Edit tour

Windows Analysis Report
Tepe - 20000000826476479.exe

Overview

General Information

Sample name:	Tepe - 20000000826476479.exe
Analysis ID:	1586814
MD5:	c761a94a20ba72d4e4ccf8fdfbc559eb
SHA1:	12266d211049379c4222388e81043fe08a5ce1e2
SHA256:	46481c24399a8e5563550d4b601d4e4892d493f5f8fd778c00a181a08a7baba4
Tags:	exeuser-lowmal3
Infos:

Detection

MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected MassLogger RAT

Yara detected Telegram RAT

AI detected suspicious sample

Machine Learning detection for sample

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Tepe - 20000000826476479.exe (PID: 2140 cmdline: "C:\Users\user\Desktop\Tepe - 20000000826476479.exe" MD5: C761A94A20BA72D4E4CCF8FDFBC559EB)

cleanup

Malware Configuration

Threatname: MassLogger

{"EXfil Mode": "SMTP", "From": "blog@alhoneycomb.com", "Password": "W           ORTH          will3611             !", "Server": "mail.alhoneycomb.com", "Port": 587}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Tepe - 20000000826476479.exe	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Tepe - 20000000826476479.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Tepe - 20000000826476479.exe	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Tepe - 20000000826476479.exe	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1b7:$a1: get_encryptedPassword 0xf4df:$a2: get_encryptedUsername 0xef52:$a3: get_timePasswordChanged 0xf073:$a4: get_passwordField 0xf1cd:$a5: set_encryptedPassword 0x10b29:$a7: get_logins 0x107da:$a8: GetOutlookPasswords 0x105cc:$a9: StartKeylogger 0x10a79:$a10: KeyLoggerEventArgs 0x10629:$a11: KeyLoggerEventArgsEventHandler
Tepe - 20000000826476479.exe	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1417f:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1367d:$a3: \Google\Chrome\User Data\Default\Login Data 0x1398b:$a4: \Orbitum\User Data\Default\Login Data 0x14783:$a5: \Kometa\User Data\Default\Login Data

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1446835652.0000000000162000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000000.00000000.1446835652.0000000000162000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.1446835652.0000000000162000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000000.1446835652.0000000000162000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xefb7:$a1: get_encryptedPassword 0xf2df:$a2: get_encryptedUsername 0xed52:$a3: get_timePasswordChanged 0xee73:$a4: get_passwordField 0xefcd:$a5: set_encryptedPassword 0x10929:$a7: get_logins 0x105da:$a8: GetOutlookPasswords 0x103cc:$a9: StartKeylogger 0x10879:$a10: KeyLoggerEventArgs 0x10429:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.2702555161.0000000002614000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2702555161.0000000002614000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: Tepe - 20000000826476479.exe PID: 2140	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: Tepe - 20000000826476479.exe PID: 2140	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Tepe - 20000000826476479.exe PID: 2140	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: Tepe - 20000000826476479.exe PID: 2140	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x10db9:$a1: get_encryptedPassword 0x110d2:$a2: get_encryptedUsername 0x10b68:$a3: get_timePasswordChanged 0x10c89:$a4: get_passwordField 0x10dcf:$a5: set_encryptedPassword 0x126d2:$a7: get_logins 0x12383:$a8: GetOutlookPasswords 0x12175:$a9: StartKeylogger 0x12622:$a10: KeyLoggerEventArgs 0x121d2:$a11: KeyLoggerEventArgsEventHandler
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.Tepe - 20000000826476479.exe.160000.0.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.0.Tepe - 20000000826476479.exe.160000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.Tepe - 20000000826476479.exe.160000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.0.Tepe - 20000000826476479.exe.160000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1b7:$a1: get_encryptedPassword 0xf4df:$a2: get_encryptedUsername 0xef52:$a3: get_timePasswordChanged 0xf073:$a4: get_passwordField 0xf1cd:$a5: set_encryptedPassword 0x10b29:$a7: get_logins 0x107da:$a8: GetOutlookPasswords 0x105cc:$a9: StartKeylogger 0x10a79:$a10: KeyLoggerEventArgs 0x10629:$a11: KeyLoggerEventArgsEventHandler
0.0.Tepe - 20000000826476479.exe.160000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1417f:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1367d:$a3: \Google\Chrome\User Data\Default\Login Data 0x1398b:$a4: \Orbitum\User Data\Default\Login Data 0x14783:$a5: \Kometa\User Data\Default\Login Data

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 74.119.238.7, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\Tepe - 20000000826476479.exe, Initiated: true, ProcessId: 2140, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49706

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T16:52:52.315282+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49704	193.122.130.0	80	TCP
2025-01-09T16:52:59.096441+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49704	193.122.130.0	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Tepe - 20000000826476479.exe

Avira: detected

Found malware configuration

Source: 0.0.Tepe - 20000000826476479.exe.160000.0.unpack

Malware Configuration Extractor: MassLogger {"EXfil Mode": "SMTP", "From": "blog@alhoneycomb.com", "Password": "W ORTH will3611 !", "Server": "mail.alhoneycomb.com", "Port": 587}

Multi AV Scanner detection for submitted file

Source: Tepe - 20000000826476479.exe

ReversingLabs: Detection: 75%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Tepe - 20000000826476479.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: Tepe - 20000000826476479.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.8:49705 version: TLS 1.0

Source: Tepe - 20000000826476479.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 4x nop then jmp 023A5782h	0_2_023A5366
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 4x nop then jmp 023A51B9h	0_2_023A4F08
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 4x nop then jmp 023A5782h	0_2_023A56AF
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 4x nop then jmp 049D1935h	0_2_049D15F8
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 4x nop then jmp 049D0741h	0_2_049D0498
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 4x nop then jmp 049DBF28h	0_2_049DBC80
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 4x nop then jmp 049DE778h	0_2_049DE4D0
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 4x nop then jmp 049DDEC8h	0_2_049DDC20
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 4x nop then jmp 049D3EF8h	0_2_049D3C50
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 4x nop then jmp 049DF028h	0_2_049DED80
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 4x nop then jmp 049DD088h	0_2_049DCDE0
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 4x nop then jmp 049DC7D8h	0_2_049DC530
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 4x nop then jmp 049D0FF1h	0_2_049D0D48
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 4x nop then jmp 049DD93Ah	0_2_049DD690
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 4x nop then jmp 049DA970h	0_2_049DA6C8
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 4x nop then jmp 049DA0C0h	0_2_049D9E18
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 4x nop then jmp 049DF8D8h	0_2_049DF630
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 4x nop then jmp 049D3AA0h	0_2_049D37F8
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 4x nop then jmp 049D31F0h	0_2_049D2F48
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 4x nop then jmp 049DB220h	0_2_049DAF78
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 4x nop then jmp 049D4350h	0_2_049D40A8
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 4x nop then jmp 049DC380h	0_2_049DC0D8
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 4x nop then jmp 049D0B99h	0_2_049D08F0
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 4x nop then jmp 049DBAD0h	0_2_049DB828
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 4x nop then jmp 049D02E9h	0_2_049D0040
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 4x nop then jmp 049DE320h	0_2_049DE078
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 4x nop then jmp 049DCC30h	0_2_049DC988
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 4x nop then jmp 049D1449h	0_2_049D11A0
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 4x nop then jmp 049DF480h	0_2_049DF1D8
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 4x nop then jmp 049DEBD0h	0_2_049DE928
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 4x nop then jmp 049DFD30h	0_2_049DFA88
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 4x nop then jmp 049D2D98h	0_2_049D2AF0
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 4x nop then jmp 049DD4E0h	0_2_049DD238
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 4x nop then jmp 049DA518h	0_2_049DA270
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 4x nop then jmp 049D3648h	0_2_049D33A0
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 4x nop then jmp 049DB678h	0_2_049DB3D0
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 4x nop then jmp 049DADC8h	0_2_049DAB20

Source: global traffic

TCP traffic: 192.168.2.8:49706 -> 74.119.238.7:587

Source: global traffic

HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.16.1 104.21.16.1
Source: Joe Sandbox View	IP Address: 74.119.238.7 74.119.238.7
Source: Joe Sandbox View	IP Address: 193.122.130.0 193.122.130.0

Source: Joe Sandbox View

ASN Name: VPLSNETUS VPLSNETUS

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic

Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49704 -> 193.122.130.0:80

Source: global traffic

TCP traffic: 192.168.2.8:49706 -> 74.119.238.7:587

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown

HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.8:49705 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: mail.alhoneycomb.com

Source: Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.000000000253E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.000000000253E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.comd
Source: Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.0000000002614000.00000004.00000800.00020000.00000000.sdmp, Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.000000000253E000.00000004.00000800.00020000.00000000.sdmp, Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.0000000002529000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.00000000024C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.0000000002614000.00000004.00000800.00020000.00000000.sdmp, Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.000000000253E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/d
Source: Tepe - 20000000826476479.exe	String found in binary or memory: http://checkip.dyndns.org/q
Source: Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.000000000253E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.orgd
Source: Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.alhoneycomb.com
Source: Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.alhoneycomb.comd
Source: Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.0000000002614000.00000004.00000800.00020000.00000000.sdmp, Tepe - 20000000826476479.exe, 00000000.00000002.2702199605.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, Tepe - 20000000826476479.exe, 00000000.00000002.2704022973.0000000005C7D000.00000004.00000020.00020000.00000000.sdmp, Tepe - 20000000826476479.exe, 00000000.00000002.2704022973.0000000005C59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r11.i.lencr.org/0-
Source: Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.0000000002614000.00000004.00000800.00020000.00000000.sdmp, Tepe - 20000000826476479.exe, 00000000.00000002.2702199605.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, Tepe - 20000000826476479.exe, 00000000.00000002.2704022973.0000000005C7D000.00000004.00000020.00020000.00000000.sdmp, Tepe - 20000000826476479.exe, 00000000.00000002.2704022973.0000000005C59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r11.o.lencr.org0#
Source: Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.000000000255B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.000000000255B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.orgd
Source: Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.00000000024C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.0000000002614000.00000004.00000800.00020000.00000000.sdmp, Tepe - 20000000826476479.exe, 00000000.00000002.2702199605.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, Tepe - 20000000826476479.exe, 00000000.00000002.2704022973.0000000005C7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.0000000002614000.00000004.00000800.00020000.00000000.sdmp, Tepe - 20000000826476479.exe, 00000000.00000002.2702199605.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, Tepe - 20000000826476479.exe, 00000000.00000002.2704022973.0000000005C7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.0000000002614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: Tepe - 20000000826476479.exe	String found in binary or memory: https://api.telegram.org/bot-/sendDocument?chat_id=
Source: Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.000000000253E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: Tepe - 20000000826476479.exe	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.000000000253E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189d
Source: Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.000000000253E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189l

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705

System Summary

Malicious sample detected (through community Yara rule)

Source: Tepe - 20000000826476479.exe, type: SAMPLE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Tepe - 20000000826476479.exe, type: SAMPLE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.0.Tepe - 20000000826476479.exe.160000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.0.Tepe - 20000000826476479.exe.160000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000000.00000000.1446835652.0000000000162000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: Tepe - 20000000826476479.exe PID: 2140, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_023AC168	0_2_023AC168
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_023A27B9	0_2_023A27B9
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_023ACAB0	0_2_023ACAB0
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_023A7E68	0_2_023A7E68
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_023A4F08	0_2_023A4F08
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_023AC386	0_2_023AC386
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_023ACAA2	0_2_023ACAA2
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_023AB9E0	0_2_023AB9E0
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_023AB9DC	0_2_023AB9DC
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_023A7E66	0_2_023A7E66
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_023A4EF8	0_2_023A4EF8
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_023A2DD1	0_2_023A2DD1
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049D1C58	0_2_049D1C58
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049D15F8	0_2_049D15F8
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049D4500	0_2_049D4500
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049D7770	0_2_049D7770
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049D6998	0_2_049D6998
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049D0498	0_2_049D0498
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049D9C90	0_2_049D9C90
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049D048A	0_2_049D048A
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DBC80	0_2_049DBC80
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DE4D0	0_2_049DE4D0
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DE4C0	0_2_049DE4C0
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DDC13	0_2_049DDC13
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DDC20	0_2_049DDC20
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049D3C50	0_2_049D3C50
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049D3C43	0_2_049D3C43
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DBC71	0_2_049DBC71
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DED80	0_2_049DED80
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DCDD0	0_2_049DCDD0
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049D15EA	0_2_049D15EA
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DCDE0	0_2_049DCDE0
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049D0D3A	0_2_049D0D3A
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DC530	0_2_049DC530
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DC520	0_2_049DC520
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049D0D48	0_2_049D0D48
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DED70	0_2_049DED70
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DD690	0_2_049DD690
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DD683	0_2_049DD683
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DA6B9	0_2_049DA6B9
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DA6C8	0_2_049DA6C8
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049D9E18	0_2_049D9E18
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DF630	0_2_049DF630
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DF620	0_2_049DF620
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049D37F8	0_2_049D37F8
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049D37E8	0_2_049D37E8
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049D2F38	0_2_049D2F38
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049D2F48	0_2_049D2F48
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DAF78	0_2_049DAF78
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DAF68	0_2_049DAF68
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049D4098	0_2_049D4098
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049D40A8	0_2_049D40A8
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049D08DF	0_2_049D08DF
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DC0D8	0_2_049DC0D8
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DC0CB	0_2_049DC0CB
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049D08F0	0_2_049D08F0
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DB818	0_2_049DB818
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049D0006	0_2_049D0006
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DB828	0_2_049DB828
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049D0040	0_2_049D0040
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DE078	0_2_049DE078
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DE068	0_2_049DE068
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049D118F	0_2_049D118F
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DC988	0_2_049DC988
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049D11A0	0_2_049D11A0
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DF1D8	0_2_049DF1D8
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DF1C8	0_2_049DF1C8
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DE928	0_2_049DE928
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DE923	0_2_049DE923
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DC97B	0_2_049DC97B
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DFA88	0_2_049DFA88
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049D2AF0	0_2_049D2AF0
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049D2AE0	0_2_049D2AE0
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DD238	0_2_049DD238
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DD22B	0_2_049DD22B
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DFA78	0_2_049DFA78
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DA270	0_2_049DA270
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DA261	0_2_049DA261
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049D3393	0_2_049D3393
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049D33A0	0_2_049D33A0
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DB3D0	0_2_049DB3D0
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DB3C1	0_2_049DB3C1
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DAB10	0_2_049DAB10
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049DAB20	0_2_049DAB20
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_049D1B4A	0_2_049D1B4A

Source: Tepe - 20000000826476479.exe, 00000000.00000000.1446864613.000000000017A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs Tepe - 20000000826476479.exe
Source: Tepe - 20000000826476479.exe, 00000000.00000002.2701864460.0000000000537000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Tepe - 20000000826476479.exe
Source: Tepe - 20000000826476479.exe, 00000000.00000002.2702199605.00000000008BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Tepe - 20000000826476479.exe
Source: Tepe - 20000000826476479.exe	Binary or memory string: OriginalFilenameCloudServices.exe< vs Tepe - 20000000826476479.exe

Source: Tepe - 20000000826476479.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Tepe - 20000000826476479.exe, type: SAMPLE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Tepe - 20000000826476479.exe, type: SAMPLE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.Tepe - 20000000826476479.exe.160000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.0.Tepe - 20000000826476479.exe.160000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000000.1446835652.0000000000162000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: Tepe - 20000000826476479.exe PID: 2140, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.winEXE@1/0@3/3

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe

Mutant created: NULL

Source: Tepe - 20000000826476479.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Tepe - 20000000826476479.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Tepe - 20000000826476479.exe, 00000000.00000002.2703063964.00000000034ED000.00000004.00000800.00020000.00000000.sdmp, Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.00000000025BC000.00000004.00000800.00020000.00000000.sdmp, Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.00000000025AE000.00000004.00000800.00020000.00000000.sdmp, Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.00000000025DD000.00000004.00000800.00020000.00000000.sdmp, Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.00000000025D1000.00000004.00000800.00020000.00000000.sdmp, Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.000000000259E000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Tepe - 20000000826476479.exe

ReversingLabs: Detection: 75%

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Tepe - 20000000826476479.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Tepe - 20000000826476479.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Tepe - 20000000826476479.exe

Static PE information: 0xB1486ED1 [Tue Apr 1 22:23:13 2064 UTC]

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_023AF273 push ebp; retf	0_2_023AF281
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_023A64F5 pushfd ; iretd	0_2_023A64FA
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_023AB544 push eax; iretd	0_2_023AB545

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Memory allocated: 2290000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Memory allocated: 24C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Memory allocated: 22C0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Window / User API: threadDelayed 1402			Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Window / User API: threadDelayed 4070			Jump to behavior

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe TID: 6700	Thread sleep time: -19369081277395017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe TID: 6700	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe TID: 5424	Thread sleep count: 1402 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe TID: 6700	Thread sleep time: -99840s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe TID: 6700	Thread sleep time: -99709s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe TID: 5424	Thread sleep count: 4070 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe TID: 6700	Thread sleep time: -99578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe TID: 6700	Thread sleep time: -99466s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe TID: 6700	Thread sleep time: -99342s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe TID: 6700	Thread sleep time: -99234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe TID: 6700	Thread sleep time: -99125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe TID: 6700	Thread sleep time: -99015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe TID: 6700	Thread sleep time: -98906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe TID: 6700	Thread sleep time: -98796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe TID: 6700	Thread sleep time: -98687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe TID: 6700	Thread sleep time: -98578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe TID: 6700	Thread sleep time: -98469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe TID: 6700	Thread sleep time: -98358s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe TID: 6700	Thread sleep time: -98250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe TID: 6700	Thread sleep time: -98139s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe TID: 6700	Thread sleep time: -98031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe TID: 6700	Thread sleep time: -97922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe TID: 6700	Thread sleep time: -97812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe TID: 6700	Thread sleep time: -97703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe TID: 6700	Thread sleep time: -97593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe TID: 6700	Thread sleep time: -97484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe TID: 6700	Thread sleep time: -97375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe TID: 6700	Thread sleep time: -97265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe TID: 6700	Thread sleep time: -97152s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe TID: 6700	Thread sleep time: -97046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe TID: 6700	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Thread delayed: delay time: 99840	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Thread delayed: delay time: 99709	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Thread delayed: delay time: 99578	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Thread delayed: delay time: 99466	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Thread delayed: delay time: 99342	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Thread delayed: delay time: 99234	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Thread delayed: delay time: 99125	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Thread delayed: delay time: 99015	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Thread delayed: delay time: 98906	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Thread delayed: delay time: 98796	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Thread delayed: delay time: 98687	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Thread delayed: delay time: 98578	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Thread delayed: delay time: 98469	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Thread delayed: delay time: 98358	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Thread delayed: delay time: 98250	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Thread delayed: delay time: 98139	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Thread delayed: delay time: 98031	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Thread delayed: delay time: 97922	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Thread delayed: delay time: 97812	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Thread delayed: delay time: 97703	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Thread delayed: delay time: 97593	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Thread delayed: delay time: 97484	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Thread delayed: delay time: 97375	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Thread delayed: delay time: 97265	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Thread delayed: delay time: 97152	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Thread delayed: delay time: 97046	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Tepe - 20000000826476479.exe, 00000000.00000002.2702199605.00000000008FF000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllJ

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe

Code function: 0_2_023AC168 LdrInitializeThunk,LdrInitializeThunk,

0_2_023AC168

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Queries volume information: C:\Users\user\Desktop\Tepe - 20000000826476479.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: Tepe - 20000000826476479.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Tepe - 20000000826476479.exe.160000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1446835652.0000000000162000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Tepe - 20000000826476479.exe PID: 2140, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: Tepe - 20000000826476479.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Tepe - 20000000826476479.exe.160000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1446835652.0000000000162000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2702555161.0000000002614000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Tepe - 20000000826476479.exe PID: 2140, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: Tepe - 20000000826476479.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Tepe - 20000000826476479.exe.160000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1446835652.0000000000162000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2702555161.0000000002614000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Tepe - 20000000826476479.exe PID: 2140, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: Tepe - 20000000826476479.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Tepe - 20000000826476479.exe.160000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1446835652.0000000000162000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Tepe - 20000000826476479.exe PID: 2140, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: Tepe - 20000000826476479.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Tepe - 20000000826476479.exe.160000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1446835652.0000000000162000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2702555161.0000000002614000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Tepe - 20000000826476479.exe PID: 2140, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	31 Virtualization/Sandbox Evasion	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	1 Data from Local System	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Timestomp	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
Tepe - 20000000826476479.exe	76%	ReversingLabs	ByteCode-MSIL.Infostealer.Mintluks
Tepe - 20000000826476479.exe	100%	Avira	TR/ATRAPS.Gen
Tepe - 20000000826476479.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://mail.alhoneycomb.comd	0%	Avira URL Cloud	safe
http://mail.alhoneycomb.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
mail.alhoneycomb.com	74.119.238.7	true	true	unknown
reallyfreegeoip.org	104.21.16.1	true	false	high
checkip.dyndns.com	193.122.130.0	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false		high
https://reallyfreegeoip.org/xml/8.46.123.189	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://r11.i.lencr.org/0-	Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.0000000002614000.00000004.00000800.00020000.00000000.sdmp, Tepe - 20000000826476479.exe, 00000000.00000002.2702199605.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, Tepe - 20000000826476479.exe, 00000000.00000002.2704022973.0000000005C7D000.00000004.00000020.00020000.00000000.sdmp, Tepe - 20000000826476479.exe, 00000000.00000002.2704022973.0000000005C59000.00000004.00000020.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/8.46.123.189l	Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.000000000253E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mail.alhoneycomb.comd	Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://r11.o.lencr.org0#	Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.0000000002614000.00000004.00000800.00020000.00000000.sdmp, Tepe - 20000000826476479.exe, 00000000.00000002.2702199605.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, Tepe - 20000000826476479.exe, 00000000.00000002.2704022973.0000000005C7D000.00000004.00000020.00020000.00000000.sdmp, Tepe - 20000000826476479.exe, 00000000.00000002.2704022973.0000000005C59000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.comd	Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.000000000253E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mail.alhoneycomb.com	Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.0000000002614000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.0000000002614000.00000004.00000800.00020000.00000000.sdmp, Tepe - 20000000826476479.exe, 00000000.00000002.2702199605.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, Tepe - 20000000826476479.exe, 00000000.00000002.2704022973.0000000005C7D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.0000000002614000.00000004.00000800.00020000.00000000.sdmp, Tepe - 20000000826476479.exe, 00000000.00000002.2702199605.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, Tepe - 20000000826476479.exe, 00000000.00000002.2704022973.0000000005C7D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org/q	Tepe - 20000000826476479.exe	false		high
http://reallyfreegeoip.orgd	Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.000000000255B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/8.46.123.189d	Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.000000000253E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://reallyfreegeoip.org	Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.000000000255B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.orgd	Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.000000000253E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org	Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.000000000253E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org	Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.0000000002614000.00000004.00000800.00020000.00000000.sdmp, Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.000000000253E000.00000004.00000800.00020000.00000000.sdmp, Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.0000000002529000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.com	Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.000000000253E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org/d	Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.0000000002614000.00000004.00000800.00020000.00000000.sdmp, Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.000000000253E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Tepe - 20000000826476479.exe, 00000000.00000002.2702555161.00000000024C1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot-/sendDocument?chat_id=	Tepe - 20000000826476479.exe	false		high
https://reallyfreegeoip.org/xml/	Tepe - 20000000826476479.exe	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.16.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
74.119.238.7	mail.alhoneycomb.com	United States	35908	VPLSNETUS	true
193.122.130.0	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1586814
Start date and time:	2025-01-09 16:51:52 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Tepe - 20000000826476479.exe
Detection:	MAL
Classification:	mal100.troj.spyw.winEXE@1/0@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 42 Number of non-executed functions: 71
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: Tepe - 20000000826476479.exe

Simulations

Behavior and APIs

Time	Type	Description
10:52:58	API Interceptor	27x Sleep call for process: Tepe - 20000000826476479.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.16.1	JNKHlxGvw4.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	188387cm.n9shteam.in/videolinePipeHttplowProcessorgamelocalTemp.php
74.119.238.7	NoERE2024000013833.exe	Get hash	malicious	AgentTesla	Browse
	1863415243647.exe	Get hash	malicious	AgentTesla	Browse
	Halkbank_Ekstre_20230426_075819_154085.exe	Get hash	malicious	AgentTesla	Browse
	hesaphareketi-01.exe	Get hash	malicious	AgentTesla	Browse
	New Purchase Order.exe	Get hash	malicious	AgentTesla	Browse
	rPO_CW00402902400415.exe	Get hash	malicious	AgentTesla	Browse
193.122.130.0	Nuevo pedido.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	VSLS SCHEDULE_pdf.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	ungziped_file.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	New order 2025.msg	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	checkip.dyndns.org/
	file.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	image.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	DHL DOC INV 191224.gz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	PO_KB#67897.cmd	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	MT Eagle Asia 11.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Order_12232024.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	Order_List.scr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	132.226.8.169
	Nuevo pedido.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	fiyati_teklif 615TBI507_ ACCADO san tic_ Sipari#U015fi jpeg docx .exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	CTM REQUEST-ETD JAN 22, 2024_pdf.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	Copy shipping docs PO EV1786 LY ECO PAK EV1.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	Payment 01.08.25.pdf.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.6.168
	December Reconciliation QuanKang.exe	Get hash	malicious	Unknown	Browse	193.122.6.168
	JB#40044 Order.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	PO.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	BgroUcYHpy.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
mail.alhoneycomb.com	NoERE2024000013833.exe	Get hash	malicious	AgentTesla	Browse	74.119.238.7
	1863415243647.exe	Get hash	malicious	AgentTesla	Browse	74.119.238.7
	Halkbank_Ekstre_20230426_075819_154085.exe	Get hash	malicious	AgentTesla	Browse	74.119.238.7
	hesaphareketi-01.exe	Get hash	malicious	AgentTesla	Browse	74.119.238.7
	New Purchase Order.exe	Get hash	malicious	AgentTesla	Browse	74.119.238.7
	rPO_CW00402902400415.exe	Get hash	malicious	AgentTesla	Browse	74.119.238.7
reallyfreegeoip.org	Order_List.scr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	104.21.64.1
	Nuevo pedido.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	CTM REQUEST-ETD JAN 22, 2024_pdf.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	Copy shipping docs PO EV1786 LY ECO PAK EV1.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	Payment 01.08.25.pdf.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.96.1
	December Reconciliation QuanKang.exe	Get hash	malicious	Unknown	Browse	104.21.48.1
	JB#40044 Order.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.112.1
	PO.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.112.1
	BgroUcYHpy.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	pbCN4g6sN5.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Order_List.scr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	104.21.64.1
	Nuevo pedido.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	Benefit_401k_2025_Enrollment.pdf	Get hash	malicious	Unknown	Browse	172.64.155.59
	https://ccml.io/	Get hash	malicious	Unknown	Browse	104.17.24.14
	http://readermodeext.info	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://bryf.atchirlisc.ru/EeMAGvIe/	Get hash	malicious	HTMLPhisher	Browse	172.64.41.3
	http://readermodeext.info	Get hash	malicious	Unknown	Browse	1.1.1.1
	CTM REQUEST-ETD JAN 22, 2024_pdf.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	Copy shipping docs PO EV1786 LY ECO PAK EV1.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	Payment 01.08.25.pdf.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.96.1
ORACLE-BMC-31898US	Nuevo pedido.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	Payment 01.08.25.pdf.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.6.168
	December Reconciliation QuanKang.exe	Get hash	malicious	Unknown	Browse	193.122.6.168
	PO.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	BgroUcYHpy.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	VSLS SCHEDULE_pdf.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	ungziped_file.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	miori.x86.elf	Get hash	malicious	Unknown	Browse	140.204.251.205
	New order 2025.msg	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	193.122.130.0
	FORTUNE RICH_PARTICULARS.pdf.scr.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
VPLSNETUS	http://vwi46h7.terraclicks.click/rd/4fRUWo26099tRCA461sdwbdplppv232VXGPAFVAHBPJXIV321477KIEL571756p9	Get hash	malicious	Phisher	Browse	67.198.205.87
	Fantazy.arm4.elf	Get hash	malicious	Unknown	Browse	67.229.74.151
	na.elf	Get hash	malicious	Mirai	Browse	98.126.6.69
	loligang.arm.elf	Get hash	malicious	Mirai	Browse	74.222.148.221
	rebirth.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	110.34.245.254
	Owari.ppc.elf	Get hash	malicious	Unknown	Browse	174.139.231.26
	nabspc.elf	Get hash	malicious	Unknown	Browse	96.62.217.206
	RHxJqGoGFB.exe	Get hash	malicious	Sality	Browse	98.126.7.202
	la.bot.arm5.elf	Get hash	malicious	Mirai	Browse	174.139.9.232
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	67.229.175.15

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	Order_List.scr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	104.21.16.1
	Nuevo pedido.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	CTM REQUEST-ETD JAN 22, 2024_pdf.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	Copy shipping docs PO EV1786 LY ECO PAK EV1.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	Payment 01.08.25.pdf.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.16.1
	December Reconciliation QuanKang.exe	Get hash	malicious	Unknown	Browse	104.21.16.1
	JB#40044 Order.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	PO.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	BgroUcYHpy.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
	pbCN4g6sN5.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	104.21.16.1

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.669911434567987
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Tepe - 20000000826476479.exe
File size:	93'696 bytes
MD5:	c761a94a20ba72d4e4ccf8fdfbc559eb
SHA1:	12266d211049379c4222388e81043fe08a5ce1e2
SHA256:	46481c24399a8e5563550d4b601d4e4892d493f5f8fd778c00a181a08a7baba4
SHA512:	d91e283a9af5212c5dc7927a6ebb8c5ac39a45c644f6c5d2420971244dd2099c9023f3f672994015fa80afc5e102ef6957c3c2a475efd6f4a8d2782160ec2d87
SSDEEP:	1536:nmhwtDk6bytzah+hThN/UP/UJS/UJ5/UJpwscb7YpLN7FMRFZ+pZ3Q:0wtDk6by9ah+hThN/UP/UJS/UJ5/UJpY
TLSH:	6B93F70937E88814D9FF8572E5B191110B3AFC594936D22D1BD8B4EE2B7BA8085C7BD3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....nH...............P..d............... ........@.. ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x41829e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xB1486ED1 [Tue Apr 1 22:23:13 2064 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x18244	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1a000	0x5c6	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x162a4	0x16400	6cd9ec669556683921b1a62b6cbeb377	False	0.34962034761235955	data	5.714461480312947	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x1a000	0x5c6	0x600	8e996f83a2e950d14655a859eaa174be	False	0.41796875	data	4.113874502790226	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1c000	0xc	0x200	2d71474ed7a54424c1ece3a3f29adc68	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x1a0a0	0x33c	data			0.4142512077294686
RT_MANIFEST	0x1a3dc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-09T16:52:52.315282+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49704	193.122.130.0	80	TCP
2025-01-09T16:52:59.096441+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49704	193.122.130.0	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 16:52:51.695157051 CET	49704	80	192.168.2.8	193.122.130.0
Jan 9, 2025 16:52:51.700103045 CET	80	49704	193.122.130.0	192.168.2.8
Jan 9, 2025 16:52:51.700181007 CET	49704	80	192.168.2.8	193.122.130.0
Jan 9, 2025 16:52:51.700485945 CET	49704	80	192.168.2.8	193.122.130.0
Jan 9, 2025 16:52:51.705327034 CET	80	49704	193.122.130.0	192.168.2.8
Jan 9, 2025 16:52:52.154489994 CET	80	49704	193.122.130.0	192.168.2.8
Jan 9, 2025 16:52:52.158382893 CET	49704	80	192.168.2.8	193.122.130.0
Jan 9, 2025 16:52:52.163167953 CET	80	49704	193.122.130.0	192.168.2.8
Jan 9, 2025 16:52:52.272420883 CET	80	49704	193.122.130.0	192.168.2.8
Jan 9, 2025 16:52:52.283296108 CET	49705	443	192.168.2.8	104.21.16.1
Jan 9, 2025 16:52:52.283334970 CET	443	49705	104.21.16.1	192.168.2.8
Jan 9, 2025 16:52:52.283436060 CET	49705	443	192.168.2.8	104.21.16.1
Jan 9, 2025 16:52:52.292200089 CET	49705	443	192.168.2.8	104.21.16.1
Jan 9, 2025 16:52:52.292216063 CET	443	49705	104.21.16.1	192.168.2.8
Jan 9, 2025 16:52:52.315282106 CET	49704	80	192.168.2.8	193.122.130.0
Jan 9, 2025 16:52:52.769785881 CET	443	49705	104.21.16.1	192.168.2.8
Jan 9, 2025 16:52:52.769891024 CET	49705	443	192.168.2.8	104.21.16.1
Jan 9, 2025 16:52:52.776185989 CET	49705	443	192.168.2.8	104.21.16.1
Jan 9, 2025 16:52:52.776210070 CET	443	49705	104.21.16.1	192.168.2.8
Jan 9, 2025 16:52:52.776590109 CET	443	49705	104.21.16.1	192.168.2.8
Jan 9, 2025 16:52:52.830745935 CET	49705	443	192.168.2.8	104.21.16.1
Jan 9, 2025 16:52:53.136425972 CET	49705	443	192.168.2.8	104.21.16.1
Jan 9, 2025 16:52:53.179339886 CET	443	49705	104.21.16.1	192.168.2.8
Jan 9, 2025 16:52:53.258621931 CET	443	49705	104.21.16.1	192.168.2.8
Jan 9, 2025 16:52:53.258687973 CET	443	49705	104.21.16.1	192.168.2.8
Jan 9, 2025 16:52:53.258747101 CET	49705	443	192.168.2.8	104.21.16.1
Jan 9, 2025 16:52:53.396807909 CET	49705	443	192.168.2.8	104.21.16.1
Jan 9, 2025 16:52:58.941150904 CET	49704	80	192.168.2.8	193.122.130.0
Jan 9, 2025 16:52:58.947530031 CET	80	49704	193.122.130.0	192.168.2.8
Jan 9, 2025 16:52:59.050964117 CET	80	49704	193.122.130.0	192.168.2.8
Jan 9, 2025 16:52:59.096441031 CET	49704	80	192.168.2.8	193.122.130.0
Jan 9, 2025 16:52:59.528788090 CET	49706	587	192.168.2.8	74.119.238.7
Jan 9, 2025 16:52:59.534116983 CET	587	49706	74.119.238.7	192.168.2.8
Jan 9, 2025 16:52:59.534200907 CET	49706	587	192.168.2.8	74.119.238.7
Jan 9, 2025 16:53:00.198538065 CET	587	49706	74.119.238.7	192.168.2.8
Jan 9, 2025 16:53:00.198945045 CET	49706	587	192.168.2.8	74.119.238.7
Jan 9, 2025 16:53:00.203850031 CET	587	49706	74.119.238.7	192.168.2.8
Jan 9, 2025 16:53:00.346800089 CET	587	49706	74.119.238.7	192.168.2.8
Jan 9, 2025 16:53:00.347065926 CET	49706	587	192.168.2.8	74.119.238.7
Jan 9, 2025 16:53:00.351912975 CET	587	49706	74.119.238.7	192.168.2.8
Jan 9, 2025 16:53:00.510873079 CET	587	49706	74.119.238.7	192.168.2.8
Jan 9, 2025 16:53:00.511553049 CET	49706	587	192.168.2.8	74.119.238.7
Jan 9, 2025 16:53:00.516382933 CET	587	49706	74.119.238.7	192.168.2.8
Jan 9, 2025 16:53:00.675260067 CET	587	49706	74.119.238.7	192.168.2.8
Jan 9, 2025 16:53:00.675277948 CET	587	49706	74.119.238.7	192.168.2.8
Jan 9, 2025 16:53:00.675288916 CET	587	49706	74.119.238.7	192.168.2.8
Jan 9, 2025 16:53:00.675301075 CET	587	49706	74.119.238.7	192.168.2.8
Jan 9, 2025 16:53:00.675338030 CET	49706	587	192.168.2.8	74.119.238.7
Jan 9, 2025 16:53:00.675364017 CET	49706	587	192.168.2.8	74.119.238.7
Jan 9, 2025 16:53:00.723407030 CET	49706	587	192.168.2.8	74.119.238.7
Jan 9, 2025 16:53:00.728298903 CET	587	49706	74.119.238.7	192.168.2.8
Jan 9, 2025 16:53:00.871052980 CET	587	49706	74.119.238.7	192.168.2.8
Jan 9, 2025 16:53:00.878845930 CET	49706	587	192.168.2.8	74.119.238.7
Jan 9, 2025 16:53:00.883687019 CET	587	49706	74.119.238.7	192.168.2.8
Jan 9, 2025 16:53:01.037002087 CET	587	49706	74.119.238.7	192.168.2.8
Jan 9, 2025 16:53:01.038072109 CET	49706	587	192.168.2.8	74.119.238.7
Jan 9, 2025 16:53:01.043004990 CET	587	49706	74.119.238.7	192.168.2.8
Jan 9, 2025 16:53:01.197563887 CET	587	49706	74.119.238.7	192.168.2.8
Jan 9, 2025 16:53:01.200037003 CET	49706	587	192.168.2.8	74.119.238.7
Jan 9, 2025 16:53:01.204870939 CET	587	49706	74.119.238.7	192.168.2.8
Jan 9, 2025 16:53:01.410433054 CET	587	49706	74.119.238.7	192.168.2.8
Jan 9, 2025 16:53:01.415374994 CET	49706	587	192.168.2.8	74.119.238.7
Jan 9, 2025 16:53:01.420217037 CET	587	49706	74.119.238.7	192.168.2.8
Jan 9, 2025 16:53:01.575392008 CET	587	49706	74.119.238.7	192.168.2.8
Jan 9, 2025 16:53:01.575681925 CET	49706	587	192.168.2.8	74.119.238.7
Jan 9, 2025 16:53:01.580532074 CET	587	49706	74.119.238.7	192.168.2.8
Jan 9, 2025 16:53:01.736546993 CET	587	49706	74.119.238.7	192.168.2.8
Jan 9, 2025 16:53:01.736876011 CET	49706	587	192.168.2.8	74.119.238.7
Jan 9, 2025 16:53:01.741702080 CET	587	49706	74.119.238.7	192.168.2.8
Jan 9, 2025 16:53:01.906861067 CET	587	49706	74.119.238.7	192.168.2.8
Jan 9, 2025 16:53:01.907568932 CET	49706	587	192.168.2.8	74.119.238.7
Jan 9, 2025 16:53:01.907597065 CET	49706	587	192.168.2.8	74.119.238.7
Jan 9, 2025 16:53:01.907618999 CET	49706	587	192.168.2.8	74.119.238.7
Jan 9, 2025 16:53:01.907643080 CET	49706	587	192.168.2.8	74.119.238.7
Jan 9, 2025 16:53:01.912339926 CET	587	49706	74.119.238.7	192.168.2.8
Jan 9, 2025 16:53:01.912377119 CET	587	49706	74.119.238.7	192.168.2.8
Jan 9, 2025 16:53:01.912553072 CET	587	49706	74.119.238.7	192.168.2.8
Jan 9, 2025 16:53:01.912564039 CET	587	49706	74.119.238.7	192.168.2.8
Jan 9, 2025 16:53:02.112500906 CET	587	49706	74.119.238.7	192.168.2.8
Jan 9, 2025 16:53:02.159015894 CET	49706	587	192.168.2.8	74.119.238.7
Jan 9, 2025 16:53:49.065987110 CET	49704	80	192.168.2.8	193.122.130.0
Jan 9, 2025 16:53:49.071026087 CET	80	49704	193.122.130.0	192.168.2.8
Jan 9, 2025 16:53:49.071141958 CET	49704	80	192.168.2.8	193.122.130.0
Jan 9, 2025 16:54:39.081513882 CET	49706	587	192.168.2.8	74.119.238.7
Jan 9, 2025 16:54:39.086414099 CET	587	49706	74.119.238.7	192.168.2.8
Jan 9, 2025 16:54:39.240619898 CET	587	49706	74.119.238.7	192.168.2.8
Jan 9, 2025 16:54:39.248470068 CET	49706	587	192.168.2.8	74.119.238.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 16:52:51.681044102 CET	65205	53	192.168.2.8	1.1.1.1
Jan 9, 2025 16:52:51.687922001 CET	53	65205	1.1.1.1	192.168.2.8
Jan 9, 2025 16:52:52.274240971 CET	56398	53	192.168.2.8	1.1.1.1
Jan 9, 2025 16:52:52.282478094 CET	53	56398	1.1.1.1	192.168.2.8
Jan 9, 2025 16:52:59.059087038 CET	57209	53	192.168.2.8	1.1.1.1
Jan 9, 2025 16:52:59.499361038 CET	53	57209	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 9, 2025 16:52:51.681044102 CET	192.168.2.8	1.1.1.1	0xeaad	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:52:52.274240971 CET	192.168.2.8	1.1.1.1	0xaa20	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:52:59.059087038 CET	192.168.2.8	1.1.1.1	0x6ac5	Standard query (0)	mail.alhoneycomb.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 9, 2025 16:52:51.687922001 CET	1.1.1.1	192.168.2.8	0xeaad	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 9, 2025 16:52:51.687922001 CET	1.1.1.1	192.168.2.8	0xeaad	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:52:51.687922001 CET	1.1.1.1	192.168.2.8	0xeaad	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:52:51.687922001 CET	1.1.1.1	192.168.2.8	0xeaad	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:52:51.687922001 CET	1.1.1.1	192.168.2.8	0xeaad	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:52:51.687922001 CET	1.1.1.1	192.168.2.8	0xeaad	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:52:52.282478094 CET	1.1.1.1	192.168.2.8	0xaa20	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:52:52.282478094 CET	1.1.1.1	192.168.2.8	0xaa20	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:52:52.282478094 CET	1.1.1.1	192.168.2.8	0xaa20	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:52:52.282478094 CET	1.1.1.1	192.168.2.8	0xaa20	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:52:52.282478094 CET	1.1.1.1	192.168.2.8	0xaa20	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:52:52.282478094 CET	1.1.1.1	192.168.2.8	0xaa20	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:52:52.282478094 CET	1.1.1.1	192.168.2.8	0xaa20	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 16:52:59.499361038 CET	1.1.1.1	192.168.2.8	0x6ac5	No error (0)	mail.alhoneycomb.com		74.119.238.7	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	193.122.130.0	80	2140	C:\Users\user\Desktop\Tepe - 20000000826476479.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 16:52:51.700485945 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 9, 2025 16:52:52.154489994 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 15:52:52 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: d1f2a3c00931b329e782433c19b16746 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 9, 2025 16:52:52.158382893 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 9, 2025 16:52:52.272420883 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 15:52:52 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 760ec1997f798e71fef16bad3a1e6bf7 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 9, 2025 16:52:58.941150904 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 9, 2025 16:52:59.050964117 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 15:52:59 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: fc33341f130d5278127740a4a802b750 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	104.21.16.1	443	2140	C:\Users\user\Desktop\Tepe - 20000000826476479.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 15:52:53 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-09 15:52:53 UTC	859	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 15:52:53 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1752762 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NCR0pg7ksP8NtHO5J8UsNkO%2B62P8ur3gCGEFsnmLeqf6sIa%2BNVobD%2BgthHdhBUxon89Nt2ST1Fa3Hanrkq8%2BBVpno1zooofcMotVwTrhvBsuzJg8bAK%2Fg4aPQsom7rMpJVrHf24x"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff598d46dd841ba-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1667&min_rtt=1658&rtt_var=641&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1682997&cwnd=192&unsent_bytes=0&cid=3119ba30565aaea0&ts=504&x=0"
2025-01-09 15:52:53 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jan 9, 2025 16:53:00.198538065 CET	587	49706	74.119.238.7	192.168.2.8	220-md-la-5.webhostbox.net ESMTP Exim 4.96.2 #2 Thu, 09 Jan 2025 21:23:00 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 9, 2025 16:53:00.198945045 CET	49706	587	192.168.2.8	74.119.238.7	EHLO 965969
Jan 9, 2025 16:53:00.346800089 CET	587	49706	74.119.238.7	192.168.2.8	250-md-la-5.webhostbox.net Hello 965969 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 9, 2025 16:53:00.347065926 CET	49706	587	192.168.2.8	74.119.238.7	STARTTLS
Jan 9, 2025 16:53:00.510873079 CET	587	49706	74.119.238.7	192.168.2.8	220 TLS go ahead

Target ID:	0
Start time:	10:52:50
Start date:	09/01/2025
Path:	C:\Users\user\Desktop\Tepe - 20000000826476479.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Tepe - 20000000826476479.exe"
Imagebase:	0x160000
File size:	93'696 bytes
MD5 hash:	C761A94A20BA72D4E4CCF8FDFBC559EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000000.00000000.1446835652.0000000000162000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.1446835652.0000000000162000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000000.1446835652.0000000000162000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000000.1446835652.0000000000162000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2702555161.0000000002614000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.2702555161.0000000002614000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	14.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	69.6%
Total number of Nodes:	56
Total number of Limit Nodes:	4

Executed Functions

Function 023A7E68 Relevance: 4.3, Strings: 1, Instructions: 3069COMMON

Download Yara Rule

Strings

N, xrefs: 023AB248

Memory Dump Source

Source File: 00000000.00000002.2702498723.00000000023A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-1130791706
Opcode ID: f24d816bdad6448ef1d379d11b834e01dd55eabb97fc4018ef783fe9c6a5e2b7
Instruction ID: c770c419c4aef7e057cf87cab2020bc3ccb6eab704a33db47f52eedf383efaea
Opcode Fuzzy Hash: f24d816bdad6448ef1d379d11b834e01dd55eabb97fc4018ef783fe9c6a5e2b7
Instruction Fuzzy Hash: A873D631D1075A8EDB11EF68C954A99FBB1FF99300F11C69AE44977221EB70AAC4CF81

Function 023ACAB0 Relevance: 3.5, Strings: 1, Instructions: 2230COMMON

Download Yara Rule

Strings

K, xrefs: 023AF12B

Memory Dump Source

Source File: 00000000.00000002.2702498723.00000000023A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: 10932c6bc11d86005fc885d0bdd5b42602928742d271755507c0c23d009b9e8b
Instruction ID: 931712c5b9ad2123d9c7deab9eecf05097b060b835a6c93ca28ea1298038d0f2
Opcode Fuzzy Hash: 10932c6bc11d86005fc885d0bdd5b42602928742d271755507c0c23d009b9e8b
Instruction Fuzzy Hash: 0233C571C146198EDB21EF68C954A9DFBB1FF99300F10D69AE44877261EB70AAC4CF81

Function 023AC168 Relevance: 2.0, APIs: 1, Instructions: 501
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2702498723.00000000023A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 437a93202df8acac6036bedd4465ad8c5d656dffab571f624bd0383970f3c422
Instruction ID: dae419b56188423ccbdcbf24d57377a4945b53880fa0737f4bce74d789edded3
Opcode Fuzzy Hash: 437a93202df8acac6036bedd4465ad8c5d656dffab571f624bd0383970f3c422
Instruction Fuzzy Hash: C4222874E002188FDB24DFA8C894B9DBBB2FF88304F5095AAD409AB355DB359D85CF90

Function 023ACAA2 Relevance: 1.5, Strings: 1, Instructions: 234COMMON

Download Yara Rule

Strings

K, xrefs: 023AF12B

Memory Dump Source

Source File: 00000000.00000002.2702498723.00000000023A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: 6f9187ad0230eedfa4aca3f93c706e080824efd82c715c695dacbda738feae1e
Instruction ID: 2d04709028f0715891929448ecc66199aeaa4eb6886c4fc0f93dcd578b5bc75a
Opcode Fuzzy Hash: 6f9187ad0230eedfa4aca3f93c706e080824efd82c715c695dacbda738feae1e
Instruction Fuzzy Hash: 0DB1F571D056198BDB14DF69C89879DFBB1FF99300F10D2AAD4087B260EB74AA85CF80

Function 049D6998 Relevance: 1.0, Instructions: 987COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3b87ada07fcf923f40208f80fdf25611bfe4826b8c0abcf2a560e231fa64009
Instruction ID: 2029e04c5e587f9d9f5a756e45414b88758d96f190cd17fb98672374590804fd
Opcode Fuzzy Hash: a3b87ada07fcf923f40208f80fdf25611bfe4826b8c0abcf2a560e231fa64009
Instruction Fuzzy Hash: D0824F70A002199FDB14DFA9D844AAEBBB6FF89300F15C5A9E905EB361DB34ED41CB50

Function 049D7770 Relevance: .9, Instructions: 916COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a272365c7f2c73a65da0faefc2478b399ac918608f823e85d25adec9418f7e98
Instruction ID: 41747d896a9869ce51a4a8c4b7a235356199f9938081bf93b7ed31b85b9bac69
Opcode Fuzzy Hash: a272365c7f2c73a65da0faefc2478b399ac918608f823e85d25adec9418f7e98
Instruction Fuzzy Hash: DE823A30A006099FCB14DFA8C984AAEBBF6FF88314F15C9A9E515AB261D734FD41CB51

Function 049D4500 Relevance: .7, Instructions: 745
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eea3718b9ee7284b4983068e307113d43b4b75cecf3a782bafd2f94ed7a2a0a7
Instruction ID: 511b610924f3ece69b8288373aa10e2955ff25556814c5fb401c67dafc2ee0a6
Opcode Fuzzy Hash: eea3718b9ee7284b4983068e307113d43b4b75cecf3a782bafd2f94ed7a2a0a7
Instruction Fuzzy Hash: 08827D74E012288FDB64DF69D998BDDBBB2BB89300F1081EAD40DA7261DB745E85CF44

Function 023A27B9 Relevance: .7, Instructions: 693
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2702498723.00000000023A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55703b45456b1fcb66e7f2f8b6417ead481e8a2de8936d0188570eb244fe3c39
Instruction ID: e9937244bf50f425ed9f9d74c5ae5b6a47add4aa8834b0f44ac1d985e11a6fbe
Opcode Fuzzy Hash: 55703b45456b1fcb66e7f2f8b6417ead481e8a2de8936d0188570eb244fe3c39
Instruction Fuzzy Hash: 8542CE22A9D2DA8ADB270F3814B43E1FFB39D6B1443DD04DAD8C54E14BDA5428CBD71A

Function 049D15F8 Relevance: .3, Instructions: 296
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 430e61f5f315038713e17b8eb01fc8bccdbb4edc3a4c3c2973ba1181fb22a961
Instruction ID: d21b533a539758d1a6ae33bbf264ace12950980e1f7fe0cdd79639e99c9f8e18
Opcode Fuzzy Hash: 430e61f5f315038713e17b8eb01fc8bccdbb4edc3a4c3c2973ba1181fb22a961
Instruction Fuzzy Hash: 27E1B274E01218CFEB64DFA9D854B9DBBB2BF89304F2081A9D409BB394DB755A85CF10

Function 023A4F08 Relevance: .3, Instructions: 268
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2702498723.00000000023A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f0b4084a2eab827b3edb5b27dd337ad386d27ba60750beed0e0f598e21b11d6
Instruction ID: 40dab7fc01521a7302bd9a15f67ecc66ce38c6010c179c27b5a8dde5cfac23cb
Opcode Fuzzy Hash: 5f0b4084a2eab827b3edb5b27dd337ad386d27ba60750beed0e0f598e21b11d6
Instruction Fuzzy Hash: 56C19F74E00318CFDB54DFA9D954BADBBB2FB89300F2081A9D809AB354DB759A81CF10

Function 023A5366 Relevance: .2, Instructions: 221
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2702498723.00000000023A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e59947ffc5b19da597d0e4480420494719b799c1b607542c0ff28d31689a781
Instruction ID: 551c9c363e042fcc257bcaa6885e834365686ef6067ae6c3330469df86928efc
Opcode Fuzzy Hash: 6e59947ffc5b19da597d0e4480420494719b799c1b607542c0ff28d31689a781
Instruction Fuzzy Hash: 5DA1F470D00208CFEB24DFA9D958B9DBBB1FF89305F208269E409B7291DB749985CF55

Function 023A56AF Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2702498723.00000000023A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e05477566703f59356960800621c9c51cbad4a6d415eda564ff03694626edc52
Instruction ID: ddd78f3c5cdad4ac36e55de011887dc21bbc7f93dbfeabe417766c5d3027d366
Opcode Fuzzy Hash: e05477566703f59356960800621c9c51cbad4a6d415eda564ff03694626edc52
Instruction Fuzzy Hash: 4391D070D00208CFDB24DFA8D558BACBBB5FF49305F209269E409BB2A1DB759984CF54

Function 049D1C58 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f049caba29754bc61cb1333ee79027992b507a258b27339a665d7e824b22038e
Instruction ID: 12f1c6ba5f4d3544a214734e03612fcd259c2adc57e8faa34bdbfe7c90fb4eb5
Opcode Fuzzy Hash: f049caba29754bc61cb1333ee79027992b507a258b27339a665d7e824b22038e
Instruction Fuzzy Hash: FB81CF75E00218CFDB58DFAAD9547ADBBF2BF89300F20806AD419AB354DB345945CF50

Function 049D15EA Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7b9a30817fff8ea91d2cd10fcad3c49e6d2b307b5c15185f2587a5fd0778166
Instruction ID: 683686de2edf2f695c04f8c8f720aa33d4af9ad5162fe17c6b2816f0d337236a
Opcode Fuzzy Hash: a7b9a30817fff8ea91d2cd10fcad3c49e6d2b307b5c15185f2587a5fd0778166
Instruction Fuzzy Hash: EC41B271D002088BEB18DFAAD8547DDBBF2BF88300F64C169C418BB294DB755946CF64

Function 023A4EF8 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2702498723.00000000023A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5fd9d977ceee29ee4573e4de9ec17465f00d5f9baaec774246a45ff322e4d3f
Instruction ID: 6dbcc8a65bda2b21c27a07d7a8e5e6d2e44a8e244f3e74adb1d3fcc845d07d3e
Opcode Fuzzy Hash: e5fd9d977ceee29ee4573e4de9ec17465f00d5f9baaec774246a45ff322e4d3f
Instruction Fuzzy Hash: 4E41D170D00248CBEB18CFAAD5546ADBBF2FF88301F24D13AD415AB268DB785946CF54

Function 023AC386 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2702498723.00000000023A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 108b57cf950e66d7061cf04d1292af4a6032042e3db93f7e495977ec3ad097ef
Instruction ID: 7dd0426ca6eb57705a8a55e65e07d3ced833632d5c09e95197748f95213118d5
Opcode Fuzzy Hash: 108b57cf950e66d7061cf04d1292af4a6032042e3db93f7e495977ec3ad097ef
Instruction Fuzzy Hash: 5E31F5B1D016189BEB18CFAAD8887DDFBF6FF88314F14D16AD418A72A4DB7409458F10

Function 023AC76C Relevance: 1.6, APIs: 1, Instructions: 62
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 023AC8AE

Memory Dump Source

Source File: 00000000.00000002.2702498723.00000000023A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a0000_Tepe - 20000000826476479.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e8dc66175ff147823da92ebc72fa7672fb24e0ab7fca058b8755d19847873a2b
Instruction ID: 80d2145eb846d45bae91a32a0734182cd72e831ca8ca3744af7a0d719d18e1e4
Opcode Fuzzy Hash: e8dc66175ff147823da92ebc72fa7672fb24e0ab7fca058b8755d19847873a2b
Instruction Fuzzy Hash: E8118B74E002089FDB18DFA8D494BADBBB9FB88305F24957AE844E7246D770ED41CB60

Function 049D8848 Relevance: .8, Instructions: 818
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 600422157b4177078c13f7448835632e74c0bd132630d31686bc0ffb1b9a39d6
Instruction ID: eeb0620f84838ddc0c6084450419ab547dba2a711a79ff9f4e3b67ac65cbfc60
Opcode Fuzzy Hash: 600422157b4177078c13f7448835632e74c0bd132630d31686bc0ffb1b9a39d6
Instruction Fuzzy Hash: 7B722274A00318CFFB249BA4C854BAEBBB6FF88300F1081A9D50A6B395DF359D859F55

Function 049D65F1 Relevance: .2, Instructions: 222
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3774178ed3d45347a472867540da367378875d41f20fdac802becd3ca8d1489c
Instruction ID: 86557bdd4f9dba091f499584d48680417dc469f30a5a504f08e04a452774c0c7
Opcode Fuzzy Hash: 3774178ed3d45347a472867540da367378875d41f20fdac802becd3ca8d1489c
Instruction Fuzzy Hash: 51817B74B006098FDB14CFA8C884A6AB7B6BF89304B65C579D816EB365DB31FC41CB91

Function 049D62A8 Relevance: .2, Instructions: 220
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb3196acce7371529997e4fed76517738fada6a828bc12cb2134f7faccb4f97a
Instruction ID: 25ee168a06be5e195b9df7c8e1b0d7b614c1fbb39804f0034543a41864151a21
Opcode Fuzzy Hash: eb3196acce7371529997e4fed76517738fada6a828bc12cb2134f7faccb4f97a
Instruction Fuzzy Hash: C07190347042118FDB19AF79D46863EBBA6EBC9240B188479E506CB395DF79EC42CB90

Function 049D2508 Relevance: .2, Instructions: 212
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0ef4ea4360655e0efe41d01fc04f0f0d748abec44399d41e880be549fb7a0ad
Instruction ID: 4428ba33f748dce17389fc2ad3743940fc89bbb0ba56e054faa74b272c006b8e
Opcode Fuzzy Hash: d0ef4ea4360655e0efe41d01fc04f0f0d748abec44399d41e880be549fb7a0ad
Instruction Fuzzy Hash: AB719E31F003199BEB15DFA4C850BAE7BB6AFC9700F14856AE405BB380DF35AD468B95

Function 049D84F8 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aba1aecca2248791e10754a131838ec4158eef3d991ea8a613bae7a8faa04059
Instruction ID: eef229e126d3aa5a934b91819bcae4a47ece083f79650c317b69717305c1b5bb
Opcode Fuzzy Hash: aba1aecca2248791e10754a131838ec4158eef3d991ea8a613bae7a8faa04059
Instruction Fuzzy Hash: 6A5181357141118FD714EF39DC9896A7BEAFF8926074588BAE426CB263EB21EC01CB50

Function 049D6130 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b49333d14000fee52907340e109050a3855e8bcd0efaa8df980a93e12b126c82
Instruction ID: 3079278fab697594c0bc6f7c361fefb3fb5b92c2a1cb795f225510aa0949d60b
Opcode Fuzzy Hash: b49333d14000fee52907340e109050a3855e8bcd0efaa8df980a93e12b126c82
Instruction Fuzzy Hash: E651DC753082159FDB158F64D854BAA7BEAFF89304F08897AE945CB281DB78EC01CB90

Function 049D44F0 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d83df1b50c47b461a2157e3806f399d09ad39748b120fc450da8e8247583f576
Instruction ID: d2d76cf71986e2e8e64d16234fdfb858cb87bcb6d2f0d2418f43bdee929fa581
Opcode Fuzzy Hash: d83df1b50c47b461a2157e3806f399d09ad39748b120fc450da8e8247583f576
Instruction Fuzzy Hash: 0181B174E412289FDB64DF69D894BEDBBB2BB89300F1080EAD809A7350DB755E81CF44

Function 049D5F08 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b92134576a086f146a89e406872fd68d4e297738e9cc292f9147b04c3be880e4
Instruction ID: e7f153129d4353058fa151e83affb0e5326d844c9de91dd070d0c7d50ab8e33d
Opcode Fuzzy Hash: b92134576a086f146a89e406872fd68d4e297738e9cc292f9147b04c3be880e4
Instruction Fuzzy Hash: 5F4102343007018FD7289B7EE414B6A7BE6AFC5610F158579E506CB7A1EF64EC068B81

Function 049D24F8 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e28f8656e986d8801d6e0074b2d2751d6cb836f9bf71ea53e04fec0c0d8a9968
Instruction ID: cd63cf7ea90ad9202dd9eae97b7425cc45a63c0cdca79cf3ede147efecb062b8
Opcode Fuzzy Hash: e28f8656e986d8801d6e0074b2d2751d6cb836f9bf71ea53e04fec0c0d8a9968
Instruction Fuzzy Hash: ED413071E00319DBDB14DFA5C890AEEBBF5AF88700F65C16AE411B7244EB71AD46CB90

Function 049D82F8 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4633e4bb4705c67936f8386d5c53292236126ec5cfde5fad26bcff82a0a0f12c
Instruction ID: f131df687c420b8df4798133f0e84463742cf5bb28defe3c9884e7f3dcf95c88
Opcode Fuzzy Hash: 4633e4bb4705c67936f8386d5c53292236126ec5cfde5fad26bcff82a0a0f12c
Instruction Fuzzy Hash: 6B4148746042159FCB14EF68D888AAE7BB6FF48310F104465F915CB3A2DB71ED41DB90

Function 049D5858 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78f057f62cff10e0187327c5a10edf31e7d308a90fa01856156ad77ed29328f1
Instruction ID: c37ba8df2f55aeca9677918c93889069c4257b4910172a676b2d8bdc042b69f1
Opcode Fuzzy Hash: 78f057f62cff10e0187327c5a10edf31e7d308a90fa01856156ad77ed29328f1
Instruction Fuzzy Hash: 2E41DF30608249EFDB019F64D855ABE7BA6EB48320F148439F90597255DB39DE21CF90

Function 049D8729 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6690dec5fce693f50cd1030c932f95ed67e53452fc31e54df279b25bf804ddd
Instruction ID: 1eb498598a1764e6540d1c12144e66fdfc5ef2e861783cf0c4828a835e48bfb4
Opcode Fuzzy Hash: f6690dec5fce693f50cd1030c932f95ed67e53452fc31e54df279b25bf804ddd
Instruction Fuzzy Hash: 9A2183347042408BEB25FA36D4A477E769BEFC4754F24C07AD522CB396EA79DC829381

Function 049D8640 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2782bc5710c4f8098bc776ab8acaf2d6a636529a5d23a4a503a1bc80a3dafc25
Instruction ID: c3e9efba4c36fb924a0d03914e07d887b72476fb412b2f2adc257194d3cb1206
Opcode Fuzzy Hash: 2782bc5710c4f8098bc776ab8acaf2d6a636529a5d23a4a503a1bc80a3dafc25
Instruction Fuzzy Hash: 8F21B7317081558BCB14EF66DC40A7B7BEAEB85320B44C836E421CB296EB70E841DB60

Function 0085D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2702052565.000000000085D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0085D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85d000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0877e34ae6ce6c667b2a9d0bca2f5f976735d3ca3fd07c03491573c0a6cf734b
Instruction ID: 768d9ee60c3579486152d9d785f5daed7a182f489ec2e76c645e7375c4a74d7f
Opcode Fuzzy Hash: 0877e34ae6ce6c667b2a9d0bca2f5f976735d3ca3fd07c03491573c0a6cf734b
Instruction Fuzzy Hash: 6E21F571504744DFDB24DF14D980B26BBA5FB84319F24C5A9DC098B296C33AD84BCA62

Function 049D26E9 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26c0723157078547dd38f00533345bd4b32c1b7ad70f09645b258337f103f328
Instruction ID: b101c496631b0d67412ffdf8db6d701f98eb8c940425516716459ae66d44c35c
Opcode Fuzzy Hash: 26c0723157078547dd38f00533345bd4b32c1b7ad70f09645b258337f103f328
Instruction Fuzzy Hash: 3411E6327083449FEB069FB8982437E3FA3DBC5250B10446AE505D7392DF358E568796

Function 0085D005 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2702052565.000000000085D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0085D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_85d000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cecdc68d5eb61bbb3c62c92fda8828dfeb9398bf378f841755e672014aadd7a
Instruction ID: e9479142bb48ef0cc5986c9e991a1a17be5644cc4aa3ac3a51bbd95f9276288f
Opcode Fuzzy Hash: 2cecdc68d5eb61bbb3c62c92fda8828dfeb9398bf378f841755e672014aadd7a
Instruction Fuzzy Hash: DA215A755097C09FCB17CB20C990715BF71BB46214F28C5EADC898B6A3C33A980ACB62

Function 049D2270 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fffc671e42e4dbf6772e592617420ae1a9d3f88c46247780f96e7f1841888d14
Instruction ID: 2b14fa78be23b36813cb940055a6a100784a3cf5168b109bbd08c073599ff389
Opcode Fuzzy Hash: fffc671e42e4dbf6772e592617420ae1a9d3f88c46247780f96e7f1841888d14
Instruction Fuzzy Hash: 9F116472800349DFDB20CF9AD804BEEBBF5EB48320F148469E958A7251C379A950DFA5

Function 049D1EB9 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73d9a82403a071b782d754e65f8d7d6375c328eeae6c44a5336a360441014e84
Instruction ID: faa21770195d01296d8448afb24a9c7d8082687c75c0c92e869122355c018dc1
Opcode Fuzzy Hash: 73d9a82403a071b782d754e65f8d7d6375c328eeae6c44a5336a360441014e84
Instruction Fuzzy Hash: 54112A75F402488FDB14DFB8E855BAEBFB6EB49311F00C065E858AB349EB74AD418B50

Function 049D2990 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f193c47332f01ee6bc4af1ab9d948a6d42fa49d1f187ced6f2e3da9d031c5e7
Instruction ID: e16e83b0fe72576c307a969127b6fa1e723765544e4a0166c758d7899ea8e22f
Opcode Fuzzy Hash: 1f193c47332f01ee6bc4af1ab9d948a6d42fa49d1f187ced6f2e3da9d031c5e7
Instruction Fuzzy Hash: 6C1164B6800349DFDB20CF99D844BDEBBF4EF48320F14845AE558A7250C339A654DFA1

Function 049D5EF8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f681eaa0736358a1a27f55ef034745587f530057bb28eb5f7960550790d3dca
Instruction ID: a666b759a3040ade76693604c333d8948feba00b2a2ee6fe5031ab82cbe25b1e
Opcode Fuzzy Hash: 3f681eaa0736358a1a27f55ef034745587f530057bb28eb5f7960550790d3dca
Instruction Fuzzy Hash: B211A034200B059FD7299B7DD450BAEB7A6AFC4664F058A79D0568B261EB70F8088B86

Function 049D60B0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0163650177282c32da1b8a7776f9f6cb99d37614fc2316806bd3c0d4ab7bbc8d
Instruction ID: 3a79e53a432965bfe579fcab3fe9e8e8072797e2559efd8eddc127c1728d008c
Opcode Fuzzy Hash: 0163650177282c32da1b8a7776f9f6cb99d37614fc2316806bd3c0d4ab7bbc8d
Instruction Fuzzy Hash: 1D01D132704118AB9B059E59D801AAF3BEBDBC8790F18803AFA05D7281DE75ED119B94

Function 049D60A0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2871ec6a442fe9233aa28bf313eef830fe76f894b86220c6ac058c7df08d7347
Instruction ID: 89f0c9ae7a68ddb7e8956e5f5b600f9d7e6d523d86de2995888e69ca1342e2f6
Opcode Fuzzy Hash: 2871ec6a442fe9233aa28bf313eef830fe76f894b86220c6ac058c7df08d7347
Instruction Fuzzy Hash: 7A01D6B7A08248AFDB028E55DC11ADF7FAADB88350F18803AF505C7142E6369D169B61

Function 049D947D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ed291dd7aa6762df0d511dff2f0510142d552a872bcddb964aa1d4a10f73249
Instruction ID: 5afb32047efd7d1a7b796a279edfcf8a8361853f945c2343eec525d7db2204db
Opcode Fuzzy Hash: 2ed291dd7aa6762df0d511dff2f0510142d552a872bcddb964aa1d4a10f73249
Instruction Fuzzy Hash: 47D0177BB00008EFCB008F88E8409DDF776FB88221B008026E911E3220C6319865CF50

Function 049D68A1 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c5ccfcfaf271d9f6a39c0674f6460460865718adad65fd8b39ef3bdb21c8588
Instruction ID: 59cdb49f0aed9dcb1e874f5034a577e827e84ac9cf52721b0bcc97b0f8565171
Opcode Fuzzy Hash: 7c5ccfcfaf271d9f6a39c0674f6460460865718adad65fd8b39ef3bdb21c8588
Instruction Fuzzy Hash: 96D02E304043484BEA81FBBCF985694B3B2BBC0204F28862482050A18FEF7831688E8A

Function 049D68B0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07b89a4dad57894daf99c255a595e418683db53e55ea7ddc621c4776cb9d8176
Instruction ID: 5d72d26f83615cf2096f755ede05c846d81303ba8dbe117d635850412a3b546b
Opcode Fuzzy Hash: 07b89a4dad57894daf99c255a595e418683db53e55ea7ddc621c4776cb9d8176
Instruction Fuzzy Hash: 5FC0123001430C4BD581F7B9F949595335ABAC4500754D531A5051924FEF7C29454B95

Non-executed Functions

Function 023AB9E0 Relevance: 1.6, Strings: 1, Instructions: 367COMMON

Download Yara Rule

Strings

", xrefs: 023ABEFE

Memory Dump Source

Source File: 00000000.00000002.2702498723.00000000023A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: f217fd70c0fffbd65108c291eb940550404e23931b284d9ee4793525a84f6c0e
Instruction ID: 613bef611cf1830d3a7432b0f4cc61bbc5a2b7b5bb687a36fa6b214f59581438
Opcode Fuzzy Hash: f217fd70c0fffbd65108c291eb940550404e23931b284d9ee4793525a84f6c0e
Instruction Fuzzy Hash: 9AF1F270E002588FEB24CFA9D49479DFFB2EF98318F24C169E448AB295D7749985CF50

Function 023A2DD1 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2702498723.00000000023A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d5dc209349cceb850bbc71b0297d07db603f440567e81e75c4887d219c04c56
Instruction ID: d6c65ac5dc739c554f1fd0ba6fe5daf393f17a7faef8108a697bf7715e332ebf
Opcode Fuzzy Hash: 0d5dc209349cceb850bbc71b0297d07db603f440567e81e75c4887d219c04c56
Instruction Fuzzy Hash: EC91A430F04218DBEB08EB74986567EB7B7BFC9700B19896ED507E7284DE758802CB95

Function 049D0498 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a40ceaf638784e6026607693b7a58a1a06bd71630805e84945e419b5a61a01f9
Instruction ID: a529aa6801f30b10921c86c9b96e79be3f026f7cc2a4012cef7d1d92c1f2aec2
Opcode Fuzzy Hash: a40ceaf638784e6026607693b7a58a1a06bd71630805e84945e419b5a61a01f9
Instruction Fuzzy Hash: 90C1C174E00218CFDB54DFA9D954B9DBBB2BF89300F2081A9D809AB365DB755E81CF50

Function 049DBC80 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72022fb1c5b1350d3768b5e6284b35231c18a2126adff71850110430c9a10a77
Instruction ID: c7c39078bd524791edc34f4dad8fc0aa91fb804f4d6a2229a52422ac73274296
Opcode Fuzzy Hash: 72022fb1c5b1350d3768b5e6284b35231c18a2126adff71850110430c9a10a77
Instruction Fuzzy Hash: EBC1C274E00218CFDB54DFA9D954BADBBB2BF89300F6081A9D409AB364DB756E81CF50

Function 049D40A8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48f7a4503b7a8833834c08a379ce3552722b408c2dc4b99d90974d4bb3cb42cc
Instruction ID: da58611f15cde8eb6a1a2b36baf93bb647ab5a489350038bbd8bcdbdef8d4b90
Opcode Fuzzy Hash: 48f7a4503b7a8833834c08a379ce3552722b408c2dc4b99d90974d4bb3cb42cc
Instruction Fuzzy Hash: B3C1B174E00218CFDB54DFA9D954BADBBB2BF89300F6081A9D409AB365DB756E81CF10

Function 049DC0D8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbefeade73ceb0d20fcb654e9fb933e07378680030320237121370889ca2d8fe
Instruction ID: b8bc49202fb4c248279b1a2371c074c28a64a026f7e01f481fc0c8829d208828
Opcode Fuzzy Hash: bbefeade73ceb0d20fcb654e9fb933e07378680030320237121370889ca2d8fe
Instruction Fuzzy Hash: 30C1B274E00218CFDB54DFA9D954BADBBB2BF89300F6081A9D409AB364DB755E81CF50

Function 049DE4D0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fd597b1a9a0cd513f088462ba0c54c6f3de1b1b956b724d9c8a4e1fe84041ef
Instruction ID: 0b48ccf3411a7a5d76b80e25deb26bd03ce3047feb00d1e9a3d8afd3cf16f750
Opcode Fuzzy Hash: 0fd597b1a9a0cd513f088462ba0c54c6f3de1b1b956b724d9c8a4e1fe84041ef
Instruction Fuzzy Hash: 2CC1B174E00218CFDB54DFA9D994B9DBBB2BF89300F6081A9D409AB364DB759E81CF50

Function 049D08F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c23cd517d1a608d3722320860e81d893615b79db444c48d34a97388ea795394
Instruction ID: 7440a428dc221f21cade7afe3aef34e64c51935c7ae5e3985bf2719be0d4a559
Opcode Fuzzy Hash: 3c23cd517d1a608d3722320860e81d893615b79db444c48d34a97388ea795394
Instruction Fuzzy Hash: A7C1B074E01218CFDB54DFA9D954BADBBB2BF89304F2081A9D809AB364DB755E81CF10

Function 049DB828 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1470a37d19d53e78f8587e2c0f98ad1ae4f1aef67def740aec9e27c8972d03ac
Instruction ID: 56a2ba6f4f95b8a6ddd3f12c200b55c903ccb2cf1b371047712df14182849f50
Opcode Fuzzy Hash: 1470a37d19d53e78f8587e2c0f98ad1ae4f1aef67def740aec9e27c8972d03ac
Instruction Fuzzy Hash: 9FC1C274E00218CFDB54DFA9D954BADBBB2BF89300F6081A9D409AB365DB756E81CF10

Function 049DDC20 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73e675a97567788b37b32d3c458db6878b5518a30d6467920cf0f3d8c12a53ec
Instruction ID: 21f7467ec88f3dff6f2ce9c2e83e8847d31724c39f320b9f63b64eaf6f13330d
Opcode Fuzzy Hash: 73e675a97567788b37b32d3c458db6878b5518a30d6467920cf0f3d8c12a53ec
Instruction Fuzzy Hash: F3C1C174E00218CFDB54DFA9D954BADBBB2BF89300F6081A9D409AB364DB756E81CF50

Function 049D3C50 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 590deb8cc2fa8f0f6e092ff8dd216d51f5a4c8adf09276ec9ad25d2257225f21
Instruction ID: 7b961309cffef1cebf85fa9e6abb4599668d608005c96cc95364388e1b16de57
Opcode Fuzzy Hash: 590deb8cc2fa8f0f6e092ff8dd216d51f5a4c8adf09276ec9ad25d2257225f21
Instruction Fuzzy Hash: C9C1C274E00218CFDB54DFA9D954B9DBBB2BF89300F5081A9D809AB365DB755E81CF10

Function 049D0040 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40ccc0d02c859bf561ae89c2666d5a2251e08708fb80c4605d804cf327798f34
Instruction ID: 347340f3730dc9066de08d85d3bec6f5a5b3555ebfce1b82c40a671dcb1d7f76
Opcode Fuzzy Hash: 40ccc0d02c859bf561ae89c2666d5a2251e08708fb80c4605d804cf327798f34
Instruction Fuzzy Hash: BFC1D174E00218CFDB54DFA9D954B9DBBB2BF89300F2080A9D809AB365DB755E81CF10

Function 049DE078 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a603393349d313b87a01912d39c8ddcdddffa341e1b0b6528075ec176882384
Instruction ID: 2bdc6cc445d4dde18e890359f1e96ff44bc674bcfd50d928062dd25defc3a1fc
Opcode Fuzzy Hash: 9a603393349d313b87a01912d39c8ddcdddffa341e1b0b6528075ec176882384
Instruction Fuzzy Hash: 0BC1C374E00218CFDB54DFA9D954BADBBB2BF89300F6081A9D409AB364DB755E81CF10

Function 049DC988 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c265f4a326684e2715efb86d08594c90d451af6c056b20df49b583ab8633e18
Instruction ID: a5ef4c8c19f1200f4e2f467ea962819ff391a8d67f00c28e7c0d20096ae07ab2
Opcode Fuzzy Hash: 6c265f4a326684e2715efb86d08594c90d451af6c056b20df49b583ab8633e18
Instruction Fuzzy Hash: 19C1B274E00218CFDB54DFA9D954B9DBBB2BF89300F6081A9D409AB364DB759E81CF50

Function 049DED80 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e54a6dc2798e8ab303195272d395b13da7dff24b340996e80c51d366cc19204b
Instruction ID: 54708a095701775497a020770f1b15e28ebcd4adfb586fa35268cdfcd2c4b40f
Opcode Fuzzy Hash: e54a6dc2798e8ab303195272d395b13da7dff24b340996e80c51d366cc19204b
Instruction Fuzzy Hash: 3BC1B174E00218CFDB54DFA9D954B9DBBB2BF89300F6081A9D409AB3A4DB756E81CF50

Function 049D11A0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8fa3b72f8264f1c8ebc67faff4412c468b07b695bea4c7c00798c58987999fd
Instruction ID: 01c1ffb1a5e1908140f0f639ceec557b229839b773ce5eeac54f760e48ec1304
Opcode Fuzzy Hash: b8fa3b72f8264f1c8ebc67faff4412c468b07b695bea4c7c00798c58987999fd
Instruction Fuzzy Hash: 82C1A174E00218CFDB54DFA9D954BADBBB2BF89300F2081A9D809AB365DB755E81CF10

Function 049DF1D8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1abea97fe117c06b66e817f55a8cf500ef83dd4d542e0c0a51d1f8da7e6c8f5
Instruction ID: 87b64091c016cd2cece48a9e5ec75fac1c3fc4a43e36d6efae7f9d71aea3b194
Opcode Fuzzy Hash: e1abea97fe117c06b66e817f55a8cf500ef83dd4d542e0c0a51d1f8da7e6c8f5
Instruction Fuzzy Hash: 87C1B174E00218CFDB54DFA9D954BADBBB2BF89300F6081A9D409AB364DB759E81CF50

Function 049DCDE0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d7eb65b672d7038c6c286c712d4fc63196279c60e914859c62d3b3e9baaf325
Instruction ID: ed4b5003ad5b624b867f65c0a8009718a6cff3ae17ed98ed5d7e8dd2b0663421
Opcode Fuzzy Hash: 8d7eb65b672d7038c6c286c712d4fc63196279c60e914859c62d3b3e9baaf325
Instruction Fuzzy Hash: AEC1B074E00218CFDB54DFA9D954B9DBBB2BF89300F6081A9D809AB364DB755E81CF50

Function 049DC530 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4440eb430cff60aea3de6c673ddd40d090da76d34bd94ff2d3b16744c891592b
Instruction ID: d14f9ca167a15122243ac8cf6ccbd880f25e698dc947a2b392c3392c2433fb8a
Opcode Fuzzy Hash: 4440eb430cff60aea3de6c673ddd40d090da76d34bd94ff2d3b16744c891592b
Instruction Fuzzy Hash: 36C1A174E00218CFDB54DFA9D954B9DBBB2BF89300F6081A9D409AB364DB756E81CF50

Function 049DE928 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8299c1600ac35146ca8fa8f482ff10c472debd40562547c0a6d2967f5bba56f4
Instruction ID: e60b83abbd9b9461615880d75e20761eebc23e4ae53355e138f914e3fb0baf65
Opcode Fuzzy Hash: 8299c1600ac35146ca8fa8f482ff10c472debd40562547c0a6d2967f5bba56f4
Instruction Fuzzy Hash: C1C1B274E01218CFDB54DFA9D954BADBBB2BF89300F6081A9D409AB364DB756E81CF10

Function 049D0D48 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b66cc4120fb283772b34f43fe53031f04e449d962af3ddd9867b0050357455e
Instruction ID: ee41fef5b7c5c175f3988232958a2f5be59a5af2413a8b5ead49de4542271208
Opcode Fuzzy Hash: 3b66cc4120fb283772b34f43fe53031f04e449d962af3ddd9867b0050357455e
Instruction Fuzzy Hash: FBC1B074E00218CFDB54DFA9D954BADBBB2BF89300F6081A9D809AB365DB755E81CF10

Function 049DD690 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bd1ba7357d606ebd1b127a68cdd3a99f3192900b60da2bcd95c66016b93e4c0
Instruction ID: 4db36b33e4f6f01df7e2f0980773e80f40d1301659f8548c67d5df252548ff77
Opcode Fuzzy Hash: 3bd1ba7357d606ebd1b127a68cdd3a99f3192900b60da2bcd95c66016b93e4c0
Instruction Fuzzy Hash: ADC1B274E00218CFDB54DFA9D954B9DBBB2BF89300F6081A9D809AB364DB756E81CF50

Function 049DFA88 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2076caa061a0cfad5b9da6310fe18d4a10ab14f045ccf75a32edea4cc791e03
Instruction ID: 5e7f9df0c7c371bb2cf0a2710136b298da189309d8ce867c538b254de0712927
Opcode Fuzzy Hash: d2076caa061a0cfad5b9da6310fe18d4a10ab14f045ccf75a32edea4cc791e03
Instruction Fuzzy Hash: 14C1C174E00218CFDB54DFA9D954BADBBB2BF89300F6081A9D409AB365DB755E81CF10

Function 049DA6C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe713f3620a01d857c759e04831cb1dce94715aafad25ca7d62ccb3647f89730
Instruction ID: dc003d595bf4a2b6c42af352f1d0c3fffdcb52c36edb3219d456ec55253fb858
Opcode Fuzzy Hash: fe713f3620a01d857c759e04831cb1dce94715aafad25ca7d62ccb3647f89730
Instruction Fuzzy Hash: C4C1B274E00218CFDB54DFA9D954B9DBBB2BF89300F6081A9D809AB364DB759E81CF50

Function 049D2AF0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcf5b1ebe0c6e5f922969e409e448d93a2238a82689f16320115a2a9b9552978
Instruction ID: 0b38f5820055e58cc834627982678d34d6c40464177d5e9a23504aa02d1d9c0f
Opcode Fuzzy Hash: dcf5b1ebe0c6e5f922969e409e448d93a2238a82689f16320115a2a9b9552978
Instruction Fuzzy Hash: F5C1B174E00218CFDB54DFA9D954BADBBB2BF89300F6081A9D809AB364DB755E81CF10

Function 049D9E18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf4f41f0b484f41093ba3b1d0ad652d5186133b7057d1f26015adae42fefa5f7
Instruction ID: f5eab9c669b639c99270cf82514ac87e60180b49f953d4ed56c6082969992ab0
Opcode Fuzzy Hash: bf4f41f0b484f41093ba3b1d0ad652d5186133b7057d1f26015adae42fefa5f7
Instruction Fuzzy Hash: 3EC1B274E00218CFDB54DFA9D954B9DBBB2BF89300F6081A9D409AB364DB75AE81CF50

Function 049DD238 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a04f2829eb19508f90fdac10c4376e4da32d5a515a3bfb90db8598244ce26edd
Instruction ID: 8c31dd09b77bb7b0f8863a2b00c957dea352c8fa52491c5ea91eafef9ec99de4
Opcode Fuzzy Hash: a04f2829eb19508f90fdac10c4376e4da32d5a515a3bfb90db8598244ce26edd
Instruction Fuzzy Hash: 6CC1B174E00218CFDB54DFA9D954B9DBBB2BF89300F6081A9D409AB3A4DB756E81CF50

Function 049DF630 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98db7dfa21b713f265f1be28e40cd464373873559705e33cda56baa5c0deb125
Instruction ID: c72344efe55b9f767c63b38cd78469035ec890b25b364061145ba7981bf3a22e
Opcode Fuzzy Hash: 98db7dfa21b713f265f1be28e40cd464373873559705e33cda56baa5c0deb125
Instruction Fuzzy Hash: C6C1A074E00218CFDB54DFA9D954B9DBBB2BF89300F6081A9D409AB364DB75AE81CF10

Function 049DA270 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ad13d9a90b2757bfd287fccfab691720d71c926d54633b59a10dd68941902e4
Instruction ID: 622e71bec9710bf43f287424d43601b77ad4149bef0c21cb0c8222ae0f3fdce6
Opcode Fuzzy Hash: 3ad13d9a90b2757bfd287fccfab691720d71c926d54633b59a10dd68941902e4
Instruction Fuzzy Hash: 62C1A174E00218CFDB54DFA9D954BADBBB2BF89300F6081A9D409AB364DB755E81CF50

Function 049D33A0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c767fc971fc2b53bce6a0c60675b195c2adddf0217ec410bc04756b47d00e18
Instruction ID: eec150e33aeb26d52051a20ca81577068c36af10ad4d70df59c9bc0617058388
Opcode Fuzzy Hash: 9c767fc971fc2b53bce6a0c60675b195c2adddf0217ec410bc04756b47d00e18
Instruction Fuzzy Hash: 12C1A374E00218CFDB64DFA9D954B9DBBB2BF89300F6081A9D809AB364DB755E81CF50

Function 049DB3D0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d64b27644bd58f65810e3a912738ff165db47f373d0b5ed17c28a5437766a328
Instruction ID: f879351f581aba9f88cb524265983d1c66b16840d95230efd22ef4fc05536fb5
Opcode Fuzzy Hash: d64b27644bd58f65810e3a912738ff165db47f373d0b5ed17c28a5437766a328
Instruction Fuzzy Hash: 98C1B074E00218CFDB54DFA9D954B9DBBB2BF89300F6081A9D409AB364DB75AE81CF50

Function 049D37F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f19bc4d95e5ce5a222ca868381483153b30af509d5f6c315c44e7428e2a5756c
Instruction ID: ca6ad07cf64c3ae457e5a35c98c9e3254180f189ea86d656b8333cec076bc69d
Opcode Fuzzy Hash: f19bc4d95e5ce5a222ca868381483153b30af509d5f6c315c44e7428e2a5756c
Instruction Fuzzy Hash: 1DC1A274E00218CFDB64DFA9D954BADBBB2BF89300F5081A9D809AB365DB755E81CF10

Function 049DAB20 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a2ee38f48c6ebb9cc15019447d9663aa5872b7a42daa2b05779f77a1832fd8a
Instruction ID: 5d945796c58ff39e3aecd2be8580dbad240547647b6d3f1453f49cfb3cfcdab5
Opcode Fuzzy Hash: 0a2ee38f48c6ebb9cc15019447d9663aa5872b7a42daa2b05779f77a1832fd8a
Instruction Fuzzy Hash: 73C1B174E00218CFDB54DFA9D954B9DBBB2BF89300F6081A9D409AB364DB756E81CF10

Function 049D2F48 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d139c71b1a40219b3ccff6c8126107842d43001084decaa451e910abf014dbc6
Instruction ID: a1e8ea5ea78b8d56eb163841516e8f54211991ce91d901bc1a1bee4882179811
Opcode Fuzzy Hash: d139c71b1a40219b3ccff6c8126107842d43001084decaa451e910abf014dbc6
Instruction Fuzzy Hash: DAC1B274E00218CFDB64DFA9D954B9DBBB2BF89300F6081A9D809AB365DB755E81CF10

Function 049DAF78 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a678b883687076f9062e92269ce8b388fbb25f2cf42d4a8019829ca6e731cde5
Instruction ID: 7786bca7c2344d19474511ec6c958a77f8924ca4451399019aebdde84d06a244
Opcode Fuzzy Hash: a678b883687076f9062e92269ce8b388fbb25f2cf42d4a8019829ca6e731cde5
Instruction Fuzzy Hash: 24C1B274E01218CFDB54DFA9D954B9DBBB2BF89300F6081A9D409AB364DB75AE81CF10

Function 049D9C90 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04d3f410724233cb12dfeacf8dd24424b688989c58c1383e04224f5e2296b611
Instruction ID: 7d638749260a8f2e84839867588e0ed0e5f97bdbc4b6ca4d78cd1d74b6af43ea
Opcode Fuzzy Hash: 04d3f410724233cb12dfeacf8dd24424b688989c58c1383e04224f5e2296b611
Instruction Fuzzy Hash: 789129B1E00259DFDB14DFA9C584A9EBBB2BF89300F15C479E819AB365C731E841CB54

Function 023A7E66 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2702498723.00000000023A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1767e4368b37cf2a50cb80f16b5d32d494eeab9a79d73288868fe258f5ce5050
Instruction ID: 11b232d13cb23653eb28a4d8edfc3d726c80cc7835e4cfabd5822749709358f4
Opcode Fuzzy Hash: 1767e4368b37cf2a50cb80f16b5d32d494eeab9a79d73288868fe258f5ce5050
Instruction Fuzzy Hash: 3BA10371D107198FDB24DFA9C894B9DFBB1EF89304F10C2AAE41867261EB709A85CF41

Function 049D1B4A Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5715c0cd53316feade419c5eb6bb64aca9023215b35a96bc057bba1242ce0300
Instruction ID: 7d8e1cf697af7bb090f4a5b3d90e1e67a86938ec2c61e09f32ced972409da2a5
Opcode Fuzzy Hash: 5715c0cd53316feade419c5eb6bb64aca9023215b35a96bc057bba1242ce0300
Instruction Fuzzy Hash: 15516976D062988FDB15CFBAC9822DDBFB2EF8A210F18C46AC4497B655D735094BCB10

Function 049DCDD0 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf7e51c51c39a8d3dffb23a11a58dd105782801b4b998f17cb238cacc66ee6d3
Instruction ID: d5cde1cc36791e85d0848eaa109a192b2df340d4e7e629c07e1543285bd98d59
Opcode Fuzzy Hash: cf7e51c51c39a8d3dffb23a11a58dd105782801b4b998f17cb238cacc66ee6d3
Instruction Fuzzy Hash: 2F410574E00208CBDF18DFAAD9446ADBBB2EF89300F24D17AC419BB254EB345946DF54

Function 049DC520 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea3fdfea1c9afc8c1406ff1b5e29ae2de9621282efe7adb53e85501d2a448c91
Instruction ID: 0703c680547ece694b2b6522d4dc0062cfed51861dc30709a31a7ecde7f77dec
Opcode Fuzzy Hash: ea3fdfea1c9afc8c1406ff1b5e29ae2de9621282efe7adb53e85501d2a448c91
Instruction Fuzzy Hash: 25411771E04208CBDF18DFAAD5546ADBBB2BB89300F24D179C419BB268EB345946CF54

Function 049DC0CB Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52b42f7b0f322d4d8867f3e45140a962fddf2f52154217a998545029da075fc0
Instruction ID: 47d5f32083cebb5b9e63a433c6da01d05f832e0f130fb839af70e9558362ea8d
Opcode Fuzzy Hash: 52b42f7b0f322d4d8867f3e45140a962fddf2f52154217a998545029da075fc0
Instruction Fuzzy Hash: 88411675E00208CBEF18DFAAD5446ADBBB2AF89300F24D17AC419BB264EB355946CF54

Function 049D0006 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41db525fbbbeae3804ebf2d6dc9a2fe8b771b97f17729f7539cff1e81d27d10a
Instruction ID: 055e3a46b6b30c2579bdf99ceba38e688636bace47cc6be81778447941a8f5ea
Opcode Fuzzy Hash: 41db525fbbbeae3804ebf2d6dc9a2fe8b771b97f17729f7539cff1e81d27d10a
Instruction Fuzzy Hash: 2F413970D05248CFEB19CFA6D8506DDBBF2AF8A304F24C07AC414AB296D7345946CF11

Function 049DC97B Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 943656e4c247eb2c10b4d25cdb7aec84d3b4965f44749c594de4f71bc2fa5928
Instruction ID: d0736bb014f971b8f4c8480a87be029886b156ff0553f6c9d822ff92b5c9222e
Opcode Fuzzy Hash: 943656e4c247eb2c10b4d25cdb7aec84d3b4965f44749c594de4f71bc2fa5928
Instruction Fuzzy Hash: F1411775E00208CBDF18DFAAD4446EDBBB2AF89300F20D17AC419BB268EB345946CF44

Function 049DD22B Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e43f6f26e59ebdde7c5071e679e31c36fc2517b9218f0bf7861012e4925f047f
Instruction ID: f7a286be247eda665b559515ec45e90fc6cf187071af148f5f1929d2db239354
Opcode Fuzzy Hash: e43f6f26e59ebdde7c5071e679e31c36fc2517b9218f0bf7861012e4925f047f
Instruction Fuzzy Hash: 5D41F675E00208CBEF18DFAAD9546ADBBB2EF89300F24D17AC418BB264DB355906CF54

Function 023AB9DC Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2702498723.00000000023A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 023A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23a0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4138a1cd0b7ee8059510e2f7c625e13d0cf04321c50e493552cee81fdf18d7ef
Instruction ID: 8814a2210dbfd99d41f16e96abf2f147a5dfc0efacc8bbd55ee54acf41de5963
Opcode Fuzzy Hash: 4138a1cd0b7ee8059510e2f7c625e13d0cf04321c50e493552cee81fdf18d7ef
Instruction Fuzzy Hash: 2D41C2B1D012189BEB18CFAAD8983DEFBF2FF88314F14C129D418AA294DBB54549CF50

Function 049DBC71 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec976ad2a855ba35ebfae5a3d4f9959610751f274edeae31177a069b3843c8c3
Instruction ID: 250625e1dc452973a488165a489ea162562f90da338194fa359e796d0ccee684
Opcode Fuzzy Hash: ec976ad2a855ba35ebfae5a3d4f9959610751f274edeae31177a069b3843c8c3
Instruction Fuzzy Hash: 1441C274E01248CBEB18DFAAD5546ADBBF2BF89300F24C13AC419BB264DB355946CF54

Function 049DF1C8 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be32684832d35857f6c1f6e9cd8e02ed5e1c3d4f184e076220400c1563f02453
Instruction ID: 1e1814f68d273e023b17ef962963702485d82167bd256eb60a5e985b1950e007
Opcode Fuzzy Hash: be32684832d35857f6c1f6e9cd8e02ed5e1c3d4f184e076220400c1563f02453
Instruction Fuzzy Hash: 13410674E01248CBEB18DFAAD5416ADBBF2AF88300F24C17AC415BB298DB345946CF44

Function 049DED70 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 386f53f82a0a34694c58bf67eff38104b5a3561facf5951001bd8938e934455c
Instruction ID: 178c396913d3e37650702f9dc6a234dc42ec7b954490289292c3743536ee2c97
Opcode Fuzzy Hash: 386f53f82a0a34694c58bf67eff38104b5a3561facf5951001bd8938e934455c
Instruction Fuzzy Hash: B841E370E01608CFEB18DFAAD9556ADBBF2AF89300F24C13AC415BB2A4DB345946CF54

Function 049DA6B9 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9d49dab984dbf5ee693da6a2163b37d33275349456cfe1cf9b1c36458460e1a
Instruction ID: b965ead59b6d5abaf9057143db587f9caf2143ec3881ea0516935d8db00e6832
Opcode Fuzzy Hash: a9d49dab984dbf5ee693da6a2163b37d33275349456cfe1cf9b1c36458460e1a
Instruction Fuzzy Hash: 3D41C271E01208CBEB18DFAAD5546ADBBF2BB89300F24C13AC418BB264DB395946CF54

Function 049DA261 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90be63830c30f4152486d8a1766caf1e3e1622e20f08e03e67f8f87d2d8fa6fc
Instruction ID: 9ac5ce94f264a445a5b4e44b5399c42564d3c910ca53abd0e29ff0e53a9abb42
Opcode Fuzzy Hash: 90be63830c30f4152486d8a1766caf1e3e1622e20f08e03e67f8f87d2d8fa6fc
Instruction Fuzzy Hash: C041E274E01248CBEB18DFAAD9546ADBBF2AF88300F24D17AC419BB264DB355946CF44

Function 049DAB10 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a217ba209de4b6b4da522b332a34b8a68f17b11683e4fc0ec33746f9076ea05b
Instruction ID: 04e821deab5a74dd4e783543334f76df998ee29483d5ea43ade57d918969aae0
Opcode Fuzzy Hash: a217ba209de4b6b4da522b332a34b8a68f17b11683e4fc0ec33746f9076ea05b
Instruction Fuzzy Hash: 2741F570E01208CBEB18DFAAD55469DBBF2BF89300F24D179D414BB264DB745946CF54

Function 049D3C43 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b62aedbd6cbef4c88ed6a9dd119dc6206d1a2c63d29ee0ebf82821a5b98eedd
Instruction ID: 2474038078d68c7c8aeb87fbee7107cba14f812e5f31bbeb64f2781a498a36f3
Opcode Fuzzy Hash: 9b62aedbd6cbef4c88ed6a9dd119dc6206d1a2c63d29ee0ebf82821a5b98eedd
Instruction Fuzzy Hash: A641F370E01208CBEB18DFAAD9546EDBBF2AF88300F24C13AC418BB265DB755946CF54

Function 049D3393 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed9eae948fc542242fed831dcfb13324528b3d041f4dcb296bbd62d174740095
Instruction ID: 128b5dc54f618b9f0f6b3a33832bf8542666a6c57ad28437ea3e277d8c3f15ca
Opcode Fuzzy Hash: ed9eae948fc542242fed831dcfb13324528b3d041f4dcb296bbd62d174740095
Instruction Fuzzy Hash: 7E41F370E00608CBEB18DFAAD5546EDBBF2AF88300F24D13AC818BB254DB395946CF54

Function 049DAF68 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d77c22e262639634918c3d3e5a21db573e19e8fc86c3c0d5a10cdedf0ca8a5b
Instruction ID: 32334e073b8fb3f868b2daa73f449dc0ce226574207c4397642f33b15b3c66b8
Opcode Fuzzy Hash: 5d77c22e262639634918c3d3e5a21db573e19e8fc86c3c0d5a10cdedf0ca8a5b
Instruction Fuzzy Hash: C141C270E01208CBEB18DFAAD5546ADFBF2AF89300F24C13AC414BB264DB755946CF54

Function 049DFA78 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38f137f400207c5093ae7371ee23aadedfdc1c870b43be988b4fad17731b74f9
Instruction ID: 5b4f1404e98451caabecf950e38c2b33fb3e4da5550f7769acd7b84b4ab725b3
Opcode Fuzzy Hash: 38f137f400207c5093ae7371ee23aadedfdc1c870b43be988b4fad17731b74f9
Instruction Fuzzy Hash: 4041F670E00248CFDB18DFAAD55569DBBF2AF88300F24C13AC419BB268DB385946CF54

Function 049D2F38 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77417c569c4e8d7cc8a5298358a107a636749d5e8c46c8cafa086ddf68f65c74
Instruction ID: ddb74ccdd0046533fdc450eb9876235954f3ae2d8c9b0eeb6a0400464fe2185a
Opcode Fuzzy Hash: 77417c569c4e8d7cc8a5298358a107a636749d5e8c46c8cafa086ddf68f65c74
Instruction Fuzzy Hash: BD41F571E00208CBEB18DFAAD55069DFBF2AF89300F24D13AC414BB264DB355946CF14

Function 049DB818 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3527b6389f30a71095ca00b10a6f15bfbf7e138e8e0f735b85cbf893b2d3e2ff
Instruction ID: a28860fc51f2e678a95e6904256da63747830b9a0f9b67c36bb9f47f1ffa8654
Opcode Fuzzy Hash: 3527b6389f30a71095ca00b10a6f15bfbf7e138e8e0f735b85cbf893b2d3e2ff
Instruction Fuzzy Hash: 0641E370E00248CBEB18DFAAD5546ADBBF2BF88304F24D13AC418BB268DB345946CF54

Function 049D37E8 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 454aa6e6210c18a0910f57b2dbccdc1857ffe0ebf750c2fe0a2bd22833dabb0f
Instruction ID: fb81cd7433fcf781f24a5413d74285abc557a87c4d79265f91ad199054187065
Opcode Fuzzy Hash: 454aa6e6210c18a0910f57b2dbccdc1857ffe0ebf750c2fe0a2bd22833dabb0f
Instruction Fuzzy Hash: A541C374E00248CBEB18DFAAD9546ADFBF2AF89301F24D13AC414BB258DB355946CF54

Function 049DE4C0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e62bf66573a65a6d74a9e3a6f74bc6aa6aa3b60f319ea0af35ac4346f2c54fe1
Instruction ID: d5a6f5dba963bec965621c6b42fd38c94afbd607ae7159881f5b99b6613c71eb
Opcode Fuzzy Hash: e62bf66573a65a6d74a9e3a6f74bc6aa6aa3b60f319ea0af35ac4346f2c54fe1
Instruction Fuzzy Hash: B941E270E01648CBEF18DFAAD95469DBBF2AF89300F20C139D418BB264EB385946CF54

Function 049DE068 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77a15b10218c1004a439486407da8e7767400493fa66d35930166aa303dda5c6
Instruction ID: 303a14dd8d953130ed4ba7ec07617ffeeb3ad21754c209c798150197f4d3634e
Opcode Fuzzy Hash: 77a15b10218c1004a439486407da8e7767400493fa66d35930166aa303dda5c6
Instruction Fuzzy Hash: D341E270E00248CBEB18DFAAD95469EFBF2AF89300F24C03AC419BB259DB345946CF54

Function 049D118F Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a23b360e0e4f03472b737be5075b52c1c5343e44916996a7f567e65447494afd
Instruction ID: 35fa9b275cebda1934310aa7189c3504580d9b0c1a25027dbf04bd814720611c
Opcode Fuzzy Hash: a23b360e0e4f03472b737be5075b52c1c5343e44916996a7f567e65447494afd
Instruction Fuzzy Hash: 8E410471E01208CBEB18DFAAD5546EDBBF2AF89300F24D13AC414BB269DB345946CF54

Function 049D0D3A Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef6c02636be896fa0339b799cb7af2073c210f08e2da04d001856a0934696d65
Instruction ID: 4614a03b6ba8b4b5c225314bd72f45def4daf643fc0312d31ae3e27e219b045a
Opcode Fuzzy Hash: ef6c02636be896fa0339b799cb7af2073c210f08e2da04d001856a0934696d65
Instruction Fuzzy Hash: 5341D375E01208CBEB18DFAAD5546ADBBF2AF89300F24C13AC414BB264DB795946CF54

Function 049DF620 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0afb4e0aa56e091711b6504303a7680bfede7d8a4535206fb7282bc61c714860
Instruction ID: a6625365ad221ab80446e22a486e58520e341ccee557057bb8c1b9e4ff8fb809
Opcode Fuzzy Hash: 0afb4e0aa56e091711b6504303a7680bfede7d8a4535206fb7282bc61c714860
Instruction Fuzzy Hash: E341F570E00248CBDB18DFEAD95469DBBF2AF89300F24D03AC419BB258EB355946CF44

Function 049D4098 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 571c4094b052af11ce17ac8d4a0d999f9abdb4552732828af05667d908510543
Instruction ID: 518ad70f08528b58590bb84d731d920dad852f3eceb5fda76eb888c52109af4e
Opcode Fuzzy Hash: 571c4094b052af11ce17ac8d4a0d999f9abdb4552732828af05667d908510543
Instruction Fuzzy Hash: E041D170E00208CBEB18DFAAD9546ADBBF2AF89304F24D13AC414BB295EB355946CF54

Function 049D048A Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fd5af8270d371525f33a1f0015821743cf23cf5996a5955c2fec608d67a94fb
Instruction ID: f7f2b673862037d7bd5f2105f3b1e8fe8b593ccb1516ed9d0f6997d120e6c377
Opcode Fuzzy Hash: 5fd5af8270d371525f33a1f0015821743cf23cf5996a5955c2fec608d67a94fb
Instruction Fuzzy Hash: 9B41F370E01248CBEB18DFAAD5546ADFBF2AF89304F24C13AC414BB258DB395946CF54

Function 049D08DF Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d279d8386048a86d7cbe90b0383a7a67a463a88288256705779ea6cb1409d4d3
Instruction ID: de582e15afc3a3670afc6a1bff1876023996b5d7910e7a2bb51c0672962ae825
Opcode Fuzzy Hash: d279d8386048a86d7cbe90b0383a7a67a463a88288256705779ea6cb1409d4d3
Instruction Fuzzy Hash: 13410370E01248CBEF18DFAAD55469DBBF2AF89304F24C13AC418BB258DB345946CF50

Function 049DDC13 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f5d499848237e5fda8ef0854233c0dfdcf3bc18e6227ad845d8dab059630d8f
Instruction ID: 87c6c81dda760d23ca5c5568728a422e8da64ba14641b06be048a5ae43e3a005
Opcode Fuzzy Hash: 7f5d499848237e5fda8ef0854233c0dfdcf3bc18e6227ad845d8dab059630d8f
Instruction Fuzzy Hash: D141D370E00208CBEF18DFAAD5546AEBBF2AF89300F24D13AD415BB268DB755946CF54

Function 049D2AE0 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c39bf8ec3623681fd3e813e21fda437816bf90d26853fd92abb33875ca9f6d3
Instruction ID: 2dc49a409053c4a9dffb2aee8907867e850a7e125481143dfff1845bca072332
Opcode Fuzzy Hash: 1c39bf8ec3623681fd3e813e21fda437816bf90d26853fd92abb33875ca9f6d3
Instruction Fuzzy Hash: 3341F370E00208CBEB18DFAAD9546AEFBF2AF89300F24C17AD414BB254DB795946CF54

Function 049DD683 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 850a8d3283dae5ac7623ca57bf64e3c05d030058bf9d5f51c5b06d0d6e672974
Instruction ID: 02ffca11dd9eeab7feeb8bcca8acf03df310b20022fdc9b81e4c79d83228ae2d
Opcode Fuzzy Hash: 850a8d3283dae5ac7623ca57bf64e3c05d030058bf9d5f51c5b06d0d6e672974
Instruction Fuzzy Hash: CF41D270E00208CBEB18DFA6D55469DBBF2AF89300F64D139D418BB268EB345946CF44

Function 049DB3C1 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f9e9a29db8e0f5f94a36378a20a0d942d4970450dd10345b04c04a65d5a8982
Instruction ID: 5fd0172591ba79548d141a5dc493fa2601ba91a17a80f2c51d0c275a1089265f
Opcode Fuzzy Hash: 0f9e9a29db8e0f5f94a36378a20a0d942d4970450dd10345b04c04a65d5a8982
Instruction Fuzzy Hash: 9641D270E00208CBEB18DFAAD5546AEFBF2AF89300F24C13AC414BB268DB345946CF54

Function 049DE923 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2703529445.00000000049D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_49d0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5acbbdc548f7781b08bdc574bdf1496ad26507d64b5bdcab694267206d2c914c
Instruction ID: 1cc516d3dd329bdfef4a73ab74150fc24b811a04554b1ec614e1e5487bd1160e
Opcode Fuzzy Hash: 5acbbdc548f7781b08bdc574bdf1496ad26507d64b5bdcab694267206d2c914c
Instruction Fuzzy Hash: 7C41D270E01648CBEF18DFAAD5546ADBBF2AF89300F24D13AC419BB268DB345946CF54

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Tepe - 20000000826476479.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: MassLogger

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
Tepe - 20000000826476479.exe

Function 023AC168 Relevance: 2.0, APIs: 1, Instructions: 501
COMMON

Function 049D4500 Relevance: .7, Instructions: 745
COMMON

Function 023A27B9 Relevance: .7, Instructions: 693
COMMON

Function 049D15F8 Relevance: .3, Instructions: 296
COMMON

Function 023A4F08 Relevance: .3, Instructions: 268
COMMON

Function 023A5366 Relevance: .2, Instructions: 221
COMMON

Function 023AC76C Relevance: 1.6, APIs: 1, Instructions: 62
libraryCOMMON

Function 049D8848 Relevance: .8, Instructions: 818
COMMON

Function 049D65F1 Relevance: .2, Instructions: 222
COMMON

Function 049D62A8 Relevance: .2, Instructions: 220
COMMON

Function 049D2508 Relevance: .2, Instructions: 212
COMMON