Edit tour

Windows Analysis Report
x.exe

Overview

General Information

Sample name:	x.exe
Analysis ID:	1586043
MD5:	10454890a3d7c7c0b7ec0bf7018141e4
SHA1:	167ab9a5a9e0c56689f73d894a397b9c176701df
SHA256:	91fee98b5957d145f144b61107ea0283fc3e02eb7e19b432e868ee45ffdc528e
Tags:	exeuser-malrpt
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

AI detected suspicious sample

Allocates memory in foreign processes

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Machine Learning detection for sample

PE file contains section with special chars

PE file has nameless sections

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

x.exe (PID: 5732 cmdline: "C:\Users\user\Desktop\x.exe" MD5: 10454890A3D7C7C0B7EC0BF7018141E4)

RegAsm.exe (PID: 6996 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://ftp.antoniomayol.com:21", "Username": "johnson@antoniomayol.com", "Password": "cMhKDQUk1{;%"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.4588333845.0000000002ABE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.4587325909.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.4587325909.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.4588333845.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.4588333845.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2150081464.000000000401F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2150081464.000000000401F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: x.exe PID: 5732	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: x.exe PID: 5732	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegAsm.exe PID: 6996	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 6996	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.RegAsm.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.RegAsm.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.RegAsm.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.RegAsm.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34735:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x347a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34831:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x348c3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3492d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3499f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34a35:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34ac5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
2.2.RegAsm.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3196b:$s2: GetPrivateProfileString 0x31018:$s3: get_OSFullName 0x32706:$s5: remove_Key 0x328b3:$s5: remove_Key 0x33795:$s6: FtpWebRequest 0x34717:$s7: logins 0x34c89:$s7: logins 0x3798e:$s7: logins 0x37a4c:$s7: logins 0x393a1:$s7: logins 0x385e6:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.x.exe.41c3420.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.x.exe.41c3420.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.x.exe.41c3420.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32935:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x329a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x32a31:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32ac3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32b2d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32b9f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32c35:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32cc5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.x.exe.41c3420.1.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2fb6b:$s2: GetPrivateProfileString 0x2f218:$s3: get_OSFullName 0x30906:$s5: remove_Key 0x30ab3:$s5: remove_Key 0x31995:$s6: FtpWebRequest 0x32917:$s7: logins 0x32e89:$s7: logins 0x35b8e:$s7: logins 0x35c4c:$s7: logins 0x375a1:$s7: logins 0x367e6:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.x.exe.4187600.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.x.exe.4187600.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.x.exe.4187600.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32935:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x329a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x32a31:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32ac3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32b2d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32b9f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32c35:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32cc5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.x.exe.4187600.2.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2fb6b:$s2: GetPrivateProfileString 0x2f218:$s3: get_OSFullName 0x30906:$s5: remove_Key 0x30ab3:$s5: remove_Key 0x31995:$s6: FtpWebRequest 0x32917:$s7: logins 0x32e89:$s7: logins 0x35b8e:$s7: logins 0x35c4c:$s7: logins 0x375a1:$s7: logins 0x367e6:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.x.exe.414b7d8.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.x.exe.414b7d8.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.x.exe.414b7d8.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32935:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x329a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x32a31:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32ac3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32b2d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32b9f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32c35:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32cc5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.x.exe.414b7d8.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2fb6b:$s2: GetPrivateProfileString 0x2f218:$s3: get_OSFullName 0x30906:$s5: remove_Key 0x30ab3:$s5: remove_Key 0x31995:$s6: FtpWebRequest 0x32917:$s7: logins 0x32e89:$s7: logins 0x35b8e:$s7: logins 0x35c4c:$s7: logins 0x375a1:$s7: logins 0x367e6:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.x.exe.41c3420.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.x.exe.41c3420.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.x.exe.41c3420.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.x.exe.41c3420.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34735:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x70355:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x347a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x703c7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34831:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x70451:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x348c3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x704e3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3492d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x7054d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3499f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x705bf:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34a35:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x70655:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34ac5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x706e5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.x.exe.41c3420.1.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3196b:$s2: GetPrivateProfileString 0x6d58b:$s2: GetPrivateProfileString 0x31018:$s3: get_OSFullName 0x6cc38:$s3: get_OSFullName 0x32706:$s5: remove_Key 0x328b3:$s5: remove_Key 0x6e326:$s5: remove_Key 0x6e4d3:$s5: remove_Key 0x33795:$s6: FtpWebRequest 0x6f3b5:$s6: FtpWebRequest 0x34717:$s7: logins 0x34c89:$s7: logins 0x3798e:$s7: logins 0x37a4c:$s7: logins 0x393a1:$s7: logins 0x70337:$s7: logins 0x708a9:$s7: logins 0x735ae:$s7: logins 0x7366c:$s7: logins 0x74fc1:$s7: logins 0x385e6:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.x.exe.4187600.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.x.exe.4187600.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.x.exe.4187600.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.x.exe.4187600.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34735:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x70555:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xac175:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x347a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x705c7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xac1e7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34831:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x70651:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xac271:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x348c3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x706e3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xac303:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3492d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x7074d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xac36d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3499f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x707bf:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xac3df:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34a35:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x70855:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xac475:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.x.exe.4187600.2.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3196b:$s2: GetPrivateProfileString 0x6d78b:$s2: GetPrivateProfileString 0xa93ab:$s2: GetPrivateProfileString 0x31018:$s3: get_OSFullName 0x6ce38:$s3: get_OSFullName 0xa8a58:$s3: get_OSFullName 0x32706:$s5: remove_Key 0x328b3:$s5: remove_Key 0x6e526:$s5: remove_Key 0x6e6d3:$s5: remove_Key 0xaa146:$s5: remove_Key 0xaa2f3:$s5: remove_Key 0x33795:$s6: FtpWebRequest 0x6f5b5:$s6: FtpWebRequest 0xab1d5:$s6: FtpWebRequest 0x34717:$s7: logins 0x34c89:$s7: logins 0x3798e:$s7: logins 0x37a4c:$s7: logins 0x393a1:$s7: logins 0x70537:$s7: logins
0.2.x.exe.414b7d8.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.x.exe.414b7d8.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.x.exe.414b7d8.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.x.exe.414b7d8.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34735:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x7055d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xac37d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xe7f9d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x347a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x705cf:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xac3ef:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xe800f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34831:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x70659:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xac479:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xe8099:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x348c3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x706eb:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xac50b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xe812b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3492d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x70755:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xac575:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xe8195:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3499f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC
0.2.x.exe.414b7d8.0.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3196b:$s2: GetPrivateProfileString 0x6d793:$s2: GetPrivateProfileString 0xa95b3:$s2: GetPrivateProfileString 0xe51d3:$s2: GetPrivateProfileString 0x31018:$s3: get_OSFullName 0x6ce40:$s3: get_OSFullName 0xa8c60:$s3: get_OSFullName 0xe4880:$s3: get_OSFullName 0x32706:$s5: remove_Key 0x328b3:$s5: remove_Key 0x6e52e:$s5: remove_Key 0x6e6db:$s5: remove_Key 0xaa34e:$s5: remove_Key 0xaa4fb:$s5: remove_Key 0xe5f6e:$s5: remove_Key 0xe611b:$s5: remove_Key 0x33795:$s6: FtpWebRequest 0x6f5bd:$s6: FtpWebRequest 0xab3dd:$s6: FtpWebRequest 0xe6ffd:$s6: FtpWebRequest 0x34717:$s7: logins
Click to see the 27 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: x.exe

Avira: detected

Found malware configuration

Source: 2.2.RegAsm.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.antoniomayol.com:21", "Username": "johnson@antoniomayol.com", "Password": "cMhKDQUk1{;%"}

Multi AV Scanner detection for submitted file

Source: x.exe

ReversingLabs: Detection: 65%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: x.exe

Joe Sandbox ML: detected

Source: x.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.x.exe.41c3420.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.x.exe.4187600.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.x.exe.414b7d8.0.raw.unpack, type: UNPACKEDPE

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 162.241.62.63 162.241.62.63

Source: Joe Sandbox View

ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US

Source: unknown

DNS query: name: ip-api.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: ftp.antoniomayol.com

Source: RegAsm.exe, 00000002.00000002.4588333845.0000000002ABE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://antoniomayol.com
Source: RegAsm.exe, 00000002.00000002.4588333845.0000000002ABE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ftp.antoniomayol.com
Source: RegAsm.exe, 00000002.00000002.4588333845.0000000002A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: x.exe, 00000000.00000002.2150081464.000000000401F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.4588333845.0000000002A61000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.4587325909.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: RegAsm.exe, 00000002.00000002.4588333845.0000000002A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: x.exe, 00000000.00000002.2150081464.000000000401F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.4587325909.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.x.exe.414b7d8.0.raw.unpack, R1W.cs	.Net Code: HAg81
Source: 0.2.x.exe.41c3420.1.raw.unpack, R1W.cs	.Net Code: HAg81
Source: 0.2.x.exe.4187600.2.raw.unpack, R1W.cs	.Net Code: HAg81

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.x.exe.41c3420.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.x.exe.41c3420.1.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.x.exe.4187600.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.x.exe.4187600.2.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.x.exe.414b7d8.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.x.exe.414b7d8.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.x.exe.41c3420.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.x.exe.41c3420.1.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.x.exe.4187600.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.x.exe.4187600.2.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.x.exe.414b7d8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.x.exe.414b7d8.0.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen

PE file contains section with special chars

Source: x.exe

Static PE information: section name: PRSq<

PE file has nameless sections

Source: x.exe

Static PE information: section name:

Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_00C628D0	0_2_00C628D0
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_00C60848	0_2_00C60848
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_00C611E0	0_2_00C611E0
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_00C628C1	0_2_00C628C1
Source: C:\Users\user\Desktop\x.exe	Code function: 0_2_00C607E0	0_2_00C607E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_02A4B48A	2_2_02A4B48A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_02A44A88	2_2_02A44A88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_02A43E70	2_2_02A43E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_02A4ECD8	2_2_02A4ECD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_02A4AD98	2_2_02A4AD98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_02A441B8	2_2_02A441B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0566C600	2_2_0566C600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0566AD78	2_2_0566AD78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_063D66C0	2_2_063D66C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_063D2440	2_2_063D2440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_063D5270	2_2_063D5270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_063DC270	2_2_063DC270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_063DB318	2_2_063DB318
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_063D7E50	2_2_063D7E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_063D7770	2_2_063D7770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_063DE478	2_2_063DE478
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_063D0040	2_2_063D0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_063D59C0	2_2_063D59C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_063D0006	2_2_063D0006

Source: x.exe, 00000000.00000002.2146115943.0000000000CAE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs x.exe
Source: x.exe, 00000000.00000002.2149991627.00000000027B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamee6c7e90e-20ff-4cd0-a277-0023958459c3.exe4 vs x.exe
Source: x.exe, 00000000.00000002.2150081464.000000000401F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamee6c7e90e-20ff-4cd0-a277-0023958459c3.exe4 vs x.exe
Source: x.exe	Binary or memory string: OriginalFilenameVVXCJEER.exe2 vs x.exe

Source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.x.exe.41c3420.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.x.exe.41c3420.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.x.exe.4187600.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.x.exe.4187600.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.x.exe.414b7d8.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.x.exe.414b7d8.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.x.exe.41c3420.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.x.exe.41c3420.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.x.exe.4187600.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.x.exe.4187600.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.x.exe.414b7d8.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.x.exe.414b7d8.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload

Source: x.exe

Static PE information: Section: PRSq< ZLIB complexity 1.0003312993096647

Source: 0.2.x.exe.414b7d8.0.raw.unpack, KLhJmaON.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.x.exe.414b7d8.0.raw.unpack, KLhJmaON.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.x.exe.414b7d8.0.raw.unpack, 7hO8luD.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.x.exe.414b7d8.0.raw.unpack, 7hO8luD.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.x.exe.414b7d8.0.raw.unpack, 7hO8luD.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.x.exe.414b7d8.0.raw.unpack, 7hO8luD.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.x.exe.414b7d8.0.raw.unpack, 9HIFdl.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.x.exe.414b7d8.0.raw.unpack, 9HIFdl.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@2/2

Source: C:\Users\user\Desktop\x.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\x.exe.log

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Mutant created: NULL

Source: x.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\x.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: x.exe

ReversingLabs: Detection: 65%

Source: unknown	Process created: C:\Users\user\Desktop\x.exe "C:\Users\user\Desktop\x.exe"
Source: C:\Users\user\Desktop\x.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\x.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\x.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: x.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: x.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: x.exe

Static PE information: 0xB8E5284B [Thu Apr 19 01:50:03 2068 UTC]

Source: x.exe	Static PE information: section name: PRSq<
Source: x.exe	Static PE information: section name:

Source: x.exe

Static PE information: section name: PRSq< entropy: 7.999313087046451

Source: C:\Users\user\Desktop\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: x.exe, 00000000.00000002.2150081464.000000000401F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.4588333845.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.4587325909.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\x.exe	Memory allocated: C60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Memory allocated: 27A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Memory allocated: 47A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Memory allocated: 4E40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Memory allocated: 5E40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Memory allocated: 5F70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Memory allocated: 6F70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 28D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2A60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 4A60000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\x.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598011	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597741	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596076	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595529	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595421	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594547	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 1275			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 8589			Jump to behavior

Source: C:\Users\user\Desktop\x.exe TID: 5552	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -26747778906878833s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2820	Thread sleep count: 1275 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2820	Thread sleep count: 8589 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -599344s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -599125s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -599015s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -598906s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -598796s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -598687s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -598578s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -598469s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -598359s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -598250s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -598125s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -598011s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -597859s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -597741s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -597625s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -597515s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -597406s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -597297s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -597187s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -597078s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -596969s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -596844s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -596734s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -596625s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -596515s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -596406s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -596297s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -596187s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -596076s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -595969s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -595859s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -595750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -595640s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -595529s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -595421s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -595312s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -595203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -595093s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -594984s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -594875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -594765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -594656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2244	Thread sleep time: -594547s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\x.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 598011	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597741	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 597078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 596076	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595529	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595421	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 595093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 594547	Jump to behavior

Source: RegAsm.exe, 00000002.00000002.4588333845.0000000002A91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: RegAsm.exe, 00000002.00000002.4587325909.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: vmware
Source: x.exe, 00000000.00000002.2150081464.000000000401F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.4587325909.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: hgfsZrw6
Source: RegAsm.exe, 00000002.00000002.4587325909.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VMwareVBoxESelect * from Win32_ComputerSystem
Source: RegAsm.exe, 00000002.00000002.4590990823.0000000005D6F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_02A47070 CheckRemoteDebuggerPresent,

2_2_02A47070

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\x.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\x.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\x.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\x.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43E000	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 440000	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\x.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 9A0008	Jump to behavior

Source: C:\Users\user\Desktop\x.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Jump to behavior

Source: C:\Users\user\Desktop\x.exe	Queries volume information: C:\Users\user\Desktop\x.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\x.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.x.exe.41c3420.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.x.exe.4187600.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.x.exe.414b7d8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.x.exe.41c3420.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.x.exe.4187600.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.x.exe.414b7d8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4588333845.0000000002ABE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4587325909.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4588333845.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2150081464.000000000401F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: x.exe PID: 5732, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6996, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.x.exe.41c3420.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.x.exe.4187600.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.x.exe.414b7d8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.x.exe.41c3420.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.x.exe.4187600.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.x.exe.414b7d8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4587325909.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4588333845.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2150081464.000000000401F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: x.exe PID: 5732, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6996, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.x.exe.41c3420.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.x.exe.4187600.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.x.exe.414b7d8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.x.exe.41c3420.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.x.exe.4187600.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.x.exe.414b7d8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4588333845.0000000002ABE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4587325909.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4588333845.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2150081464.000000000401F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: x.exe PID: 5732, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 6996, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	231 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	311 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	34 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	1 Credentials in Registry	531 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	1 Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	261 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	261 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	311 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
x.exe	66%	ReversingLabs	Win32.Trojan.InfostealerTesla
x.exe	100%	Avira	TR/Dropper.Gen
x.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://antoniomayol.com	0%	Avira URL Cloud	safe
http://ftp.antoniomayol.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
antoniomayol.com	162.241.62.63	true	true	unknown
ip-api.com	208.95.112.1	true	false	high
ftp.antoniomayol.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ip-api.com/line/?fields=hosting	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://antoniomayol.com	RegAsm.exe, 00000002.00000002.4588333845.0000000002ABE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ftp.antoniomayol.com	RegAsm.exe, 00000002.00000002.4588333845.0000000002ABE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.dyn.com/	x.exe, 00000000.00000002.2150081464.000000000401F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.4587325909.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegAsm.exe, 00000002.00000002.4588333845.0000000002A61000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ip-api.com	RegAsm.exe, 00000002.00000002.4588333845.0000000002A61000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false
162.241.62.63	antoniomayol.com	United States		46606	UNIFIEDLAYER-AS-1US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1586043
Start date and time:	2025-01-08 16:52:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	x.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 83 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 20.12.23.50
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: x.exe

Simulations

Behavior and APIs

Time	Type	Description
10:53:01	API Interceptor	11544761x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	TR98760H.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	47SXvEQ.exe	Get hash	malicious	Blank Grabber, Xmrig	Browse	ip-api.com/json/?fields=225545
	test.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	ip-api.com/json/
	HaLCYOFjMN.exe	Get hash	malicious	DCRat, PureLog Stealer, RedLine, XWorm, zgRAT	Browse	ip-api.com/line/?fields=hosting
	1.exe	Get hash	malicious	Unknown	Browse	ip-api.com/json/?fields=hosting,query
	1.exe	Get hash	malicious	Unknown	Browse	ip-api.com/json/?fields=hosting,query
	YPzNsfg4nR.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	SAL987656700.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Resource.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/json/?fields=225545
	P3A946MOFP.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
162.241.62.63	Order 122001-220 guanzo.exe	Get hash	malicious	FormBook	Browse	www.pasteleriaruth.com/meub/?6lt4=M6ATVT20FLj&ktI=BrZDxrt78R4OSP6X83RJQ8I8yi0a/QJgiEays5do7SITSAPpSF1hBU/JW21XLBQwE3Ox

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	TR98760H.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	47SXvEQ.exe	Get hash	malicious	Blank Grabber, Xmrig	Browse	208.95.112.1
	test.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	208.95.112.1
	HaLCYOFjMN.exe	Get hash	malicious	DCRat, PureLog Stealer, RedLine, XWorm, zgRAT	Browse	208.95.112.1
	1.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	1.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	YPzNsfg4nR.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	SAL987656700.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Resource.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	P3A946MOFP.exe	Get hash	malicious	XWorm	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNIFIEDLAYER-AS-1US	https://AAYUSHRELOCATEPACKERSANDMOVERS.COM	Get hash	malicious	Unknown	Browse	162.241.148.33
	EZZGTmJj4O.exe	Get hash	malicious	AgentTesla	Browse	192.254.186.165
	https://e.trustifi.com/#/fff2a0/670719/6dc158/ef68bf/5e1243/19ce62/f4cd99/c6b84a/e8666a/ef542d/85972d/627493/9a11d6/1f4096/1d247f/d78873/cd64d0/869af2/e9ab57/7015c1/91dda7/f34c0a/f30b47/688cba/a1d645/18dc79/33d9f9/9ee0a0/c61099/8f2456/8e1864/996369/790047/a93a09/347b17/38082d/363d49/f88c07/81bae2/57a7bb/6027c6/942952/b2de1b/e98aef/6a05c2/91297b/c70871/7f29c3/0a450d/ad0cac/967c2a/e7cb67/6e1193/8c4088/13aef1/e1d296/5056d4/51a97e/89a35b/c13e69/fa274a/5b7c2e/a8c901/02856f/1e0211/03ca84/d7b573/7e0de3/e2bdbb/7cab47/4dd465/addb41/2076e1/85559c/dbcb2d/514505/a6a54e/41e864/abb5a5/e59e4b/8c2df6/7e5cf3/b648da/8fbd98/4c7d8a/08e6a3/72f66f/a49cc6/18211b/1e6a5c/0d4fde	Get hash	malicious	HTMLPhisher	Browse	162.241.149.91
	https://jmak-service.com/3225640388	Get hash	malicious	HTMLPhisher	Browse	162.241.149.91
	TR98760H.exe	Get hash	malicious	AgentTesla	Browse	162.241.62.63
	https://pozaweclip.upnana.com/	Get hash	malicious	Unknown	Browse	162.241.149.91
	https://us01-i-prod-estimating-storage.s3.amazonaws.com/598134325679181/562949954787293/Documents/1706942/Hoosier%20Crane%20Service%20Company.pdf	Get hash	malicious	HTMLPhisher	Browse	162.241.149.91
	miori.m68k.elf	Get hash	malicious	Unknown	Browse	142.7.137.184
	https://universidad-unidem.edu.mx/mah/i/amFjb2JAc3RlaW5ib3JuLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	162.214.205.216
	https://g248jqtc.r.ap-south-1.awstrack.me/L0/https://fub.direct/1/wpcpz2KV6CJLjr9Ku5V9crqS4vRSbleRYVQVlbRDO0VhTlcqWS8eK4WwWGYEcIFo0NTTfcu_ywSiT_-hMwRGjBfgg1rcvHOcCbgDl1KQiWE/https/westcommerce.com.br/e63o/1750871326/Ara/%23%3Fnl=amRpYkBhcmEuY29t/1/0109019433d34740-32de3bb4-8eb6-4b18-a944-d8e7ee993673-000000/ImcP_D-hsLxxvDJopI2vRjkqrI4=188	Get hash	malicious	Unknown	Browse	50.116.112.103
TUT-ASUS	TR98760H.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	47SXvEQ.exe	Get hash	malicious	Blank Grabber, Xmrig	Browse	208.95.112.1
	test.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	208.95.112.1
	HaLCYOFjMN.exe	Get hash	malicious	DCRat, PureLog Stealer, RedLine, XWorm, zgRAT	Browse	208.95.112.1
	1.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	1.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	YPzNsfg4nR.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	SAL987656700.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Resource.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	P3A946MOFP.exe	Get hash	malicious	XWorm	Browse	208.95.112.1

Process:	C:\Users\user\Desktop\x.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.890578871500804
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.96% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	x.exe
File size:	294'912 bytes
MD5:	10454890a3d7c7c0b7ec0bf7018141e4
SHA1:	167ab9a5a9e0c56689f73d894a397b9c176701df
SHA256:	91fee98b5957d145f144b61107ea0283fc3e02eb7e19b432e868ee45ffdc528e
SHA512:	20518fd44aff080fddac3a508bcc3b29336ea87c868bd0faf639726b36479de4562ec639e425dbe06234ba5b4629da84b37228b199f8497a7777d36638f77e04
SSDEEP:	6144:DT9nXr8bxYfMPcy4OmBag1+pF0lsmxRQQc+gpvEUkxNl:XNQb2fMPSOCwpCFRj0p8UkxNl
TLSH:	E354D0AD352072EFC85BC4728EA82C78BBA064A7430F4317A46715BD9E4D89BCF150F6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...K(............"...0..~............... ... ....@.. ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x44c00a
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xB8E5284B [Thu Apr 19 01:50:03 2068 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [0044C000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x425d4	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4a000	0x5a6	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4e000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x4c000	0x8
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x42000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
PRSq<	0x2000	0x3f404	0x3f600	5261171bab6d8a7b4501c897be296e7d	False	1.0003312993096647	data	7.999313087046451	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.text	0x42000	0x7b1c	0x7c00	37c9644c8497775def0fc8286e12fde7	False	0.39642137096774194	data	4.964421780003819	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x4a000	0x5a6	0x600	dc18d4b0afd3469c75bccacc71c88f19	False	0.4186197916666667	data	4.108775403741988	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x4c000	0x10	0x200	93a54e833bb343506d34a5f26a043ed5	False	0.044921875	data	0.14263576814887827	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x4e000	0xc	0x200	7cca55dde79b6ddd1c48f85e6619951b	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x4a0a0	0x31c	data			0.43090452261306533
RT_MANIFEST	0x4a3bc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 16:53:01.125919104 CET	49710	80	192.168.2.6	208.95.112.1
Jan 8, 2025 16:53:01.130749941 CET	80	49710	208.95.112.1	192.168.2.6
Jan 8, 2025 16:53:01.130840063 CET	49710	80	192.168.2.6	208.95.112.1
Jan 8, 2025 16:53:01.131408930 CET	49710	80	192.168.2.6	208.95.112.1
Jan 8, 2025 16:53:01.136147976 CET	80	49710	208.95.112.1	192.168.2.6
Jan 8, 2025 16:53:01.595609903 CET	80	49710	208.95.112.1	192.168.2.6
Jan 8, 2025 16:53:01.642144918 CET	49710	80	192.168.2.6	208.95.112.1
Jan 8, 2025 16:53:03.251892090 CET	49712	21	192.168.2.6	162.241.62.63
Jan 8, 2025 16:53:03.256705999 CET	21	49712	162.241.62.63	192.168.2.6
Jan 8, 2025 16:53:03.256817102 CET	49712	21	192.168.2.6	162.241.62.63
Jan 8, 2025 16:53:03.261168957 CET	49712	21	192.168.2.6	162.241.62.63
Jan 8, 2025 16:53:03.266002893 CET	21	49712	162.241.62.63	192.168.2.6
Jan 8, 2025 16:53:03.266191959 CET	49712	21	192.168.2.6	162.241.62.63
Jan 8, 2025 16:53:52.923499107 CET	49710	80	192.168.2.6	208.95.112.1
Jan 8, 2025 16:53:52.928440094 CET	80	49710	208.95.112.1	192.168.2.6
Jan 8, 2025 16:53:52.928513050 CET	49710	80	192.168.2.6	208.95.112.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 16:53:01.114375114 CET	56455	53	192.168.2.6	1.1.1.1
Jan 8, 2025 16:53:01.121191978 CET	53	56455	1.1.1.1	192.168.2.6
Jan 8, 2025 16:53:02.911405087 CET	62794	53	192.168.2.6	1.1.1.1
Jan 8, 2025 16:53:03.250587940 CET	53	62794	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 8, 2025 16:53:01.114375114 CET	192.168.2.6	1.1.1.1	0xd3f0	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jan 8, 2025 16:53:02.911405087 CET	192.168.2.6	1.1.1.1	0x983b	Standard query (0)	ftp.antoniomayol.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 8, 2025 16:53:01.121191978 CET	1.1.1.1	192.168.2.6	0xd3f0	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 16:53:03.250587940 CET	1.1.1.1	192.168.2.6	0x983b	No error (0)	ftp.antoniomayol.com	antoniomayol.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 8, 2025 16:53:03.250587940 CET	1.1.1.1	192.168.2.6	0x983b	No error (0)	antoniomayol.com		162.241.62.63	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	208.95.112.1	80	6996	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 16:53:01.131408930 CET	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jan 8, 2025 16:53:01.595609903 CET	175	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 15:53:01 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Target ID:	0
Start time:	10:52:59
Start date:	08/01/2025
Path:	C:\Users\user\Desktop\x.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\x.exe"
Imagebase:	0x480000
File size:	294'912 bytes
MD5 hash:	10454890A3D7C7C0B7EC0BF7018141E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2150081464.000000000401F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2150081464.000000000401F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:52:59
Start date:	08/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x790000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.4588333845.0000000002ABE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.4587325909.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.4587325909.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.4588333845.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.4588333845.0000000002A91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	27.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	133
Total number of Limit Nodes:	1

Executed Functions

Function 00C611E0 Relevance: 3.2, Strings: 2, Instructions: 651COMMON

Download Yara Rule

Strings

<, xrefs: 00C61315
@, xrefs: 00C61AF5

Memory Dump Source

Source File: 00000000.00000002.2143298601.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_x.jbxd

Similarity

API ID:
String ID: <$@
API String ID: 0-1426351568
Opcode ID: e02d1d185cee9fe49fb8d9399708c0424a992933c3032719480f0335494a6256
Instruction ID: 80a85af89a68746af637a33a4ead92bafc4c87e1bcecd96e4bbd660283b42505
Opcode Fuzzy Hash: e02d1d185cee9fe49fb8d9399708c0424a992933c3032719480f0335494a6256
Instruction Fuzzy Hash: 31629074D01219CFDB64DFA9C981A9DFBF2BF48312F19C1A9D858AB211E7309A81CF54

Function 00C60848 Relevance: 1.9, Strings: 1, Instructions: 611COMMON

Download Yara Rule

Strings

[F, xrefs: 00C61171, 00C61176

Memory Dump Source

Source File: 00000000.00000002.2143298601.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_x.jbxd

Similarity

API ID:
String ID: [F
API String ID: 0-583136422
Opcode ID: 49b172acd74603a4215fae9fa544b58dd18ff5d1ce56b0e0949d7ebecdd7af21
Instruction ID: a6cc94d00aa93b2758d966351edc50e29b91a70b85ef00ce2d648b420fed02b5
Opcode Fuzzy Hash: 49b172acd74603a4215fae9fa544b58dd18ff5d1ce56b0e0949d7ebecdd7af21
Instruction Fuzzy Hash: 7752D174E012598FDB64DFA9C980A9EFBF2BF49301F25C1A9D448AB212D7309E81CF55

Function 00C607E0 Relevance: 1.5, Strings: 1, Instructions: 267COMMON

Download Yara Rule

Strings

[F, xrefs: 00C61171, 00C61176

Memory Dump Source

Source File: 00000000.00000002.2143298601.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_x.jbxd

Similarity

API ID:
String ID: [F
API String ID: 0-583136422
Opcode ID: 9f5d67080a5c9e3b1da682fb34a04b2887414132700363ca5ab3496d3cc72ad9
Instruction ID: b950e725f9a6332f79a05f1d06ec372377368ef7ebe182bbe489146f9199eb0a
Opcode Fuzzy Hash: 9f5d67080a5c9e3b1da682fb34a04b2887414132700363ca5ab3496d3cc72ad9
Instruction Fuzzy Hash: 0AC1E774E012698FEB64CF69C850BDABBB2BF89300F14C4EAD549A7255DB304E85CF51

Function 00C628D0 Relevance: .5, Instructions: 506COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2143298601.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b03404fdd9def6d9a65621e5cfe8578d779ba7455bb0420e1ef81fad8740dc69
Instruction ID: 53fab63fbf617632a741d478e8df495b0e4b2e48b387671957be755fe7f22ad4
Opcode Fuzzy Hash: b03404fdd9def6d9a65621e5cfe8578d779ba7455bb0420e1ef81fad8740dc69
Instruction Fuzzy Hash: 89427074E01629CFDB64CFA9C984B9DBBF2BF48301F5581A9E809A7355D730AA81CF50

Function 00C628C1 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2143298601.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 735698303772c171d993940e1bda0335585162af69a5790a9316a172d1cf9948
Instruction ID: 4184f9002c86d553752d065f0750aba0a880b5ce0f05d3314d367561b4ef0d3a
Opcode Fuzzy Hash: 735698303772c171d993940e1bda0335585162af69a5790a9316a172d1cf9948
Instruction Fuzzy Hash: 6D61B774E01618CFDB14CFA6C994B9DBBF2BF88300F1581A9D809A7365D735A946CF50

Function 00C66374 Relevance: 1.8, APIs: 1, Instructions: 342
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,037A358C,037A3590,00C66316,?,?,?,?,?), ref: 00C666A3

Memory Dump Source

Source File: 00000000.00000002.2143298601.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_x.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 1a6abd47acefbebd21e9008a9fc3ffd4e2c3be4bcadf6f722be0f4a7a9cc3072
Instruction ID: 73c20eae001e7f01382b91b03d3d40b67624ca6668fd792df780b6163048d119
Opcode Fuzzy Hash: 1a6abd47acefbebd21e9008a9fc3ffd4e2c3be4bcadf6f722be0f4a7a9cc3072
Instruction Fuzzy Hash: 22D12671D002198FDF24CFA8C981BEDBBF1BF49304F1091AAE459A7290DB749A85CF95

Function 00C657CC Relevance: 1.8, APIs: 1, Instructions: 341
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,037A358C,037A3590,00C66316,?,?,?,?,?), ref: 00C666A3

Memory Dump Source

Source File: 00000000.00000002.2143298601.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_x.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 06dc161548f705f4b7d3bc6390d3970bf9392e89d7fafde002279bc44147b5f1
Instruction ID: 24b7c3f1199345eb66bf02d836450b0439b9dd07f775ff248bdccebd5b3f90da
Opcode Fuzzy Hash: 06dc161548f705f4b7d3bc6390d3970bf9392e89d7fafde002279bc44147b5f1
Instruction Fuzzy Hash: D4D12571D002298FDB24CFA8C981BEDBBF1BF49304F1091A9E459A7290DB749E85CF95

Function 00C65830 Relevance: 1.6, APIs: 1, Instructions: 123
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,00000000), ref: 00C671AD

Memory Dump Source

Source File: 00000000.00000002.2143298601.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_x.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: a0f05d1eac40192fc2f4723208ab02fc35886a019b957c6cdeeff88f61167aef
Instruction ID: f59f3380dac87161a6145bcd9c723926c0466d4577d0288be55f3309c5307b98
Opcode Fuzzy Hash: a0f05d1eac40192fc2f4723208ab02fc35886a019b957c6cdeeff88f61167aef
Instruction Fuzzy Hash: 4F41BBB5D042589FDB10CFA9D884AEEFBF0BF49314F24946AE818BB210D374A945CF54

Function 00C66D28 Relevance: 1.6, APIs: 1, Instructions: 121
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 00C66DDC

Memory Dump Source

Source File: 00000000.00000002.2143298601.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_x.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f0680a974a7396a9b3fbfaf5b82e8314fe99adb96a0d1d74a8f4b09bb8e8ebf8
Instruction ID: 8224618ea38ccf30f9231be07106c9b3bf58ef00f01dae17e52433d2e4315b17
Opcode Fuzzy Hash: f0680a974a7396a9b3fbfaf5b82e8314fe99adb96a0d1d74a8f4b09bb8e8ebf8
Instruction Fuzzy Hash: AA4189B9D052589FCB10CFA9D984ADEFBB0BB4A310F24911AE814B7250D735A952CF68

Function 00C6583C Relevance: 1.6, APIs: 1, Instructions: 118
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,00000000), ref: 00C671AD

Memory Dump Source

Source File: 00000000.00000002.2143298601.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_x.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 9479b373e0a58ab2c17056756ad4f44ade7548efd6e04119bd5df4cbc1c71ff2
Instruction ID: dc1733b320ede728a3363c6228481791b50bb1d75dd3f32a21e6e5a434099784
Opcode Fuzzy Hash: 9479b373e0a58ab2c17056756ad4f44ade7548efd6e04119bd5df4cbc1c71ff2
Instruction Fuzzy Hash: 014199B5D042589FDF10CFA9D984AEEFBF1BB49314F24942AE818BB210D375A944CF64

Function 00C670D2 Relevance: 1.6, APIs: 1, Instructions: 117
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,00000000), ref: 00C671AD

Memory Dump Source

Source File: 00000000.00000002.2143298601.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_x.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 816114c39b0407c9ff082824602d48dce4369fb8b86c46e85c5dd624582c5d42
Instruction ID: 0a675649d43610011c0be92ae0a93fdf8f742d04198760ee5e243961488585ec
Opcode Fuzzy Hash: 816114c39b0407c9ff082824602d48dce4369fb8b86c46e85c5dd624582c5d42
Instruction Fuzzy Hash: 1C4197B5D042589FDF10CFA9D880AEEFBF1BB49310F24902AE818BB210D374AA45CF54

Function 00C6580C Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(00000004,?,00C66AFB,?,?), ref: 00C66BDC

Memory Dump Source

Source File: 00000000.00000002.2143298601.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_x.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 865142aabf02b6ef2c890d7691ea9c8c63fc2ab36ea721d599cb051de7e03138
Instruction ID: f3256a749bb548882debff037ed69bead2e3150287c0d842fb7da4e4af7ffab8
Opcode Fuzzy Hash: 865142aabf02b6ef2c890d7691ea9c8c63fc2ab36ea721d599cb051de7e03138
Instruction Fuzzy Hash: D84187B9D04258DFCB10CFA9D984ADEFBF0BB49310F20906AE818B7210D375A945CF68

Function 00C66B20 Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(00000004,?,00C66AFB,?,?), ref: 00C66BDC

Memory Dump Source

Source File: 00000000.00000002.2143298601.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_x.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: fa7a16afe31419089f4d65da3945c6fae04e6072b107121f8e7da5a0fb289a11
Instruction ID: 6c746ca112df43dd09d6d0bdf5ad6b0e66f0d21405c420cdd2650b07d2603566
Opcode Fuzzy Hash: fa7a16afe31419089f4d65da3945c6fae04e6072b107121f8e7da5a0fb289a11
Instruction Fuzzy Hash: 4841A7B9D04258DFCF10CFA9D984ADEFBB0BB49310F20902AE818B7210C375AA45CF64

Function 00C65824 Relevance: 1.6, APIs: 1, Instructions: 103
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 00C66DDC

Memory Dump Source

Source File: 00000000.00000002.2143298601.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_x.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0827af54d8e512d6ce77731fd49463dcab0400494fe11f5852418e33b6242439
Instruction ID: c0e6ed636fa1ee8d2c318f4912dc5945cd65f8e59c2216a18bd2652cb7ccfb74
Opcode Fuzzy Hash: 0827af54d8e512d6ce77731fd49463dcab0400494fe11f5852418e33b6242439
Instruction Fuzzy Hash: DF4168B9D052589FCF10CFA9D984A9EFBF5AB09310F20902AE918B7310D375A941CB54

Function 00C65854 Relevance: 1.6, APIs: 1, Instructions: 96
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 00C66A49

Memory Dump Source

Source File: 00000000.00000002.2143298601.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_x.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: f477aa816a9ec850477f8ee76a2c345d9bcc1e7ed57ffd21c35bea43ab0a1ede
Instruction ID: fadf4c488b9c54e14c8d017e58de5b426c6a680927a3dc1fbb9f29938d49ec8f
Opcode Fuzzy Hash: f477aa816a9ec850477f8ee76a2c345d9bcc1e7ed57ffd21c35bea43ab0a1ede
Instruction Fuzzy Hash: 3C4199B5D01258DFDB10CFAAD984ADEFBF0BB49310F24802AE419B7211D378AA45CF94

Function 00C61BD1 Relevance: 1.6, APIs: 1, Instructions: 96
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00C61C7F

Memory Dump Source

Source File: 00000000.00000002.2143298601.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_x.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 54edf722137cee93b8ec1e7a1aebddb6739eed4963af406defcb27a45111d205
Instruction ID: e669dbd7f3b831fdb6cef51011725950d1184a0cea8ca3acb66e3b333dd611fd
Opcode Fuzzy Hash: 54edf722137cee93b8ec1e7a1aebddb6739eed4963af406defcb27a45111d205
Instruction Fuzzy Hash: 7831AAB9D042589FCF10CFA9D580ADEFBF0AB59310F24906AE815B7210D375A945CF64

Function 00C657E4 Relevance: 1.6, APIs: 1, Instructions: 96
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 00C66A49

Memory Dump Source

Source File: 00000000.00000002.2143298601.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_x.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: a86226c6e69d78f91625100534b8b18fa2462606446e9b94946b504bcc7df174
Instruction ID: 35235d855ba64ebb2998d1ce1911388c5316dbf487730658891ba3352db76301
Opcode Fuzzy Hash: a86226c6e69d78f91625100534b8b18fa2462606446e9b94946b504bcc7df174
Instruction Fuzzy Hash: B84199B5D052589FDB10CFAAD984ADEFBF0BB49310F24802AE419B7211D378AA45CF54

Function 00C66990 Relevance: 1.6, APIs: 1, Instructions: 96
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 00C66A49

Memory Dump Source

Source File: 00000000.00000002.2143298601.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_x.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: bb275d48b7ee43214760c925398d518944aed9a754cd8d78bf52b27ee51a18ff
Instruction ID: f4da2e0dd409cce6fd571ed185b2b397357665b03531a85c154660f383b9f354
Opcode Fuzzy Hash: bb275d48b7ee43214760c925398d518944aed9a754cd8d78bf52b27ee51a18ff
Instruction Fuzzy Hash: BE4199B5D012599FDB10CFAAD984ADEFBF0BB49310F24802AE419B7351D378A949CF54

Function 00C61BD8 Relevance: 1.6, APIs: 1, Instructions: 94
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00C61C7F

Memory Dump Source

Source File: 00000000.00000002.2143298601.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_x.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 37a442fb39f47952710ca2873469f5b700170e19f691fd138de9913b014b7067
Instruction ID: efac97fb9015294179361661f1c69eccd8634ae7f08afb16ee74d78a352cc217
Opcode Fuzzy Hash: 37a442fb39f47952710ca2873469f5b700170e19f691fd138de9913b014b7067
Instruction Fuzzy Hash: A43197B9D04258AFCB10CFA9D580ADEFBF0AB19310F24902AE818B7210D375A945CFA4

Function 00C6586C Relevance: 1.6, APIs: 1, Instructions: 74
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE(00000000), ref: 00C674F5

Memory Dump Source

Source File: 00000000.00000002.2143298601.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_x.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: f2cb5f13a9c2781e590e174462cc3abe5202770f0bb09e7b5802bb42acf5d783
Instruction ID: 47012d175f58be6c6577d4cf9bfba820ce0ed0cd83aa1c48b4d01c8c0f03e138
Opcode Fuzzy Hash: f2cb5f13a9c2781e590e174462cc3abe5202770f0bb09e7b5802bb42acf5d783
Instruction Fuzzy Hash: BE31CBB4D052189FDB10CFA9D584A9EFBF4EB49314F20946AE815B7310D774A940CFA4

Function 00C67470 Relevance: 1.6, APIs: 1, Instructions: 74threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(00000000), ref: 00C674F5

Memory Dump Source

Source File: 00000000.00000002.2143298601.0000000000C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c60000_x.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: f8339d44a43fc465efb76ef432f85e58ff5ae8b944f449a5f9d5dad467dfa1b7
Instruction ID: a68d0b6903faa0253f4fb3faa830ba5ca607f505176b2c2e491de52ecb4a1202
Opcode Fuzzy Hash: f8339d44a43fc465efb76ef432f85e58ff5ae8b944f449a5f9d5dad467dfa1b7
Instruction Fuzzy Hash: 4731DAB4D052589FDB10CFA9E984ADEFBF0AB49310F20905AE815B7310C338A905CF94

Function 00AAD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2142591062.0000000000AAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aad000_x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 787573edd39addc598f340f837bd6fb1c5cfb98c333ef29a38e8a63554b5e4a6
Instruction ID: 38054838279be6f5f58aa82083a506e298ff58c2978981401f7d14dbfb6a4eec
Opcode Fuzzy Hash: 787573edd39addc598f340f837bd6fb1c5cfb98c333ef29a38e8a63554b5e4a6
Instruction Fuzzy Hash: F9210375500204EFDB04DF14D9C0B26BB65FB99324F20C56DE94A0F696C33AE856DAA2

Function 00AAD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2142591062.0000000000AAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_aad000_x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 347ceff61f71c01d8d79cfdbd8358f6f0be4c31f492294fd5b1d002aa0560fbf
Instruction ID: 2d6d5a00c7c59b08aae19cdb5e007e3056cab7b85d838320d649ded9bb8bda2a
Opcode Fuzzy Hash: 347ceff61f71c01d8d79cfdbd8358f6f0be4c31f492294fd5b1d002aa0560fbf
Instruction Fuzzy Hash: 4611D376504240DFDB15CF10D5C4B16BF71FB99324F24C6A9D84A0B656C33AE856CBA1

Analysis Process: RegAsm.exePID: 6996, Parent PID: 5732COMMON

Execution Graph

Execution Coverage:	10.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	12%
Total number of Nodes:	25
Total number of Limit Nodes:	4

Executed Functions

Function 063D5270 Relevance: 1.8, Strings: 1, Instructions: 594
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 063D5969

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: b9203ec7d1f698331cf2daddaecc9e204daa9a5f9199ec929cac9ea5f45d5422
Instruction ID: 1c73a29b727d2a1947e56a87b5b349fe6523a5e74df34367147b9896e5649e46
Opcode Fuzzy Hash: b9203ec7d1f698331cf2daddaecc9e204daa9a5f9199ec929cac9ea5f45d5422
Instruction Fuzzy Hash: 6E22D072F012558FDF61DBA4D8806AEBBB2EF85320F24846AD446EB345DA31DD49CB90

Function 02A47070 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32(?,?), ref: 02A470E7

Memory Dump Source

Source File: 00000002.00000002.4588286900.0000000002A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a40000_RegAsm.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 8fb5963dd3d8516904e19b3cd7544fb334b646655e46c65838fa1d809e666da4
Instruction ID: 26e73d4c87eb0f800f1bedf0452cae080b86c303c130804cf6bc362aef059657
Opcode Fuzzy Hash: 8fb5963dd3d8516904e19b3cd7544fb334b646655e46c65838fa1d809e666da4
Instruction Fuzzy Hash: 122159B2801259CFDB10CF9AD884BEEFBF4AF88324F14845AE455A3250C778A944CF61

Function 063D2440 Relevance: 1.5, Instructions: 1492COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af1e31e1a220a8a19d1b08522bbb684de2db6f965b3eb4ef4a6006c589896c65
Instruction ID: 7cc5e0f8eea1258520cefe679d23d60a6df3690159b56f47dcc651ff597e5bc5
Opcode Fuzzy Hash: af1e31e1a220a8a19d1b08522bbb684de2db6f965b3eb4ef4a6006c589896c65
Instruction Fuzzy Hash: E8D24931E10209CFDB64DB68D584A9EB7B2FF89300F5485AAD449AB255DB31ED86CF80

Function 063D66C0 Relevance: .8, Instructions: 815COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a136d7281ef51cc03dadd3ee4bbbbbf20dfc3ec6c82cb35c48f71722c5f893e
Instruction ID: 05e6e1d46edc132d5e85744fbc67462b4a5003bc09ac231324f81bda5d1735d3
Opcode Fuzzy Hash: 3a136d7281ef51cc03dadd3ee4bbbbbf20dfc3ec6c82cb35c48f71722c5f893e
Instruction Fuzzy Hash: 7962BC32F002058FDB54EB68E995AADB7F2EF89310F148469E416DB391DB31ED46CB90

Function 063DB318 Relevance: .8, Instructions: 775COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37189b06a3da4dda7cebc0cfa8f4babf98ea4b2da61c25b0f4d728f820f07436
Instruction ID: 71c3ff9ab8618388702cc5f8df78a0bb18808c1a164889f2c96abf57a913566c
Opcode Fuzzy Hash: 37189b06a3da4dda7cebc0cfa8f4babf98ea4b2da61c25b0f4d728f820f07436
Instruction Fuzzy Hash: D95260B1E102098FEF64DB68E4807ADF7B6FB85310F11852AE406EB355DA35DC89CB91

Function 063DC270 Relevance: .6, Instructions: 633COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59dc4c7a4aeb943be76fd30e58627a15a3b6698a5ae5c6952b825ab2eb324c02
Instruction ID: ffdaec4bd1d6bc041e456bb3da8c5ab9e07b37714cd5b2b6a4a37b760358768c
Opcode Fuzzy Hash: 59dc4c7a4aeb943be76fd30e58627a15a3b6698a5ae5c6952b825ab2eb324c02
Instruction Fuzzy Hash: FE32A031B202098FDF54DB68E890BAEB7B6FB88310F109529E505EB355DB35EC46CB91

Function 063D7E50 Relevance: .5, Instructions: 473COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ff710f5d7430e40e43babd1fc47b6eca93a3e048915a0a75797457d6cd5ed3f
Instruction ID: 0dbbd681f0c84274dde153c894dd63feeb5f1832008669b7206621f7f25f7cfb
Opcode Fuzzy Hash: 5ff710f5d7430e40e43babd1fc47b6eca93a3e048915a0a75797457d6cd5ed3f
Instruction Fuzzy Hash: 73029D31B012069FDB54DB68E890AAEB7F6FF84310F148569D4169B385DB31ED8ACBD0

Function 0566BF18 Relevance: 1.7, APIs: 1, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0566C17E

Memory Dump Source

Source File: 00000002.00000002.4590949928.0000000005660000.00000040.00000800.00020000.00000000.sdmp, Offset: 05660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5660000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: dd8e074996353e4510db2354d8eb699964d82cb1680d523cd5d6f0749d87d921
Instruction ID: 029a4a38632358f87c8d6535db755a49e6663152ed25771dbe9533e3020934a9
Opcode Fuzzy Hash: dd8e074996353e4510db2354d8eb699964d82cb1680d523cd5d6f0749d87d921
Instruction Fuzzy Hash: 80813570A00B459FEB24DF6AD44475ABBF1FF88604F008A2ED48AD7B50DB75E845CB90

Function 02A4F170 Relevance: 1.6, APIs: 1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.4588286900.0000000002A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a40000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f99612114c336958f3c0e6fc1b821730f8806359164b345ed5f128b68c8d203b
Instruction ID: 302859d4ff3d08c047adf0e97f1e2c9407bf7c41825148b6cba267ae950678db
Opcode Fuzzy Hash: f99612114c336958f3c0e6fc1b821730f8806359164b345ed5f128b68c8d203b
Instruction Fuzzy Hash: 1D414572D0478A9FDB10CFB9D8446DEFBB0AFC9220F14866AD854E7241DB349885CBE1

Function 0566E104 Relevance: 1.6, APIs: 1, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0566E222

Memory Dump Source

Source File: 00000002.00000002.4590949928.0000000005660000.00000040.00000800.00020000.00000000.sdmp, Offset: 05660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5660000_RegAsm.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 3e3e704c75e3050b68ad93cb5fd7586643652e97ceec933da446e90f70ef6fa7
Instruction ID: 57715acd13a7836530d689a06da12bb8f2fefcf5d109edba4e43028f0852227a
Opcode Fuzzy Hash: 3e3e704c75e3050b68ad93cb5fd7586643652e97ceec933da446e90f70ef6fa7
Instruction Fuzzy Hash: 5451C2B5D04349EFDB14CF9AC884ADEFBB6BF48714F24852AE819AB210D7719845CF90

Function 0566E110 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0566E222

Memory Dump Source

Source File: 00000002.00000002.4590949928.0000000005660000.00000040.00000800.00020000.00000000.sdmp, Offset: 05660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5660000_RegAsm.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: e9dd3069e3601ff0ebe1e339701e158ea06845d69069fad1be3a0dc745b7ea78
Instruction ID: e04edd994f89339e265f8178bf3bc60c0dc59b99424a533735f40231cad274d8
Opcode Fuzzy Hash: e9dd3069e3601ff0ebe1e339701e158ea06845d69069fad1be3a0dc745b7ea78
Instruction Fuzzy Hash: 7A41B0B5D10349DFDB14CF9AC984ADEFBB6BF48310F24852AE819AB210D7759845CF90

Function 02A4706A Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32(?,?), ref: 02A470E7

Memory Dump Source

Source File: 00000002.00000002.4588286900.0000000002A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a40000_RegAsm.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 5008ad96f5142d2a575faac098cc1bce857b6f4a45be172bf4a14daadfc2ddff
Instruction ID: a45bc41dc14079d06984899edcb70a3939cfc3f6cd14054939a8bc5c7413c699
Opcode Fuzzy Hash: 5008ad96f5142d2a575faac098cc1bce857b6f4a45be172bf4a14daadfc2ddff
Instruction Fuzzy Hash: 052159B2801259CFDB10CF9AD885BEEFBF4EF88324F14845AE459A7250C778A945CF61

Function 02A4F240 Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 02A4F2AF

Memory Dump Source

Source File: 00000002.00000002.4588286900.0000000002A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2a40000_RegAsm.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: eaf144607808ee1505c6835e8eefd036752fe8a7beab7bb2ec804aa82ee4cfef
Instruction ID: a5ff92b8bfc7a061d7b6d62c99b22f032e3a21daa7d34138cac590a33e5e7cdb
Opcode Fuzzy Hash: eaf144607808ee1505c6835e8eefd036752fe8a7beab7bb2ec804aa82ee4cfef
Instruction Fuzzy Hash: 8A1114B2C0065ADFDB10CFAAC544BDEFBB4AF48324F14815AD818B7240D778A944CFA5

Function 0566C118 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0566C17E

Memory Dump Source

Source File: 00000002.00000002.4590949928.0000000005660000.00000040.00000800.00020000.00000000.sdmp, Offset: 05660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5660000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2219707def752dfe65b8215591fc88f40ec961e526c52d0fe5374d425dc21bfd
Instruction ID: ed7ca4d05ded19ebcc9e5b65e5c688f757748f3b11987c50f749f0623f98e424
Opcode Fuzzy Hash: 2219707def752dfe65b8215591fc88f40ec961e526c52d0fe5374d425dc21bfd
Instruction Fuzzy Hash: C41110B6C047498FDB10CF9AC844BDEFBF4EB88624F10841AD469A7610C378A545CFA5

Function 063DFED8 Relevance: 1.3, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

|, xrefs: 063DFF38

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: f66b14b929745a5c76a623944190e4286993100ea1d7e7fef24f4aab7b4b585d
Instruction ID: 307e3c76088c1ff524256957cd48693f8fdf7267c7ccb3493858c800203065f1
Opcode Fuzzy Hash: f66b14b929745a5c76a623944190e4286993100ea1d7e7fef24f4aab7b4b585d
Instruction Fuzzy Hash: 0A117C75F002249FDB54DF789904B6EBBF5AF4C600F10446AEA0AE73A0DA3599018B84

Function 063DFEE8 Relevance: 1.3, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

|, xrefs: 063DFF38

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: 64ede8f6cc40396292764a8319425ac30e55fbb0788315e2343d33944f17ceb0
Instruction ID: ee712f8be9092b28172781b3bab81c9d0746141a06410dc372040426bad54596
Opcode Fuzzy Hash: 64ede8f6cc40396292764a8319425ac30e55fbb0788315e2343d33944f17ceb0
Instruction Fuzzy Hash: F9114975B042149FDB44EF789804B6EBBF5AF8C600F108469E60AE73A0EA35A900CB80

Function 063DD018 Relevance: .8, Instructions: 802
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e83276db38c23d5d4a65f685661d7a149d38ee7509c17dfdfd91c00811f9b55
Instruction ID: e31d06a24bb81a5744f2a1e01c54003bd42b5878cfe25a759231c0cc04b55a0a
Opcode Fuzzy Hash: 5e83276db38c23d5d4a65f685661d7a149d38ee7509c17dfdfd91c00811f9b55
Instruction Fuzzy Hash: C5621C31A0020ACFDB55EB68E590A5EB7B2FF84304F208A69D4059F359DB75ED4ACBD0

Function 063DADB0 Relevance: .4, Instructions: 395COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c741faad0b8cd5d06d989ef62b55d239e77ffdbd96e58dd62940d4ad3cd44c35
Instruction ID: fc8791f8264d0b8abda833636962ba41285ef99c8870ad7b96f22cf15dea5823
Opcode Fuzzy Hash: c741faad0b8cd5d06d989ef62b55d239e77ffdbd96e58dd62940d4ad3cd44c35
Instruction Fuzzy Hash: 88E17F71E1020A8FDB65DF69E9846AEB7B6EF89304F208529D4169B344DF31DC4ACBD0

Function 063DB30B Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa33aa28090326459aba1c1852c2576ffbd5397ad57e37e098fb586fd19246ae
Instruction ID: e0b007096a4613739b0715e6f15186d641d24e36c417a351c880b7eff39cde39
Opcode Fuzzy Hash: aa33aa28090326459aba1c1852c2576ffbd5397ad57e37e098fb586fd19246ae
Instruction Fuzzy Hash: A1A1A6B5F101099FEF64DA6CD8907AEF7B6FB49300F218425E406E7385DA35DC858BA1

Function 063D9220 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aceed6223e847e94b5367b5d29618e253f76d67cc8b027f4f0faf008616b9797
Instruction ID: 708797b2448df1ddbc67ed249809e0f4290ce5f6f266a89f44596a5addbe62f5
Opcode Fuzzy Hash: aceed6223e847e94b5367b5d29618e253f76d67cc8b027f4f0faf008616b9797
Instruction Fuzzy Hash: ED915031F1011A8FDB54EB65D8507AEB3F6EF88300F108569C81AEB385EA71DD468B91

Function 063D5EB8 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 680709284339b3fb1d9b243feb4e1f9a29e3911b167c2ee0c36f0d49349f1729
Instruction ID: 4f0addc4ff1267fcad9839a79590ec41a5fb3e07fef6b3359c559f0408dd26dc
Opcode Fuzzy Hash: 680709284339b3fb1d9b243feb4e1f9a29e3911b167c2ee0c36f0d49349f1729
Instruction Fuzzy Hash: 1D61B272F000114BDF509A6DD884A6FBADBEFC4620B15443AE80ADB3A0DE75DD0287D5

Function 063D3F70 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f40c0514c5de5aaf1324dee1cc06bfaf1f88daf5dc96bfe731f91793c7a1f19b
Instruction ID: 306708aea873024a12f0a1024dfed708745565ccb71f7f0f10a4d79cdb894ccb
Opcode Fuzzy Hash: f40c0514c5de5aaf1324dee1cc06bfaf1f88daf5dc96bfe731f91793c7a1f19b
Instruction Fuzzy Hash: 76814C31B112498FDB54DFA8D45476EB7F6EF89300F108429E40ADB385EE35EC468B91

Function 063D4290 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2acddeb37db2b0d2aa3937cc8b739521df47a9b0f8a3ff223a24bc25c00032bf
Instruction ID: eaa50c375083dc0371a47804537665cae252fb2a14918a14aaad8e1f13c90fdc
Opcode Fuzzy Hash: 2acddeb37db2b0d2aa3937cc8b739521df47a9b0f8a3ff223a24bc25c00032bf
Instruction Fuzzy Hash: 95915E31E1061A8FDF60DF68C850B9DB7B1FF89310F208599D549EB255DB70AA85CF90

Function 063D3F80 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f999ed6389e54f7896200a4ea0e32a75459dc617bea9deb48901ffd2a5e64fec
Instruction ID: a028a069afe9df2e0bf94f605f3b784eda1de6daf604b1c6d60ed66b1ed45937
Opcode Fuzzy Hash: f999ed6389e54f7896200a4ea0e32a75459dc617bea9deb48901ffd2a5e64fec
Instruction Fuzzy Hash: 39813B31B1124A8FDB54DFA9D45466EB7F6EF89300F108529E40AEB385EE31EC468B91

Function 063D42A8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed47ff4761e4c1aa6126bfa1e5e95349e9a18d2177df0e1a4eec17747c0923da
Instruction ID: 555e482c2b866a9da0b2e420cf7d9c893626cfd981805f02f251de92e4d8e949
Opcode Fuzzy Hash: ed47ff4761e4c1aa6126bfa1e5e95349e9a18d2177df0e1a4eec17747c0923da
Instruction Fuzzy Hash: B2912C31E1061A8BDF60DF68C880B9DB7B1FF89310F208599D549BB355EB71AA85CF90

Function 063DEBE0 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87d33f535bc751f74f28eb1c81c61f9cc0bc94a793db137ebd5c2575002ee284
Instruction ID: bd365838ff98e8b7580fd557f356edbffe99f724f117628d29dc3becdacc4b62
Opcode Fuzzy Hash: 87d33f535bc751f74f28eb1c81c61f9cc0bc94a793db137ebd5c2575002ee284
Instruction Fuzzy Hash: BA710E71E002099FDB54EFA9D990A9DBBF6FF88300F148529D419EB355DB30E946CB90

Function 063DEBF0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a97ddb6610984b8b3daf0783455b9ba9dbd17ae53a073ffa4061be5fd6312072
Instruction ID: 4de60ac1e24c168eae51f0fa9118174f15d33a195f64ebb80437cb9579880d83
Opcode Fuzzy Hash: a97ddb6610984b8b3daf0783455b9ba9dbd17ae53a073ffa4061be5fd6312072
Instruction Fuzzy Hash: C671F971E002099FDB54EFA9D990A9DBBF6FF88300F248529D419EB355DB30E946CB90

Function 063D4840 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb8cb429f9bbf147dd114ee789b71148f4c6896c2936ae1d2698dbbdf6c6bcb2
Instruction ID: e464fc8f721d87d7515f1fce309470ba67f0873119e02e925ef56b1299ed0284
Opcode Fuzzy Hash: fb8cb429f9bbf147dd114ee789b71148f4c6896c2936ae1d2698dbbdf6c6bcb2
Instruction Fuzzy Hash: 5E619E31F102189FEB549FA5D8147AEBBF6FB88700F20842AE106AB395DE758C058B94

Function 063DF622 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c5d3f1847da07bef8160d409cb2621a59f99396b83dcfca6b202b826450ceb8
Instruction ID: 64016f226fbef1c517b4d79979edb892b96c6214d840493a34b869af5649150f
Opcode Fuzzy Hash: 1c5d3f1847da07bef8160d409cb2621a59f99396b83dcfca6b202b826450ceb8
Instruction Fuzzy Hash: 88510639B202159FEF606668E89476F365ADB89740F20442EE50BD73E5CE78CC4687E2

Function 063DFC88 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2943dc477d2bb698640387207864a6c7135879740e38763d25271a64542ddf3f
Instruction ID: ae11c51f592a8d1e0d8b8c30cc0da4a83740e01910cba7a6d0ac1fd68a3665aa
Opcode Fuzzy Hash: 2943dc477d2bb698640387207864a6c7135879740e38763d25271a64542ddf3f
Instruction Fuzzy Hash: DE51DF72E01109CFDB14ABB8F8946ADBBB2EF84311F10886DE106DB251DF318959CBD0

Function 063D9213 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 105003de4b339ae7c8c4a21ef9fec21e47d4bccdea635f3056d8a388d5463912
Instruction ID: 982c22d74b1097e3996ed5908298266eaade4e5138bbbc85d821f53732b065d5
Opcode Fuzzy Hash: 105003de4b339ae7c8c4a21ef9fec21e47d4bccdea635f3056d8a388d5463912
Instruction Fuzzy Hash: 82515631B111468FDB54EB74D950B6E73F6EF88300F10856AC81ADB385EA31DC468F95

Function 063DF630 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ce99b40a0c0381c9af0dc3a36c012729dc34fb952b8775b796774b13e074248
Instruction ID: 9095573c6093c0a441dbcecfa5bfee0f811e4c613074c7f9a40d40520e0d9d3c
Opcode Fuzzy Hash: 2ce99b40a0c0381c9af0dc3a36c012729dc34fb952b8775b796774b13e074248
Instruction Fuzzy Hash: 4451E439B202059FEF606A6CE89476F365AD789740F20442EE10BD7395CE78CC4687E2

Function 063D4831 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc38db228d80e969a293dc821477c057c1d897af9551b9a213b5e3fbc11e6967
Instruction ID: 7be759c011218f2da770c8d21d7ea4dbf0446eb3fdb142c4ca4790c459b060ae
Opcode Fuzzy Hash: dc38db228d80e969a293dc821477c057c1d897af9551b9a213b5e3fbc11e6967
Instruction Fuzzy Hash: E0519D30F102489FDB559FA8C8547AEBBF6EF88700F20842AE105EB395DA718C059BA0

Function 063D50F8 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc1ee1a79047d09f5924b59352614e392c6fcaab92129ce963bb69240bd8e4b9
Instruction ID: 4ce8e984a5737b8aa094182092e7f746191ca5111200efb8b8ecaad272f69597
Opcode Fuzzy Hash: dc1ee1a79047d09f5924b59352614e392c6fcaab92129ce963bb69240bd8e4b9
Instruction Fuzzy Hash: 1D414272E006099FDF70CEA9E881BAFF7F1FB95224F10492AE156D7650D730A9498BD0

Function 063DDB8D Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75b2f9ea34021f71fd7a2a413e235aaf19a89b33ef8f3bb282eae1d027d9b90f
Instruction ID: a84c536e33d2ba85e2347d6d9205611b3cb2907dc337f64b61bf79da6d34a935
Opcode Fuzzy Hash: 75b2f9ea34021f71fd7a2a413e235aaf19a89b33ef8f3bb282eae1d027d9b90f
Instruction Fuzzy Hash: 7E41A271E103499FDF25DF65E84469EBBB2FF86300F104529E406D7280EBB1D94ACB91

Function 063DDBA0 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 768b8f6a9af474b192f82ffa60bb22c1cac17bb05768c9076a2f872c17c7901a
Instruction ID: de04acbe94bc55b3851441d8debc0f316c6f1e044d870fdec2fb9c9e21f44a16
Opcode Fuzzy Hash: 768b8f6a9af474b192f82ffa60bb22c1cac17bb05768c9076a2f872c17c7901a
Instruction Fuzzy Hash: 04419171E1020ADFDB64DFA5E8446AEBBB2FF85300F108429D406EB240DB70D94ACBC1

Function 063D22A5 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e7c0f336fc26695e34b710f8147fc82cb09b14d4890a9ab866954892f77f3b1
Instruction ID: ef6b4e96d69dde2fe8ec5ede49a5f9fd3b778c26ae39dd952143743744d088dc
Opcode Fuzzy Hash: 3e7c0f336fc26695e34b710f8147fc82cb09b14d4890a9ab866954892f77f3b1
Instruction Fuzzy Hash: 62310131B102058FDB55AB34E8546AFBBA6EB89600F108468D506DB381EE35CE4ACBE0

Function 063D22B8 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1976a796a26fcf7f7ba7e4bfcdede09c1cd71550450e274bc8c3757f5af4d952
Instruction ID: 60a9c8c8abdf9ab0e509891fed1c5b82c5f0963b0280463a0f984ab3ef6a05f4
Opcode Fuzzy Hash: 1976a796a26fcf7f7ba7e4bfcdede09c1cd71550450e274bc8c3757f5af4d952
Instruction Fuzzy Hash: 6631E531B002058FDB55AB74E91466FB7E7EF89600F108428D506DB381EE35DD46CBE0

Function 063D2168 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e443a319e1aba8e69ee722f55ccb03e49cabbc334159120b4c51702fafff4850
Instruction ID: 4fbc7e51ff8a5909a88a5cfc6f094c18d49ab9b4d51f022f7b0df88a72c34cbc
Opcode Fuzzy Hash: e443a319e1aba8e69ee722f55ccb03e49cabbc334159120b4c51702fafff4850
Instruction Fuzzy Hash: 1231AF31E102099BDB55CFA4D89569EB7B2FF89300F10C929E916E7340DB71ED46CB90

Function 063D2178 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8cb30d2bf26921840b30e7c62377286f9795eefe67246eb5d338c96ebcf5420
Instruction ID: 37b4cb7608e5e688579b0c2eaba2e2d4cf9a230040ede5512645511e757f1067
Opcode Fuzzy Hash: e8cb30d2bf26921840b30e7c62377286f9795eefe67246eb5d338c96ebcf5420
Instruction Fuzzy Hash: 73317A31E106099BDB58DFA4D89469EB7B2FF89300F10C929E916EB350DB71ED46CB90

Function 063D3B79 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6de505ce2520bb600dc12fadf8f7b96e82941e7438d406312af55b4e170f6afa
Instruction ID: 9659d3cf8d6d1132a3e3e72296636dc11d6ea8f5a3452a8a4402826e3e66be18
Opcode Fuzzy Hash: 6de505ce2520bb600dc12fadf8f7b96e82941e7438d406312af55b4e170f6afa
Instruction Fuzzy Hash: 0B31EF72E112559FEB00DF79D840AAEBBF1EB88710F10842AE945E7381E731DD42CB91

Function 063D3B88 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c39eb243f4b1237d0ccecd4618f836da9f9a6efe793049d40294fd06c1c9934c
Instruction ID: b45c0b6041604fa8d72ab42f4f2dc3b69057fc8f8502753ed94e99cfdab358ed
Opcode Fuzzy Hash: c39eb243f4b1237d0ccecd4618f836da9f9a6efe793049d40294fd06c1c9934c
Instruction Fuzzy Hash: F3217C76E116199FEB40DF69E980AAEBBF5FB88710F108425E905E7380E732DD018B91

Function 063D6DD8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 069c736d2445634800e546ed9f0ea63f4007e305ea5f89cabb54a1c274ac4c3e
Instruction ID: 9949d290fa3bf5db7b774551dc26efe6a0422cfc781237acde5e8a415202f631
Opcode Fuzzy Hash: 069c736d2445634800e546ed9f0ea63f4007e305ea5f89cabb54a1c274ac4c3e
Instruction Fuzzy Hash: 00210132F110059FDF54DA78E95179DB7F6EF89310F14882AD405EB340D6309D828BC0

Function 00F9D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4587961002.0000000000F9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f9d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ed19136f9add78a44c25abd0930554ede0789c0760475bc15337d5c343b2b86
Instruction ID: bec15d25171282a0781969dc453219288a7783b1c937b23100b9ea706e15059f
Opcode Fuzzy Hash: 1ed19136f9add78a44c25abd0930554ede0789c0760475bc15337d5c343b2b86
Instruction Fuzzy Hash: 2821F272A04244DFEF14DF24D984B16BB61EB84324F34C56DD90A4B26AC33AD847EA61

Function 063D6DE8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acf588fb6209b402553e4ef769d0a6d17b1415735e8c2bf0555001a0534de2a5
Instruction ID: 5923570aff17f9976ea76d55f1ca45c431fb8969051647f1518a634087a2e045
Opcode Fuzzy Hash: acf588fb6209b402553e4ef769d0a6d17b1415735e8c2bf0555001a0534de2a5
Instruction Fuzzy Hash: 4E21E132B110098FDF84DA68F95179EB7B6EF89310F108529E409EB380DB31ED428BC0

Function 00F9D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4587961002.0000000000F9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f9d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41bf9210158cf6096d2ad70b755ed4386c4f8fe294e5316b65a2e220f10959fa
Instruction ID: 69aeff0c1d76e0c03706e6ae35caabef7eccc3efb5204120710a3e0831dff0a8
Opcode Fuzzy Hash: 41bf9210158cf6096d2ad70b755ed4386c4f8fe294e5316b65a2e220f10959fa
Instruction Fuzzy Hash: 54219F755093C08FDB02CF24D990715BF71EB46324F28C5EAD8498F6A7C33A980ACB62

Function 063D3C98 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afc9a085a8f95b60738bf5969e0238d83b4fb01cb5bf6b1cc9bd56fe65fd41e2
Instruction ID: 435a4de734bb3e3e1ac441122ac58c342a018f36a250d00d22e9680cb69901ab
Opcode Fuzzy Hash: afc9a085a8f95b60738bf5969e0238d83b4fb01cb5bf6b1cc9bd56fe65fd41e2
Instruction Fuzzy Hash: B4115E32B105298FDB949669D814AAEB7AAEBC9710F044539D40AEB344EE35DC068BD2

Function 063D3ED0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad46457e82d554620e242ca9b91f6e2a65e094ac903dcddf03853b0e646267d7
Instruction ID: 52743dbf1560e6f16459889f141952fc18bf40ef27cb2949375973c798630b73
Opcode Fuzzy Hash: ad46457e82d554620e242ca9b91f6e2a65e094ac903dcddf03853b0e646267d7
Instruction Fuzzy Hash: 6501D231B152461BEB659A7CA41031ABBEACBCB610F14846AE14ACB342DD65CC8683D6

Function 063DEE5F Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b66c320622cf65b19745a9a2f6ac06222e3877086d65c0ea33defde8d4b7b3dd
Instruction ID: 1994a6533e52c62add8494abd16226a23cc662d1a286e1fcee8e0947730893eb
Opcode Fuzzy Hash: b66c320622cf65b19745a9a2f6ac06222e3877086d65c0ea33defde8d4b7b3dd
Instruction Fuzzy Hash: 41018F32B101115BDB75AA7CB49072E7BD6DBCAA14F248839F50ACF381D925DC0783E1

Function 063DA3E0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 229472c654bc297abcc66b9d5ceafe99279462471ea99ed12ec495a86c36e739
Instruction ID: e819081e8cdf2f80c35ba1b0ffdae1b8d0517b12ea57fda74593c2acbe2ed551
Opcode Fuzzy Hash: 229472c654bc297abcc66b9d5ceafe99279462471ea99ed12ec495a86c36e739
Instruction Fuzzy Hash: 0C01F2B3F102404FD7A1E67CE96472A77E5DB8A700F118839E04ACB355EE21DC0687E1

Function 063D6500 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93ced183acb9788fde47fb9133825c350bc00b99701242ce52890cd89ae7a6c8
Instruction ID: cc25cc3c2708c72f59f6aa44c89b55d001b325ceed9b2c411f486cd537cd32b5
Opcode Fuzzy Hash: 93ced183acb9788fde47fb9133825c350bc00b99701242ce52890cd89ae7a6c8
Instruction Fuzzy Hash: B301B1639092A19EE752AE78D86638A3F71CF43204F1904DFC0C4CF293E525C58AD3A6

Function 063D3958 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0391c7563db75acdbba0232ede530bee44c90516e3bebba7479353ca9e6f5cb
Instruction ID: 9e134d711330d0c4d382376d56ca3cb31b26540fde68a65381c2d05c2aef5493
Opcode Fuzzy Hash: c0391c7563db75acdbba0232ede530bee44c90516e3bebba7479353ca9e6f5cb
Instruction Fuzzy Hash: F211D3B5D012599FDB00CF9AD885BDEFBB4FB49714F10812AE518B7200C374A954CBA5

Function 063D3950 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0e9282b05cda7a4215a7b4887ed8fc791a65d9c6f0df1e81549f90742bf2c64
Instruction ID: 4b1fb6085a3e213f7c6fbed60bb1d3c49b52f6a3a884ec1ac50f6edbea9b6732
Opcode Fuzzy Hash: c0e9282b05cda7a4215a7b4887ed8fc791a65d9c6f0df1e81549f90742bf2c64
Instruction Fuzzy Hash: 6C21D3B6D012199FDB40CF9AD985BDEFBB4BF48315F10852AE518B7200C374A954CFA5

Function 063D3EE0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dba8625762c34bc6cc0baf76ff7ecb00390a728ad7dfe12da4f2ec14deb76b1
Instruction ID: 79f34906c20690b2d7b33a0c43993f2ef8ceddb064cec258c6b5e6b8d9d7166a
Opcode Fuzzy Hash: 8dba8625762c34bc6cc0baf76ff7ecb00390a728ad7dfe12da4f2ec14deb76b1
Instruction Fuzzy Hash: 50014B32B101160BEB649A6DA45072AA2DACBCAB24F108429F50ECB384ED65DC4643D6

Function 063D3C8B Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fba4d61cd70a7493827d268ddb957dd0960c8cca7f25b52234ea29fcd89bf40
Instruction ID: cf11d9587b87b680ea20c671dcdad176f5b081a937ea98b842774e4629813cfe
Opcode Fuzzy Hash: 7fba4d61cd70a7493827d268ddb957dd0960c8cca7f25b52234ea29fcd89bf40
Instruction Fuzzy Hash: 0801A232F254254FEF959678D814BEEB7AADFC8610F04413AD50AEB284EE35CC464BD2

Function 063DEE70 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6adbb6be20a7b2c2edc96e8d1ae1803d1e1c95afa4467e63893c5462ce6fafbe
Instruction ID: 29dec830031bd016a70906098f31ed3b73daa31795550f47a6570685077ce92f
Opcode Fuzzy Hash: 6adbb6be20a7b2c2edc96e8d1ae1803d1e1c95afa4467e63893c5462ce6fafbe
Instruction Fuzzy Hash: A0018C32B100114BDBB4AA6CA45072EB7DADBCAB24F108829E50ACF380EE25DC0743E5

Function 063DA3F0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3ea14a4ef55b809bb9bfb475012fe80b7fc6fe394d8ba9f889ba63ca82c9de2
Instruction ID: 287c3500168751763234429192f86847ae055dabb548fb2b0161c263872a94e2
Opcode Fuzzy Hash: f3ea14a4ef55b809bb9bfb475012fe80b7fc6fe394d8ba9f889ba63ca82c9de2
Instruction Fuzzy Hash: 7501A432B201154FDBA0E67CE95471AB3E5D789714F108438E50ACB344EE21EC0687D5

Function 063DC8B0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3994e54f9f8d71c200364b1628027d2a306812e79607c34f20fac10213d6865
Instruction ID: 7be81a1c0fb2061f45410ec46fb8554b7ccd0877ced8409e6d87e248f793d6d6
Opcode Fuzzy Hash: d3994e54f9f8d71c200364b1628027d2a306812e79607c34f20fac10213d6865
Instruction Fuzzy Hash: 4A01A432F202249BDB54AA69F940A9EB77AE789314F004529E905EB345DB31AD0ACBD0

Function 063D4729 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47f817f45c038bc961b9ba30bbc2b8c904f776f0577de8ca49abe2941e44b385
Instruction ID: 590c6fcbda837ce56de12d2ced0f1a8bfd6432db9c20aded6e47582e38cd792c
Opcode Fuzzy Hash: 47f817f45c038bc961b9ba30bbc2b8c904f776f0577de8ca49abe2941e44b385
Instruction Fuzzy Hash: 13F0F871A20219EFDB14DF94E859BAEBBB6FF89701F200119E012A7295CBB41D46DBC0

Function 063D6550 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4591578865.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_63d0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b84372c5675e9e2ad0d48ef59261142a4f61175df5c468163b217fc4eaddae97
Instruction ID: 1b8e67e23291c4cfc902adf10c736a128da38129e3fd8c1db15596caeba9a5e5
Opcode Fuzzy Hash: b84372c5675e9e2ad0d48ef59261142a4f61175df5c468163b217fc4eaddae97
Instruction Fuzzy Hash: 18E01272E1010CABDF50DEB4D94A75A77AED703214F2088A5D819C7206E677DA4687C0

Non-executed Functions

Function 05663A12 Relevance: 6.1, APIs: 4, Instructions: 129threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 05663A96
GetCurrentThread.KERNEL32 ref: 05663AD3
GetCurrentProcess.KERNEL32 ref: 05663B10
GetCurrentThreadId.KERNEL32 ref: 05663B69

Memory Dump Source

Source File: 00000002.00000002.4590949928.0000000005660000.00000040.00000800.00020000.00000000.sdmp, Offset: 05660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5660000_RegAsm.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 3e99c403562fff37f42fced5ca6f5e160483877959b7ebe7377ff5902ce400e9
Instruction ID: 3aa4d156e73765b9c99f353fe6ec7c36005e2a6b72508e3be49eb98ecb2f79d8
Opcode Fuzzy Hash: 3e99c403562fff37f42fced5ca6f5e160483877959b7ebe7377ff5902ce400e9
Instruction Fuzzy Hash: 4A5167B490024A8FDB54CFA9D948BDEBBF1EF88304F208519E419A73A0DB349944CB65

Function 05663A18 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 05663A96
GetCurrentThread.KERNEL32 ref: 05663AD3
GetCurrentProcess.KERNEL32 ref: 05663B10
GetCurrentThreadId.KERNEL32 ref: 05663B69

Memory Dump Source

Source File: 00000002.00000002.4590949928.0000000005660000.00000040.00000800.00020000.00000000.sdmp, Offset: 05660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5660000_RegAsm.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: ec89995faf047d19090d9abc4471443b790d2f4d25ab63375296cc4479e5f214
Instruction ID: ddcf30e91a933a93f94e75e0b851e9f6239f77452dbc5a7e8dcf4b37fc3192fb
Opcode Fuzzy Hash: ec89995faf047d19090d9abc4471443b790d2f4d25ab63375296cc4479e5f214
Instruction Fuzzy Hash: 2B5178B490034A8FDB54CFA9D948BDEBBF1FF88304F208419E419A73A0DB349944CB65

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report x.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\x.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
x.exe

Function 00C66374 Relevance: 1.8, APIs: 1, Instructions: 342
processCOMMON

Function 00C657CC Relevance: 1.8, APIs: 1, Instructions: 341
processCOMMON

Function 00C65830 Relevance: 1.6, APIs: 1, Instructions: 123
injectionCOMMON

Function 00C66D28 Relevance: 1.6, APIs: 1, Instructions: 121
memoryCOMMON

Function 00C6583C Relevance: 1.6, APIs: 1, Instructions: 118
injectionCOMMON

Function 00C670D2 Relevance: 1.6, APIs: 1, Instructions: 117
injectionCOMMON

Function 00C6580C Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Function 00C66B20 Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Function 00C65824 Relevance: 1.6, APIs: 1, Instructions: 103
memoryCOMMON

Function 00C65854 Relevance: 1.6, APIs: 1, Instructions: 96
threadCOMMON

Function 00C61BD1 Relevance: 1.6, APIs: 1, Instructions: 96
memoryCOMMON

Function 00C657E4 Relevance: 1.6, APIs: 1, Instructions: 96
threadCOMMON

Function 00C66990 Relevance: 1.6, APIs: 1, Instructions: 96
threadCOMMON

Function 00C61BD8 Relevance: 1.6, APIs: 1, Instructions: 94
memoryCOMMON

Function 00C6586C Relevance: 1.6, APIs: 1, Instructions: 74
threadCOMMON

Function 063D5270 Relevance: 1.8, Strings: 1, Instructions: 594
COMMON

Function 02A47070 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre