c8c50174bee11f9882207dfed74e31d12f4697374e1987de
Instruction Fuzzy Hash: A9B184795142998ACB05EF68C4913F63BA1EF6A300F0851B9EC9CCF757D3398506EB64

Function 00436C9D Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: ead0cef3b0fda5c4522f49b9ed51e98e8a5165699e21cbc4f344a2de8f03cfd9
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: FF9198722090A35DDB29423E843403FFFE15A563A1B1B679FE4F3CB2C5ED28C5699624

Function 00436F58 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: 3a5f3f28e05ced0c476ae62a9fbfc87eb2deb37e5825eaa5068885373994e230
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: 5B9154B310C0E349DB3D4639847403FFEF15A563A1B1A679FE4F2CA2C5EE288565D624

Function 004369D6 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: eb820b35a2641912eb9ff5d16cdfa81a50ceb30e04b2f4d47c9798fb0fa66f46
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: 3491A7722090A31DDB2D4639843403FFFE15A563A1B1BA79FD4F2CB2C5ED28D964DA24

Function 0043D04B Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 364cc13a289dc0ce81a78afd7db0cdc41a28cfc106a277fbe5b23d2174104350
Instruction ID: 3cf18c0d826463afbe89e475a5c7b17f33369b7a6d620af3ef40d0ad4ead64e4
Opcode Fuzzy Hash: 364cc13a289dc0ce81a78afd7db0cdc41a28cfc106a277fbe5b23d2174104350
Instruction Fuzzy Hash: 10615771E0060867EE386968B856BBF23A4AF4DB18F14341BE843DB385D65DDD43835E

Function 0043D2A8 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e08550926610149d2907a64cdab228bdd5846e9e2727ceec6c104fc9914690c2
Instruction ID: b9fa1b0b40c6464c7c23e4f783a2c4cc8d7b3f542efc6a4ce67a7e3fa50c54dc
Opcode Fuzzy Hash: e08550926610149d2907a64cdab228bdd5846e9e2727ceec6c104fc9914690c2
Instruction Fuzzy Hash: 596136B1E0060896DB385A28B8967BF2398EB5D304F14351BEC83DB381D66DED46875F

Function 0043672C Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: 7b3a2e63247afe9edf549f88f25df29c5744deddbf3acd7c38ddff1b86da152b
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: A081C9B21090A31DDB2D423A853413FFFE15E553A1B1BA79FD4F2CA2C5EE28C564D624

Function 0043CBED Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4e8e107ebb569481f6dec165aac6f3bea1aaf1a879556bc36ff33913e703c4a
Instruction ID: cee5e8aa058cab72f47c1252862074b7a33edcf92ba99b8242ad85c8d79f7feb
Opcode Fuzzy Hash: e4e8e107ebb569481f6dec165aac6f3bea1aaf1a879556bc36ff33913e703c4a
Instruction Fuzzy Hash: 6A51787160060857DB395A6885D67BF2B899B0E344F18742FE48BFB382C60DED12D39E

Function 0043CE1C Relevance: .2, Instructions: 214COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cdc0b4430c882dd513f9aba2f942575131dd1f5e6007437ccc46010af73f7df
Instruction ID: a1764f4878c0090f3dddee11b9fa4dd44c6bcaf443cdbc9a7423fc55b8fdb92d
Opcode Fuzzy Hash: 0cdc0b4430c882dd513f9aba2f942575131dd1f5e6007437ccc46010af73f7df
Instruction Fuzzy Hash: 285138616407049BDB38856884DB7BF679A9B5E704F18390FE486F73C2C60DEE06875E

Function 004271B8 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c779f12f611b8dda6e5ae50ec22da61f8b8ae12354eff81384336edfcffc5bc
Instruction ID: b54697577a8b4caa58ab057165119fb3c01a9d9d25aa48dfc33613f80cd324c0
Opcode Fuzzy Hash: 1c779f12f611b8dda6e5ae50ec22da61f8b8ae12354eff81384336edfcffc5bc
Instruction Fuzzy Hash: D2616D32A0C3059FC308DF75E581A5BB7E5BFCC718F910D1EF4899A151E634EA088B96

Function 00418195 Relevance: 52.8, APIs: 29, Strings: 1, Instructions: 324windowmemoryCOMMON

Download Yara Rule

APIs

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 004181AF
CreateCompatibleDC.GDI32(00000000), ref: 004181BA

Part of subcall function 00418648: EnumDisplaySettingsW.USER32(?,000000FF,?), ref: 00418678

CreateCompatibleBitmap.GDI32(?,00000000), ref: 0041823B
DeleteDC.GDI32(?), ref: 00418253
DeleteDC.GDI32(00000000), ref: 00418256
SelectObject.GDI32(00000000,00000000), ref: 00418261
StretchBlt.GDI32(00000000,00000000,00000000,00000000,?,?,?,?,00000000,?,00CC0020), ref: 00418289
GetCursorInfo.USER32(?), ref: 004182AB
GetIconInfo.USER32(?,?), ref: 004182C1
DeleteObject.GDI32(?), ref: 004182F0
DeleteObject.GDI32(?), ref: 004182FD
DrawIcon.USER32(00000000,?,?,?), ref: 0041830A
BitBlt.GDI32(00000000,00000000,00000000,00000000,?,?,00000000,00000000,00660046), ref: 0041833A
GetObjectA.GDI32(?,00000018,?), ref: 00418369
LocalAlloc.KERNEL32(00000040,00000028), ref: 004183B2
LocalAlloc.KERNEL32(00000040,00000001), ref: 004183D5
GlobalAlloc.KERNEL32(00000000,?), ref: 0041843E
GetDIBits.GDI32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00418461
DeleteDC.GDI32(?), ref: 00418475
DeleteDC.GDI32(00000000), ref: 00418478
DeleteObject.GDI32(00000000), ref: 0041847B
GlobalFree.KERNEL32(00CC0020), ref: 00418486
DeleteObject.GDI32(00000000), ref: 0041853A
GlobalFree.KERNEL32(?), ref: 00418541
DeleteDC.GDI32(?), ref: 00418551
DeleteDC.GDI32(00000000), ref: 0041855C
DeleteDC.GDI32(?), ref: 0041858E
DeleteDC.GDI32(00000000), ref: 00418591
DeleteObject.GDI32(?), ref: 00418597

Strings

DISPLAY, xrefs: 004181A8

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Delete$Object$AllocCreateGlobal$CompatibleFreeIconInfoLocal$BitmapBitsCursorDisplayDrawEnumSelectSettingsStretch
String ID: DISPLAY
API String ID: 1352755160-865373369
Opcode ID: f43b31cd191835719c67feef2a51a2d06668b937d994ffc7dcc294679b32e0a8
Instruction ID: a1654617e6feb41a21483335bab58d6c80918fdf06c9fa75f2eb3c48c5790805
Opcode Fuzzy Hash: f43b31cd191835719c67feef2a51a2d06668b937d994ffc7dcc294679b32e0a8
Instruction Fuzzy Hash: EFC16C31504344AFD7209F21CC44BABBBE9EF88751F44482EF989A32A1DF34E945CB5A

Function 0041742B Relevance: 47.5, APIs: 22, Strings: 5, Instructions: 290libraryloaderthreadCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll,ZwCreateSection,00000000,00000000), ref: 00417472
GetProcAddress.KERNEL32(00000000), ref: 00417475
GetModuleHandleA.KERNEL32(ntdll,ZwMapViewOfSection), ref: 00417486
GetProcAddress.KERNEL32(00000000), ref: 00417489
GetModuleHandleA.KERNEL32(ntdll,ZwUnmapViewOfSection), ref: 0041749A
GetProcAddress.KERNEL32(00000000), ref: 0041749D
GetModuleHandleA.KERNEL32(ntdll,ZwClose), ref: 004174AE
GetProcAddress.KERNEL32(00000000), ref: 004174B1
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00417552
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 0041756A
GetThreadContext.KERNEL32(?,00000000), ref: 00417580
ReadProcessMemory.KERNEL32(?,?,?,00000004,?), ref: 004175A6
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00417626
TerminateProcess.KERNEL32(?,00000000), ref: 0041763A
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,00000001,00000000,00000040), ref: 00417671
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 0041773E
SetThreadContext.KERNEL32(?,00000000), ref: 0041775B
ResumeThread.KERNEL32(?), ref: 00417768
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00417780
GetCurrentProcess.KERNEL32(?), ref: 0041778B
TerminateProcess.KERNEL32(?,00000000), ref: 004177A5
GetLastError.KERNEL32 ref: 004177AD

Strings

ZwCreateSection, xrefs: 00417458
ZwMapViewOfSection, xrefs: 00417477
ntdll, xrefs: 0041745D, 0041747C, 00417490, 004174A4
ZwUnmapViewOfSection, xrefs: 0041748B
ZwClose, xrefs: 0041749F

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Process$AddressHandleModuleProc$ThreadVirtual$ContextCurrentFreeMemoryTerminate$AllocCreateErrorLastReadResumeWrite
String ID: ZwClose$ZwCreateSection$ZwMapViewOfSection$ZwUnmapViewOfSection$ntdll
API String ID: 4188446516-3035715614
Opcode ID: ca58d074774f4cb3cec8caed2bdcc8ae3fb1cd477b48ba63cf2103ffe40dc484
Instruction ID: 9d7e092ec3b05a7a521957261ed1896ff906ab06cfb84d00d3f911d9ff722cfe
Opcode Fuzzy Hash: ca58d074774f4cb3cec8caed2bdcc8ae3fb1cd477b48ba63cf2103ffe40dc484
Instruction Fuzzy Hash: C3A16D71508304AFD710DF65CD89B6B7BF8FB48345F00082EF699962A1DB75E884CB6A

Function 0040C28E Relevance: 47.5, APIs: 6, Strings: 21, Instructions: 282registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00411771: TerminateProcess.KERNEL32(00000000,pth_unenc,0040E748), ref: 00411781
Part of subcall function 00411771: WaitForSingleObject.KERNEL32(000000FF), ref: 00411794

GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,00000000), ref: 0040C38B
RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040C39E
SetFileAttributesW.KERNEL32(?,00000080,?,?,00000000), ref: 0040C3B7
SetFileAttributesW.KERNEL32(00000000,00000080,?,?,00000000), ref: 0040C3E7

Part of subcall function 0040AFBA: TerminateThread.KERNEL32(004099A9,00000000,00475308,pth_unenc,0040BF26,004752F0,00475308,?,pth_unenc), ref: 0040AFC9
Part of subcall function 0040AFBA: UnhookWindowsHookEx.USER32(00475108), ref: 0040AFD5
Part of subcall function 0040AFBA: TerminateThread.KERNEL32(Function_00009993,00000000,?,pth_unenc), ref: 0040AFE3

Part of subcall function 0041B79A: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,00466900,00000000,00000000,0040C267,00000000,00000000,fso.DeleteFile(Wscript.ScriptFullName)), ref: 0041B7D9

ShellExecuteW.SHELL32(00000000,open,00000000,00466900,00466900,00000000), ref: 0040C632
ExitProcess.KERNEL32 ref: 0040C63E

Strings

while fso.FileExists(", xrefs: 0040C45A
exepath, xrefs: 0040C365
CreateObject("WScript.Shell").Run "cmd /c "", xrefs: 0040C56F
fso.DeleteFile ", xrefs: 0040C4A8
Set fso = CreateObject("Scripting.FileSystemObject"), xrefs: 0040C418
""", 0, xrefs: 0040C555
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 0040C2DF
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 0040C330
open, xrefs: 0040C62C
"), xrefs: 0040C443
fso.DeleteFile(Wscript.ScriptFullName), xrefs: 0040C5E1
SG, xrefs: 0040C3DC
wend, xrefs: 0040C4F7
SG, xrefs: 0040C505
dMG, xrefs: 0040C2C9
PSG, xrefs: 0040C33D
\update.vbs, xrefs: 0040C3E9
fso.DeleteFolder ", xrefs: 0040C519
SG, xrefs: 0040C3C4
Temp, xrefs: 0040C3EE
On Error Resume Next, xrefs: 0040C427

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: File$Terminate$AttributesProcessThread$CreateDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
String ID: SG$ SG$ SG$""", 0$")$CreateObject("WScript.Shell").Run "cmd /c ""$On Error Resume Next$PSG$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$\update.vbs$dMG$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$open$wend$while fso.FileExists("
API String ID: 1861856835-1415323999
Opcode ID: 8e9550d2a36138100e1c2fc1d5f82ae9fdcfc18a7661daa6d71ec6f3d761d588
Instruction ID: 61d23169d088639e971774d7266815e56d2523c1fe05d3951d40341dc357c42d
Opcode Fuzzy Hash: 8e9550d2a36138100e1c2fc1d5f82ae9fdcfc18a7661daa6d71ec6f3d761d588
Instruction Fuzzy Hash: F891A3316042005AC314FB21D852AAF7799AF90318F50453FF88AB71E2EF7CAD49C69E

Function 0040BF04 Relevance: 44.0, APIs: 6, Strings: 19, Instructions: 260registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00411771: TerminateProcess.KERNEL32(00000000,pth_unenc,0040E748), ref: 00411781
Part of subcall function 00411771: WaitForSingleObject.KERNEL32(000000FF), ref: 00411794

GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,00475308,?,pth_unenc), ref: 0040C013
RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040C026
SetFileAttributesW.KERNEL32(00000000,00000080,?,?,?,?,?,00475308,?,pth_unenc), ref: 0040C056
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,00475308,?,pth_unenc), ref: 0040C065

Part of subcall function 0040AFBA: TerminateThread.KERNEL32(004099A9,00000000,00475308,pth_unenc,0040BF26,004752F0,00475308,?,pth_unenc), ref: 0040AFC9
Part of subcall function 0040AFBA: UnhookWindowsHookEx.USER32(00475108), ref: 0040AFD5
Part of subcall function 0040AFBA: TerminateThread.KERNEL32(Function_00009993,00000000,?,pth_unenc), ref: 0040AFE3

Part of subcall function 0041AD43: GetCurrentProcessId.KERNEL32(00000000,75923530,00000000,?,?,?,?,00466900,0040C07B,.vbs,?,?,?,?,?,00475308), ref: 0041AD6A

ShellExecuteW.SHELL32(00000000,open,00000000,00466900,00466900,00000000), ref: 0040C280
ExitProcess.KERNEL32 ref: 0040C287

Strings

while fso.FileExists(", xrefs: 0040C136
exepath, xrefs: 0040BFEF
dMG, xrefs: 0040BF3F
fso.DeleteFile ", xrefs: 0040C183
SG, xrefs: 0040C031
Set fso = CreateObject("Scripting.FileSystemObject"), xrefs: 0040C0F3
pth_unenc, xrefs: 0040BF0A
SG, xrefs: 0040C1E0
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 0040BF55
PSG, xrefs: 0040BFCC
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 0040BFA6
open, xrefs: 0040C27A
"), xrefs: 0040C11F
fso.DeleteFile(Wscript.ScriptFullName), xrefs: 0040C22F
wend, xrefs: 0040C1D2
.vbs, xrefs: 0040C06F
fso.DeleteFolder ", xrefs: 0040C1F8
Temp, xrefs: 0040C0B4
On Error Resume Next, xrefs: 0040C102

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: FileProcessTerminate$AttributesThread$CurrentDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
String ID: SG$ SG$")$.vbs$On Error Resume Next$PSG$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$dMG$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$open$pth_unenc$wend$while fso.FileExists("
API String ID: 3797177996-899740633
Opcode ID: 45352128316decb50fa812bea07fa27229c4ed24509ec15bd5d086fbabda10ef
Instruction ID: 3970d62be7f9f5e1fdb580af11360c5c0218cddba346a3e39168d22276c4a34b
Opcode Fuzzy Hash: 45352128316decb50fa812bea07fa27229c4ed24509ec15bd5d086fbabda10ef
Instruction Fuzzy Hash: 838194316042005BC315FB21D852AAF7799AF91708F10453FF986A72E2EF7C9D49C69E

Function 0041138D Relevance: 43.9, APIs: 17, Strings: 8, Instructions: 189synchronizationsleepfileCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000001,00000000,00475308,?,00000000), ref: 004113AC
ExitProcess.KERNEL32 ref: 004115F5

Part of subcall function 00412735: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,00000000,00475308), ref: 00412751
Part of subcall function 00412735: RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,00000208,?), ref: 0041276A
Part of subcall function 00412735: RegCloseKey.KERNEL32(00000000), ref: 00412775

Part of subcall function 0041B825: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,00000000,00409F65), ref: 0041B83E

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,?,?,?,00000000), ref: 00411433
OpenProcess.KERNEL32(00100000,00000000,,@,?,?,?,?,00000000), ref: 00411442
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,00000000), ref: 0041144D
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000), ref: 00411454
GetCurrentProcessId.KERNEL32(?,?,?,?,00000000), ref: 0041145A

Part of subcall function 004128AD: RegCreateKeyA.ADVAPI32(80000001,00000000,TeF), ref: 004128BB
Part of subcall function 004128AD: RegSetValueExA.KERNEL32(TeF,000000AF,00000000,00000004,00000001,00000004,?,?,?,0040B94C,004670E0,00000001,000000AF,00466554), ref: 004128D6
Part of subcall function 004128AD: RegCloseKey.KERNEL32(?,?,?,?,0040B94C,004670E0,00000001,000000AF,00466554), ref: 004128E1

PathFileExistsW.SHLWAPI(?,?,?,?,?,00000000), ref: 0041148B
GetTempPathW.KERNEL32(00000104,?,?,?,?,?,?,?,?,00000000), ref: 004114E7
GetTempFileNameW.KERNEL32(?,temp_,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00411501
lstrcatW.KERNEL32(?,.exe,?,?,?,?,?,?,?,00000000), ref: 00411513

Part of subcall function 0041B79A: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0041B7F6
Part of subcall function 0041B79A: WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0041B80A
Part of subcall function 0041B79A: CloseHandle.KERNEL32(00000000), ref: 0041B817

ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 0041155B
Sleep.KERNEL32(000001F4,?,?,?,?,00000000), ref: 0041159C
OpenProcess.KERNEL32(00100000,00000000,?,?,?,?,?,00000000), ref: 004115B1
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,00000000), ref: 004115BC
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000), ref: 004115C3
GetCurrentProcessId.KERNEL32(?,?,?,?,00000000), ref: 004115C9

Part of subcall function 0041B79A: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,00466900,00000000,00000000,0040C267,00000000,00000000,fso.DeleteFile(Wscript.ScriptFullName)), ref: 0041B7D9

Strings

open, xrefs: 00411555
,@, xrefs: 00411439
exepath, xrefs: 004113E0
PSG, xrefs: 004113BA
temp_, xrefs: 004114F5
WDH, xrefs: 00411461, 004115D0
.exe, xrefs: 00411507
0TG, xrefs: 0041139B

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: File$CloseCreateProcess$HandleOpen$CurrentObjectPathSingleTempValueWait$ExecuteExistsExitMutexNamePointerQueryShellSleepWritelstrcat
String ID: ,@$.exe$0TG$PSG$WDH$exepath$open$temp_
API String ID: 4250697656-4136069298
Opcode ID: db40e97701d6933eb01dc6137a2f1fe71b6556f31fe51939fd8c3e0f7f5558e8
Instruction ID: 17001e37a1d7cf9a3413e78a7a022695eb621cd558d1591dce66fb7483b9d66c
Opcode Fuzzy Hash: db40e97701d6933eb01dc6137a2f1fe71b6556f31fe51939fd8c3e0f7f5558e8
Instruction Fuzzy Hash: 7551B571A00315BBDB00A7A09C46EFE736E9B44715F10416BF906B71E2EF788E858A9D

Function 0041A3B1 Relevance: 42.2, APIs: 12, Strings: 12, Instructions: 180synchronizationCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(00000000,00000000,00000000,00000000), ref: 0041A4A8
mciSendStringA.WINMM(play audio,00000000,00000000,00000000), ref: 0041A4BC
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,000000A9,00466554), ref: 0041A4E4
PathFileExistsW.SHLWAPI(00000000,00000000,00000000,00474EE0,00000000), ref: 0041A4F5
mciSendStringA.WINMM(pause audio,00000000,00000000,00000000), ref: 0041A536
mciSendStringA.WINMM(resume audio,00000000,00000000,00000000), ref: 0041A54E
mciSendStringA.WINMM(status audio mode,?,00000014,00000000), ref: 0041A563
SetEvent.KERNEL32 ref: 0041A580
WaitForSingleObject.KERNEL32(000001F4), ref: 0041A591
CloseHandle.KERNEL32 ref: 0041A5A1
mciSendStringA.WINMM(stop audio,00000000,00000000,00000000), ref: 0041A5C3
mciSendStringA.WINMM(close audio,00000000,00000000,00000000), ref: 0041A5CD

Strings

TeF, xrefs: 0041A4C1
stopped, xrefs: 0041A569
status audio mode, xrefs: 0041A55E
play audio, xrefs: 0041A4B7
stop audio, xrefs: 0041A5BE
" type , xrefs: 0041A441
NG, xrefs: 0041A475, 0041A3F5
open ", xrefs: 0041A43C
pause audio, xrefs: 0041A531
resume audio, xrefs: 0041A549
close audio, xrefs: 0041A5C8
alias audio, xrefs: 0041A424

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: SendString$Event$CloseCreateExistsFileHandleObjectPathSingleWait
String ID: alias audio$" type $TeF$close audio$open "$pause audio$play audio$resume audio$status audio mode$stop audio$stopped$NG
API String ID: 738084811-3504112074
Opcode ID: 487eb8d61853791132be4fc542b0a4356c39d735bd1ee74e7e5f7e21231ae993
Instruction ID: 23b594f260307180257043fa1e2d6aa1707bafa700398656917524c484c431be
Opcode Fuzzy Hash: 487eb8d61853791132be4fc542b0a4356c39d735bd1ee74e7e5f7e21231ae993
Instruction Fuzzy Hash: A251B1716442046AD214BB32EC92EBF3B9DAB90758F10443FF445621E2EE789D48866F

Function 0040BC67 Relevance: 37.0, APIs: 12, Strings: 9, Instructions: 203fileCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0040BC75
CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000000,?,004750FC,0000000E,00000027,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E), ref: 0040BC8E
CopyFileW.KERNEL32(C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe,00000000,00000000,00000000,00000000,00000000,?,004750FC,0000000E,00000027,0000000D,00000033,00000000,00000032,00000000,Exe), ref: 0040BD3E
_wcslen.LIBCMT ref: 0040BD54
CreateDirectoryW.KERNEL32(00000000,00000000,00000000), ref: 0040BDDC
CopyFileW.KERNEL32(C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe,00000000,00000000), ref: 0040BDF2
SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040BE31
_wcslen.LIBCMT ref: 0040BE34
SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040BE4B
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004750FC,0000000E), ref: 0040BE9B
ShellExecuteW.SHELL32(00000000,open,00000000,00466900,00466900,00000001), ref: 0040BEB9
ExitProcess.KERNEL32 ref: 0040BED0

Strings

SG, xrefs: 0040BD85
open, xrefs: 0040BEB2
SG, xrefs: 0040BDD1
SG, xrefs: 0040BE40
del, xrefs: 0040BE63
6, xrefs: 0040BD48
SG, xrefs: 0040BD6C
SG, xrefs: 0040BC7A
C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, xrefs: 0040BCFF, 0040BD04, 0040BD37, 0040BDEC, 0040BDF1, 0040BDF8, 0040BE59

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: File$_wcslen$AttributesCopyCreateDirectory$CloseExecuteExitHandleProcessShell
String ID: SG$ SG$ SG$ SG$ SG$6$C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe$del$open
API String ID: 1579085052-2286748684
Opcode ID: 0585f1678bb5d4e8e7e6530c04c4a9b567f933f53f733ffc91d09e89a9b2ad51
Instruction ID: cada26950b0f91ffbe9684419e497f708478a0192fdd3dd39558b78de3226dfb
Opcode Fuzzy Hash: 0585f1678bb5d4e8e7e6530c04c4a9b567f933f53f733ffc91d09e89a9b2ad51
Instruction Fuzzy Hash: 0B51C1316046006BD609B722EC52E7F77889F81719F50443FF985A62E2DF7CAD4582EE

Function 00401BE8 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 156fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401C54
WriteFile.KERNEL32(00000000,RIFF,00000004,?,00000000), ref: 00401C7E
WriteFile.KERNEL32(00000000,00000000,00000004,00000000,00000000), ref: 00401C8E
WriteFile.KERNEL32(00000000,WAVE,00000004,00000000,00000000), ref: 00401C9E
WriteFile.KERNEL32(00000000,fmt ,00000004,00000000,00000000), ref: 00401CAE
WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401CBE
WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401CCF
WriteFile.KERNEL32(00000000,00472B02,00000002,00000000,00000000), ref: 00401CE0
WriteFile.KERNEL32(00000000,00472B04,00000004,00000000,00000000), ref: 00401CF0
WriteFile.KERNEL32(00000000,00000001,00000004,00000000,00000000), ref: 00401D00
WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401D11
WriteFile.KERNEL32(00000000,00472B0E,00000002,00000000,00000000), ref: 00401D22
WriteFile.KERNEL32(00000000,data,00000004,00000000,00000000), ref: 00401D32
WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401D42

Strings

WAVE, xrefs: 00401C98
fmt , xrefs: 00401CA8
RIFF, xrefs: 00401C78
data, xrefs: 00401D2C

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: File$Write$Create
String ID: RIFF$WAVE$data$fmt
API String ID: 1602526932-4212202414
Opcode ID: d86e0a11b62900f44300c56c570c8f4c6d29e182ebfed168058ac3948617b838
Instruction ID: 459023fa40bd80d73c97eac26e4027242e7445eca248bff5dcea5bec94493f3f
Opcode Fuzzy Hash: d86e0a11b62900f44300c56c570c8f4c6d29e182ebfed168058ac3948617b838
Instruction Fuzzy Hash: 85411C726443187AE210DE51DD86FBB7FACEB85B54F40081AF644E6080D7A5E909DBB3

Function 004064E0 Relevance: 35.1, APIs: 12, Strings: 8, Instructions: 62libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(ntdll.dll,RtlInitUnicodeString,00000000,C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe,00000001,004068B2,C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe,00000003,004068DA,004752F0,00406933), ref: 004064F4
GetProcAddress.KERNEL32(00000000), ref: 004064FD
GetModuleHandleW.KERNEL32(ntdll.dll,NtAllocateVirtualMemory), ref: 0040650E
GetProcAddress.KERNEL32(00000000), ref: 00406511
GetModuleHandleW.KERNEL32(ntdll.dll,NtFreeVirtualMemory), ref: 00406522
GetProcAddress.KERNEL32(00000000), ref: 00406525
GetModuleHandleW.KERNEL32(ntdll.dll,RtlAcquirePebLock), ref: 00406536
GetProcAddress.KERNEL32(00000000), ref: 00406539
GetModuleHandleW.KERNEL32(ntdll.dll,RtlReleasePebLock), ref: 0040654A
GetProcAddress.KERNEL32(00000000), ref: 0040654D
GetModuleHandleW.KERNEL32(ntdll.dll,LdrEnumerateLoadedModules), ref: 0040655E
GetProcAddress.KERNEL32(00000000), ref: 00406561

Strings

ntdll.dll, xrefs: 004064E8, 004064F3, 0040650D, 00406521, 00406535, 00406549, 0040655D
NtFreeVirtualMemory, xrefs: 0040651C
LdrEnumerateLoadedModules, xrefs: 00406558
NtAllocateVirtualMemory, xrefs: 00406508
RtlAcquirePebLock, xrefs: 00406530
RtlInitUnicodeString, xrefs: 004064EE
C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, xrefs: 004064E1
RtlReleasePebLock, xrefs: 00406544

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe$LdrEnumerateLoadedModules$NtAllocateVirtualMemory$NtFreeVirtualMemory$RtlAcquirePebLock$RtlInitUnicodeString$RtlReleasePebLock$ntdll.dll
API String ID: 1646373207-362752046
Opcode ID: ef23c6471a2b46cbb5b12a679159521cca5d22753a6c35f36816646c352fbe50
Instruction ID: d8392adca69ca7380431791802c09c3f057f20abbaf47be00649cb9a46baa942
Opcode Fuzzy Hash: ef23c6471a2b46cbb5b12a679159521cca5d22753a6c35f36816646c352fbe50
Instruction Fuzzy Hash: D20171A4E40B1635CB206F7B7C94D17AEAC9E503503160837A406F32A1EEBCD400CD7D

Function 0041B3C6 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 139stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 0041B3E1
_memcmp.LIBVCRUNTIME ref: 0041B3F9
lstrlenW.KERNEL32(?), ref: 0041B412
FindFirstVolumeW.KERNEL32(?,00000104,?), ref: 0041B44D
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0041B460
QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 0041B4A4
lstrcmpW.KERNEL32(?,?), ref: 0041B4BF
FindNextVolumeW.KERNEL32(?,0000003F,00000104), ref: 0041B4D7
_wcslen.LIBCMT ref: 0041B4E6
FindVolumeClose.KERNEL32(?), ref: 0041B506
GetLastError.KERNEL32 ref: 0041B51E
GetVolumePathNamesForVolumeNameW.KERNEL32(?,?,?,?), ref: 0041B54B
lstrcatW.KERNEL32(?,?), ref: 0041B564
lstrcpyW.KERNEL32(?,?), ref: 0041B573
GetLastError.KERNEL32 ref: 0041B57B

Strings

?, xrefs: 0041B478

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Volume$ErrorFindLast$lstrlen$CloseDeviceFirstNameNamesNextPathQuery_memcmp_wcslenlstrcatlstrcmplstrcpy
String ID: ?
API String ID: 3941738427-1684325040
Opcode ID: ab6c0a2e820866b083e3708fbad612f297667e297ed8968616fd37775c99846c
Instruction ID: f0577cbf519c1fbc76aa3138d797bbd7c283cc622b072e5c2a83b2d98bec9820
Opcode Fuzzy Hash: ab6c0a2e820866b083e3708fbad612f297667e297ed8968616fd37775c99846c
Instruction Fuzzy Hash: 8441A071504705ABC720DF61E8489EBB7E8EB48705F00482FF541D2262EF78D989CBDA

Function 0044E41E Relevance: 25.9, APIs: 17, Instructions: 419COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0044E4B0
_free.LIBCMT ref: 0044E4D6
_free.LIBCMT ref: 0044E4FF
_free.LIBCMT ref: 0044E537
_free.LIBCMT ref: 0044E568
_free.LIBCMT ref: 0044E5A9
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 0044E62A
_free.LIBCMT ref: 0044E643
_wcschr.LIBVCRUNTIME ref: 0044E680
_free.LIBCMT ref: 0044E6EC
_free.LIBCMT ref: 0044E712
_free.LIBCMT ref: 0044E73B
_free.LIBCMT ref: 0044E770
_free.LIBCMT ref: 0044E7A1
_free.LIBCMT ref: 0044E7E2
SetEnvironmentVariableW.KERNEL32(00000000,?,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0044E867
_free.LIBCMT ref: 0044E880

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: _free$EnvironmentVariable$_wcschr
String ID:
API String ID: 3899193279-0
Opcode ID: 0e1a8f8bbfaf70a5321281e28d07a2b80f4a7f922fdb1718459ded84c8fb4435
Instruction ID: a8aac0df7486383d9a181904d39d16e24afc3d72eb934652fe50c6e09291e228
Opcode Fuzzy Hash: 0e1a8f8bbfaf70a5321281e28d07a2b80f4a7f922fdb1718459ded84c8fb4435
Instruction Fuzzy Hash: 5DD12771D00310AFFB21AF77888166E7BA4BF01368F45416FF945A7381EA399E418B9D

Function 00411D59 Relevance: 25.0, APIs: 9, Strings: 5, Instructions: 479sleepfileCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00411D72

Part of subcall function 0041AD43: GetCurrentProcessId.KERNEL32(00000000,75923530,00000000,?,?,?,?,00466900,0040C07B,.vbs,?,?,?,?,?,00475308), ref: 0041AD6A

Part of subcall function 0041789C: CloseHandle.KERNEL32(00403AB9,?,?,00403AB9,00466324), ref: 004178B2
Part of subcall function 0041789C: CloseHandle.KERNEL32($cF,?,?,00403AB9,00466324), ref: 004178BB

Sleep.KERNEL32(0000000A,00466324), ref: 00411EC4
Sleep.KERNEL32(0000000A,00466324,00466324), ref: 00411F66
Sleep.KERNEL32(0000000A,00466324,00466324,00466324), ref: 00412008
DeleteFileW.KERNEL32(00000000,00466324,00466324,00466324), ref: 00412069
DeleteFileW.KERNEL32(00000000,00466324,00466324,00466324), ref: 004120A0
DeleteFileW.KERNEL32(00000000,00466324,00466324,00466324), ref: 004120DC
Sleep.KERNEL32(000001F4,00466324,00466324,00466324), ref: 004120F6
Sleep.KERNEL32(00000064), ref: 00412138

Part of subcall function 00404468: send.WS2_32(000002FC,00000000,00000000,00000000), ref: 004044FD

Strings

NG, xrefs: 0041220A
HTG, xrefs: 004122CA
HTG, xrefs: 004123EE
/stext ", xrefs: 00411E4F, 00411EF1, 00411F93
NG, xrefs: 00412356

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Sleep$File$Delete$CloseHandle$CurrentModuleNameProcesssend
String ID: /stext "$HTG$HTG$NG$NG
API String ID: 1223786279-556891652
Opcode ID: dc2d48520b73d896eeb902e8487fecec8a65e375c022621813084e4261d1f7f8
Instruction ID: b666a026b41db1aee680f36e7b950d376c2ae40a85d54f66cdb5da2431d4b1f1
Opcode Fuzzy Hash: dc2d48520b73d896eeb902e8487fecec8a65e375c022621813084e4261d1f7f8
Instruction Fuzzy Hash: F00224315083414AD324FB61D891BEFB7D5AFD4308F50493EF88A931E2EF785A49C69A

Function 0041CCA9 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 73windowCOMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000401,?,?), ref: 0041CCF4
GetCursorPos.USER32(?), ref: 0041CD03
SetForegroundWindow.USER32(?), ref: 0041CD0C
TrackPopupMenu.USER32(00000000,?,?,00000000,?,00000000), ref: 0041CD26
Shell_NotifyIconA.SHELL32(00000002,00474B50), ref: 0041CD77
ExitProcess.KERNEL32 ref: 0041CD7F
CreatePopupMenu.USER32 ref: 0041CD85
AppendMenuA.USER32(00000000,00000000,00000000,Close), ref: 0041CD9A

Strings

Close, xrefs: 0041CD8B

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Menu$PopupWindow$AppendCreateCursorExitForegroundIconNotifyProcProcessShell_Track
String ID: Close
API String ID: 1657328048-3535843008
Opcode ID: bed582d39fc96e8479943e4d89b527f8ff9ef20370aed2009df63d45acb158b0
Instruction ID: 460fc807693895ecf387abb2373bcbc61375cccb84b7011694e880842115b21a
Opcode Fuzzy Hash: bed582d39fc96e8479943e4d89b527f8ff9ef20370aed2009df63d45acb158b0
Instruction Fuzzy Hash: F321F831140205EFDB054FA4FD4DBAA3F65EB04702F004539FA0AA41B1DBB6ED91EB59

Function 0044514D Relevance: 22.8, APIs: 15, Instructions: 296COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004451BD
_free.LIBCMT ref: 004451D3
_free.LIBCMT ref: 004451E4
_free.LIBCMT ref: 004451F5
_free.LIBCMT ref: 0044520C
GetCPInfo.KERNEL32(?,?), ref: 00445254

Part of subcall function 00451E2B: _free.LIBCMT ref: 00451E96

_free.LIBCMT ref: 00445400
_free.LIBCMT ref: 00445413
_free.LIBCMT ref: 00445421
_free.LIBCMT ref: 0044542C
_free.LIBCMT ref: 0044546E
_free.LIBCMT ref: 00445476
_free.LIBCMT ref: 0044547E
_free.LIBCMT ref: 00445486
_free.LIBCMT ref: 00445494

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 39c5139744f4540f523a9af4ed2fa8afb712fe0565144d4bd577e3f50ea1b080
Instruction ID: de18a1b700a064f56ed707831433d851a0809218b1b1d193042f08ca5b0df7c8
Opcode Fuzzy Hash: 39c5139744f4540f523a9af4ed2fa8afb712fe0565144d4bd577e3f50ea1b080
Instruction Fuzzy Hash: 59B190719006059FEF11DF69C881BEEBBF4FF09304F14406EF895AB252DA799C459B24

Function 00407DEF Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 325fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,000000B6), ref: 00407F4C
GetFileSizeEx.KERNEL32(00000000,00000000), ref: 00407FC2
__aulldiv.LIBCMT ref: 00407FE9
SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000000), ref: 0040810D
ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00408128
CloseHandle.KERNEL32(00000000), ref: 00408200
CloseHandle.KERNEL32(00000000,00000052,00000000,?), ref: 0040821A
CloseHandle.KERNEL32(00000000), ref: 00408256

Strings

Uploading file to Controller: , xrefs: 00408077
NG, xrefs: 00407E87
SetFilePointerEx error, xrefs: 00408266
ReadFile error, xrefs: 0040822E

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$CreatePointerReadSize__aulldiv
String ID: ReadFile error$SetFilePointerEx error$Uploading file to Controller: $NG
API String ID: 1884690901-2582957567
Opcode ID: 51cee8c69b7389e8a28f069381dc337d69fe878f182ed45289c66d2e756e5a1e
Instruction ID: fe8c5194ffe86d3827a7b181bfbb3d0fd3c62202293e6b84b2d5449ede98e066
Opcode Fuzzy Hash: 51cee8c69b7389e8a28f069381dc337d69fe878f182ed45289c66d2e756e5a1e
Instruction Fuzzy Hash: 73B182716083409BC614FB25C892BAFB7E5AFD4314F40492EF889632D2EF789945C79B

Function 00413F0F Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 109libraryloaderCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00413F5E
LoadLibraryA.KERNEL32(?), ref: 00413FA0
GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00413FC0
FreeLibrary.KERNEL32(00000000), ref: 00413FC7
LoadLibraryA.KERNEL32(?), ref: 00413FFF
GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414011
FreeLibrary.KERNEL32(00000000), ref: 00414018
GetProcAddress.KERNEL32(00000000,?), ref: 00414027
FreeLibrary.KERNEL32(00000000), ref: 0041403E

Strings

getaddrinfo, xrefs: 00413F1C, 00413FBA, 0041400B
\wship6, xrefs: 00413FE7
\ws2_32, xrefs: 00413F88

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeProc$Load$DirectorySystem
String ID: \ws2_32$\wship6$getaddrinfo
API String ID: 2490988753-3078833738
Opcode ID: a1ebb0e7ad90273c6050595515f5be941597b1bff8e5ee6fc120c50391cee153
Instruction ID: be6955175b5ce73d91635d8a52bfbd354ab09fdd92d7e760b1966c561f7cb5d0
Opcode Fuzzy Hash: a1ebb0e7ad90273c6050595515f5be941597b1bff8e5ee6fc120c50391cee153
Instruction Fuzzy Hash: B33117B280131567D320EF55DC84EDB7BDCAF89745F01092AFA88A3201D73CD98587AE

Function 0045027D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 004502C1

Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F510
Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F522
Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F534
Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F546
Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F558
Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F56A
Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F57C
Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F58E
Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F5A0
Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F5B2
Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F5C4
Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F5D6
Part of subcall function 0044F4F3: _free.LIBCMT ref: 0044F5E8

_free.LIBCMT ref: 004502B6

Part of subcall function 00446CD5: RtlFreeHeap.NTDLL(00000000,00000000,?,0044FC60,0000000A,00000000,0000000A,00000000,?,0044FF04,0000000A,00000007,0000000A,?,00450415,0000000A), ref: 00446CEB
Part of subcall function 00446CD5: GetLastError.KERNEL32(0000000A,?,0044FC60,0000000A,00000000,0000000A,00000000,?,0044FF04,0000000A,00000007,0000000A,?,00450415,0000000A,0000000A), ref: 00446CFD

_free.LIBCMT ref: 004502D8
_free.LIBCMT ref: 004502ED
_free.LIBCMT ref: 004502F8
_free.LIBCMT ref: 0045031A
_free.LIBCMT ref: 0045032D
_free.LIBCMT ref: 0045033B
_free.LIBCMT ref: 00450346
_free.LIBCMT ref: 0045037E
_free.LIBCMT ref: 00450385
_free.LIBCMT ref: 004503A2
_free.LIBCMT ref: 004503BA

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 0aefceb04b648aea5efd53e91dec8318d050154b6956abd82aee10787160205d
Instruction ID: 8d5a52dc196ca223d521196e0170462af54da78aea2ffa7a7b46d1c1532e12ca
Opcode Fuzzy Hash: 0aefceb04b648aea5efd53e91dec8318d050154b6956abd82aee10787160205d
Instruction Fuzzy Hash: 57316F355003009FEB20AA79D84AB5B73E9EF01365F51445FF88AD7652DF38AC48D719

Function 0040C66D Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 147COMMON

Download Yara Rule

APIs

Part of subcall function 00411771: TerminateProcess.KERNEL32(00000000,pth_unenc,0040E748), ref: 00411781
Part of subcall function 00411771: WaitForSingleObject.KERNEL32(000000FF), ref: 00411794

Part of subcall function 00412735: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,00000000,00475308), ref: 00412751
Part of subcall function 00412735: RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,00000208,?), ref: 0041276A
Part of subcall function 00412735: RegCloseKey.KERNEL32(00000000), ref: 00412775

GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 0040C6C7
ShellExecuteW.SHELL32(00000000,open,00000000,00466900,00466900,00000000), ref: 0040C826
ExitProcess.KERNEL32 ref: 0040C832

Strings

open, xrefs: 0040C820
.vbs, xrefs: 0040C6CD
exepath, xrefs: 0040C69F
CreateObject("WScript.Shell").Run "cmd /c "", xrefs: 0040C767
Temp, xrefs: 0040C708
CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName), xrefs: 0040C7D5
PSG, xrefs: 0040C67D
""", 0, xrefs: 0040C74F

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Process$CloseExecuteExitFileModuleNameObjectOpenQueryShellSingleTerminateValueWait
String ID: """, 0$.vbs$CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)$CreateObject("WScript.Shell").Run "cmd /c ""$PSG$Temp$exepath$open
API String ID: 1913171305-1605470806
Opcode ID: e25f8157e9f350052b0f4595ec8701be29ea22bdce4a73478e308fb1e33702c0
Instruction ID: 0a59ab1ac2652dc6c4b0de1f1bfb113b457f9f33def171b9a9917dadcc9857af
Opcode Fuzzy Hash: e25f8157e9f350052b0f4595ec8701be29ea22bdce4a73478e308fb1e33702c0
Instruction Fuzzy Hash: 2E416D329101185ACB14F761DC56DFE7779AF50708F10417FF806B31E2EE786A8ACA98

Function 0044F5F1 Relevance: 18.4, APIs: 12, Instructions: 376COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0044F639
_free.LIBCMT ref: 0044F65D
_free.LIBCMT ref: 0044F66A
_free.LIBCMT ref: 0044F68F
_free.LIBCMT ref: 0044F69C
_free.LIBCMT ref: 0044F6A5
_free.LIBCMT ref: 0044F983
_free.LIBCMT ref: 0044F98B

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: b030283a6c0ce51ba92dd09d555ed862ebb201d4cb761b5ee972a13664eb7e13
Instruction ID: 986e8a668492dbee8f9f46891c6c86f5dcf9ebf43b9fca0c5b911ed3811bef24
Opcode Fuzzy Hash: b030283a6c0ce51ba92dd09d555ed862ebb201d4cb761b5ee972a13664eb7e13
Instruction Fuzzy Hash: 1FC15371D40204BBEB20EAA8CC82FEE77B89B08704F15416AFE45FB282D6749D459768

Function 004047EB Relevance: 18.1, APIs: 12, Instructions: 66synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,00404B8E,?,?,?,00404B26), ref: 004047FD
SetEvent.KERNEL32(?,?,?,?,00000000,?,00404B8E,?,?,?,00404B26), ref: 00404808
CloseHandle.KERNEL32(?,?,?,?,00000000,?,00404B8E,?,?,?,00404B26), ref: 00404811
closesocket.WS2_32(000000FF), ref: 0040481F
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,00404B8E,?,?,?,00404B26), ref: 00404856
SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00404867
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040486E
SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404880
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404885
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040488A
SetEvent.KERNEL32(?,?,?,?,00000000,?,00404B8E,?,?,?,00404B26), ref: 00404895
CloseHandle.KERNEL32(?,?,?,?,00000000,?,00404B8E,?,?,?,00404B26), ref: 0040489A

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$ObjectSingleWait$closesocket
String ID:
API String ID: 3658366068-0
Opcode ID: 0962e5985aceae85a5c94cde7029e24ad356a8ace8c6bfbca5ef33fdb60659b2
Instruction ID: bab6184e8302d1d457a53eef1949a11c31841f7ba2aeead181e9cd14b25d2afd
Opcode Fuzzy Hash: 0962e5985aceae85a5c94cde7029e24ad356a8ace8c6bfbca5ef33fdb60659b2
Instruction Fuzzy Hash: 21212C71100F149FC6216B26DC05A17BBE1EF40325F104A6EE2A622AF2CF35F851DB4C

Function 00454B92 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00454860: CreateFileW.KERNEL32(00000000,?,?,;LE,?,?,00000000,?,00454C3B,00000000,0000000C), ref: 0045487D

GetLastError.KERNEL32 ref: 00454CA6
__dosmaperr.LIBCMT ref: 00454CAD
GetFileType.KERNEL32(00000000), ref: 00454CB9
GetLastError.KERNEL32 ref: 00454CC3
__dosmaperr.LIBCMT ref: 00454CCC
CloseHandle.KERNEL32(00000000), ref: 00454CEC
CloseHandle.KERNEL32(?), ref: 00454E36
GetLastError.KERNEL32 ref: 00454E68
__dosmaperr.LIBCMT ref: 00454E6F

Strings

H, xrefs: 00454DF4

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 7241ecee4a5f1f89fc763009d89c6ec11b2c57897b1f7dc41199f6beedf99759
Instruction ID: a1ee14646c220e05fb339a94c39d658440f80e8cb8884f5184f0ba1168eb6fd8
Opcode Fuzzy Hash: 7241ecee4a5f1f89fc763009d89c6ec11b2c57897b1f7dc41199f6beedf99759
Instruction Fuzzy Hash: EBA126319045489FDF19DF68D8427AE7BB1EB46329F14015EEC01AF392CB398896CB5A

Function 0041931E Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 174sleeptimeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00419323
GdiplusStartup.GDIPLUS(00474AF4,?,00000000), ref: 00419355
CreateDirectoryW.KERNEL32(00000000,00000000,00000000,0000001A,00000019), ref: 004193E1
Sleep.KERNEL32(000003E8), ref: 00419463
GetLocalTime.KERNEL32(?), ref: 00419472
Sleep.KERNEL32(00000000,00000018,00000000), ref: 0041955B

Strings

wnd_%04i%02i%02i_%02i%02i%02i, xrefs: 00419404, 0041941F, 00419496
time_%04i%02i%02i_%02i%02i%02i, xrefs: 00419409
VG, xrefs: 004194B7
VG, xrefs: 004193BC

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Sleep$CreateDirectoryGdiplusH_prologLocalStartupTime
String ID: time_%04i%02i%02i_%02i%02i%02i$wnd_%04i%02i%02i_%02i%02i%02i$VG$VG
API String ID: 489098229-455837001
Opcode ID: 500acf9a494ada26150f229ae3ebd5d047cc9a7eea70b6fe6913e98e6c89e00a
Instruction ID: fd6a6a94d4e700b4a78141c9ee43bb9ee9cebd21b8d39b126fa21a823fd8be24
Opcode Fuzzy Hash: 500acf9a494ada26150f229ae3ebd5d047cc9a7eea70b6fe6913e98e6c89e00a
Instruction Fuzzy Hash: 9F517B71A002449ACB14BBB5C866AFE7BA9AB55308F40403FF845B71D2EF3C5E85C799

Function 00413D3F Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 155COMMON

Download Yara Rule

Strings

udp, xrefs: 00413DEF, 00413DF7, 00413DFB
65535, xrefs: 00413D42

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID:
String ID: 65535$udp
API String ID: 0-1267037602
Opcode ID: ca54308d78d3c4eee7f7b8de95e44a5f1974b5ba6ce0b2e83d9cd08af329ba0f
Instruction ID: c3bfc2202edcb816331f8b78e042012e01f064b481147a6b300cfea58c86e196
Opcode Fuzzy Hash: ca54308d78d3c4eee7f7b8de95e44a5f1974b5ba6ce0b2e83d9cd08af329ba0f
Instruction Fuzzy Hash: E241F4716093029BD7209F28D905BBB3BA4EB84742F04042FF98593391EB6DDEC1866E

Function 0041700D Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 107filesynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000000FF,00000070,00466554), ref: 0041710A
CloseHandle.KERNEL32(00000000), ref: 00417113
DeleteFileA.KERNEL32(00000000), ref: 00417122
ShellExecuteExA.SHELL32(0000003C,00000000,00000010,?,?,?), ref: 004170D6

Part of subcall function 00404468: send.WS2_32(000002FC,00000000,00000000,00000000), ref: 004044FD

Strings

HVG, xrefs: 0041714F
@, xrefs: 004170B8
TeF, xrefs: 004170DE
Temp, xrefs: 0041702E
<, xrefs: 004170B1
HVG, xrefs: 004170E3

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: CloseDeleteExecuteFileHandleObjectShellSingleWaitsend
String ID: <$@$HVG$HVG$TeF$Temp
API String ID: 1107811701-3258348784
Opcode ID: d902a6d54ce373eeaba4fe26e471b4facccc04bacbce4bf5cb3c6a9bc09dc6e7
Instruction ID: 91e4b2e714ed18abe86730f534b33d619c8c8851ecafca63038a632c75497fc1
Opcode Fuzzy Hash: d902a6d54ce373eeaba4fe26e471b4facccc04bacbce4bf5cb3c6a9bc09dc6e7
Instruction Fuzzy Hash: 00319C31A00209ABCB04FBA1DC56AEE7775AF50308F40417EF506761E2EF785A89CB99

Function 00439571 Relevance: 16.6, APIs: 11, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401AD8,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 004395C9
GetLastError.KERNEL32(?,?,00401AD8,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 004395D6
__dosmaperr.LIBCMT ref: 004395DD
MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401AD8,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 00439609
GetLastError.KERNEL32(?,?,?,00401AD8,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 00439613
__dosmaperr.LIBCMT ref: 0043961A
WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,?,?,?,?,?,00401AD8,?), ref: 0043965D
GetLastError.KERNEL32(?,?,?,?,?,?,00401AD8,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 00439667
__dosmaperr.LIBCMT ref: 0043966E
_free.LIBCMT ref: 0043967A
_free.LIBCMT ref: 00439681

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr$_free
String ID:
API String ID: 2441525078-0
Opcode ID: 7d25b48f924a9fae5a5881453bd469cfe57fd0c2e6412707544dbbd620f0408d
Instruction ID: 4e2bc3e06b1619faa1414a7a2c806c5d1514cda6e297fdc8b1054bbcfea92265
Opcode Fuzzy Hash: 7d25b48f924a9fae5a5881453bd469cfe57fd0c2e6412707544dbbd620f0408d
Instruction Fuzzy Hash: D431E27280560ABFDF11AFA5DC459AF3B68EF09324F10015EF81066251DB39CD50DBAA

Function 00404E52 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 155windowmemoryCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?), ref: 00404E71
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00404F21
TranslateMessage.USER32(?), ref: 00404F30
DispatchMessageA.USER32(?), ref: 00404F3B
HeapCreate.KERNEL32(00000000,00000000,00000000,00000074,00474F78), ref: 00404FF3
HeapFree.KERNEL32(00000000,00000000,0000003B,0000003B,?,00000000), ref: 0040502B

Part of subcall function 00404468: send.WS2_32(000002FC,00000000,00000000,00000000), ref: 004044FD

Strings

GetMessage, xrefs: 00404FAA
DisplayMessage, xrefs: 00404F9E
CloseChat, xrefs: 00404FBB

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Message$Heap$CreateDispatchEventFreeTranslatesend
String ID: CloseChat$DisplayMessage$GetMessage
API String ID: 2956720200-749203953
Opcode ID: 96316b140588b7c4ada28055f90010ccda92cd34d6d0a69490f2829ee7134a41
Instruction ID: 290a0909c372499a911e5ffd519e5407deecd3e64339803c74491ead196e324c
Opcode Fuzzy Hash: 96316b140588b7c4ada28055f90010ccda92cd34d6d0a69490f2829ee7134a41
Instruction Fuzzy Hash: A441B1726043016BC614FB75DC568AF7BA8ABC1714F00093EF906A31E6EF38DA05C79A

Function 00406616 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 98COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00475A50,00000000,004752F0,00003000,00000004,00000000,00000001), ref: 00406647
GetCurrentProcess.KERNEL32(00475A50,00000000,00008000,?,00000000,00000001,00000000,004068BB,C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe), ref: 00406705

Strings

explorer.exe, xrefs: 004066BD, 004066E2
[-] NtAllocateVirtualMemory Error, xrefs: 004066AA
peF, xrefs: 0040672B
\explorer.exe, xrefs: 0040666A
windir, xrefs: 00406654
[+] NtAllocateVirtualMemory Success, xrefs: 0040667A
PEB: %x, xrefs: 00406716

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: CurrentProcess
String ID: PEB: %x$[+] NtAllocateVirtualMemory Success$[-] NtAllocateVirtualMemory Error$\explorer.exe$explorer.exe$peF$windir
API String ID: 2050909247-369753874
Opcode ID: 3d4dde61fac8f932cecf13147f1715ad91c8a5d9075df555c2e0fc840e87cdfb
Instruction ID: 2a8ac338152687dbadce55b3d6de3572d7837fd421bef744f3a625c24d449dc1
Opcode Fuzzy Hash: 3d4dde61fac8f932cecf13147f1715ad91c8a5d9075df555c2e0fc840e87cdfb
Instruction Fuzzy Hash: B231B671600700AFD300AF65DC8AF5677A8FB44709F11053EF50ABB6E1EBB9A8548B6D

Function 00419E7B Relevance: 15.1, APIs: 10, Instructions: 66serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000011,00000000,?,?,?,?,?,?,004197EE,00000000,00000000), ref: 00419E8A
OpenServiceW.ADVAPI32(00000000,00000000,000F003F,?,?,?,?,?,?,004197EE,00000000,00000000), ref: 00419EA1
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,004197EE,00000000,00000000), ref: 00419EAE
ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,004197EE,00000000,00000000), ref: 00419EBD
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,004197EE,00000000,00000000), ref: 00419ECE
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,004197EE,00000000,00000000), ref: 00419ED1

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ControlManager
String ID:
API String ID: 221034970-0
Opcode ID: d8ee8a8803e7433114f97b69310c3a8ddf5ffb6cd74ebe626055e8ac32cb8db8
Instruction ID: 401ec45fa9dd23e1a78cca63bf6ad54db5d4c9b9326c405a7ffc92fc58cb3c60
Opcode Fuzzy Hash: d8ee8a8803e7433114f97b69310c3a8ddf5ffb6cd74ebe626055e8ac32cb8db8
Instruction Fuzzy Hash: 4211A331941218BBD711AB64DC85DFF3B6CDB45BA1B05002AF902A21D2DF64CD4A9AB5

Function 00446FDB Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00446FEF

Part of subcall function 00446CD5: RtlFreeHeap.NTDLL(00000000,00000000,?,0044FC60,0000000A,00000000,0000000A,00000000,?,0044FF04,0000000A,00000007,0000000A,?,00450415,0000000A), ref: 00446CEB
Part of subcall function 00446CD5: GetLastError.KERNEL32(0000000A,?,0044FC60,0000000A,00000000,0000000A,00000000,?,0044FF04,0000000A,00000007,0000000A,?,00450415,0000000A,0000000A), ref: 00446CFD

_free.LIBCMT ref: 00446FFB
_free.LIBCMT ref: 00447006
_free.LIBCMT ref: 00447011
_free.LIBCMT ref: 0044701C
_free.LIBCMT ref: 00447027
_free.LIBCMT ref: 00447032
_free.LIBCMT ref: 0044703D
_free.LIBCMT ref: 00447048
_free.LIBCMT ref: 00447056

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 6cab9f7d569f345c7814ae43f5c160195df6b64f63ea78a6b18b8aa73aee7787
Instruction ID: 9fec27c2adf71536e74eabd4120179072dbaa777ef3671cded9c13d0800a1e4b
Opcode Fuzzy Hash: 6cab9f7d569f345c7814ae43f5c160195df6b64f63ea78a6b18b8aa73aee7787
Instruction Fuzzy Hash: 86119B7550011CBFDB05EF55C882CDD3BB5EF05364B9240AAF9494F222DA35DE50EB49

Function 0041BA2F Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 214registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020019,?), ref: 0041BA51
RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 0041BA95
RegCloseKey.ADVAPI32(?), ref: 0041BD5F

Strings

Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 0041BA47
DisplayName, xrefs: 0041BADC

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: DisplayName$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 1332880857-3614651759
Opcode ID: 403d69b7d6150682721d806f011c6d0cce43ad32a20d27b465eebd232eb4432d
Instruction ID: 1bcbf0a3cc417a03c0c35e29071d92a42b6db1fb54f2f7a4c144fc0fa0a0a3c2
Opcode Fuzzy Hash: 403d69b7d6150682721d806f011c6d0cce43ad32a20d27b465eebd232eb4432d
Instruction Fuzzy Hash: 43813F311082409FD324EB11D951AEFB7E8FFD4314F10493FB586921E1EF34AA59CA9A

Function 004103EC Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 192COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?), ref: 0041040B
inet_ntoa.WS2_32(?), ref: 004104A6

Strings

NG, xrefs: 00410431
StopReverse, xrefs: 00410598
StartForward, xrefs: 0041056A
StartReverse, xrefs: 00410576
StopForward, xrefs: 00410587
GetDirectListeningPort, xrefs: 004105A9

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Eventinet_ntoa
String ID: GetDirectListeningPort$StartForward$StartReverse$StopForward$StopReverse$NG
API String ID: 3578746661-3604713145
Opcode ID: 755815a8590020fe67a5e007faf453d0433b6e07d610cf032f2efe3dd928df76
Instruction ID: 73c74054356758d85ec5353b0407031f458931cc5dd6312d5a4dd957febfbb04
Opcode Fuzzy Hash: 755815a8590020fe67a5e007faf453d0433b6e07d610cf032f2efe3dd928df76
Instruction Fuzzy Hash: 5851A4316043005BCA14FB75D95AAAE36A59B84318F00453FF809972E1DFBC9D85C78E

Function 004167E2 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 103sleepfileCOMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,open,dxdiag,00000000,00000000,00000000), ref: 00416842

Part of subcall function 0041B825: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,00000000,00409F65), ref: 0041B83E

Sleep.KERNEL32(00000064), ref: 0041686E
DeleteFileW.KERNEL32(00000000), ref: 004168A2

Strings

open, xrefs: 0041683C
/t , xrefs: 00416821
temp, xrefs: 004167F2
dxdiag, xrefs: 00416837
\sysinfo.txt, xrefs: 004167ED

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: File$CreateDeleteExecuteShellSleep
String ID: /t $\sysinfo.txt$dxdiag$open$temp
API String ID: 1462127192-2001430897
Opcode ID: 30589525983727894ad073842d04d74b43d138f664415db5492ece07a2d42c30
Instruction ID: c4be9e9118a59201799f54b99a9a171b680bb642a7e99c3b30ff6139130205e5
Opcode Fuzzy Hash: 30589525983727894ad073842d04d74b43d138f664415db5492ece07a2d42c30
Instruction Fuzzy Hash: 1B313E719001189ADB04FBA1DC96EEE7764AF50708F00417FF946730D2EF786A8ACA9D

Function 00401A8E Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 89COMMON

Download Yara Rule

APIs

_strftime.LIBCMT ref: 00401AD3

Part of subcall function 00401BE8: CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401C54

waveInUnprepareHeader.WINMM(00472AC0,00000020,00000000,?), ref: 00401B85
waveInPrepareHeader.WINMM(00472AC0,00000020), ref: 00401BC3
waveInAddBuffer.WINMM(00472AC0,00000020), ref: 00401BD2

Strings

dMG, xrefs: 00401B04
%Y-%m-%d %H.%M, xrefs: 00401AC4
.wav, xrefs: 00401AEC
|MG, xrefs: 00401B8B

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: wave$Header$BufferCreateFilePrepareUnprepare_strftime
String ID: %Y-%m-%d %H.%M$.wav$dMG$|MG
API String ID: 3809562944-243156785
Opcode ID: 8bc7c709b81e80b1cd26a8133e5bfa918e3c280da4f8c48c3ca11c29a62aef04
Instruction ID: b0e15ff03f11dcb3e5bfd7c1448581b7ace3962aa9bffbd159c0990beee9d81b
Opcode Fuzzy Hash: 8bc7c709b81e80b1cd26a8133e5bfa918e3c280da4f8c48c3ca11c29a62aef04
Instruction Fuzzy Hash: 7E315E315043019FC324EB21DC56A9E77A4FB94314F00493EF559A21F1EFB8AA89CB9A

Function 0041CB7A Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 47windowstringCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0041CB93

Part of subcall function 0041CC2A: RegisterClassExA.USER32(00000030), ref: 0041CC77
Part of subcall function 0041CC2A: CreateWindowExA.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,00000000,00000000), ref: 0041CC92
Part of subcall function 0041CC2A: GetLastError.KERNEL32 ref: 0041CC9C

ExtractIconA.SHELL32(00000000,?,00000000), ref: 0041CBCA
lstrcpynA.KERNEL32(00474B68,Remcos,00000080), ref: 0041CBE4
Shell_NotifyIconA.SHELL32(00000000,00474B50), ref: 0041CBFA
TranslateMessage.USER32(?), ref: 0041CC06
DispatchMessageA.USER32(?), ref: 0041CC10
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0041CC1D

Strings

Remcos, xrefs: 0041CBD5

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Message$Icon$ClassCreateDispatchErrorExtractFileLastModuleNameNotifyRegisterShell_TranslateWindowlstrcpyn
String ID: Remcos
API String ID: 1970332568-165870891
Opcode ID: 7a949f86bc247f3cbdd076edfe2cda77560b6c3ffe772df9fdb29a851d56ec4a
Instruction ID: 6591afd7fea275f101bd811abb8745f55115b26a2df550b070e187602390ba30
Opcode Fuzzy Hash: 7a949f86bc247f3cbdd076edfe2cda77560b6c3ffe772df9fdb29a851d56ec4a
Instruction Fuzzy Hash: 130112B1940344ABD7109BA5EC4DFEABBBCA7C5B05F004029E615A2061EFB8E585CB6D

Function 0044B660 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b79e0bacf68e79f56bbfbff6a95aeb92d11d955db7cfd18af0a5c0e52fbe5259
Instruction ID: 8081305e108bfff8a8e14cd18a234b42858a69a1a1930647e7f2335dd99175ec
Opcode Fuzzy Hash: b79e0bacf68e79f56bbfbff6a95aeb92d11d955db7cfd18af0a5c0e52fbe5259
Instruction Fuzzy Hash: 44C105B0D04249AFEF11DFA9C8417BEBBB4EF09314F04415AE544A7392C738D941CBA9

Function 00452D3A Relevance: 13.8, APIs: 9, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,00453013,00000000,00000000,?,00000001,?,?,?,?,00000001), ref: 00452DE6
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000001,00000000,00000000,?,00453013,00000000,00000000,?,00000001,?,?,?,?), ref: 00452E69
__alloca_probe_16.LIBCMT ref: 00452EA1
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000001,00000000,00453013,?,00453013,00000000,00000000,?,00000001,?,?,?,?), ref: 00452EFC
__alloca_probe_16.LIBCMT ref: 00452F4B
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00453013,00000000,00000000,?,00000001,?,?,?,?), ref: 00452F13

Part of subcall function 00446D0F: RtlAllocateHeap.NTDLL(00000000,00434613,?,?,00437437,?,?,?,?,?,0040CD5A,00434613,?,?,?,?), ref: 00446D41

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,00453013,00000000,00000000,?,00000001,?,?,?,?), ref: 00452F8F
__freea.LIBCMT ref: 00452FBA
__freea.LIBCMT ref: 00452FC6

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$__alloca_probe_16__freea$AllocateHeapInfo
String ID:
API String ID: 201697637-0
Opcode ID: 636d8ee8978a4b28d28c899fe5287c94f7ea3d2e518637072967bc6aea0c1ce5
Instruction ID: e285173fe66e9ab68cc8b5f7bb46492c032c90826bba7407019ac45f59d87ef3
Opcode Fuzzy Hash: 636d8ee8978a4b28d28c899fe5287c94f7ea3d2e518637072967bc6aea0c1ce5
Instruction Fuzzy Hash: E991D572E002169BDF208E64DA41AEFBBB5AF0A312F14055BFC05E7242D778DC48C768

Function 00444609 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004470CF: GetLastError.KERNEL32(?,?,0043952C,?,00000000,?,0043BB65,00000000,00000000), ref: 004470D3
Part of subcall function 004470CF: _free.LIBCMT ref: 00447106
Part of subcall function 004470CF: SetLastError.KERNEL32(00000000,00000000,00000000), ref: 00447147
Part of subcall function 004470CF: _abort.LIBCMT ref: 0044714D

_memcmp.LIBVCRUNTIME ref: 004448B3
_free.LIBCMT ref: 00444924
_free.LIBCMT ref: 0044493D
_free.LIBCMT ref: 0044496F
_free.LIBCMT ref: 00444978
_free.LIBCMT ref: 00444984

Strings

C, xrefs: 00444771

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast$_abort_memcmp
String ID: C
API String ID: 1679612858-1037565863
Opcode ID: 614205798ad6061f3d9420df6d0f7eb30440e43e095dda7afa9147f4421e103d
Instruction ID: ce46d41f1d9e01bafc0896c2bb0d2adb680072b6a59d341745b23d3028246374
Opcode Fuzzy Hash: 614205798ad6061f3d9420df6d0f7eb30440e43e095dda7afa9147f4421e103d
Instruction Fuzzy Hash: 24B14975A012199FEB24DF18C884BAEB7B4FF49314F1045AEE849A7351D738AE90CF48

Function 00413A9F Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 228COMMON

Download Yara Rule

Strings

udp, xrefs: 00413BD9
tcp, xrefs: 00413C03

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID:
String ID: tcp$udp
API String ID: 0-3725065008
Opcode ID: af4d639371690cb8637a3a63659cf8324f890a8ac4b6ebd8bb2dc9423f2fa13d
Instruction ID: 641150f3fd0ea6af627c79cdc5c75230aa36f57d28899e04d0661f3c05bf373f
Opcode Fuzzy Hash: af4d639371690cb8637a3a63659cf8324f890a8ac4b6ebd8bb2dc9423f2fa13d
Instruction Fuzzy Hash: 0D71D1716083528FDB24CF1994846ABB7E0AF84746F14442FF885A7352E77CDE81CB8A

Function 0044821F Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 171timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045E478), ref: 00448289
WideCharToMultiByte.KERNEL32(00000000,00000000,0047279C,000000FF,00000000,0000003F,00000000,?,?), ref: 00448301
WideCharToMultiByte.KERNEL32(00000000,00000000,004727F0,000000FF,?,0000003F,00000000,?), ref: 0044832E
_free.LIBCMT ref: 00448277

Part of subcall function 00446CD5: RtlFreeHeap.NTDLL(00000000,00000000,?,0044FC60,0000000A,00000000,0000000A,00000000,?,0044FF04,0000000A,00000007,0000000A,?,00450415,0000000A), ref: 00446CEB
Part of subcall function 00446CD5: GetLastError.KERNEL32(0000000A,?,0044FC60,0000000A,00000000,0000000A,00000000,?,0044FF04,0000000A,00000007,0000000A,?,00450415,0000000A,0000000A), ref: 00446CFD

_free.LIBCMT ref: 00448443

Strings

xE, xrefs: 00448232, 00448238
xE, xrefs: 004483A6

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
String ID: xE$xE
API String ID: 1286116820-1741595589
Opcode ID: 1f630aa574f8f032912558e332746922b811222e22d4e5e5c8fa9a473f36de46
Instruction ID: 82a604bb7294b81f3f73b5ad664ce4632eb81d562d18d3de5c52697f85b56542
Opcode Fuzzy Hash: 1f630aa574f8f032912558e332746922b811222e22d4e5e5c8fa9a473f36de46
Instruction Fuzzy Hash: 43510871900219ABEB14EF698D819AE77BCEF44B14F1002AFF854A3291EF788D418B5C

Function 00412D60 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 135registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00020019,?), ref: 00412D99

Part of subcall function 00412A82: RegQueryInfoKeyW.ADVAPI32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00412AF5
Part of subcall function 00412A82: RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?,?,?,?,00000000,?,?,?,?), ref: 00412B24

Part of subcall function 00404468: send.WS2_32(000002FC,00000000,00000000,00000000), ref: 004044FD

RegCloseKey.ADVAPI32(TeFTeF,00466554,00466554,00466900,00466900,00000071), ref: 00412F09

Strings

TeF, xrefs: 00412EEA
NG, xrefs: 00412DC8
TG, xrefs: 00412DD0
TeFTeF, xrefs: 00412F05
TG, xrefs: 00412ED7

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: CloseEnumInfoOpenQuerysend
String ID: TeF$TeFTeF$NG$TG$TG
API String ID: 3114080316-3278504382
Opcode ID: 21c71a250b61d8481e14fb29f658506147abfbd5a14f52d08b2dadadcd8e3add
Instruction ID: 217e792c851e8857c64f97df11b7492b8bc11e7bd79a931969a0b124146415da
Opcode Fuzzy Hash: 21c71a250b61d8481e14fb29f658506147abfbd5a14f52d08b2dadadcd8e3add
Instruction Fuzzy Hash: ED41A1316042005BD224F725D8A2AEF7395AFD0308F50843FF94A671E2EF7C5D4986AE

Function 00406BE9 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 97fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000004,00000000,00000000,00000002,00000080,00000000,00466454,?,?,00000000,00407273,00000000,?,0000000A,00000000), ref: 00406C38
WriteFile.KERNEL32(00000000,?,00000000,?,00000000,?,000186A0,?,?,?,00000000,00407273,00000000,?,0000000A,00000000), ref: 00406C80

Part of subcall function 00404468: send.WS2_32(000002FC,00000000,00000000,00000000), ref: 004044FD

CloseHandle.KERNEL32(00000000,?,?,00000000,00407273,00000000,?,0000000A,00000000,00000000), ref: 00406CC0
MoveFileW.KERNEL32(00000000,00000000), ref: 00406CDD
CloseHandle.KERNEL32(00000000,00000057,?,00000008,?,?,?,?,?,?,0000000A,00000000,00000000), ref: 00406D08
DeleteFileW.KERNEL32(00000000,?,?,?,?,?,?,0000000A,00000000,00000000), ref: 00406D18

Part of subcall function 0040455B: WaitForSingleObject.KERNEL32(?,000000FF,?,?,0040460E,00000000,?,?), ref: 0040456A
Part of subcall function 0040455B: SetEvent.KERNEL32(?,?,?,0040460E,00000000,?,?), ref: 00404588

Strings

.part, xrefs: 00406C0F

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$CreateDeleteEventMoveObjectSingleWaitWritesend
String ID: .part
API String ID: 1303771098-3499674018
Opcode ID: b78f9c0dad55f8f19791313ae5084cf2035b383ecf8786089be001690557f36c
Instruction ID: 7eae26b3d9efd85ab9a821acf87acbbc445967fcd6ce231ca79d13f55b5b668b
Opcode Fuzzy Hash: b78f9c0dad55f8f19791313ae5084cf2035b383ecf8786089be001690557f36c
Instruction Fuzzy Hash: C631A4715083019FD210EF21DD459AFB7A8FB84755F40093EF9C6B21A1DF38AA48CB9A

Function 0040B6EA Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 004125EB: RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 0041260F
Part of subcall function 004125EB: RegQueryValueExA.KERNEL32(?,?,00000000,00000000,?,00000400), ref: 0041262C
Part of subcall function 004125EB: RegCloseKey.KERNEL32(?), ref: 00412637

ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,00000000), ref: 0040B76C
PathFileExistsA.SHLWAPI(?), ref: 0040B779

Strings

[IE cookies cleared!], xrefs: 0040B7C6, 0040B7E6
Cookies, xrefs: 0040B6FE
Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders, xrefs: 0040B703
TeF, xrefs: 0040B72B
[IE cookies not found], xrefs: 0040B741

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: CloseEnvironmentExistsExpandFileOpenPathQueryStringsValue
String ID: [IE cookies cleared!]$[IE cookies not found]$Cookies$Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders$TeF
API String ID: 1133728706-3101562037
Opcode ID: f8e7fb648c548857668710dd0e9519a80c5674c84583f57a4e2fba272261da1f
Instruction ID: 7ed93d3ebd4d115a7197ccd8f2df160251767479400bef64a6787df62d4369c8
Opcode Fuzzy Hash: f8e7fb648c548857668710dd0e9519a80c5674c84583f57a4e2fba272261da1f
Instruction Fuzzy Hash: 29215C31A1410966CB04F7B2CCA69EE7764AE94318F40013FA902771D2EF789A4986DE

Function 0040196B Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,00000000), ref: 0040197B
waveInOpen.WINMM(00472AF8,000000FF,00472B00,Function_00001A8E,00000000,00000000,00000024), ref: 00401A11
waveInPrepareHeader.WINMM(00472AC0,00000020,00000000), ref: 00401A66
waveInAddBuffer.WINMM(00472AC0,00000020), ref: 00401A75
waveInStart.WINMM ref: 00401A81

Strings

|MG, xrefs: 00401A1E
dMG, xrefs: 0040196F

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: wave$BufferCreateDirectoryHeaderOpenPrepareStart
String ID: dMG$|MG
API String ID: 1356121797-1683252805
Opcode ID: 77e1d5555118943626de1adf0eca28b59d42989bc3a47fc9702db746b9fc2c03
Instruction ID: 140f40b68b7a2e7574469051551963e155d477b90c1392cdc23a62cf20397fe9
Opcode Fuzzy Hash: 77e1d5555118943626de1adf0eca28b59d42989bc3a47fc9702db746b9fc2c03
Instruction Fuzzy Hash: 52215C316002019BC725DF66EE1996A7BA6FB84710B00883EF50DE76B0DBF898C0CB5C

Function 0041C0BB Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

AllocConsole.KERNEL32(004750FC), ref: 0041C0C4
GetConsoleWindow.KERNEL32 ref: 0041C0CA
ShowWindow.USER32(00000000,00000000), ref: 0041C0DD
SetConsoleOutputCP.KERNEL32(000004E4), ref: 0041C102

Strings

Remcos v, xrefs: 0041C11D
6.0.0 Pro, xrefs: 0041C12B
CONOUT$, xrefs: 0041C0F0

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Console$Window$AllocOutputShow
String ID: Remcos v$6.0.0 Pro$CONOUT$
API String ID: 4067487056-3561919337
Opcode ID: 51f71f4df576cdb042b408fdcee2c306aad9b55f4cf694b49fe88f2f6d88a06c
Instruction ID: 9cd6404a4583bb7861016a5e8077681a34a6ce6b29b6da971a73374578d830bb
Opcode Fuzzy Hash: 51f71f4df576cdb042b408fdcee2c306aad9b55f4cf694b49fe88f2f6d88a06c
Instruction Fuzzy Hash: 750121B1A80304BADA10F7F19D4BF9976AC6B14B09F500426BA05A70C2EEB8A554462D

Function 00449B60 Relevance: 12.2, APIs: 8, Instructions: 216COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,0043D774,0043D774,?,?,?,00449DB1,00000001,00000001,1AE85006), ref: 00449BBA
__alloca_probe_16.LIBCMT ref: 00449BF2
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00449DB1,00000001,00000001,1AE85006,?,?,?), ref: 00449C40
__alloca_probe_16.LIBCMT ref: 00449CD7
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,1AE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00449D3A
__freea.LIBCMT ref: 00449D47

Part of subcall function 00446D0F: RtlAllocateHeap.NTDLL(00000000,00434613,?,?,00437437,?,?,?,?,?,0040CD5A,00434613,?,?,?,?), ref: 00446D41

__freea.LIBCMT ref: 00449D50
__freea.LIBCMT ref: 00449D75

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 3864826663-0
Opcode ID: 45550f184a61a9f8ddf17f24dc0c1f131df532b020593bc4805c091103afbf88
Instruction ID: b9264d00d576e3e69c3e593975f72d59ef517f4fd458bc34bb1ef2c80a576446
Opcode Fuzzy Hash: 45550f184a61a9f8ddf17f24dc0c1f131df532b020593bc4805c091103afbf88
Instruction Fuzzy Hash: 3651F8B2A10206AFFB258F65DC82EBF77A9EB44754F15462EFC05DB240EB38DC409658

Function 00418CB4 Relevance: 12.1, APIs: 8, Instructions: 117keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32 ref: 00418CFE
SendInput.USER32(00000001,?,0000001C), ref: 00418D26
SendInput.USER32(00000001,0000001C,0000001C), ref: 00418D4D
SendInput.USER32(00000001,0000001C,0000001C), ref: 00418D6B
SendInput.USER32(00000001,0000001C,0000001C), ref: 00418D8B
SendInput.USER32(00000001,0000001C,0000001C), ref: 00418DB0
SendInput.USER32(00000001,0000001C,0000001C), ref: 00418DD2
SendInput.USER32(00000001,?,0000001C), ref: 00418DF5

Part of subcall function 00418CA7: MapVirtualKeyA.USER32(00000000,00000000), ref: 00418CAD

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: InputSend$Virtual
String ID:
API String ID: 1167301434-0
Opcode ID: 03d106074c487e793b96b2f05eb270ad55284c326fdeb905245ef2a17d2a5417
Instruction ID: 141eef32e971302722b3407f09031bac5ba220a7556c2b6a6b809b2d6bbc12e7
Opcode Fuzzy Hash: 03d106074c487e793b96b2f05eb270ad55284c326fdeb905245ef2a17d2a5417
Instruction Fuzzy Hash: 2D318031258349A9E210DF65DC41FDFBBECAFC9B08F04080FB58457191EAA4858C87AB

Function 00415BDD Relevance: 12.0, APIs: 8, Instructions: 46clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00415BDE
EmptyClipboard.USER32 ref: 00415BEC
CloseClipboard.USER32 ref: 00415BF2
OpenClipboard.USER32 ref: 00415BF9
GetClipboardData.USER32(0000000D), ref: 00415C09
GlobalLock.KERNEL32(00000000), ref: 00415C12
GlobalUnlock.KERNEL32(00000000), ref: 00415C1B
CloseClipboard.USER32 ref: 00415C21

Part of subcall function 00404468: send.WS2_32(000002FC,00000000,00000000,00000000), ref: 004044FD

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Clipboard$CloseGlobalOpen$DataEmptyLockUnlocksend
String ID:
API String ID: 2172192267-0
Opcode ID: c3bbb9bbde72810014a30b189257db169a48326f431590227c3d1d8f527ca17d
Instruction ID: 369576e1793333014f6cd695595c81a654a0099a6e7e621b1e9fba3c04e1709a
Opcode Fuzzy Hash: c3bbb9bbde72810014a30b189257db169a48326f431590227c3d1d8f527ca17d
Instruction Fuzzy Hash: EE0152322003009FC350BF71DC59AAE77A5AF80B42F00443FFD06A61A2EF35C949C659

Function 00446369 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00446471
__freea.LIBCMT ref: 0044651B
__freea.LIBCMT ref: 00446539

Strings

hD, xrefs: 004467A3
am/pm, xrefs: 0044659C
a/p, xrefs: 00446600

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16
String ID: a/p$am/pm$hD
API String ID: 3509577899-3668228793
Opcode ID: 44ea5ac924aea223c25ec6af7a156dea15db996b08b3c9c3fe5b3e61d2d79652
Instruction ID: deb853d5fd6adf3918d69246e21912660bd894b39407ab32d9d7da7685977c7a
Opcode Fuzzy Hash: 44ea5ac924aea223c25ec6af7a156dea15db996b08b3c9c3fe5b3e61d2d79652
Instruction Fuzzy Hash: 1CD111719002069AFB289F68C9857BBB7B0FF06708F26415BE9019B355D33D9D81CB6B

Function 0044FA16 Relevance: 10.7, APIs: 7, Instructions: 204COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0044FA85
_free.LIBCMT ref: 0044FA93
_free.LIBCMT ref: 0044FBC1
_free.LIBCMT ref: 0044FBCC

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 1d80ecd898b2873860388bfd90a69a91c38572b88f559cfcb1da031a1a01905e
Instruction ID: 0b2e84c71dbf843dbcc2e99f9f8dbab27ea7d8a4e4ef3fbdb467abc62f582456
Opcode Fuzzy Hash: 1d80ecd898b2873860388bfd90a69a91c38572b88f559cfcb1da031a1a01905e
Instruction Fuzzy Hash: E061E271D00244AFEB20DF69C842BAABBF4EB4A320F24407BED45EB251D734AD45DB58

Function 0044418B Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 187COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00446D0F: RtlAllocateHeap.NTDLL(00000000,00434613,?,?,00437437,?,?,?,?,?,0040CD5A,00434613,?,?,?,?), ref: 00446D41

_free.LIBCMT ref: 00444296
_free.LIBCMT ref: 004442AD
_free.LIBCMT ref: 004442CC
_free.LIBCMT ref: 004442E7
_free.LIBCMT ref: 004442FE

Strings

Z9D, xrefs: 004441BB, 0044433D

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: _free$AllocateHeap
String ID: Z9D
API String ID: 3033488037-3781130823
Opcode ID: 1e396c4f324de9ddb7b01a7129941a49517c4d4e7f7401902ff7e7d19c1db4b4
Instruction ID: 86c8eacfe83d9672290f1135950403671a27bde0e5aa55c461cabd1b4ee88ac5
Opcode Fuzzy Hash: 1e396c4f324de9ddb7b01a7129941a49517c4d4e7f7401902ff7e7d19c1db4b4
Instruction Fuzzy Hash: D551B171A00304AFEB20DF6AC881B6A77F4FF95724B1446AEF809D7650E779DA01CB48

Function 0044A2D3 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,0044AA48,?,00000000,00000000,00000000,00000000,0000000C), ref: 0044A315
__fassign.LIBCMT ref: 0044A390
__fassign.LIBCMT ref: 0044A3AB
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 0044A3D1
WriteFile.KERNEL32(?,00000000,00000000,0044AA48,00000000,?,?,?,?,?,?,?,?,?,0044AA48,?), ref: 0044A3F0
WriteFile.KERNEL32(?,?,00000001,0044AA48,00000000,?,?,?,?,?,?,?,?,?,0044AA48,?), ref: 0044A429

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 19793b4b6baa09b5fac30a83039e1f9c1b1fc09f5707b87a30c95e6118fc2717
Instruction ID: 781c03a50f1c813746d4e14bf3c61566c92396d5579059589c4d950ed669b936
Opcode Fuzzy Hash: 19793b4b6baa09b5fac30a83039e1f9c1b1fc09f5707b87a30c95e6118fc2717
Instruction Fuzzy Hash: 6551C474E002499FDB10CFA8D845AEEBBF4EF09300F14412BE955E7291E774A951CB6A

Function 00401768 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 142threadCOMMON

Download Yara Rule

APIs

ExitThread.KERNEL32 ref: 004017F4

Part of subcall function 00433724: EnterCriticalSection.KERNEL32(00471D18,?,00476D54,?,0040AE8B,00476D54,?,00000000,00000000), ref: 0043372F
Part of subcall function 00433724: LeaveCriticalSection.KERNEL32(00471D18,?,0040AE8B,00476D54,?,00000000,00000000), ref: 0043376C

waveInUnprepareHeader.WINMM(?,00000020,00000000,?,00000020,00474EE0,00000000), ref: 00401902

Part of subcall function 00433AB0: __onexit.LIBCMT ref: 00433AB6

__Init_thread_footer.LIBCMT ref: 004017BC

Part of subcall function 004336DA: EnterCriticalSection.KERNEL32(00471D18,00476D54,?,0040AEAC,00476D54,00456FA7,?,00000000,00000000), ref: 004336E4
Part of subcall function 004336DA: LeaveCriticalSection.KERNEL32(00471D18,?,0040AEAC,00476D54,00456FA7,?,00000000,00000000), ref: 00433717

Strings

XMG, xrefs: 00401800
NG, xrefs: 0040188E
NG, xrefs: 0040180B

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$ExitHeaderInit_thread_footerThreadUnprepare__onexitwave
String ID: XMG$NG$NG
API String ID: 1596592924-1283814050
Opcode ID: 9c93778598743552ca7cf549f7c264060170741c6fea158e9adbc4e2dfda7b39
Instruction ID: a5e0bc9ac4bbc073a85812dd1d3adb1d2a3c84d0b98f0a89840e4e641ba94373
Opcode Fuzzy Hash: 9c93778598743552ca7cf549f7c264060170741c6fea158e9adbc4e2dfda7b39
Instruction Fuzzy Hash: 5341B4712042008BC329FB65DD96AAE7395EB94318F10453FF54AA31F2DF389986CB5E

Function 0040E77B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041B366: GetCurrentProcess.KERNEL32(?,?,?,0040C914,WinDir,00000000,00000000), ref: 0041B377
Part of subcall function 0041B366: IsWow64Process.KERNEL32(00000000,?,?,0040C914,WinDir,00000000,00000000), ref: 0041B37E

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040E799
Process32FirstW.KERNEL32(00000000,?), ref: 0040E7BD
Process32NextW.KERNEL32(00000000,0000022C), ref: 0040E7CC
CloseHandle.KERNEL32(00000000), ref: 0040E983

Part of subcall function 0041B392: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,0040E5A8,00000000,?,?,004750FC), ref: 0041B3A7
Part of subcall function 0041B392: IsWow64Process.KERNEL32(00000000,?,?,?,004750FC), ref: 0041B3B2

Part of subcall function 0041B588: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041B5A0
Part of subcall function 0041B588: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041B5B3

Process32NextW.KERNEL32(00000000,0000022C), ref: 0040E974

Strings

`wF, xrefs: 0040E7DA

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Process$OpenProcess32$NextWow64$CloseCreateCurrentFirstHandleSnapshotToolhelp32
String ID: `wF
API String ID: 2180151492-1213667750
Opcode ID: 9dc562cd00f3f50bc6e2eada1fc9f3fa230e0bea5391e794d91a9c4d3f2fe10f
Instruction ID: eccf11dc20c1a31a83cdfd33956dcb3d749eb3f266b118f2c15681f5292a9231
Opcode Fuzzy Hash: 9dc562cd00f3f50bc6e2eada1fc9f3fa230e0bea5391e794d91a9c4d3f2fe10f
Instruction Fuzzy Hash: F741CF311083455BC225FB61D891AEFB7E5AFA4304F50453EF849531E1EF389A49C65A

Function 00437C90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00437CBB
___except_validate_context_record.LIBVCRUNTIME ref: 00437CC3
_ValidateLocalCookies.LIBCMT ref: 00437D51
__IsNonwritableInCurrentImage.LIBCMT ref: 00437D7C
_ValidateLocalCookies.LIBCMT ref: 00437DD1

Strings

csm, xrefs: 00437D66

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: e20e4e91601e7da6f84b85b393d4409c90c36ea595a33a74ae9b4edf16c34eae
Instruction ID: 1103995f59bc857a00dd0af833384e4a9f5f4a2e3f3cb1d3a3c35a3a433dd29e
Opcode Fuzzy Hash: e20e4e91601e7da6f84b85b393d4409c90c36ea595a33a74ae9b4edf16c34eae
Instruction Fuzzy Hash: 4E410674A042099BCF20DF29C844AAE7BA5AF4C328F14905AEC55AB392D739DD45CF98

Function 00455B13 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfbae8f3dcd2e5f3bdf3bcee8d3106cebccc1d81cd58107c476234e6777acd1f
Instruction ID: 890753aa9dfb888b2a1585f98a5e225511b13b718af609ae416a1884f745cca0
Opcode Fuzzy Hash: cfbae8f3dcd2e5f3bdf3bcee8d3106cebccc1d81cd58107c476234e6777acd1f
Instruction Fuzzy Hash: 3A112472504A15BFDB206F729C08D3B3AACEB82736F20016EFC15D7282DE38C800C669

Function 0040FCC7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0040FCD4
int.LIBCPMT ref: 0040FCE7

Part of subcall function 0040CFB3: std::_Lockit::_Lockit.LIBCPMT ref: 0040CFC4
Part of subcall function 0040CFB3: std::_Lockit::~_Lockit.LIBCPMT ref: 0040CFDE

std::_Facet_Register.LIBCPMT ref: 0040FD23
std::_Lockit::~_Lockit.LIBCPMT ref: 0040FD49
__CxxThrowException@8.LIBVCRUNTIME ref: 0040FD65

Strings

xkG, xrefs: 0040FD6C

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
String ID: xkG
API String ID: 2536120697-3406988965
Opcode ID: 4b6f72b1e0d08092fd2688f9826419a51511b3482868562e895aff95ac9ad519
Instruction ID: 7cf641d0f45d7e480cf6c67891cb53e845b1d2cd586d61112ae60f6436568b55
Opcode Fuzzy Hash: 4b6f72b1e0d08092fd2688f9826419a51511b3482868562e895aff95ac9ad519
Instruction Fuzzy Hash: 3B11F032900119A7CB14FBA5D8429DEB7689E55358F10013BF809B72D1EB3CAF49C7D9

Function 0044FEEB Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0044FC32: _free.LIBCMT ref: 0044FC5B

_free.LIBCMT ref: 0044FF39

Part of subcall function 00446CD5: RtlFreeHeap.NTDLL(00000000,00000000,?,0044FC60,0000000A,00000000,0000000A,00000000,?,0044FF04,0000000A,00000007,0000000A,?,00450415,0000000A), ref: 00446CEB
Part of subcall function 00446CD5: GetLastError.KERNEL32(0000000A,?,0044FC60,0000000A,00000000,0000000A,00000000,?,0044FF04,0000000A,00000007,0000000A,?,00450415,0000000A,0000000A), ref: 00446CFD

_free.LIBCMT ref: 0044FF44
_free.LIBCMT ref: 0044FF4F
_free.LIBCMT ref: 0044FFA3
_free.LIBCMT ref: 0044FFAE
_free.LIBCMT ref: 0044FFB9
_free.LIBCMT ref: 0044FFC4

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7c29d87e7d6a666a6374703866dd42c53a280d6db8acc668fe4e1522d65ba280
Instruction ID: 7d3bb130547cbd64d3bc6acdbb054c191a8682768e3bc5df2cfa43195c7f437f
Opcode Fuzzy Hash: 7c29d87e7d6a666a6374703866dd42c53a280d6db8acc668fe4e1522d65ba280
Instruction Fuzzy Hash: 3611603158175CAAE930B7B2CC87FCB779CFF01744F804C2EB69B66052DA2CB90A5655

Function 00406815 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,00000000,C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe), ref: 00406835

Part of subcall function 00406764: _wcslen.LIBCMT ref: 00406788
Part of subcall function 00406764: CoGetObject.OLE32(?,00000024,004669B0,00000000), ref: 004067E9

CoUninitialize.OLE32 ref: 0040688E

Strings

[+] ucmCMLuaUtilShellExecMethod, xrefs: 0040681A
[+] before ShellExec, xrefs: 00406856
[+] ShellExec success, xrefs: 00406873
C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, xrefs: 00406815, 00406818, 0040686A

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: InitializeObjectUninitialize_wcslen
String ID: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe$[+] ShellExec success$[+] before ShellExec$[+] ucmCMLuaUtilShellExecMethod
API String ID: 3851391207-2780929936
Opcode ID: f62f8ea22737c4132ff5b3dac93a03cf3a5d885852b0606909ed978fbfad8032
Instruction ID: bf5204b976fdd256b066cceb308157ad377b3c08e3874fea13dbf5f4dff6080c
Opcode Fuzzy Hash: f62f8ea22737c4132ff5b3dac93a03cf3a5d885852b0606909ed978fbfad8032
Instruction Fuzzy Hash: F20180722023117FE2287B21DC0EF7B6658DB4176AF12413FF946A71C1EAA9AC014679

Function 0040FFAA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0040FFB7
int.LIBCPMT ref: 0040FFCA

Part of subcall function 0040CFB3: std::_Lockit::_Lockit.LIBCPMT ref: 0040CFC4
Part of subcall function 0040CFB3: std::_Lockit::~_Lockit.LIBCPMT ref: 0040CFDE

std::_Facet_Register.LIBCPMT ref: 00410006
std::_Lockit::~_Lockit.LIBCPMT ref: 0041002C
__CxxThrowException@8.LIBVCRUNTIME ref: 00410048

Strings

pmG, xrefs: 0040FFC2

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
String ID: pmG
API String ID: 2536120697-2472243355
Opcode ID: 49ddf8ddb094ef95c775291761389dec69e80ba720e56a3ba1433f00512a79dc
Instruction ID: 7757f8b08a06b45aa46d7f93aac2e311949306114fe400d1b3bff67def6a62fd
Opcode Fuzzy Hash: 49ddf8ddb094ef95c775291761389dec69e80ba720e56a3ba1433f00512a79dc
Instruction Fuzzy Hash: D911B231900419EBCB14FBA5D9429DD7B689E58358F10016FF40567191EB78AF86C789

Function 0040B2A8 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 48fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Cookies), ref: 0040B2E4
GetLastError.KERNEL32 ref: 0040B2EE

Strings

\AppData\Local\Google\Chrome\User Data\Default\Cookies, xrefs: 0040B2AF
UserProfile, xrefs: 0040B2B4
[Chrome Cookies not found], xrefs: 0040B308
[Chrome Cookies found, cleared!], xrefs: 0040B314

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: DeleteErrorFileLast
String ID: [Chrome Cookies found, cleared!]$[Chrome Cookies not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Cookies
API String ID: 2018770650-304995407
Opcode ID: cf451260b0bd619138d89529fe6e6a099da6595cca3d19e9fe3cb5fbfd9057d6
Instruction ID: 9d7a183bab8cffc7e176200adf3036985cfece21d6991fc3b8afe8d0fe8b9813
Opcode Fuzzy Hash: cf451260b0bd619138d89529fe6e6a099da6595cca3d19e9fe3cb5fbfd9057d6
Instruction Fuzzy Hash: AB01623565010557CB0477B6DD6B9AF3628ED51718B60013FF802771E2FE3A990586DE

Function 0043980C Relevance: 9.3, APIs: 6, Instructions: 284COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00439999
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004399B5
__allrem.LIBCMT ref: 004399CC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004399EA
__allrem.LIBCMT ref: 00439A01
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00439A1F

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: b56df2ec526ecb605ad204b00dc5db07d06cb4bbbde3923a820af03cd63327b9
Instruction ID: 5399b0f9a6461ae69e9bde9777a653eaf6085cdcce353b40ae7049a42401d5b7
Opcode Fuzzy Hash: b56df2ec526ecb605ad204b00dc5db07d06cb4bbbde3923a820af03cd63327b9
Instruction Fuzzy Hash: 15810B72A00706ABE724BA79CC41B6B73E89F89768F24522FF411D7781E7B8DD008758

Function 00444D4D Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 00444D79
__cftoe.LIBCMT ref: 00444DAB

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: __cftoe
String ID:
API String ID: 4189289331-0
Opcode ID: 59a84199312040bebd3b7080c8be9dd535ae7880d2ee6b6a8de25d9cd02a2692
Instruction ID: 890c16c57639ce4616fdae23c1b2cf08611ffd87950db76db0bf4773250d0152
Opcode Fuzzy Hash: 59a84199312040bebd3b7080c8be9dd535ae7880d2ee6b6a8de25d9cd02a2692
Instruction Fuzzy Hash: 2C512972900205ABFB249BA98C41FAF77A9EFC8324F24411FF815D6292DB3DDD11966C

Function 00403DE7 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 135sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00403E8A

Part of subcall function 00403FCD: __EH_prolog.LIBCMT ref: 00403FD2

Strings

HNG, xrefs: 00403FAC
CloseCamera, xrefs: 00403F54
OpenCamera, xrefs: 00403F48
GetFrame, xrefs: 00403F65
FreeFrame, xrefs: 00403F76

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: H_prologSleep
String ID: CloseCamera$FreeFrame$GetFrame$HNG$OpenCamera
API String ID: 3469354165-3054508432
Opcode ID: a571c00ded84ac1c02560f50a488ee548fe76179a7eec9e921c662aaf166c676
Instruction ID: 0fabaa65846f565374d927adde4572b2cc1454b627dc53539f04e4ca1ee376cc
Opcode Fuzzy Hash: a571c00ded84ac1c02560f50a488ee548fe76179a7eec9e921c662aaf166c676
Instruction Fuzzy Hash: 4641B031A0420196C614FF75C956AAD3BA59B81708F00453FF809A72E6DF7C9A85C7CF

Function 00419FE2 Relevance: 9.1, APIs: 6, Instructions: 66serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000002,00000000,?,00000000,?,?,004196FD,00000000,00000000), ref: 00419FF2
OpenServiceW.ADVAPI32(00000000,00000000,00000002,?,00000000,?,?,004196FD,00000000,00000000), ref: 0041A006
CloseServiceHandle.ADVAPI32(00000000,?,00000000,?,?,004196FD,00000000,00000000), ref: 0041A013
ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000004,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,004196FD), ref: 0041A048
CloseServiceHandle.ADVAPI32(00000000,?,00000000,?,?,004196FD,00000000,00000000), ref: 0041A05A
CloseServiceHandle.ADVAPI32(00000000,?,00000000,?,?,004196FD,00000000,00000000), ref: 0041A05D

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ChangeConfigManager
String ID:
API String ID: 493672254-0
Opcode ID: 65b9834a0bb4e8b96eb35e8af166575ebded0736ec3647688d6b347b4d29b64b
Instruction ID: 3721d8981427c9c50277447f2eb78ca90bee9705940f35750f03ddb94c099399
Opcode Fuzzy Hash: 65b9834a0bb4e8b96eb35e8af166575ebded0736ec3647688d6b347b4d29b64b
Instruction Fuzzy Hash: 28016D315062107ED2111F349C0EEBF3E1CDF567B1F00022FF522A22D2DE69CE8981AA

Function 00438016 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0043800D,004379C1), ref: 00438024
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00438032
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0043804B
SetLastError.KERNEL32(00000000,?,0043800D,004379C1), ref: 0043809D

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 3d2ceef5274e4dce0ae2caf7dfaf84fccaef2f9a96c7b33c4be4e75810a8a5f0
Instruction ID: c897193d57ecee64636fe05851fbd3cadc70b6e754ca2b2668497838eaebe06c
Opcode Fuzzy Hash: 3d2ceef5274e4dce0ae2caf7dfaf84fccaef2f9a96c7b33c4be4e75810a8a5f0
Instruction Fuzzy Hash: DC0190321083416DFB2823756C465377B68E709378F21123FF328515F1EF994C44514C

Function 004470CF Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0043952C,?,00000000,?,0043BB65,00000000,00000000), ref: 004470D3
_free.LIBCMT ref: 00447106
_free.LIBCMT ref: 0044712E
SetLastError.KERNEL32(00000000,00000000,00000000), ref: 0044713B
SetLastError.KERNEL32(00000000,00000000,00000000), ref: 00447147
_abort.LIBCMT ref: 0044714D

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: ae40a63e46beb22daa4956e078090859b5f7183b7e2bf3c5c9b8e84b2b7f2479
Instruction ID: 03a1e9305cc52ab1e573739f72da4c843e3c1f7cd4612cbd08a2c6f68691a865
Opcode Fuzzy Hash: ae40a63e46beb22daa4956e078090859b5f7183b7e2bf3c5c9b8e84b2b7f2479
Instruction Fuzzy Hash: F2F0F931508B1027F612777A6C46E1B15269BC17B6B26002FF509A6392EF2C8C07911D

Function 00419E16 Relevance: 9.0, APIs: 6, Instructions: 44serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000020,00000000,?,?,?,?,?,?,00419991,00000000,00000000), ref: 00419E25
OpenServiceW.ADVAPI32(00000000,00000000,00000020,?,?,?,?,?,?,00419991,00000000,00000000), ref: 00419E39
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00419991,00000000,00000000), ref: 00419E46
ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,00419991,00000000,00000000), ref: 00419E55
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00419991,00000000,00000000), ref: 00419E67
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,00419991,00000000,00000000), ref: 00419E6A

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ControlManager
String ID:
API String ID: 221034970-0
Opcode ID: 0c1a15e356219896acdb347c35b0c45111e5d78bcfdfe9148325f151f6ad1740
Instruction ID: 47980c42e9b022aba05d73d81e1ae7aa31c0ed05cef52b60765f03c540efa169
Opcode Fuzzy Hash: 0c1a15e356219896acdb347c35b0c45111e5d78bcfdfe9148325f151f6ad1740
Instruction Fuzzy Hash: 44F062319003186BD611AB65DC89EBF3B6CDB45BA1F01002AF906A21D2DF78DD4A95F5

Function 00419F7D Relevance: 9.0, APIs: 6, Instructions: 44serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,?,?,?,?,?,?,0041988D,00000000,00000000), ref: 00419F8C
OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,0041988D,00000000,00000000), ref: 00419FA0
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041988D,00000000,00000000), ref: 00419FAD
ControlService.ADVAPI32(00000000,00000003,?,?,?,?,?,?,?,0041988D,00000000,00000000), ref: 00419FBC
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041988D,00000000,00000000), ref: 00419FCE
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041988D,00000000,00000000), ref: 00419FD1

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ControlManager
String ID:
API String ID: 221034970-0
Opcode ID: 5b24b4e27fffc125df5634aa0be26648fed0954f23ddfe4314b62b15434ff522
Instruction ID: cbb6f8d25e78bf3f904679f952f169c6c08018e661e4ba535c0ca8fa304c3d8e
Opcode Fuzzy Hash: 5b24b4e27fffc125df5634aa0be26648fed0954f23ddfe4314b62b15434ff522
Instruction Fuzzy Hash: 68F0C2315002147BD2116B24DC49EBF3A6CDB45BA1B01002AFA06A2192DF78CE4A85B8

Function 00419F18 Relevance: 9.0, APIs: 6, Instructions: 44serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,?,?,?,?,?,?,0041990F,00000000,00000000), ref: 00419F27
OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,0041990F,00000000,00000000), ref: 00419F3B
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041990F,00000000,00000000), ref: 00419F48
ControlService.ADVAPI32(00000000,00000002,?,?,?,?,?,?,?,0041990F,00000000,00000000), ref: 00419F57
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041990F,00000000,00000000), ref: 00419F69
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041990F,00000000,00000000), ref: 00419F6C

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ControlManager
String ID:
API String ID: 221034970-0
Opcode ID: 8b5bee833df7660f85241f437fe153c135d0241f59d488d3ebe91362aced60b6
Instruction ID: 95d7f5aa039a93820bb4883d7663946178ed8a5ec9cf590f88e81ba893971d89
Opcode Fuzzy Hash: 8b5bee833df7660f85241f437fe153c135d0241f59d488d3ebe91362aced60b6
Instruction Fuzzy Hash: 7EF062715003147BD2116B65DC4AEBF3B6CDB45BA1B01002AFA06B2192DF78DD4A96B9

Function 00412A82 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 173registryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00412AF5
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?,?,?,?,00000000,?,?,?,?), ref: 00412B24
RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,?,?,00002710,?,?,?,00000000,?,?,?,?), ref: 00412BC5

Strings

[regsplt], xrefs: 00412C5D
TG, xrefs: 00412C07

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Enum$InfoQueryValue
String ID: [regsplt]$TG
API String ID: 3554306468-170812940
Opcode ID: 63fafdce963b054f75e0ec9a91e8ba00106c89ff40fb0d126c08ff78ed9ae450
Instruction ID: eeb20da9b05a32976bf12a6402f5e40020a9f6991e42d7db5c0f7bae6a1218cc
Opcode Fuzzy Hash: 63fafdce963b054f75e0ec9a91e8ba00106c89ff40fb0d126c08ff78ed9ae450
Instruction Fuzzy Hash: C5511E72108345AED310EF61D985DEFB7ECEF84704F00492EB585D2191EB74EA088BAA

Function 00441C91 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

Strings

E, xrefs: 00441D5E

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID:
String ID: E
API String ID: 0-2089609516
Opcode ID: 06f5741e10c63ae8bf02417847894b944428abddfdd2a378d9b946abe0f64cd5
Instruction ID: 88518833c1d7008d36d723bd78668d328a40e80baed6ee8e3f57c0ed0377fbed
Opcode Fuzzy Hash: 06f5741e10c63ae8bf02417847894b944428abddfdd2a378d9b946abe0f64cd5
Instruction Fuzzy Hash: FE413AB1A00704BFE7249F39CC41BAABBA8EB84718F10412FF405DB291D379A9418788

Function 004428E4 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe,00000104), ref: 00442924
_free.LIBCMT ref: 004429EF
_free.LIBCMT ref: 004429F9

Strings

8([, xrefs: 0044292A
C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, xrefs: 0044291B, 00442922, 00442951, 00442989

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: _free$FileModuleName
String ID: 8([$C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe
API String ID: 2506810119-2511246626
Opcode ID: e43589620df6d0a02bbe9fe69612e96b807286bf84d647a6e2c91bfdc5f7fdb4
Instruction ID: 08a660f2d8e46f51ee0862092f41265a48d7a3eaa7bec75f040af8368b354bfd
Opcode Fuzzy Hash: e43589620df6d0a02bbe9fe69612e96b807286bf84d647a6e2c91bfdc5f7fdb4
Instruction Fuzzy Hash: E53193B1A00258AFEB21DF999E8199EBBBCEB85314F50406BF805A7311D6F84A41CB59

Function 0041AA28 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 90COMMON

Download Yara Rule

APIs

Part of subcall function 0041265C: RegOpenKeyExW.ADVAPI32(80000001,00000400,00000000,00020019,?), ref: 0041267E
Part of subcall function 0041265C: RegQueryValueExW.ADVAPI32(?,0040E18D,00000000,00000000,?,00000400), ref: 0041269D
Part of subcall function 0041265C: RegCloseKey.ADVAPI32(?), ref: 004126A6

Part of subcall function 0041B366: GetCurrentProcess.KERNEL32(?,?,?,0040C914,WinDir,00000000,00000000), ref: 0041B377
Part of subcall function 0041B366: IsWow64Process.KERNEL32(00000000,?,?,0040C914,WinDir,00000000,00000000), ref: 0041B37E

_wcslen.LIBCMT ref: 0041AB01

Strings

program files (x86)\, xrefs: 0041AAFB
http\shell\open\command, xrefs: 0041AA38
program files\, xrefs: 0041AAE7, 0041AAEE, 0041AB00
.exe, xrefs: 0041AA53

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Process$CloseCurrentOpenQueryValueWow64_wcslen
String ID: .exe$http\shell\open\command$program files (x86)\$program files\
API String ID: 3286818993-4246244872
Opcode ID: 91537cc37855c4d4d30a4d4a060cf2929123fb739607bd98f20b22aa84b26542
Instruction ID: 944f249e3467cd2310196e71108a033bc811508d99a3a404dc4e3305fa2889c9
Opcode Fuzzy Hash: 91537cc37855c4d4d30a4d4a060cf2929123fb739607bd98f20b22aa84b26542
Instruction Fuzzy Hash: 8621A772B001042BDB04B6B58C96EFE366D9B84318B10087FF452B71D3EE3C9D554269

Function 0040AE58 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 00433724: EnterCriticalSection.KERNEL32(00471D18,?,00476D54,?,0040AE8B,00476D54,?,00000000,00000000), ref: 0043372F
Part of subcall function 00433724: LeaveCriticalSection.KERNEL32(00471D18,?,0040AE8B,00476D54,?,00000000,00000000), ref: 0043376C

Part of subcall function 00433AB0: __onexit.LIBCMT ref: 00433AB6

__Init_thread_footer.LIBCMT ref: 0040AEA7

Part of subcall function 004336DA: EnterCriticalSection.KERNEL32(00471D18,00476D54,?,0040AEAC,00476D54,00456FA7,?,00000000,00000000), ref: 004336E4
Part of subcall function 004336DA: LeaveCriticalSection.KERNEL32(00471D18,?,0040AEAC,00476D54,00456FA7,?,00000000,00000000), ref: 00433717

Strings

XmG, xrefs: 0040AE70
TmG, xrefs: 0040AE80
[Text copied to clipboard], xrefs: 0040AEF6
[End of clipboard], xrefs: 0040AEE9

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit
String ID: [End of clipboard]$[Text copied to clipboard]$TmG$XmG
API String ID: 2974294136-1855599884
Opcode ID: 6be3199e03e4d79244a0686247a10a62383e0a85fc1942f24318a510031ea9ae
Instruction ID: 2623299308dd9d50029d580546b1e3590cd03a5acc49d0be8ee118f943746456
Opcode Fuzzy Hash: 6be3199e03e4d79244a0686247a10a62383e0a85fc1942f24318a510031ea9ae
Instruction Fuzzy Hash: FB216131A102155ACB24FB65D8929EE7775AF54318F10403FF506772E2EF3C6E4A868D

Function 0041CC2A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54registryCOMMON

Download Yara Rule

APIs

RegisterClassExA.USER32(00000030), ref: 0041CC77
CreateWindowExA.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,00000000,00000000), ref: 0041CC92
GetLastError.KERNEL32 ref: 0041CC9C

Strings

MsgWindowClass, xrefs: 0041CC33
0, xrefs: 0041CC38

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: ClassCreateErrorLastRegisterWindow
String ID: 0$MsgWindowClass
API String ID: 2877667751-2410386613
Opcode ID: 2bfcb1dee2ed81dd37ad325623522de50802513b554cdfc95296743f6fff5b81
Instruction ID: c9edb97a89f7ec8dfbaa779d36c224b53f51aa00da94833f787b12e8c600820c
Opcode Fuzzy Hash: 2bfcb1dee2ed81dd37ad325623522de50802513b554cdfc95296743f6fff5b81
Instruction Fuzzy Hash: 2001E9B1D1021DAF8B00DF9ADCC49EFFBBDBE49355B50452AE414B6100EB708A458AA5

Function 004069BA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(C:\Windows\System32\cmd.exe,/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 00406A00
CloseHandle.KERNEL32(?), ref: 00406A0F
CloseHandle.KERNEL32(?), ref: 00406A14

Strings

/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f, xrefs: 004069F6
C:\Windows\System32\cmd.exe, xrefs: 004069FB

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateProcess
String ID: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f$C:\Windows\System32\cmd.exe
API String ID: 2922976086-4183131282
Opcode ID: 76fab65495b0fd8f7af94722782b38f5ec20939b495d63d65361185c7f15ad50
Instruction ID: 0865c4136dfbb59e32125d892e445ee09242962a1e3dc4bc305b740a121ed375
Opcode Fuzzy Hash: 76fab65495b0fd8f7af94722782b38f5ec20939b495d63d65361185c7f15ad50
Instruction Fuzzy Hash: 68F090B690029D7ACB20ABD69C0EECF7F3CEBC5B11F01046ABA04A2051DA706104CAB8

Function 004064D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMON

Download Yara Rule

Strings

Rmc-DCXXDI, xrefs: 0040693F
C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe, xrefs: 00406927

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe$Rmc-DCXXDI
API String ID: 0-1773504347
Opcode ID: 68549dc5139d56a2d1ebd5a20fc71dabf1e7981f7a57b1309e8f30a02d7c51f6
Instruction ID: ac3f053366391772af188fc274efb03f25e4c049f181d6a95d7665767018bac5
Opcode Fuzzy Hash: 68549dc5139d56a2d1ebd5a20fc71dabf1e7981f7a57b1309e8f30a02d7c51f6
Instruction Fuzzy Hash: 4FF0F6B17022109BDB103B34AD1966A3A45DB40346F01807BF98BFA6E2DF7C8851C68C

Function 004427E9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,0044279A,?,?,0044273A,?,0046EAF0,0000000C,00442891,?,00000002), ref: 00442809
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0044281C
FreeLibrary.KERNEL32(00000000,?,?,?,0044279A,?,?,0044273A,?,0046EAF0,0000000C,00442891,?,00000002,00000000), ref: 0044283F

Strings

mscoree.dll, xrefs: 00442802
CorExitProcess, xrefs: 00442814

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 263cd25904221f4c100099ecbb428eb8354416072efb1e7fc04c1483da550fa7
Instruction ID: e557d05a47d06e8d32a7f66c2c4e22cdfb14d47a79db446b90f8ad9ee3cbc836
Opcode Fuzzy Hash: 263cd25904221f4c100099ecbb428eb8354416072efb1e7fc04c1483da550fa7
Instruction Fuzzy Hash: 8CF0A430900309FBDB119F94DD09B9EBFB4EB08753F4041B9F805A2261DF789D44CA98

Function 00404AB1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35synchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,004755B0,00414F47,00000000,00000000,00000001), ref: 00404AED
SetEvent.KERNEL32(00000304), ref: 00404AF9
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00404B04
CloseHandle.KERNEL32(00000000), ref: 00404B0D

Part of subcall function 0041A891: GetLocalTime.KERNEL32(00000000), ref: 0041A8AB

Strings

KeepAlive | Disabled, xrefs: 00404AC6

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Event$CloseCreateHandleLocalObjectSingleTimeWait
String ID: KeepAlive | Disabled
API String ID: 2993684571-305739064
Opcode ID: 87b3d8b3ec28cdfa47286890c680b6ef87dd714ebeb2c7092d66f3d4d30662f2
Instruction ID: 7c4d48bbaa8a7164c3353f7df4ad5523490a6ea0f3ebe4e46dcacb08dafaa92a
Opcode Fuzzy Hash: 87b3d8b3ec28cdfa47286890c680b6ef87dd714ebeb2c7092d66f3d4d30662f2
Instruction Fuzzy Hash: 31F096B19047007BDB1137759D0B66B7F58AB46325F00096FF492A26F2DE39D8508B5E

Function 0041A128 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A891: GetLocalTime.KERNEL32(00000000), ref: 0041A8AB

GetModuleHandleA.KERNEL32(00000000,00020009), ref: 0041A15A
PlaySoundW.WINMM(00000000,00000000), ref: 0041A168
Sleep.KERNEL32(00002710), ref: 0041A16F
PlaySoundW.WINMM(00000000,00000000,00000000), ref: 0041A178

Strings

Alarm triggered, xrefs: 0041A131

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: PlaySound$HandleLocalModuleSleepTime
String ID: Alarm triggered
API String ID: 614609389-2816303416
Opcode ID: 4a48c68418f768cffa6c3ed767b5f5e80af739637c9128b647918063f34aba9e
Instruction ID: 198adcd2ac8b5b4b9acde76a755fda1533c143b191b85f9fe5233f4cbfc21951
Opcode Fuzzy Hash: 4a48c68418f768cffa6c3ed767b5f5e80af739637c9128b647918063f34aba9e
Instruction Fuzzy Hash: 79E01A22A04261379520337B7D0FD6F3D28EAC7B65741006FF905A6192EE580811C6FB

Function 0041C07A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,00000000,?,?,?,?,?,?,0041C10D), ref: 0041C084
GetConsoleScreenBufferInfo.KERNEL32(00000000,?,?,?,?,?,?,?,0041C10D), ref: 0041C091
SetConsoleTextAttribute.KERNEL32(00000000,0000000C,?,?,?,?,?,?,0041C10D), ref: 0041C09E
SetConsoleTextAttribute.KERNEL32(00000000,?,?,?,?,?,?,?,0041C10D), ref: 0041C0B1

Strings

______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/ , xrefs: 0041C0A4

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Console$AttributeText$BufferHandleInfoScreen
String ID: ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/
API String ID: 3024135584-2418719853
Opcode ID: 1559ced9db44309d12e9096fc874ef99716f3117c459c374921cc59209bdbdc6
Instruction ID: f27d36e20d2a67c690befc106ea5cafab99e09d075a2dfca7d32a9b7008c9529
Opcode Fuzzy Hash: 1559ced9db44309d12e9096fc874ef99716f3117c459c374921cc59209bdbdc6
Instruction Fuzzy Hash: 57E04F62604348BBD30037F6AC4EDAB3B7CE784617B10092AF612A01D3ED7484468B79

Function 004403AA Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a796732182faefe73add1043189caf6ca4f606f7631d49291716b08cb320153
Instruction ID: 7c1105064789ab48ae90d42f937b6a9cbc34ac1ed42c20d541c6d1c3f1a57216
Opcode Fuzzy Hash: 2a796732182faefe73add1043189caf6ca4f606f7631d49291716b08cb320153
Instruction Fuzzy Hash: 7671D371900216AFEF20CF54C884ABFBB75EF45310F14422BEA15A7281DB788C61CFA9

Function 00410BF1 Relevance: 7.7, APIs: 5, Instructions: 198memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00410691: SetLastError.KERNEL32(0000000D,00410C10,?,00000000), ref: 00410697

GetNativeSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00410BED), ref: 00410C9C
GetProcessHeap.KERNEL32(00000008,00000040,?,?,00000000), ref: 00410D02
HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00410D09
SetLastError.KERNEL32(0000045A,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00410E17
SetLastError.KERNEL32(000000C1,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00410BED), ref: 00410E41

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: ErrorLast$Heap$AllocInfoNativeProcessSystem
String ID:
API String ID: 3525466593-0
Opcode ID: 5b761030cf84cfef50a77e8f1fc708b710696a941d42968a3fbf92de24ca1f36
Instruction ID: e2f64966b18619331c3eea81ef564f6afd9e4387f8ea08f62d3b86939114ae32
Opcode Fuzzy Hash: 5b761030cf84cfef50a77e8f1fc708b710696a941d42968a3fbf92de24ca1f36
Instruction Fuzzy Hash: 8E61E570200305ABD710AF56C981BA77BA5BF84308F04451EF909CB382DBF8E8D5CB99

Function 004432A8 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0044331A
_free.LIBCMT ref: 0044333A

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: c6d5326bb826bef7d4312f682f8fd03de73532d4ef60da68ba97a8c78ea7af64
Instruction ID: 036c3dfb054a6f01566e3cd8d28730a68c174e79056a6e67996f15c63748089b
Opcode Fuzzy Hash: c6d5326bb826bef7d4312f682f8fd03de73532d4ef60da68ba97a8c78ea7af64
Instruction Fuzzy Hash: F341D636A002049FEB20DF79C881A5EB7B5FF88718F1545AEE915EB351DA35EE01CB84

Function 004500E3 Relevance: 7.6, APIs: 5, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,0043E5FD,?,00000000,?,00000001,?,?,00000001,0043E5FD,?), ref: 00450130
__alloca_probe_16.LIBCMT ref: 00450168
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 004501B9
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00439BCF,?), ref: 004501CB
__freea.LIBCMT ref: 004501D4

Part of subcall function 00446D0F: RtlAllocateHeap.NTDLL(00000000,00434613,?,?,00437437,?,?,?,?,?,0040CD5A,00434613,?,?,?,?), ref: 00446D41

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__alloca_probe_16__freea
String ID:
API String ID: 313313983-0
Opcode ID: daed02162d7f278869bfaea3c7a8f88d5c2a2d3218cc1490f903801f97ac0c2c
Instruction ID: d7464a72994917abc30d80f71ec8451e4cba9cf5435b4dea42e63c5c2bdc5daf
Opcode Fuzzy Hash: daed02162d7f278869bfaea3c7a8f88d5c2a2d3218cc1490f903801f97ac0c2c
Instruction Fuzzy Hash: 9631E132A0060AABDF249F65DC41DAF7BA5EB00311F05416AFC04E7252EB3ACD54CBA5

Function 0044E34B Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0044E354
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0044E377

Part of subcall function 00446D0F: RtlAllocateHeap.NTDLL(00000000,00434613,?,?,00437437,?,?,?,?,?,0040CD5A,00434613,?,?,?,?), ref: 00446D41

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0044E39D
_free.LIBCMT ref: 0044E3B0
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0044E3BF

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 1d4758ed0160ac471983c8ffd3a0470c3cf8fd4ea00c3cafbe93e28275fbbba9
Instruction ID: 5f1b7bba735f2dc00ee4e6ee14e94985e19ed078b50b1d1b699098eccd63c47a
Opcode Fuzzy Hash: 1d4758ed0160ac471983c8ffd3a0470c3cf8fd4ea00c3cafbe93e28275fbbba9
Instruction Fuzzy Hash: D50171726017157F73221A776C88C7B6A6DEAC2F65315012EFD05D3241DE698C0291B9

Function 00447153 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(0000000A,0000000B,0000000A,00445569,00440CA8,00000000,?,?,?,?,00440E8B,00000000,0000000A,000000FF,0000000A,00000000), ref: 00447158
_free.LIBCMT ref: 0044718D
_free.LIBCMT ref: 004471B4
SetLastError.KERNEL32(00000000,0000000A,00000000), ref: 004471C1
SetLastError.KERNEL32(00000000,0000000A,00000000), ref: 004471CA

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: c73b76ca02ce190c9082a6036dde6ca48763b4b9e088bcde2ec0a65c3a46cc10
Instruction ID: 9627307c59aa3692a64de8377ee3c20019e30fe80ec8d82769d3f9bfdfbdb6fb
Opcode Fuzzy Hash: c73b76ca02ce190c9082a6036dde6ca48763b4b9e088bcde2ec0a65c3a46cc10
Instruction Fuzzy Hash: 3E01F97624CB102BB30267B95C85D2B2A29DBC17B6726012FF509A6392EF2C8C07515D

Function 0041B588 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041B5A0
OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041B5B3
GetProcessImageFileNameW.PSAPI(00000000,?,00000104,?,00000000,00000000,00000000), ref: 0041B5D3
CloseHandle.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0041B5DE
CloseHandle.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0041B5E6

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Process$CloseHandleOpen$FileImageName
String ID:
API String ID: 2951400881-0
Opcode ID: ef8d0d82becda269430901369212c52b3606b15fcf963f3a122b886808132bbc
Instruction ID: 5d23c8c1f4703883972a4236376900cac23e2486f01e1b2fafccabe2f4d6955e
Opcode Fuzzy Hash: ef8d0d82becda269430901369212c52b3606b15fcf963f3a122b886808132bbc
Instruction Fuzzy Hash: D5F049712003167BD31167558C4AFABB66ECF40B9AF01002BF611E21A2EF74DDC146BD

Function 0044F9AD Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0044F9C5

Part of subcall function 00446CD5: RtlFreeHeap.NTDLL(00000000,00000000,?,0044FC60,0000000A,00000000,0000000A,00000000,?,0044FF04,0000000A,00000007,0000000A,?,00450415,0000000A), ref: 00446CEB
Part of subcall function 00446CD5: GetLastError.KERNEL32(0000000A,?,0044FC60,0000000A,00000000,0000000A,00000000,?,0044FF04,0000000A,00000007,0000000A,?,00450415,0000000A,0000000A), ref: 00446CFD

_free.LIBCMT ref: 0044F9D7
_free.LIBCMT ref: 0044F9E9
_free.LIBCMT ref: 0044F9FB
_free.LIBCMT ref: 0044FA0D

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 8a0a0e5e94a0327d1776c165067cf9b9603f8d21362122b3839296c578ae3d6e
Instruction ID: 2de1f51a18cc7960585f1cc37bbb46b0208bdbaa703fd0d38dd13c161260ee8b
Opcode Fuzzy Hash: 8a0a0e5e94a0327d1776c165067cf9b9603f8d21362122b3839296c578ae3d6e
Instruction Fuzzy Hash: B5F012725042107BA620DF59FAC6D1773E9EA457247A5482BF18DEBA51C738FCC0865C

Function 004434F7 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00443515

Part of subcall function 00446CD5: RtlFreeHeap.NTDLL(00000000,00000000,?,0044FC60,0000000A,00000000,0000000A,00000000,?,0044FF04,0000000A,00000007,0000000A,?,00450415,0000000A), ref: 00446CEB
Part of subcall function 00446CD5: GetLastError.KERNEL32(0000000A,?,0044FC60,0000000A,00000000,0000000A,00000000,?,0044FF04,0000000A,00000007,0000000A,?,00450415,0000000A,0000000A), ref: 00446CFD

_free.LIBCMT ref: 00443527
_free.LIBCMT ref: 0044353A
_free.LIBCMT ref: 0044354B
_free.LIBCMT ref: 0044355C

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5455ce8706e3ca66a7bad791c73c4693f29d9b457f563819123ce72749b06e66
Instruction ID: bf08c2b723e6da78e2f9a692d3f9dcffc94df7bb1312aea5ebb3a1bf48e2a6b8
Opcode Fuzzy Hash: 5455ce8706e3ca66a7bad791c73c4693f29d9b457f563819123ce72749b06e66
Instruction Fuzzy Hash: 4EF0FEB08011219FD726AF69BE414063BA0F709764346113BF45E66B71E7790982EB8E

Function 00416937 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 182threadwindowCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(?,?), ref: 0041694E
GetWindowTextW.USER32(?,?,0000012C), ref: 00416980
IsWindowVisible.USER32(?), ref: 00416987

Part of subcall function 0041B588: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041B5A0
Part of subcall function 0041B588: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041B5B3

Strings

0VG, xrefs: 00416B10

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: ProcessWindow$Open$TextThreadVisible
String ID: 0VG
API String ID: 3142014140-3748860515
Opcode ID: 8040e70f99a29c17371243be5b0374263071332b934c14761d81ab03223ac4bc
Instruction ID: a92d2c2722018a5f2df8734f3a85bf91d45912e01cb50305def5a483f7f9536a
Opcode Fuzzy Hash: 8040e70f99a29c17371243be5b0374263071332b934c14761d81ab03223ac4bc
Instruction Fuzzy Hash: FE71C3311082415AC335FB61D8A5ADFB3E4EFD4308F50493EB58A530E1EF74AA49CB9A

Function 0044D669 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_strpbrk.LIBCMT ref: 0044D6B8
_free.LIBCMT ref: 0044D7D5

Part of subcall function 0043AA64: IsProcessorFeaturePresent.KERNEL32(00000017,0043AA36,00000000,0000000A,0000000A,00000000,0041AF72,00000022,?,?,0043AA43,00000000,00000000,00000000,00000000,00000000), ref: 0043AA66
Part of subcall function 0043AA64: GetCurrentProcess.KERNEL32(C0000417,0000000A,00000000), ref: 0043AA88
Part of subcall function 0043AA64: TerminateProcess.KERNEL32(00000000), ref: 0043AA8F

Strings

*?, xrefs: 0044D6AC
., xrefs: 0044D98C

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free_strpbrk
String ID: *?$.
API String ID: 2812119850-3972193922
Opcode ID: a944b580e8880c8e130e00bdfc146e92b9e44dab990486ab21efc68c0a65a633
Instruction ID: 04f9c45711fae47bd805a28d6c684d852fff3551aaaea8338e0504d4b1d9eb7e
Opcode Fuzzy Hash: a944b580e8880c8e130e00bdfc146e92b9e44dab990486ab21efc68c0a65a633
Instruction Fuzzy Hash: C251B175E00209AFEF14DFA9C881AAEBBB5EF58314F25416FE854E7301E6399E01CB54

Function 00404468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92synchronizationnetworkCOMMON

Download Yara Rule

APIs

send.WS2_32(000002FC,00000000,00000000,00000000), ref: 004044FD
WaitForSingleObject.KERNEL32(00000330,00000000,{NAL,?,?,00000004,?,?,00000004,00474EE0,004755B0,00000000), ref: 0040450E
SetEvent.KERNEL32(00000330,?,?,00000004,?,?,00000004,00474EE0,004755B0,00000000,?,?,?,?,?,00414E7B), ref: 0040453C

Strings

{NAL, xrefs: 00404473, 004044D6, 0040454A, 004044DC

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: EventObjectSingleWaitsend
String ID: {NAL
API String ID: 3963590051-1903569844
Opcode ID: 438a4a486c613dad8f91b4ef8ef70ced317a48407eae681756782b40dc658345
Instruction ID: 09920f02ef31e30e393b68ef0c8285e211ae926702cc5adcda46913b737bad1c
Opcode Fuzzy Hash: 438a4a486c613dad8f91b4ef8ef70ced317a48407eae681756782b40dc658345
Instruction Fuzzy Hash: 552137B29005156BCF04ABA5DC96DEE777CBF54358B00413EF916B21E1EE78A504C6E4

Function 00403A10 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 92sleepCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00403A2A

Part of subcall function 0041AD43: GetCurrentProcessId.KERNEL32(00000000,75923530,00000000,?,?,?,?,00466900,0040C07B,.vbs,?,?,?,?,?,00475308), ref: 0041AD6A

Part of subcall function 0041789C: CloseHandle.KERNEL32(00403AB9,?,?,00403AB9,00466324), ref: 004178B2
Part of subcall function 0041789C: CloseHandle.KERNEL32($cF,?,?,00403AB9,00466324), ref: 004178BB

Part of subcall function 0041B825: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,00000000,00409F65), ref: 0041B83E

Sleep.KERNEL32(000000FA,00466324), ref: 00403AFC

Strings

/sort "Visit Time" /stext ", xrefs: 00403A76
0NG, xrefs: 00403A5B

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: CloseFileHandle$CreateCurrentModuleNameProcessSleep
String ID: /sort "Visit Time" /stext "$0NG
API String ID: 368326130-3219657780
Opcode ID: b9ea6b50cec41ec040a9f76ae8369c1ad19d6b37305134aedebb5ccf8f56233d
Instruction ID: 03df4c4d2d4284c33795d9a7a6d048d6c9d09091ba23d5cef523323604a75e49
Opcode Fuzzy Hash: b9ea6b50cec41ec040a9f76ae8369c1ad19d6b37305134aedebb5ccf8f56233d
Instruction Fuzzy Hash: 88319531A0011456CB14FB76DC969EE7779AF80318F00007FF906B31D2EF385A4AC699

Function 0044837A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 004483ED
_free.LIBCMT ref: 00448443

Part of subcall function 0044821F: _free.LIBCMT ref: 00448277
Part of subcall function 0044821F: GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045E478), ref: 00448289
Part of subcall function 0044821F: WideCharToMultiByte.KERNEL32(00000000,00000000,0047279C,000000FF,00000000,0000003F,00000000,?,?), ref: 00448301
Part of subcall function 0044821F: WideCharToMultiByte.KERNEL32(00000000,00000000,004727F0,000000FF,?,0000003F,00000000,?), ref: 0044832E

Strings

xE, xrefs: 004483A6

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID: xE
API String ID: 314583886-407097786
Opcode ID: 9c637a4c831fe7eeac3cdc02b43c82e31c030d80d9709743783fb0f8cc9b1dbe
Instruction ID: 75d3a8e9ed6c4df3bbb87a82b1f0f54536a25ed198edf9988c125f258b025633
Opcode Fuzzy Hash: 9c637a4c831fe7eeac3cdc02b43c82e31c030d80d9709743783fb0f8cc9b1dbe
Instruction Fuzzy Hash: 90213B3280013957F730A7259C46DEF7378DB41724F1102AFEC98A2191EF784DC189AD

Function 0040A876 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,?,00000000), ref: 0040A884
wsprintfW.USER32 ref: 0040A905

Part of subcall function 00409D58: SetEvent.KERNEL32(?,?,?,0040AF3F,?,?,?,?,?,00000000), ref: 00409D84

Strings

], xrefs: 0040A892
[%04i/%02i/%02i %02i:%02i:%02i , xrefs: 0040A88D

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: EventLocalTimewsprintf
String ID: [%04i/%02i/%02i %02i:%02i:%02i $]
API String ID: 1497725170-1359877963
Opcode ID: 2c1e205bf1f5052a51d4638fd4dd379fe1f7b993f8f7852f87f4d6bf88a020b2
Instruction ID: eacaba0d290b76b22f399a57737f65b18f8a023abca8575ba11697f47f6457b1
Opcode Fuzzy Hash: 2c1e205bf1f5052a51d4638fd4dd379fe1f7b993f8f7852f87f4d6bf88a020b2
Instruction Fuzzy Hash: F1115172500118AACB18FB96EC56CFF77B8AE48715B00013FF542621D1EF7C5A86C6E9

Function 0040A611 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A876: GetLocalTime.KERNEL32(?,?,00000000), ref: 0040A884
Part of subcall function 0040A876: wsprintfW.USER32 ref: 0040A905

Part of subcall function 0041A891: GetLocalTime.KERNEL32(00000000), ref: 0041A8AB

CreateThread.KERNEL32(00000000,00000000,Function_00009993,?,00000000,00000000), ref: 0040A691
CreateThread.KERNEL32(00000000,00000000,Function_000099B5,?,00000000,00000000), ref: 0040A69D
CreateThread.KERNEL32(00000000,00000000,004099C1,?,00000000,00000000), ref: 0040A6A9

Strings

Online Keylogger Started, xrefs: 0040A626, 0040A62F, 0040A659

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: CreateThread$LocalTime$wsprintf
String ID: Online Keylogger Started
API String ID: 112202259-1258561607
Opcode ID: e51d8b7f57c875fd14822fa47be4c1fb55d37c331493fca39a38941afd0278ea
Instruction ID: 13545b77b67cc4507d33d8d8c8ff512a749ba16b8a43449315e0da64450a8124
Opcode Fuzzy Hash: e51d8b7f57c875fd14822fa47be4c1fb55d37c331493fca39a38941afd0278ea
Instruction Fuzzy Hash: E80161A1A003193AE62076768C86DBF7A6DCA813A8F41043EF541662C3EA7D5D5582FA

Function 0044AC83 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,00000000,8@,?,0044ABA1,8@,0046ED38,0000000C), ref: 0044ACD9
GetLastError.KERNEL32(?,0044ABA1,8@,0046ED38,0000000C), ref: 0044ACE3
__dosmaperr.LIBCMT ref: 0044AD0E

Strings

8@, xrefs: 0044AC88

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID: 8@
API String ID: 2583163307-819625340
Opcode ID: f11388ad4d481d826d75519938a9a20661ac3afaecb278e3b0e3570ed3326013
Instruction ID: 727ae4bd5dc399200e14d16721253afac520870d53d00e52bc8525c117eb1139
Opcode Fuzzy Hash: f11388ad4d481d826d75519938a9a20661ac3afaecb278e3b0e3570ed3326013
Instruction Fuzzy Hash: 6F018836640A100BF3212634688573F67498B91B39F29022FF804872D2CE2D8CC1919F

Function 00404B29 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00404B26), ref: 00404B40
CloseHandle.KERNEL32(?,?,?,?,00404B26), ref: 00404B98
SetEvent.KERNEL32(?,?,?,?,00404B26), ref: 00404BA7

Strings

Connection Timeout, xrefs: 00404B66

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: CloseEventHandleObjectSingleWait
String ID: Connection Timeout
API String ID: 2055531096-499159329
Opcode ID: c54170f10c28a2d70f0f06c2367e9daa17625b27f18bd79627845602b5625e1d
Instruction ID: 3c9b6871d48b6b3111a672927d5bafc1cfd46058a166b60e959a8cf6be3f516d
Opcode Fuzzy Hash: c54170f10c28a2d70f0f06c2367e9daa17625b27f18bd79627845602b5625e1d
Instruction Fuzzy Hash: 1601F5B1900B41AFD325BB3A8C4255ABFE4AB45315740053FE293A2BA2DE38E440CB5E

Function 0041284C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38registryCOMMON

Download Yara Rule

APIs

RegCreateKeyW.ADVAPI32(80000001,00000000,004752F0), ref: 00412857
RegSetValueExW.ADVAPI32(004752F0,?,00000000,00000001,00000000,00000000,00475308,?,0040E6A3,pth_unenc,004752F0), ref: 00412885
RegCloseKey.ADVAPI32(004752F0,?,0040E6A3,pth_unenc,004752F0), ref: 00412890

Strings

pth_unenc, xrefs: 00412850

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID: pth_unenc
API String ID: 1818849710-4028850238
Opcode ID: b3a4cd364a4f7c7358af441d7ba84bfe6998b6fc3540b8922562f2b11cb0be87
Instruction ID: ab464752906d06cf6e422ab9fb9c42b8cedad3247386a7cb387aa37f92243dc4
Opcode Fuzzy Hash: b3a4cd364a4f7c7358af441d7ba84bfe6998b6fc3540b8922562f2b11cb0be87
Instruction Fuzzy Hash: 2DF09071500218BBDF50AFA0EE46FEE376CEF40B55F10452AF902B60A1EF75DA08DA94

Function 0040CE91 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0040CE9C
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0040CEDB

Part of subcall function 004349CD: _Yarn.LIBCPMT ref: 004349EC
Part of subcall function 004349CD: _Yarn.LIBCPMT ref: 00434A10

__CxxThrowException@8.LIBVCRUNTIME ref: 0040CEFF

Strings

bad locale name, xrefs: 0040CEE9

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Exception@8Locinfo::_Locinfo_ctorLockitLockit::_Throw
String ID: bad locale name
API String ID: 3628047217-1405518554
Opcode ID: 010949cb006bc602daa897d098c336462d98aae1940c118575e4f0b09407aa79
Instruction ID: d3fe92e39fe1a76843bdcbebe92e6b3b15f8dcb0f99b50ce5c9cc2ba4b618b17
Opcode Fuzzy Hash: 010949cb006bc602daa897d098c336462d98aae1940c118575e4f0b09407aa79
Instruction Fuzzy Hash: FEF03171004214AAC768FB62D853ADE77A4AF14758F504B3FF046224D2AF7CB619C688

Function 0041534A Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,open,cmd.exe,00000000,00000000,00000000), ref: 0041538C

Strings

open, xrefs: 00415386
/C , xrefs: 0041536A
cmd.exe, xrefs: 00415381

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: ExecuteShell
String ID: /C $cmd.exe$open
API String ID: 587946157-3896048727
Opcode ID: ee5632475eb46ff15070bdf5b556040dc051f9dd48e26135e6c52f0a98a02d4f
Instruction ID: 200bce0b0309f38ec9064e519a9a4578f5a600b3ca3b701a036ea6d1077247ba
Opcode Fuzzy Hash: ee5632475eb46ff15070bdf5b556040dc051f9dd48e26135e6c52f0a98a02d4f
Instruction Fuzzy Hash: F1E0C0B11043406AC708FB65DC96DBF77AC9A90749F10483FB582621E2EE78A949865E

Function 0040AFBA Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32(004099A9,00000000,00475308,pth_unenc,0040BF26,004752F0,00475308,?,pth_unenc), ref: 0040AFC9
UnhookWindowsHookEx.USER32(00475108), ref: 0040AFD5
TerminateThread.KERNEL32(Function_00009993,00000000,?,pth_unenc), ref: 0040AFE3

Strings

pth_unenc, xrefs: 0040AFBA

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: TerminateThread$HookUnhookWindows
String ID: pth_unenc
API String ID: 3123878439-4028850238
Opcode ID: 5ce168509fd4f53ac483e5472d8910f69c83d539265d002f33f874c0df2e9344
Instruction ID: 19faee7e247875c6ed4f8509c992ad96cda0262a64c11258bcf204109443e34b
Opcode Fuzzy Hash: 5ce168509fd4f53ac483e5472d8910f69c83d539265d002f33f874c0df2e9344
Instruction Fuzzy Hash: BEE01DB1245715DFD3101F545C94825BB99EB44746324087FF6C165252CD798C14C759

Function 00448F1B Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00448FA6
__alldvrm.LIBCMT ref: 004491A7
__alldvrm.LIBCMT ref: 004491C9

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: af13233f64bff1d952fd16752439a8415c6481e4108584e155c4282d62de78f9
Instruction ID: 0b1f6a9dfc50a2d3a5cef35921af3bd2f2baba9a31ad448e356136b6fbdd55d0
Opcode Fuzzy Hash: af13233f64bff1d952fd16752439a8415c6481e4108584e155c4282d62de78f9
Instruction Fuzzy Hash: 3AA14532A042869FFB258E18C8817AFBBA1EF15354F1841AFE8859B382C67C8D41D758

Function 00455BDA Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00455D09

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 74ece5ab94bf9e1454a637eee9e3d981c9d933d52cb43566ce5b815ebd6edde4
Instruction ID: 0bd1fcef5d7791e57e96aa6a4775832058b0444fd7bffa6098b49987863132bf
Opcode Fuzzy Hash: 74ece5ab94bf9e1454a637eee9e3d981c9d933d52cb43566ce5b815ebd6edde4
Instruction Fuzzy Hash: 64415D31900F00ABEF227AB98C9667F3A75DF01775F14411FFC1896293D63C890986AA

Function 0040B806 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 103sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 0040B81B
Sleep.KERNEL32(00001388), ref: 0040B8A3

Strings

[Cleared browsers logins and cookies.], xrefs: 0040B8DE
Cleared browsers logins and cookies., xrefs: 0040B8EF

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: [Cleared browsers logins and cookies.]$Cleared browsers logins and cookies.
API String ID: 3472027048-1236744412
Opcode ID: 974243172e929ecbed863af11f3888abaeff5056eaa34a0c48e853e7952ed2f5
Instruction ID: 247d09dce9e3c977c7e86e48a76dae703d52755688f8fe644b587970fcea700c
Opcode Fuzzy Hash: 974243172e929ecbed863af11f3888abaeff5056eaa34a0c48e853e7952ed2f5
Instruction Fuzzy Hash: FE31A81124C38069CA117B7514167AB6F958A93754F08847FE8C4273E3DB7A480883EF

Function 0041AB95 Relevance: 6.1, APIs: 4, Instructions: 78timesleepCOMMON

Download Yara Rule

APIs

GetSystemTimes.KERNEL32(?,?,?), ref: 0041ABAB
Sleep.KERNEL32(000003E8), ref: 0041ABB6
GetSystemTimes.KERNEL32(?,?,?), ref: 0041ABCB
__aulldiv.LIBCMT ref: 0041AC67

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: SystemTimes$Sleep__aulldiv
String ID:
API String ID: 188215759-0
Opcode ID: a7e496ea74412c4f74dd561fc1d9e5efe2a930fde01781876ab294e7da94f75c
Instruction ID: 7cb4eddd506215a21d9c44be4850b318e12e80d273729b61be08d6c7a3dfdc1e
Opcode Fuzzy Hash: a7e496ea74412c4f74dd561fc1d9e5efe2a930fde01781876ab294e7da94f75c
Instruction Fuzzy Hash: 9A216D725043009FC304EF65D9858AFB7E8EFC8714F044A2EF58593251EA38EA49CBA7

Function 00409C4B Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 71sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041B8F1: GetForegroundWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041B901
Part of subcall function 0041B8F1: GetWindowTextLengthW.USER32(00000000), ref: 0041B90A
Part of subcall function 0041B8F1: GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0041B934

Sleep.KERNEL32(000001F4), ref: 00409C95
Sleep.KERNEL32(00000064), ref: 00409D1F

Strings

[ , xrefs: 00409CB1
], xrefs: 00409C9D

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Window$SleepText$ForegroundLength
String ID: [ $ ]
API String ID: 3309952895-93608704
Opcode ID: a49d20d3ecb8acddbd4132256805943c56c930b2d695a3c4727dac55219dcbc1
Instruction ID: 7bed66d096a43dd94c2219bc8d3cdd3a5a7df98386a17a5ae9bf36b343ab91a8
Opcode Fuzzy Hash: a49d20d3ecb8acddbd4132256805943c56c930b2d695a3c4727dac55219dcbc1
Instruction Fuzzy Hash: AF119F315042009BD218BB26DC17AAEBBA8AF41708F40047FF542621D3EF79AA1986DE

Function 00442EE2 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0179cd47eff8c75336d676f059f6bc7958f0419c29ca715f1c911511461a8d64
Instruction ID: b58c8eca075ef28bddc965f0bc4d2171c3ec1f8ef65ef5096018edf4bb449d44
Opcode Fuzzy Hash: 0179cd47eff8c75336d676f059f6bc7958f0419c29ca715f1c911511461a8d64
Instruction Fuzzy Hash: 2501F2B26093163EF61016796CC1F27671CEF417B8BB1032BB626612D2EEA88C46606D

Function 00442F61 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 112e7316d96929b625426bf143e83baabee3255260599eba4999be5de9cde10c
Instruction ID: 7fe3e8edc5bbc175eb6928fc2517c3e9b6b95ea9c4057c88a91cd5d3c4beb3ed
Opcode Fuzzy Hash: 112e7316d96929b625426bf143e83baabee3255260599eba4999be5de9cde10c
Instruction Fuzzy Hash: F201F9B22096167EB61016796DC4D27676DEF813B83F1033BF421612D1EEA8CC44A179

Function 00438305 Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 0043831F

Part of subcall function 0043826C: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 0043829B
Part of subcall function 0043826C: ___AdjustPointer.LIBCMT ref: 004382B6

_UnwindNestedFrames.LIBCMT ref: 00438334
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00438345
CallCatchBlock.LIBVCRUNTIME ref: 0043836D

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: c8370f5f766c88f9b882548d03e746073a9763e8d7037f7b78bb80a5d64990c6
Instruction ID: 0bcd00d322a0ad7a372b2cc4a74953bc209b0d499cbe7a3061e5fba3b10c2df3
Opcode Fuzzy Hash: c8370f5f766c88f9b882548d03e746073a9763e8d7037f7b78bb80a5d64990c6
Instruction Fuzzy Hash: 3E014072100248BBDF126E96CC41DEF7B69EF4C758F04501DFE4866221D73AE861DBA4

Function 00447420 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000000,00000000,00000000,?,004473C7,00000000,00000000,00000000,00000000,?,004476F3,00000006,FlsSetValue), ref: 00447452
GetLastError.KERNEL32(?,004473C7,00000000,00000000,00000000,00000000,?,004476F3,00000006,FlsSetValue,0045E328,FlsSetValue,00000000,00000364,?,004471A1), ref: 0044745E
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,004473C7,00000000,00000000,00000000,00000000,?,004476F3,00000006,FlsSetValue,0045E328,FlsSetValue,00000000), ref: 0044746C

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: bca6965db1f65f3d9859255c05e5b0128703451981dee5a4eba808798ce175cf
Instruction ID: 55721a836d87515a1eea2a56d4c7bce34062b93f94d6470a2cb527c4f3a692dc
Opcode Fuzzy Hash: bca6965db1f65f3d9859255c05e5b0128703451981dee5a4eba808798ce175cf
Instruction Fuzzy Hash: 6D01FC326497366BD7314F789C44A777FD8AF047617114535F906E3241DF28D802C6E8

Function 0041B825 Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,00000000,00409F65), ref: 0041B83E
GetFileSize.KERNEL32(00000000,00000000), ref: 0041B852
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0041B877
CloseHandle.KERNEL32(00000000), ref: 0041B885

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleReadSize
String ID:
API String ID: 3919263394-0
Opcode ID: ed58f78054f3304a0e571c39d56cdde4fa23284483a9ae65eff7322f5774d552
Instruction ID: 2a104a3335fe37b36386f9496d9e2b25d881a91c22a4f34d2042fa75e5cfbfce
Opcode Fuzzy Hash: ed58f78054f3304a0e571c39d56cdde4fa23284483a9ae65eff7322f5774d552
Instruction Fuzzy Hash: 47F0C2B12422047FE6102F25AC89FBF3A5CDB86BA9F10023EF801A2291DE258C0581B9

Function 00418702 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000004C), ref: 0041870F
GetSystemMetrics.USER32(0000004D), ref: 00418715
GetSystemMetrics.USER32(0000004E), ref: 0041871B
GetSystemMetrics.USER32(0000004F), ref: 00418721

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-0
Opcode ID: 0409876626ed8831e64dc81abc3b09ac1b97839c455807a5cfaaf12ce600e90b
Instruction ID: 0d34e4fe417a410293abd419840fb627d3fd172a5f9f2d4f3f0ee0adad43daa0
Opcode Fuzzy Hash: 0409876626ed8831e64dc81abc3b09ac1b97839c455807a5cfaaf12ce600e90b
Instruction Fuzzy Hash: 26F0D672B043215BCB00AB754C4596EBB969FC03A4F25083FFA159B381EE78EC4687D9

Function 004420ED Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0044217D

Strings

pow, xrefs: 00442155, 00442172

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 520362507bef941fab5cffea9abde62870a3d8c74bbf2bfcbae46fc27f337450
Instruction ID: 9e1bbc3390eeabea57be79b34f62796538476165ffe421cdb5ba0d05f4dc7be1
Opcode Fuzzy Hash: 520362507bef941fab5cffea9abde62870a3d8c74bbf2bfcbae46fc27f337450
Instruction Fuzzy Hash: 7251AF61A0A20297F7557B15CE8137B2B90EB50741F684D6BF085423E9EB7CCC819F4E

Function 00421179 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 178COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00421211

Strings

<kG, xrefs: 004213DC
<kG, xrefs: 004211E7

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: _memcmp
String ID: <kG$<kG
API String ID: 2931989736-383723866
Opcode ID: 21e918851be83e46baa3e5e3c8b8b30cd909724b045746f3163941703dd33272
Instruction ID: 841d78c923fca9e627808cf77cab3bf97fcfd39527adbe47470f5cf9fadca134
Opcode Fuzzy Hash: 21e918851be83e46baa3e5e3c8b8b30cd909724b045746f3163941703dd33272
Instruction Fuzzy Hash: 9F613471604B0A9ED710DF28D8806A6B7A5FF18304F440A3FEC5CCF656E3B8A955C7A9

Function 004095D6 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 158COMMON

Download Yara Rule

APIs

GetKeyboardLayoutNameA.USER32(?), ref: 00409601

Part of subcall function 004041F1: socket.WS2_32(?,00000001,00000006), ref: 00404212

Part of subcall function 0040428C: connect.WS2_32(?,?,?), ref: 004042A5

Part of subcall function 0041B8B5: CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,?,00000000,00409689,00474EE0,?,00474EE0,00000000,00474EE0,00000000), ref: 0041B8CA

Part of subcall function 00404468: send.WS2_32(000002FC,00000000,00000000,00000000), ref: 004044FD

Strings

pQG, xrefs: 00409676
NG, xrefs: 00409657

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: CreateFileKeyboardLayoutNameconnectsendsocket
String ID: pQG$NG
API String ID: 2334542088-921107917
Opcode ID: baae2f31211816717d1891d12ba902b559df7df93e5a23e8c27409df4f7124f2
Instruction ID: 713adcd63a50277e86c853b9c7bd1a900ae8bd87492a3ad9f31fb308660c5d8e
Opcode Fuzzy Hash: baae2f31211816717d1891d12ba902b559df7df93e5a23e8c27409df4f7124f2
Instruction Fuzzy Hash: BB5141321082405AC365F775D8A2AEF73E5AFD4308F50483FF84A671E2EE789949C69D

Function 0044DD44 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,00000005,?,00000000), ref: 0044DD69

Strings

vD, xrefs: 0044DD5B
, xrefs: 0044DDAE

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Info
String ID: $vD
API String ID: 1807457897-3636070802
Opcode ID: af2dbb740455362532db4c6e27cef1bba8ecc5757f530743f693fef6f10ca257
Instruction ID: 6a53932102cf2f29093c464eb4c67803ff3648b28b3ba8b7d074bec3f8911faa
Opcode Fuzzy Hash: af2dbb740455362532db4c6e27cef1bba8ecc5757f530743f693fef6f10ca257
Instruction Fuzzy Hash: D0415DB0D047489BEF218E24CC84AF6BBF9DF55708F2404EEE58A87142D239AD45DF65

Function 00417DD2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

SHCreateMemStream.SHLWAPI(00000000,00000000,?,?,?,00000000), ref: 00417DFE

Part of subcall function 00417988: GdipLoadImageFromStream.GDIPLUS(?,?,?,00417E11,00000000,?,?,?,?,00000000), ref: 0041799C

SHCreateMemStream.SHLWAPI(00000000), ref: 00417E4B

Part of subcall function 004179FB: GdipSaveImageToStream.GDIPLUS(?,?,?,?,00000000,00417E67,00000000,?,?), ref: 00417A0D

Part of subcall function 004179AB: GdipDisposeImage.GDIPLUS(?,00417EC2), ref: 004179B4

Strings

image/jpeg, xrefs: 00417E15

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Stream$GdipImage$Create$DisposeFromLoadSave
String ID: image/jpeg
API String ID: 1291196975-3785015651
Opcode ID: c0c6e86b316e55d66ebf2cdb0a10bdafe60ea560917bbaebe4dfd9cc843f5356
Instruction ID: 8af81f403c9bc23e7458ee74b157d237c4b9220e470ad7f048828f44144df9d5
Opcode Fuzzy Hash: c0c6e86b316e55d66ebf2cdb0a10bdafe60ea560917bbaebe4dfd9cc843f5356
Instruction Fuzzy Hash: 23313C71518204AFC301EF65C884DAFB7E9EF8A704F000A6EF98597251DB79D9098BA6

Function 00450AEE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,00450D49,?,00000050,?,?,?,?,?), ref: 00450BC9

Strings

OCP, xrefs: 00450B42
ACP, xrefs: 00450B0C

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID:
String ID: ACP$OCP
API String ID: 0-711371036
Opcode ID: 6fd782f53c9633299fe98566c4ec68ed2bffd726811d49864d22e4fe4dac6dcd
Instruction ID: d29bb87f3b47b124c8bd6c760bb86eb4cd4ec0f84f402c6b2e0ab732353f73f5
Opcode Fuzzy Hash: 6fd782f53c9633299fe98566c4ec68ed2bffd726811d49864d22e4fe4dac6dcd
Instruction Fuzzy Hash: 4021F72AA00105A6E7308FD48C82B977396AB50B1BF564467ED09D7303F73AFD09C358

Function 00417ECF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

SHCreateMemStream.SHLWAPI(00000000,00000000,?,?,?,00000000), ref: 00417EEA

Part of subcall function 00417988: GdipLoadImageFromStream.GDIPLUS(?,?,?,00417E11,00000000,?,?,?,?,00000000), ref: 0041799C

SHCreateMemStream.SHLWAPI(00000000,00000000,00000000,?,?,?,?,00000000), ref: 00417F0F

Part of subcall function 004179FB: GdipSaveImageToStream.GDIPLUS(?,?,?,?,00000000,00417E67,00000000,?,?), ref: 00417A0D

Part of subcall function 004179AB: GdipDisposeImage.GDIPLUS(?,00417EC2), ref: 004179B4

Strings

image/png, xrefs: 00417F01

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: Stream$GdipImage$Create$DisposeFromLoadSave
String ID: image/png
API String ID: 1291196975-2966254431
Opcode ID: af5d1f129cd5bd430e2235d416c6cbdfecbf91bf363856a8bd94ba4e637429f2
Instruction ID: ee77ca1c213fe0bce41e511bbcee913114c194eb695e7cc9890245c9a4d1a3c2
Opcode Fuzzy Hash: af5d1f129cd5bd430e2235d416c6cbdfecbf91bf363856a8bd94ba4e637429f2
Instruction Fuzzy Hash: B9219F71204210AFC301AB61CC88DBFBBBDEFCA714B00052EF94693261DB389945CBA6

Function 00449A39 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00449AB1

Strings

P*G, xrefs: 00449A6C
T*G, xrefs: 00449A7E

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: _free
String ID: P*G$T*G
API String ID: 269201875-829108958
Opcode ID: 2f751c0efca173fa551c184794475f0d61f37e7d68ea2317de90041697b8eca5
Instruction ID: a7437cf58198a632dccd7940a762e636932f246661e7801d2bdfb2ecead32fa8
Opcode Fuzzy Hash: 2f751c0efca173fa551c184794475f0d61f37e7d68ea2317de90041697b8eca5
Instruction Fuzzy Hash: 6111E4711443429FFB20DF26D441B53B3E8EB55368B30842FE48A9B281DB78AC859788

Function 004049BA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,00474EE0,004755B0,?,?,?,?,?,?,?,00414F0F,?,00000001,0000004C,00000000), ref: 004049F1

Part of subcall function 0041A891: GetLocalTime.KERNEL32(00000000), ref: 0041A8AB

GetLocalTime.KERNEL32(?,00474EE0,004755B0,?,?,?,?,?,?,?,00414F0F,?,00000001,0000004C,00000000), ref: 00404A4E

Strings

KeepAlive | Enabled | Timeout: , xrefs: 004049E5

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: LocalTime
String ID: KeepAlive | Enabled | Timeout:
API String ID: 481472006-1507639952
Opcode ID: 7b17d1e227f48684207d6be12f6d8554e6a2daeb87b5d1524601f4e1b57e679e
Instruction ID: 07f09c1926c096f578aeb4a964dedba27d52497869334d5e310e707c12b0f234
Opcode Fuzzy Hash: 7b17d1e227f48684207d6be12f6d8554e6a2daeb87b5d1524601f4e1b57e679e
Instruction Fuzzy Hash: 932131B1A042806BD600F77A980635B7B9497C4314F84043FE90C562E2EEBD59898BAF

Function 00448B07 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00448B53
GetFileType.KERNEL32(00000000), ref: 00448B65

Strings

`]], xrefs: 00448B9C

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: FileHandleType
String ID: `]]
API String ID: 3000768030-2908298338
Opcode ID: 709764ea7de61a1ee6b1c7a208d8f310102b3ec00a3095b3a15ed26258e7c2c3
Instruction ID: 4d96847604c3c5e89c92e0bae5a56447120e6fba85ff24299cab8e9791f5b951
Opcode Fuzzy Hash: 709764ea7de61a1ee6b1c7a208d8f310102b3ec00a3095b3a15ed26258e7c2c3
Instruction Fuzzy Hash: E71196B15047814EE7304A3D8C8962B6A54D752334B38071FF5B6967F1CF28E882924D

Function 0043AE40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0043AE6E
_free.LIBCMT ref: 0043AE94

Strings

`]], xrefs: 0043AE69, 0043AE76, 0043AE8F, 0043AE9C, 0043AEC2

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: _free
String ID: `]]
API String ID: 269201875-2908298338
Opcode ID: d7be576e25eb8f91f1c7522a8e83579c420102f8c2aee4373051d9f21f228018
Instruction ID: bbcf2e6bbb9829bcdebbaa4262a7be325da62559df7761f078343b1b3ea7e5ad
Opcode Fuzzy Hash: d7be576e25eb8f91f1c7522a8e83579c420102f8c2aee4373051d9f21f228018
Instruction Fuzzy Hash: EF11B471A803114AE7245F39BD42F563254E704734F15122BEA79DB2E0E7BCC8C2568A

Function 0041A891 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(00000000), ref: 0041A8AB

Strings

| , xrefs: 0041A8DE
%02i:%02i:%02i:%03i , xrefs: 0041A8C0

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: LocalTime
String ID: | $%02i:%02i:%02i:%03i
API String ID: 481472006-2430845779
Opcode ID: 93a98d44db7fb0c881bd96abbdce9d50535dabea07bf117fefb48cdc9cbc8cb7
Instruction ID: bea5c42f2d95e84a76b62dfc34e9438b8882b4e2d456746f57979f9b7964cbe7
Opcode Fuzzy Hash: 93a98d44db7fb0c881bd96abbdce9d50535dabea07bf117fefb48cdc9cbc8cb7
Instruction Fuzzy Hash: 0F114C725082405BC704EBA5D8969BF77E8AB94708F10093FF885A31E1EF38DA44C69E

Function 004126C6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 004126EA
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00412720

Strings

TeF, xrefs: 004126E5

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID: TeF
API String ID: 3660427363-331424825
Opcode ID: d95fd9167a1313fe8c80bfc7e96c72c6aa8b9b847f69a2249def5cc6c104aaba
Instruction ID: 3cb62dd7824af05a29d95bf947337739d939994cfcf273d244ad568f401b79ba
Opcode Fuzzy Hash: d95fd9167a1313fe8c80bfc7e96c72c6aa8b9b847f69a2249def5cc6c104aaba
Instruction Fuzzy Hash: 650184B6A00108BFEB05AB95DD46EFF7ABDEB44240F14007AF901E2241E6B0AF049664

Function 0041A07F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(00000000), ref: 0041A0A4

Strings

TeF, xrefs: 0041A0B3
alarm.wav, xrefs: 0041A08F

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID: TeF$alarm.wav
API String ID: 1174141254-486219832
Opcode ID: f7ee6337fc654cc0b09d6f8c04168479c952f1b1aa7db7e8f0e02e837cc1a088
Instruction ID: 6b61ed94da76c6dc8509722386f9763649bd27766d5c45ddbf5277e073f3d638
Opcode Fuzzy Hash: f7ee6337fc654cc0b09d6f8c04168479c952f1b1aa7db7e8f0e02e837cc1a088
Instruction Fuzzy Hash: 4D01D23160520166C604B636D8576EE3A458BC0728F50813FF88A666E2EF7CAED5C2DF

Function 0040A767 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

Part of subcall function 0040A876: GetLocalTime.KERNEL32(?,?,00000000), ref: 0040A884
Part of subcall function 0040A876: wsprintfW.USER32 ref: 0040A905

Part of subcall function 0041A891: GetLocalTime.KERNEL32(00000000), ref: 0041A8AB

CloseHandle.KERNEL32(?), ref: 0040A7CA
UnhookWindowsHookEx.USER32 ref: 0040A7DD

Strings

Online Keylogger Stopped, xrefs: 0040A777, 0040A77F, 0040A7A6

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: LocalTime$CloseHandleHookUnhookWindowswsprintf
String ID: Online Keylogger Stopped
API String ID: 1623830855-1496645233
Opcode ID: 908f31768a51f4bba0f1177a467c2c11ec0582f6bfe0bae760a55f80d2203bb8
Instruction ID: da65c2120251a34d34924486d515db36f90714a8cba0a7d82e96ebed52376b78
Opcode Fuzzy Hash: 908f31768a51f4bba0f1177a467c2c11ec0582f6bfe0bae760a55f80d2203bb8
Instruction Fuzzy Hash: 5901F131A043019BCB25BB35C80B7AEBBB19B45314F40406EE441225D2EB7999A6C3DF

Function 00448973 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 00444CDC: EnterCriticalSection.KERNEL32(-00472558,?,0044246B,00000000,0046EAD0,0000000C,00442426,0000000A,?,?,00448949,0000000A,?,00447184,00000001,00000364), ref: 00444CEB

DeleteCriticalSection.KERNEL32(?,?,?,?,?,0046ECB8,00000010,0043AF25), ref: 004489D5
_free.LIBCMT ref: 004489E3

Strings

`]], xrefs: 0044899D, 004489B3, 004489C9, 004489DB, 004489E9

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: CriticalSection$DeleteEnter_free
String ID: `]]
API String ID: 1836352639-2908298338
Opcode ID: 9d76c620edcff08112ad37d792de4fd9c43109646451596060a8f89fb46b25c4
Instruction ID: 148d79857643bc82b319f24316268943629f83d9e3709ab7633481e59fa6f6a8
Opcode Fuzzy Hash: 9d76c620edcff08112ad37d792de4fd9c43109646451596060a8f89fb46b25c4
Instruction Fuzzy Hash: F51161715002119FE715DFA9E946BAD73B0FB08724F11411EE5A5AB2E2CF7CE8829B0D

Function 004016E8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

waveInPrepareHeader.WINMM(005CF588,00000020,?,?,00000000,00476B98,00474EE0,?,00000000,00401913), ref: 00401747
waveInAddBuffer.WINMM(005CF588,00000020,?,00000000,00401913), ref: 0040175D

Strings

XMG, xrefs: 004016F6

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: wave$BufferHeaderPrepare
String ID: XMG
API String ID: 2315374483-813777761
Opcode ID: 620c8429846d9d472bb74b0b690090328b51b047c9fc1556c206adb706f1508e
Instruction ID: 26799fbdff8c3ec01ad48014b311b0d3f370155dffc0330205344997a7b0d52a
Opcode Fuzzy Hash: 620c8429846d9d472bb74b0b690090328b51b047c9fc1556c206adb706f1508e
Instruction Fuzzy Hash: 6501AD71300300AFD7209F39ED45A69BBB5EF89315B00413EB808E33A2EB74AC50CB98

Function 004479A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMONLIBRARYCODE

Download Yara Rule

APIs

IsValidLocale.KERNEL32(00000000,z?D,00000000,00000001,?,?,00443F7A,?,?,?,?,00000004), ref: 004479EC

Strings

z?D, xrefs: 004479E3, 004479D0
IsValidLocaleName, xrefs: 004479B1, 004479BB

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: LocaleValid
String ID: IsValidLocaleName$z?D
API String ID: 1901932003-2490211753
Opcode ID: 030ca6b5b062e3e6eb463140e6e5805cf12db518d0019a9c378278714199a4d0
Instruction ID: 892bc6e93789200f6c95030ba230210178196c8f1f686432b442ac7872abfc60
Opcode Fuzzy Hash: 030ca6b5b062e3e6eb463140e6e5805cf12db518d0019a9c378278714199a4d0
Instruction Fuzzy Hash: 06F0E930645218B7DB186F258C06F5E7B95CB05716F50807BFC047A293DE794E0295DD

Function 00401D91 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00401D96

Strings

XMG, xrefs: 00401DDB
XMG, xrefs: 00401DB7

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID: XMG$XMG
API String ID: 3519838083-886261599
Opcode ID: 94d942c2b9cd7cd452367b65107360caec8e392a141153fe325b9bee2a1bda9b
Instruction ID: 0a877421dfc5135a28098138b17ad9f721677e320a6d1c8a6a2adbe775497da7
Opcode Fuzzy Hash: 94d942c2b9cd7cd452367b65107360caec8e392a141153fe325b9bee2a1bda9b
Instruction Fuzzy Hash: D4F0E9B1B00211ABC715BB65880569EB768EF41369F01827FB416772E1CFBD5D04975C

Function 0040AD56 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000011), ref: 0040AD5B

Part of subcall function 00409B10: GetForegroundWindow.USER32(?,?,00475108), ref: 00409B3F
Part of subcall function 00409B10: GetWindowThreadProcessId.USER32(00000000,?), ref: 00409B4B
Part of subcall function 00409B10: GetKeyboardLayout.USER32(00000000), ref: 00409B52
Part of subcall function 00409B10: GetKeyState.USER32(00000010), ref: 00409B5C
Part of subcall function 00409B10: GetKeyboardState.USER32(?,?,00475108), ref: 00409B67
Part of subcall function 00409B10: ToUnicodeEx.USER32(0047515C,00000000,?,?,00000010,00000000,00000000), ref: 00409B8A
Part of subcall function 00409B10: ToUnicodeEx.USER32(?,?,00000010,00000000,00000000), ref: 00409BE3

Part of subcall function 00409D58: SetEvent.KERNEL32(?,?,?,0040AF3F,?,?,?,?,?,00000000), ref: 00409D84

Strings

[AltL], xrefs: 0040AD9D
[AltR], xrefs: 0040AD91

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: State$KeyboardUnicodeWindow$EventForegroundLayoutProcessThread
String ID: [AltL]$[AltR]
API String ID: 2738857842-2658077756
Opcode ID: 013d8eb75564844e77d0a130007ea633e5b9443d2c6b05f924e9c22f592720ae
Instruction ID: 4c389cf0edc94a27bb3bc0fddc987b72c0da48b50f0a0a77cbfc03dd010ffeca
Opcode Fuzzy Hash: 013d8eb75564844e77d0a130007ea633e5b9443d2c6b05f924e9c22f592720ae
Instruction Fuzzy Hash: 9AE09B2134032117C898323EA91B6EE3A218F82F65B80016FF8427BADADD7D4D5043CF

Function 00448A13 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00448A35

Part of subcall function 00446CD5: RtlFreeHeap.NTDLL(00000000,00000000,?,0044FC60,0000000A,00000000,0000000A,00000000,?,0044FF04,0000000A,00000007,0000000A,?,00450415,0000000A), ref: 00446CEB
Part of subcall function 00446CD5: GetLastError.KERNEL32(0000000A,?,0044FC60,0000000A,00000000,0000000A,00000000,?,0044FF04,0000000A,00000007,0000000A,?,00450415,0000000A,0000000A), ref: 00446CFD

Strings

8@, xrefs: 00448A18
8@, xrefs: 00448A19

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast_free
String ID: 8@$8@
API String ID: 1353095263-3408345419
Opcode ID: 9a963da6b0d453c70d37714207bd95daf40472698ea915a46c6a843fe12f4396
Instruction ID: 8fe4af4b93ebf6b2b13329648f525de20a5552277f2be9521e73d3219e6c2dc0
Opcode Fuzzy Hash: 9a963da6b0d453c70d37714207bd95daf40472698ea915a46c6a843fe12f4396
Instruction Fuzzy Hash: 01E092361003059F8720CF6DD400A86B7F4EF95720720852FE89EE3710D731E812CB40

Function 0040ADB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000012), ref: 0040ADB5

Strings

[CtrlL], xrefs: 0040ADE3
[CtrlR], xrefs: 0040ADD2

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: State
String ID: [CtrlL]$[CtrlR]
API String ID: 1649606143-2446555240
Opcode ID: 4cd3fd2045822c407c10e6f4791885f4ed8356674f4e2c80592f01f7e92f4c5a
Instruction ID: c178b64a75e50e2fccb38c9379e001e6e5e0f6b670105b82eaba8ba361dc1658
Opcode Fuzzy Hash: 4cd3fd2045822c407c10e6f4791885f4ed8356674f4e2c80592f01f7e92f4c5a
Instruction Fuzzy Hash: 59E0866170031517C514363DD61B67F39128F41B66F80012FF842A7AC6ED7E8D6423CB

Function 00412A52 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\,00000000,00000002,?,80000002,80000002,0040BFB2,00000000,004752F0,00475308,?,pth_unenc), ref: 00412A60
RegDeleteValueW.ADVAPI32(?,?,?,pth_unenc), ref: 00412A70

Strings

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 00412A5E

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: DeleteOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
API String ID: 2654517830-1051519024
Opcode ID: 3a238ae8f5602ce2402de7cae663a0db3b4178bc362611f3100633d001d48757
Instruction ID: 27182704b7fa20b5ed2a2764b3d23dc9a6b68b829b0f6622ee10c7d45645f89b
Opcode Fuzzy Hash: 3a238ae8f5602ce2402de7cae663a0db3b4178bc362611f3100633d001d48757
Instruction Fuzzy Hash: F1E01270200308BAEF204FA19E06FEB37ACAB40BC9F004169F601F5191EAB6DD54A658

Function 0043AF18 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

Part of subcall function 00448973: DeleteCriticalSection.KERNEL32(?,?,?,?,?,0046ECB8,00000010,0043AF25), ref: 004489D5
Part of subcall function 00448973: _free.LIBCMT ref: 004489E3

Part of subcall function 00448A13: _free.LIBCMT ref: 00448A35

DeleteCriticalSection.KERNEL32(005D5D40), ref: 0043AF41
_free.LIBCMT ref: 0043AF55

Strings

`]], xrefs: 0043AF27, 0043AF34, 0043AF5A

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: _free$CriticalDeleteSection
String ID: `]]
API String ID: 1906768660-2908298338
Opcode ID: 71ff8b17d51679f1d22a336c43bf2a586848bbcdcff3b0266824fadac5e6ad26
Instruction ID: c565f5be962e97e7d95751f2e11d368bfb34a8db459f84b373f63e28eeb95a6a
Opcode Fuzzy Hash: 71ff8b17d51679f1d22a336c43bf2a586848bbcdcff3b0266824fadac5e6ad26
Instruction Fuzzy Hash: 31E0D83280461087D6247F7DFD4195D73A4EB4D725F02042EF859B3161CE6C6CC1674D

Function 0040AF77 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000,?,pth_unenc), ref: 0040AF84
RemoveDirectoryW.KERNEL32(00000000,?,pth_unenc), ref: 0040AFAF

Strings

pth_unenc, xrefs: 0040AF77

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: DeleteDirectoryFileRemove
String ID: pth_unenc
API String ID: 3325800564-4028850238
Opcode ID: 7b845410b2c100cd84e1cb5c796077768945eb3f9586e929b361309ded2c1d61
Instruction ID: b030a41f26c3d5f2e51690188d4bb45887e11e7cc62b1c698fc8f7347c957287
Opcode Fuzzy Hash: 7b845410b2c100cd84e1cb5c796077768945eb3f9586e929b361309ded2c1d61
Instruction Fuzzy Hash: 12E046715116104BC610AB32E845AEBB798AB05306F00446FE8D3B36A1DE38A948CA98

Function 00411771 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13synchronizationCOMMON

Download Yara Rule

APIs

TerminateProcess.KERNEL32(00000000,pth_unenc,0040E748), ref: 00411781
WaitForSingleObject.KERNEL32(000000FF), ref: 00411794

Strings

pth_unenc, xrefs: 00411771

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: ObjectProcessSingleTerminateWait
String ID: pth_unenc
API String ID: 1872346434-4028850238
Opcode ID: 5bb4d910bf534706ca5f2b5d32154bdbdc32722f36a2c9cc9993c004b7262cc3
Instruction ID: eef26e02e81300ba4c8cf7f61278c3f59c29627b67378ac59a4e73c1cb1fd9d7
Opcode Fuzzy Hash: 5bb4d910bf534706ca5f2b5d32154bdbdc32722f36a2c9cc9993c004b7262cc3
Instruction Fuzzy Hash: 24D01234145351AFD7610B60AD19F953F68E705323F108365F428512F1CFB58494AA1C

Function 0044E2FB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32 ref: 0044E2FB
GetCommandLineW.KERNEL32 ref: 0044E306

Strings

8([, xrefs: 0044E301

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: CommandLine
String ID: 8([
API String ID: 3253501508-1960659948
Opcode ID: 2af003f58cbc160ee14b683418bbba4d8b8a3db8a81f41d33ad53b69198441d0
Instruction ID: 13669fbb96da4af28d6e29504cff827b20a3884a95298ededa59c37acacad3b6
Opcode Fuzzy Hash: 2af003f58cbc160ee14b683418bbba4d8b8a3db8a81f41d33ad53b69198441d0
Instruction Fuzzy Hash: E7B092788017019FC7519F30BE0C2053BA0B3082033800479D809D3B21DE748082EF08

Function 0043FCA1 Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00401AD8), ref: 0043FD37
GetLastError.KERNEL32 ref: 0043FD45
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0043FDA0

Memory Dump Source

Source File: 00000000.00000002.4511946468.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4511934086.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511973439.0000000000458000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000471000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4511992687.0000000000474000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4512026993.0000000000477000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: da5cee2afb3fc4b5b183086853f31dabd9e5fae04dd03cb90eeff65bb8952867
Instruction ID: a8021b2984f9c2011c4d4eba480f75da6e6c35d7fa760b83b06315d7a0ea6bca
Opcode Fuzzy Hash: da5cee2afb3fc4b5b183086853f31dabd9e5fae04dd03cb90eeff65bb8952867
Instruction Fuzzy Hash: E1410A30E00246AFCF218F65C84867B7BA5EF09310F14517EFC5A9B2A2DB398D05C759

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Remcos

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Privilege Escalation

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\remcos\logs.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\json[1].json

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
173634822473cd620521fcc8b42a4aac25bbd1c3f6e30c324045b1411f9747e93f432d0281839.dat-decoded.exe

Function 0041BEEE Relevance: 115.6, APIs: 40, Strings: 26, Instructions: 140
libraryloaderCOMMON

Function 0040D83A Relevance: 60.3, APIs: 13, Strings: 21, Instructions: 800
COMMON

Function 004099E4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 65
windowCOMMON

Function 0040E627 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 88
sleepCOMMON

Function 00404915 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60
timethreadCOMMON

Function 004140AC Relevance: 51.6, APIs: 5, Strings: 24, Instructions: 855
sleepnetworkCOMMON

Function 0040A3F4 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 158
sleepCOMMON

Function 0040428C Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 147
networkCOMMON

Function 0040C89E Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 139
COMMON

Function 00409E48 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 163
sleepCOMMON

Function 0041A66E Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 59
COMMON

Function 0041A726 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68
networkfileCOMMON

Function 00409D97 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58
sleepfileCOMMON

Function 004127AA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37
registryCOMMON

Function 004098A5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70
threadCOMMON

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre