Edit tour

Windows Analysis Report
Tepe - 20000000826476479.exe

Overview

General Information

Sample name:	Tepe - 20000000826476479.exe
Analysis ID:	1586937
MD5:	62fe073a652c373cdcceaf4226e62836
SHA1:	5b3ebbd663f55a13918f73a8aa842330435476f5
SHA256:	ae96c4b2a9f4666798c865510244e61247009328d2f078c7831ee1033c228eba
Tags:	exeuser-lowmal3
Infos:

Detection

MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected MassLogger RAT

Yara detected Telegram RAT

Yara detected UAC Bypass using CMSTP

AI detected suspicious sample

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Machine Learning detection for sample

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Suricata IDS alerts with low severity for network traffic

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Tepe - 20000000826476479.exe (PID: 5352 cmdline: "C:\Users\user\Desktop\Tepe - 20000000826476479.exe" MD5: 62FE073A652C373CDCCEAF4226E62836)

RegAsm.exe (PID: 6060 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

InstallUtil.exe (PID: 4528 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

InstallUtil.exe (PID: 1528 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

WerFault.exe (PID: 3776 cmdline: C:\Windows\system32\WerFault.exe -u -p 5352 -s 1028 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Configuration

Threatname: MassLogger

{"EXfil Mode": "SMTP", "From": "blog@alhoneycomb.com", "Password": "W           ORTH          will3611             !", "Server": "mail.alhoneycomb.com", "Port": 587}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.2738093564.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000003.00000002.2738093564.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2738093564.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000003.00000002.2738093564.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xefb7:$a1: get_encryptedPassword 0xf2df:$a2: get_encryptedUsername 0xed52:$a3: get_timePasswordChanged 0xee73:$a4: get_passwordField 0xefcd:$a5: set_encryptedPassword 0x10929:$a7: get_logins 0x105da:$a8: GetOutlookPasswords 0x103cc:$a9: StartKeylogger 0x10879:$a10: KeyLoggerEventArgs 0x10429:$a11: KeyLoggerEventArgsEventHandler
00000003.00000002.2739861946.0000000002DA6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2739861946.0000000002DA6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1575435424.0000026092608000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000000.00000002.1575435424.0000026092608000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1575435424.0000026092608000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1575435424.0000026092608000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x27abf:$a1: get_encryptedPassword 0x3e907:$a1: get_encryptedPassword 0x27de7:$a2: get_encryptedUsername 0x3ec2f:$a2: get_encryptedUsername 0x2785a:$a3: get_timePasswordChanged 0x3e6a2:$a3: get_timePasswordChanged 0x2797b:$a4: get_passwordField 0x3e7c3:$a4: get_passwordField 0x27ad5:$a5: set_encryptedPassword 0x3e91d:$a5: set_encryptedPassword 0x29431:$a7: get_logins 0x40279:$a7: get_logins 0x290e2:$a8: GetOutlookPasswords 0x3ff2a:$a8: GetOutlookPasswords 0x28ed4:$a9: StartKeylogger 0x3fd1c:$a9: StartKeylogger 0x29381:$a10: KeyLoggerEventArgs 0x401c9:$a10: KeyLoggerEventArgs 0x28f31:$a11: KeyLoggerEventArgsEventHandler 0x3fd79:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.1574756756.000002608263B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: Tepe - 20000000826476479.exe PID: 5352	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: Tepe - 20000000826476479.exe PID: 5352	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Tepe - 20000000826476479.exe PID: 5352	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Tepe - 20000000826476479.exe PID: 5352	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: Tepe - 20000000826476479.exe PID: 5352	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: Tepe - 20000000826476479.exe PID: 5352	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x32fe6:$a1: get_encryptedPassword 0x332ff:$a2: get_encryptedUsername 0x32d95:$a3: get_timePasswordChanged 0x32eb6:$a4: get_passwordField 0x32ffc:$a5: set_encryptedPassword 0x348ff:$a7: get_logins 0x345b0:$a8: GetOutlookPasswords 0x343a2:$a9: StartKeylogger 0x3484f:$a10: KeyLoggerEventArgs 0x343ff:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: InstallUtil.exe PID: 4528	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: InstallUtil.exe PID: 4528	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 4528	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: InstallUtil.exe PID: 4528	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x8e92:$a1: get_encryptedPassword 0x91ab:$a2: get_encryptedUsername 0x8c41:$a3: get_timePasswordChanged 0x8d62:$a4: get_passwordField 0x8ea8:$a5: set_encryptedPassword 0xa7ab:$a7: get_logins 0xa45c:$a8: GetOutlookPasswords 0xa24e:$a9: StartKeylogger 0xa6fb:$a10: KeyLoggerEventArgs 0xa2ab:$a11: KeyLoggerEventArgsEventHandler
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Tepe - 20000000826476479.exe.26092637750.3.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.Tepe - 20000000826476479.exe.26092637750.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Tepe - 20000000826476479.exe.26092637750.3.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Tepe - 20000000826476479.exe.26092637750.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd3b7:$a1: get_encryptedPassword 0xd6df:$a2: get_encryptedUsername 0xd152:$a3: get_timePasswordChanged 0xd273:$a4: get_passwordField 0xd3cd:$a5: set_encryptedPassword 0xed29:$a7: get_logins 0xe9da:$a8: GetOutlookPasswords 0xe7cc:$a9: StartKeylogger 0xec79:$a10: KeyLoggerEventArgs 0xe829:$a11: KeyLoggerEventArgsEventHandler
0.2.Tepe - 20000000826476479.exe.26092637750.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1237f:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1187d:$a3: \Google\Chrome\User Data\Default\Login Data 0x11b8b:$a4: \Orbitum\User Data\Default\Login Data 0x12983:$a5: \Kometa\User Data\Default\Login Data
3.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
3.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
3.2.InstallUtil.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1b7:$a1: get_encryptedPassword 0xf4df:$a2: get_encryptedUsername 0xef52:$a3: get_timePasswordChanged 0xf073:$a4: get_passwordField 0xf1cd:$a5: set_encryptedPassword 0x10b29:$a7: get_logins 0x107da:$a8: GetOutlookPasswords 0x105cc:$a9: StartKeylogger 0x10a79:$a10: KeyLoggerEventArgs 0x10629:$a11: KeyLoggerEventArgsEventHandler
3.2.InstallUtil.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1417f:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1367d:$a3: \Google\Chrome\User Data\Default\Login Data 0x1398b:$a4: \Orbitum\User Data\Default\Login Data 0x14783:$a5: \Kometa\User Data\Default\Login Data
0.2.Tepe - 20000000826476479.exe.26092620908.2.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.Tepe - 20000000826476479.exe.26092620908.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Tepe - 20000000826476479.exe.26092620908.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Tepe - 20000000826476479.exe.26092620908.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd3b7:$a1: get_encryptedPassword 0xd6df:$a2: get_encryptedUsername 0xd152:$a3: get_timePasswordChanged 0xd273:$a4: get_passwordField 0xd3cd:$a5: set_encryptedPassword 0xed29:$a7: get_logins 0xe9da:$a8: GetOutlookPasswords 0xe7cc:$a9: StartKeylogger 0xec79:$a10: KeyLoggerEventArgs 0xe829:$a11: KeyLoggerEventArgsEventHandler
0.2.Tepe - 20000000826476479.exe.26092620908.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1237f:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1187d:$a3: \Google\Chrome\User Data\Default\Login Data 0x11b8b:$a4: \Orbitum\User Data\Default\Login Data 0x12983:$a5: \Kometa\User Data\Default\Login Data
0.2.Tepe - 20000000826476479.exe.26092637750.3.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.Tepe - 20000000826476479.exe.26092637750.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Tepe - 20000000826476479.exe.26092637750.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Tepe - 20000000826476479.exe.26092637750.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1b7:$a1: get_encryptedPassword 0xf4df:$a2: get_encryptedUsername 0xef52:$a3: get_timePasswordChanged 0xf073:$a4: get_passwordField 0xf1cd:$a5: set_encryptedPassword 0x10b29:$a7: get_logins 0x107da:$a8: GetOutlookPasswords 0x105cc:$a9: StartKeylogger 0x10a79:$a10: KeyLoggerEventArgs 0x10629:$a11: KeyLoggerEventArgsEventHandler
0.2.Tepe - 20000000826476479.exe.26092620908.2.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0.2.Tepe - 20000000826476479.exe.26092620908.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Tepe - 20000000826476479.exe.26092620908.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Tepe - 20000000826476479.exe.26092620908.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf1b7:$a1: get_encryptedPassword 0x25fff:$a1: get_encryptedPassword 0xf4df:$a2: get_encryptedUsername 0x26327:$a2: get_encryptedUsername 0xef52:$a3: get_timePasswordChanged 0x25d9a:$a3: get_timePasswordChanged 0xf073:$a4: get_passwordField 0x25ebb:$a4: get_passwordField 0xf1cd:$a5: set_encryptedPassword 0x26015:$a5: set_encryptedPassword 0x10b29:$a7: get_logins 0x27971:$a7: get_logins 0x107da:$a8: GetOutlookPasswords 0x27622:$a8: GetOutlookPasswords 0x105cc:$a9: StartKeylogger 0x27414:$a9: StartKeylogger 0x10a79:$a10: KeyLoggerEventArgs 0x278c1:$a10: KeyLoggerEventArgs 0x10629:$a11: KeyLoggerEventArgsEventHandler 0x27471:$a11: KeyLoggerEventArgsEventHandler
Click to see the 18 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 74.119.238.7, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe, Initiated: true, ProcessId: 4528, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49713

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T19:20:52.719930+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49704	193.122.130.0	80	TCP
2025-01-09T19:20:58.876061+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49704	193.122.130.0	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.Tepe - 20000000826476479.exe.26092637750.3.raw.unpack

Malware Configuration Extractor: MassLogger {"EXfil Mode": "SMTP", "From": "blog@alhoneycomb.com", "Password": "W ORTH will3611 !", "Server": "mail.alhoneycomb.com", "Port": 587}

Multi AV Scanner detection for submitted file

Source: Tepe - 20000000826476479.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Tepe - 20000000826476479.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 00000000.00000002.1574756756.000002608263B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Tepe - 20000000826476479.exe PID: 5352, type: MEMORYSTR

Source: unknown

HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.8:49706 version: TLS 1.0

Source: Tepe - 20000000826476479.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER6266.tmp.dmp.7.dr
Source:	Binary string: mscorlib.pdb source: WER6266.tmp.dmp.7.dr
Source:	Binary string: System.ni.pdbRSDS source: WER6266.tmp.dmp.7.dr
Source:	Binary string: mscorlib.ni.pdb source: WER6266.tmp.dmp.7.dr
Source:	Binary string: System.Core.pdb source: WER6266.tmp.dmp.7.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER6266.tmp.dmp.7.dr
Source:	Binary string: Microsoft.VisualBasic.pdbH source: WER6266.tmp.dmp.7.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER6266.tmp.dmp.7.dr
Source:	Binary string: System.ni.pdb source: WER6266.tmp.dmp.7.dr
Source:	Binary string: System.pdb source: WER6266.tmp.dmp.7.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER6266.tmp.dmp.7.dr
Source:	Binary string: System.Core.ni.pdb source: WER6266.tmp.dmp.7.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER6266.tmp.dmp.7.dr

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 012D5782h	3_2_012D5363
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 012D51B9h	3_2_012D4F08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 012D5782h	3_2_012D56AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 05231935h	3_2_052315F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 0523C7D8h	3_2_0523C530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 05230FF1h	3_2_05230D48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 0523F028h	3_2_0523ED80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 0523D088h	3_2_0523CDE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 0523DEC8h	3_2_0523DC20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 05233EF8h	3_2_05233C50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 0523BF28h	3_2_0523BC80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 05230741h	3_2_05230498
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 0523E778h	3_2_0523E4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 0523B220h	3_2_0523AF78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 052331F0h	3_2_05232F48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 05233AA0h	3_2_052337F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 0523F8D8h	3_2_0523F630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 0523A0C0h	3_2_05239E18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 0523D93Ah	3_2_0523D690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 0523A970h	3_2_0523A6C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 0523EBD0h	3_2_0523E928
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 05231449h	3_2_052311A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 0523CC30h	3_2_0523C988
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 0523F480h	3_2_0523F1D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 0523BAD0h	3_2_0523B828
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 0523E320h	3_2_0523E078
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 052302E9h	3_2_05230040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 05234350h	3_2_052340A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 05230B99h	3_2_052308F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 0523C380h	3_2_0523C0D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 0523ADC8h	3_2_0523AB20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 05233648h	3_2_052333A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 0523B678h	3_2_0523B3D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 0523D4E0h	3_2_0523D238
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 0523A518h	3_2_0523A270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 0523FD30h	3_2_0523FA88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 05232D98h	3_2_05232AF0

Source: global traffic

TCP traffic: 192.168.2.8:49713 -> 74.119.238.7:587

Source: global traffic

TCP traffic: 192.168.2.8:59006 -> 162.159.36.2:53

Source: global traffic

HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 74.119.238.7 74.119.238.7
Source: Joe Sandbox View	IP Address: 104.21.32.1 104.21.32.1
Source: Joe Sandbox View	IP Address: 193.122.130.0 193.122.130.0

Source: Joe Sandbox View

ASN Name: VPLSNETUS VPLSNETUS

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic

Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49704 -> 193.122.130.0:80

Source: global traffic

TCP traffic: 192.168.2.8:49713 -> 74.119.238.7:587

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown

HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.8:49706 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: mail.alhoneycomb.com
Source: global traffic	DNS traffic detected: DNS query: 198.187.3.20.in-addr.arpa

Source: InstallUtil.exe, 00000003.00000002.2739861946.0000000002CD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: InstallUtil.exe, 00000003.00000002.2739861946.0000000002CD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.comd
Source: InstallUtil.exe, 00000003.00000002.2739861946.0000000002CD0000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2739861946.0000000002DA6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2739861946.0000000002CBE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: InstallUtil.exe, 00000003.00000002.2739861946.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: InstallUtil.exe, 00000003.00000002.2739861946.0000000002CD0000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2739861946.0000000002DA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/d
Source: Tepe - 20000000826476479.exe, 00000000.00000002.1575435424.0000026092608000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2738093564.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: InstallUtil.exe, 00000003.00000002.2739861946.0000000002CD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.orgd
Source: InstallUtil.exe, 00000003.00000002.2739861946.0000000002DA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.alhoneycomb.com
Source: InstallUtil.exe, 00000003.00000002.2739861946.0000000002DA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.alhoneycomb.comd
Source: InstallUtil.exe, 00000003.00000002.2742440897.00000000062ED000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2739861946.0000000002DA6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2742440897.00000000062F7000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2738440509.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r11.i.lencr.org/0-
Source: InstallUtil.exe, 00000003.00000002.2742440897.00000000062ED000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2739861946.0000000002DA6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2742440897.00000000062F7000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2738440509.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r11.o.lencr.org0#
Source: InstallUtil.exe, 00000003.00000002.2739861946.0000000002CED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: InstallUtil.exe, 00000003.00000002.2739861946.0000000002CED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.orgd
Source: InstallUtil.exe, 00000003.00000002.2739861946.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.7.dr	String found in binary or memory: http://upx.sf.net
Source: Tepe - 20000000826476479.exe	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Tepe - 20000000826476479.exe	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0Digitized
Source: Tepe - 20000000826476479.exe	String found in binary or memory: http://www.ascendercorp.com/http://www.ascendercorp.com/typedesigners.htmlLicensed
Source: InstallUtil.exe, 00000003.00000002.2742440897.00000000062ED000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2739861946.0000000002DA6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2742440897.00000000062B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: InstallUtil.exe, 00000003.00000002.2742440897.00000000062ED000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2739861946.0000000002DA6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2742440897.00000000062B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: InstallUtil.exe, 00000003.00000002.2739861946.0000000002DA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: Tepe - 20000000826476479.exe, 00000000.00000002.1575435424.0000026092608000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2738093564.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot-/sendDocument?chat_id=
Source: InstallUtil.exe, 00000003.00000002.2739861946.0000000002CD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: Tepe - 20000000826476479.exe, 00000000.00000002.1575435424.0000026092608000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2739861946.0000000002CD0000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2738093564.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: InstallUtil.exe, 00000003.00000002.2739861946.0000000002CD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189d
Source: InstallUtil.exe, 00000003.00000002.2739861946.0000000002CD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189l

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.Tepe - 20000000826476479.exe.26092637750.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Tepe - 20000000826476479.exe.26092637750.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 3.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 3.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Tepe - 20000000826476479.exe.26092620908.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Tepe - 20000000826476479.exe.26092620908.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Tepe - 20000000826476479.exe.26092637750.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Tepe - 20000000826476479.exe.26092620908.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000003.00000002.2738093564.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1575435424.0000026092608000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: Tepe - 20000000826476479.exe PID: 5352, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: InstallUtil.exe PID: 4528, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_00007FFB4AED3EFB	0_2_00007FFB4AED3EFB
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_00007FFB4AECB080	0_2_00007FFB4AECB080
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_00007FFB4AECB461	0_2_00007FFB4AECB461
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_00007FFB4AECDFE9	0_2_00007FFB4AECDFE9
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_00007FFB4AECACBF	0_2_00007FFB4AECACBF
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_00007FFB4AEC0CC0	0_2_00007FFB4AEC0CC0
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_00007FFB4AEC85B0	0_2_00007FFB4AEC85B0
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_00007FFB4AED3F48	0_2_00007FFB4AED3F48
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_00007FFB4AFA026B	0_2_00007FFB4AFA026B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_012DC168	3_2_012DC168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_012DA821	3_2_012DA821
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_012DCAB0	3_2_012DCAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_012D4F08	3_2_012D4F08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_012D7E68	3_2_012D7E68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_012DC37B	3_2_012DC37B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_012DB9E0	3_2_012DB9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_012DCAAE	3_2_012DCAAE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_012D2DDB	3_2_012D2DDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_012D7E66	3_2_012D7E66
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_012D4EFB	3_2_012D4EFB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_05234500	3_2_05234500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_052315F8	3_2_052315F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_05231C58	3_2_05231C58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_05237770	3_2_05237770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_05236998	3_2_05236998
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523C520	3_2_0523C520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523C530	3_2_0523C530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523ED70	3_2_0523ED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_05230D43	3_2_05230D43
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_05230D48	3_2_05230D48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523ED80	3_2_0523ED80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523CDE0	3_2_0523CDE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_052315F3	3_2_052315F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523CDD0	3_2_0523CDD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523DC20	3_2_0523DC20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523DC12	3_2_0523DC12
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523BC71	3_2_0523BC71
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_05233C42	3_2_05233C42
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_05233C50	3_2_05233C50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523BC80	3_2_0523BC80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_05230489	3_2_05230489
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_05239C90	3_2_05239C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_05230498	3_2_05230498
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523E4C0	3_2_0523E4C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523E4D0	3_2_0523E4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_05232F38	3_2_05232F38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523AF68	3_2_0523AF68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523AF78	3_2_0523AF78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_05232F48	3_2_05232F48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_052337E8	3_2_052337E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_052337F8	3_2_052337F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523F620	3_2_0523F620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523F630	3_2_0523F630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_05239E18	3_2_05239E18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523A6B9	3_2_0523A6B9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523D682	3_2_0523D682
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523D690	3_2_0523D690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523A6C8	3_2_0523A6C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523E928	3_2_0523E928
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523E91A	3_2_0523E91A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523C97A	3_2_0523C97A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_052311A0	3_2_052311A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523C988	3_2_0523C988
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_05231197	3_2_05231197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523F1C8	3_2_0523F1C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523F1D8	3_2_0523F1D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523B828	3_2_0523B828
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_05230006	3_2_05230006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523B818	3_2_0523B818
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523E068	3_2_0523E068
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523E078	3_2_0523E078
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_05230040	3_2_05230040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_052340A8	3_2_052340A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_05234098	3_2_05234098
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_052308EB	3_2_052308EB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_052308F0	3_2_052308F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523C0CA	3_2_0523C0CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523C0D8	3_2_0523C0D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523AB20	3_2_0523AB20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523AB10	3_2_0523AB10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_052333A0	3_2_052333A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_05233392	3_2_05233392
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523B3C1	3_2_0523B3C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523B3D0	3_2_0523B3D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523D22A	3_2_0523D22A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523D238	3_2_0523D238
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523A261	3_2_0523A261
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523A270	3_2_0523A270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523FA78	3_2_0523FA78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0523FA88	3_2_0523FA88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_05232AE0	3_2_05232AE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_05232AF0	3_2_05232AF0

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5352 -s 1028

Source: Tepe - 20000000826476479.exe

Static PE information: No import functions for PE file found

Source: Tepe - 20000000826476479.exe, 00000000.00000002.1574530336.0000026080AE0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameEwipoyekuvirogokiD vs Tepe - 20000000826476479.exe
Source: Tepe - 20000000826476479.exe, 00000000.00000002.1575435424.0000026092608000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs Tepe - 20000000826476479.exe
Source: Tepe - 20000000826476479.exe, 00000000.00000002.1575435424.0000026092608000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameEwipoyekuvirogokiD vs Tepe - 20000000826476479.exe
Source: Tepe - 20000000826476479.exe	Binary or memory string: OriginalFilenameOfagusimetolixune< vs Tepe - 20000000826476479.exe

Source: 0.2.Tepe - 20000000826476479.exe.26092637750.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Tepe - 20000000826476479.exe.26092637750.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 3.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 3.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Tepe - 20000000826476479.exe.26092620908.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Tepe - 20000000826476479.exe.26092620908.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Tepe - 20000000826476479.exe.26092637750.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Tepe - 20000000826476479.exe.26092620908.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000003.00000002.2738093564.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1575435424.0000026092608000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: Tepe - 20000000826476479.exe PID: 5352, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: InstallUtil.exe PID: 4528, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: Tepe - 20000000826476479.exe

Static PE information: Section: .rsrc ZLIB complexity 0.9948613940628638

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@8/5@4/3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5352

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\ee71aeae-8a97-4cf0-8187-df986f58ad86

Jump to behavior

Source: Tepe - 20000000826476479.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: InstallUtil.exe, 00000003.00000002.2739861946.0000000002D6F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2741164033.0000000003C7D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2739861946.0000000002D40000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2739861946.0000000002D30000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2739861946.0000000002D4E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2739861946.0000000002D63000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Tepe - 20000000826476479.exe

ReversingLabs: Detection: 42%

Source: unknown	Process created: C:\Users\user\Desktop\Tepe - 20000000826476479.exe "C:\Users\user\Desktop\Tepe - 20000000826476479.exe"
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5352 -s 1028
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Tepe - 20000000826476479.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Tepe - 20000000826476479.exe

Static file information: File size 1449984 > 1048576

Source: Tepe - 20000000826476479.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER6266.tmp.dmp.7.dr
Source:	Binary string: mscorlib.pdb source: WER6266.tmp.dmp.7.dr
Source:	Binary string: System.ni.pdbRSDS source: WER6266.tmp.dmp.7.dr
Source:	Binary string: mscorlib.ni.pdb source: WER6266.tmp.dmp.7.dr
Source:	Binary string: System.Core.pdb source: WER6266.tmp.dmp.7.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER6266.tmp.dmp.7.dr
Source:	Binary string: Microsoft.VisualBasic.pdbH source: WER6266.tmp.dmp.7.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER6266.tmp.dmp.7.dr
Source:	Binary string: System.ni.pdb source: WER6266.tmp.dmp.7.dr
Source:	Binary string: System.pdb source: WER6266.tmp.dmp.7.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER6266.tmp.dmp.7.dr
Source:	Binary string: System.Core.ni.pdb source: WER6266.tmp.dmp.7.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER6266.tmp.dmp.7.dr

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_00007FFB4AEC8167 push ebx; ret	0_2_00007FFB4AEC816A
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Code function: 0_2_00007FFB4AFA026B push esp; retf 4810h	0_2_00007FFB4AFA0312
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_012D7E59 push edx; ret	3_2_012D7E5A

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: Tepe - 20000000826476479.exe PID: 5352, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Tepe - 20000000826476479.exe, 00000000.00000002.1574756756.000002608263B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: Tepe - 20000000826476479.exe, 00000000.00000002.1574756756.000002608263B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Memory allocated: 26080A50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Memory allocated: 2609A600000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 12D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2C50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 4C50000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 3672			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 1634			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2856	Thread sleep time: -19369081277395017s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2856	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2856	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2664	Thread sleep count: 3672 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2664	Thread sleep count: 1634 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2856	Thread sleep time: -99746s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2856	Thread sleep time: -99626s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2856	Thread sleep time: -99500s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2856	Thread sleep time: -99389s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2856	Thread sleep time: -99210s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2856	Thread sleep time: -99106s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2856	Thread sleep time: -98918s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2856	Thread sleep time: -98804s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2856	Thread sleep time: -98662s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2856	Thread sleep time: -98546s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2856	Thread sleep time: -98437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2856	Thread sleep time: -98327s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2856	Thread sleep time: -98218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2856	Thread sleep time: -98109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2856	Thread sleep time: -97999s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2856	Thread sleep time: -97890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2856	Thread sleep time: -97781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2856	Thread sleep time: -97671s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2856	Thread sleep time: -97562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2856	Thread sleep time: -97453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2856	Thread sleep time: -97343s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2856	Thread sleep time: -97232s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2856	Thread sleep time: -97124s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2856	Thread sleep time: -97015s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2856	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99746	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99626	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99389	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99210	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99106	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98918	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98804	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98662	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98327	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97999	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97232	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97124	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Amcache.hve.7.dr	Binary or memory string: VMware
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.7.dr	Binary or memory string: VMware-42 27 c5 9a 47 85 d6 84-53 49 ec ec 87 a6 6d 67
Source: Amcache.hve.7.dr	Binary or memory string: VMware, Inc.
Source: Tepe - 20000000826476479.exe, 00000000.00000002.1574756756.000002608263B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.7.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.7.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Tepe - 20000000826476479.exe, 00000000.00000002.1574756756.000002608263B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: Tepe - 20000000826476479.exe, 00000000.00000002.1574756756.000002608263B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Amcache.hve.7.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Tepe - 20000000826476479.exe, 00000000.00000002.1574756756.000002608263B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: Tepe - 20000000826476479.exe, 00000000.00000002.1574756756.000002608263B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: Amcache.hve.7.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: InstallUtil.exe, 00000003.00000002.2738440509.0000000000F9C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll#
Source: Amcache.hve.7.dr	Binary or memory string: vmci.sys
Source: Tepe - 20000000826476479.exe, 00000000.00000002.1574756756.000002608263B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin`
Source: Tepe - 20000000826476479.exe, 00000000.00000002.1574756756.000002608263B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: Amcache.hve.7.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Tepe - 20000000826476479.exe, 00000000.00000002.1574756756.000002608263B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Tepe - 20000000826476479.exe, 00000000.00000002.1574756756.000002608263B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Amcache.hve.7.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.7.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.7.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.7.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.7.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Tepe - 20000000826476479.exe, 00000000.00000002.1574756756.000002608263B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: Tepe - 20000000826476479.exe, 00000000.00000002.1574756756.000002608263B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: Amcache.hve.7.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.7.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.7.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Code function: 3_2_012DC168 LdrInitializeThunk,LdrInitializeThunk,

3_2_012DC168

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 41A000	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 41C000	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: B27008	Jump to behavior

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"	Jump to behavior

Source: Tepe - 20000000826476479.exe

Binary or memory string: Shell_TrayWndC

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe	Queries volume information: C:\Users\user\Desktop\Tepe - 20000000826476479.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Tepe - 20000000826476479.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.7.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 0.2.Tepe - 20000000826476479.exe.26092637750.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Tepe - 20000000826476479.exe.26092620908.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Tepe - 20000000826476479.exe.26092637750.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Tepe - 20000000826476479.exe.26092620908.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2738093564.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1575435424.0000026092608000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Tepe - 20000000826476479.exe PID: 5352, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 4528, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.Tepe - 20000000826476479.exe.26092637750.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Tepe - 20000000826476479.exe.26092620908.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Tepe - 20000000826476479.exe.26092637750.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Tepe - 20000000826476479.exe.26092620908.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2738093564.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2739861946.0000000002DA6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1575435424.0000026092608000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Tepe - 20000000826476479.exe PID: 5352, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 4528, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 0.2.Tepe - 20000000826476479.exe.26092637750.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Tepe - 20000000826476479.exe.26092620908.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Tepe - 20000000826476479.exe.26092637750.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Tepe - 20000000826476479.exe.26092620908.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2738093564.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2739861946.0000000002DA6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1575435424.0000026092608000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Tepe - 20000000826476479.exe PID: 5352, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 4528, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 0.2.Tepe - 20000000826476479.exe.26092637750.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Tepe - 20000000826476479.exe.26092620908.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Tepe - 20000000826476479.exe.26092637750.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Tepe - 20000000826476479.exe.26092620908.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2738093564.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1575435424.0000026092608000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Tepe - 20000000826476479.exe PID: 5352, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 4528, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.Tepe - 20000000826476479.exe.26092637750.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Tepe - 20000000826476479.exe.26092620908.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Tepe - 20000000826476479.exe.26092637750.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Tepe - 20000000826476479.exe.26092620908.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2738093564.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2739861946.0000000002DA6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1575435424.0000026092608000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Tepe - 20000000826476479.exe PID: 5352, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 4528, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	312 Process Injection	1 Disable or Modify Tools	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	312 Process Injection	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Tepe - 20000000826476479.exe	42%	ReversingLabs	ByteCode-MSIL.Trojan.Leonem
Tepe - 20000000826476479.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://mail.alhoneycomb.comd	0%	Avira URL Cloud	safe
http://mail.alhoneycomb.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
mail.alhoneycomb.com	74.119.238.7	true	true	unknown
reallyfreegeoip.org	104.21.32.1	true	false	high
checkip.dyndns.com	193.122.130.0	true	false	high
checkip.dyndns.org	unknown	unknown	false	high
198.187.3.20.in-addr.arpa	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://reallyfreegeoip.org/xml/8.46.123.189	false		high
http://checkip.dyndns.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	Tepe - 20000000826476479.exe	false		high
http://r11.i.lencr.org/0-	InstallUtil.exe, 00000003.00000002.2742440897.00000000062ED000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2739861946.0000000002DA6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2742440897.00000000062F7000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2738440509.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://r11.o.lencr.org0#	InstallUtil.exe, 00000003.00000002.2742440897.00000000062ED000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2739861946.0000000002DA6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2742440897.00000000062F7000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2738440509.0000000000FEA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	InstallUtil.exe, 00000003.00000002.2739861946.0000000002DA6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://reallyfreegeoip.orgd	InstallUtil.exe, 00000003.00000002.2739861946.0000000002CED000.00000004.00000800.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.7.dr	false		high
http://checkip.dyndns.org	InstallUtil.exe, 00000003.00000002.2739861946.0000000002CD0000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2739861946.0000000002DA6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2739861946.0000000002CBE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.ascendercorp.com/http://www.ascendercorp.com/typedesigners.htmlLicensed	Tepe - 20000000826476479.exe	false		high
https://reallyfreegeoip.org/xml/8.46.123.189l	InstallUtil.exe, 00000003.00000002.2739861946.0000000002CD0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mail.alhoneycomb.comd	InstallUtil.exe, 00000003.00000002.2739861946.0000000002DA6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.comd	InstallUtil.exe, 00000003.00000002.2739861946.0000000002CD0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mail.alhoneycomb.com	InstallUtil.exe, 00000003.00000002.2739861946.0000000002DA6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	InstallUtil.exe, 00000003.00000002.2742440897.00000000062ED000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2739861946.0000000002DA6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2742440897.00000000062B0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	InstallUtil.exe, 00000003.00000002.2742440897.00000000062ED000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2739861946.0000000002DA6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2742440897.00000000062B0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0Digitized	Tepe - 20000000826476479.exe	false		high
http://checkip.dyndns.org/q	Tepe - 20000000826476479.exe, 00000000.00000002.1575435424.0000026092608000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2738093564.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/8.46.123.189d	InstallUtil.exe, 00000003.00000002.2739861946.0000000002CD0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://reallyfreegeoip.org	InstallUtil.exe, 00000003.00000002.2739861946.0000000002CED000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.orgd	InstallUtil.exe, 00000003.00000002.2739861946.0000000002CD0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org	InstallUtil.exe, 00000003.00000002.2739861946.0000000002CD0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.com	InstallUtil.exe, 00000003.00000002.2739861946.0000000002CD0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org/d	InstallUtil.exe, 00000003.00000002.2739861946.0000000002CD0000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2739861946.0000000002DA6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	InstallUtil.exe, 00000003.00000002.2739861946.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot-/sendDocument?chat_id=	Tepe - 20000000826476479.exe, 00000000.00000002.1575435424.0000026092608000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2738093564.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/	Tepe - 20000000826476479.exe, 00000000.00000002.1575435424.0000026092608000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2739861946.0000000002CD0000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2738093564.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
74.119.238.7	mail.alhoneycomb.com	United States	35908	VPLSNETUS	true
104.21.32.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
193.122.130.0	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1586937
Start date and time:	2025-01-09 19:19:45 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Tepe - 20000000826476479.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@8/5@4/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 48 Number of non-executed functions: 33
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173, 40.126.32.133, 52.149.20.212, 20.3.187.198, 13.107.246.45
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: Tepe - 20000000826476479.exe

Simulations

Behavior and APIs

Time	Type	Description
13:20:55	API Interceptor	1x Sleep call for process: WerFault.exe modified
13:20:57	API Interceptor	26x Sleep call for process: InstallUtil.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
74.119.238.7	Tepe - 20000000826476479.exe	Get hash	malicious	MassLogger RAT	Browse
	NoERE2024000013833.exe	Get hash	malicious	AgentTesla	Browse
	1863415243647.exe	Get hash	malicious	AgentTesla	Browse
	Halkbank_Ekstre_20230426_075819_154085.exe	Get hash	malicious	AgentTesla	Browse
	hesaphareketi-01.exe	Get hash	malicious	AgentTesla	Browse
	New Purchase Order.exe	Get hash	malicious	AgentTesla	Browse
	rPO_CW00402902400415.exe	Get hash	malicious	AgentTesla	Browse
104.21.32.1	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	www.mzkd6gp5.top/3u0p/
104.21.32.1	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	redroomaudio.com/administrator/index.php
193.122.130.0	SOA NOV. Gateway Freight_MEDWA0577842.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	dekont garanti bbva_Ba#U015fka Bankaya Transfer 01112 img .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Tepe - 20000000826476479.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	Nuevo pedido.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	VSLS SCHEDULE_pdf.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	ungziped_file.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	New order 2025.msg	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	checkip.dyndns.org/
	file.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	image.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	DHL DOC INV 191224.gz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	PO#3_RKG367.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	104.21.80.1
	SOA NOV. Gateway Freight_MEDWA0577842.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.64.1
	dekont garanti bbva_Ba#U015fka Bankaya Transfer 01112 img .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	#U0130LC#U0130 HOLD#U0130NG a.s fiyati_teklif 017867Sipari#U015fi jpeg doc .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	fiyati_teklif 65TBI20_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	1C24TDP_000000029.jse	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	jqxrkk.ps1	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	Tepe - 20000000826476479.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	Order_List.scr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	104.21.64.1
checkip.dyndns.com	PO#3_RKG367.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	SOA NOV. Gateway Freight_MEDWA0577842.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	dekont garanti bbva_Ba#U015fka Bankaya Transfer 01112 img .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	#U0130LC#U0130 HOLD#U0130NG a.s fiyati_teklif 017867Sipari#U015fi jpeg doc .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	fiyati_teklif 65TBI20_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	1C24TDP_000000029.jse	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73
	jqxrkk.ps1	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	Tepe - 20000000826476479.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	Order_List.scr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	132.226.8.169
mail.alhoneycomb.com	Tepe - 20000000826476479.exe	Get hash	malicious	MassLogger RAT	Browse	74.119.238.7
	NoERE2024000013833.exe	Get hash	malicious	AgentTesla	Browse	74.119.238.7
	1863415243647.exe	Get hash	malicious	AgentTesla	Browse	74.119.238.7
	Halkbank_Ekstre_20230426_075819_154085.exe	Get hash	malicious	AgentTesla	Browse	74.119.238.7
	hesaphareketi-01.exe	Get hash	malicious	AgentTesla	Browse	74.119.238.7
	New Purchase Order.exe	Get hash	malicious	AgentTesla	Browse	74.119.238.7
	rPO_CW00402902400415.exe	Get hash	malicious	AgentTesla	Browse	74.119.238.7

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	PO#3_RKG367.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	SOA NOV. Gateway Freight_MEDWA0577842.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	dekont garanti bbva_Ba#U015fka Bankaya Transfer 01112 img .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	Tepe - 20000000826476479.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	Nuevo pedido.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	Payment 01.08.25.pdf.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.6.168
	December Reconciliation QuanKang.exe	Get hash	malicious	Unknown	Browse	193.122.6.168
	PO.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	BgroUcYHpy.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	VSLS SCHEDULE_pdf.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
VPLSNETUS	Tepe - 20000000826476479.exe	Get hash	malicious	MassLogger RAT	Browse	74.119.238.7
	http://vwi46h7.terraclicks.click/rd/4fRUWo26099tRCA461sdwbdplppv232VXGPAFVAHBPJXIV321477KIEL571756p9	Get hash	malicious	Phisher	Browse	67.198.205.87
	Fantazy.arm4.elf	Get hash	malicious	Unknown	Browse	67.229.74.151
	na.elf	Get hash	malicious	Mirai	Browse	98.126.6.69
	loligang.arm.elf	Get hash	malicious	Mirai	Browse	74.222.148.221
	rebirth.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	110.34.245.254
	Owari.ppc.elf	Get hash	malicious	Unknown	Browse	174.139.231.26
	nabspc.elf	Get hash	malicious	Unknown	Browse	96.62.217.206
	RHxJqGoGFB.exe	Get hash	malicious	Sality	Browse	98.126.7.202
	la.bot.arm5.elf	Get hash	malicious	Mirai	Browse	174.139.9.232
CLOUDFLARENETUS	PO#3_RKG367.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	104.21.80.1
	SOA NOV. Gateway Freight_MEDWA0577842.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.64.1
	dekont garanti bbva_Ba#U015fka Bankaya Transfer 01112 img .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	#U0130LC#U0130 HOLD#U0130NG a.s fiyati_teklif 017867Sipari#U015fi jpeg doc .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	fiyati_teklif 65TBI20_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.112.1
	1C24TDP_000000029.jse	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	jqxrkk.ps1	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	0V2JsCrGUB.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.38.84
	https://boutiquedumonde.instawp.xyz/wp-content/themes/twentytwentyfive/envoidoclosa_toutdomaine/wetransfer/index.html	Get hash	malicious	Unknown	Browse	1.1.1.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	PO#3_RKG367.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	104.21.32.1
	SOA NOV. Gateway Freight_MEDWA0577842.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.32.1
	dekont garanti bbva_Ba#U015fka Bankaya Transfer 01112 img .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	#U0130LC#U0130 HOLD#U0130NG a.s fiyati_teklif 017867Sipari#U015fi jpeg doc .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	fiyati_teklif 65TBI20_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	1C24TDP_000000029.jse	Get hash	malicious	MassLogger RAT	Browse	104.21.32.1
	jqxrkk.ps1	Get hash	malicious	MassLogger RAT	Browse	104.21.32.1
	Tepe - 20000000826476479.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.32.1
	Order_List.scr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	104.21.32.1

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Tepe - 200000008_b34044648ff360a99e48402af82a47894a32b5a7_b309c098_24496982-b67a-43e7-943a-8c8fcc4671ba\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0081878450373674
Encrypted:	false
SSDEEP:	192:mQfdzR0UnUlaWB2WPzuiFcRZ24lO83WU5:NVzSUnUlam24zuiFcRY4lO8mU5
MD5:	4C3F2F6727ED7395CB3AF20F6B8D4652
SHA1:	6F8A2C3DACCDE60F173E643337356DAD4D26C155
SHA-256:	51D5E09CD8B2C355780DFA7EEC6D9D6BA7924EF01680F1792DE322E7DE1CD9D8
SHA-512:	D13DD0379F255FB9436F997CFCA36F9241B5DF7EBE51BF1543F5C5E0C39B11F075C6471A1B5C7AB4F55141F04A58EC2971EDAD50D813E27E37901CCE19FA1539
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.0.9.2.0.4.5.0.4.6.6.9.3.9.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.0.9.2.0.4.5.0.9.9.8.1.7.5.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.4.4.9.6.9.8.2.-.b.6.7.a.-.4.3.e.7.-.9.4.3.a.-.8.c.8.f.c.c.4.6.7.1.b.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.4.e.2.6.6.b.b.-.7.3.4.c.-.4.e.7.7.-.9.2.a.5.-.e.9.0.a.3.3.1.c.9.9.2.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.T.e.p.e. .-. .2.0.0.0.0.0.0.0.8.2.6.4.7.6.4.7.9...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.O.f.a.g.u.s.i.m.e.t.o.l.i.x.u.n.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.4.e.8.-.0.0.0.1.-.0.0.1.4.-.8.0.6.a.-.a.8.3.4.c.3.6.2.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.1.3.c.7.f.5.0.f.8.7.0.d.9.a.3.4.3.a.c.2.5.e.3.3.9.7.e.1.4.9.9.9.0.0.0.0.0.0.0.0.!.0.0.0.0.5.b.3.e.b.b.d.6.6.3.f.5.5.a.1.3.9.1.8.f.7.3.a.8.a.a.8.4.2.3.3.0.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6266.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Thu Jan 9 18:20:50 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	386309
Entropy (8bit):	3.238432305331071
Encrypted:	false
SSDEEP:	3072:cV9zRyDKL1CCq2wg3+vJSNIm+pk1v42sIcS6:GeD2q2wg3QJSZvf
MD5:	DD59C06E6B6C9F3BEADB9CB97BFA3866
SHA1:	5C56FEF487902921BA3090D326F55D36E18815E3
SHA-256:	0218B0727A9685FCE976CA8BFB7E35F5DB41EBC05961EB1B057983B731CC7D28
SHA-512:	4650D9608E5E21FC4D14C8D5D981A5F31A355D50CA3536383A5A7EDD824C858E017007D8B3D01500A25BC8C388B1B93CCE89A5934DF8529390DE87C1F50E1EB7
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ..........g....................................$...........L...........TD.. s..........l.......8...........T............(..U............6...........7..............................................................................eJ.......8......Lw......................T..............g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER639F.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8854
Entropy (8bit):	3.7087609641615362
Encrypted:	false
SSDEEP:	192:R6l7wVeJQdfJK6YSSKMgmfoMRprk89bpUGqUfnjm:R6lXJy86Y3BgmfoMtpUGBf6
MD5:	19E41EDCD8935FB1F153172C916E63E7
SHA1:	DC4AC321FBDDFD2DBCCDEFA00A7025F7796D0422
SHA-256:	5B4AF0C78971804F13C594A58405C71B61352BF94FC9E1BEFB7C0D8878F2B81A
SHA-512:	81E635F4F27864048DFD2AF680741359DB3E0E6EF5E27622ECF8B7C4AF519F6EB4F4E78189CAEC53C360D02B11FE52259312CA140A4AB23BB2240AEA4ACD62AA
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.3.5.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER63CF.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4839
Entropy (8bit):	4.523902810540279
Encrypted:	false
SSDEEP:	48:cvIwWl8zsQJg771I9gLWpW8VYQoYm8M4Jxk5QFuyq85vWIArsZMYQd:uIjfWI7r67VNJ0NrsZMYQd
MD5:	54DA3B1BEF2F078DCF76A60E1292DF94
SHA1:	E76B3A83FEADD9DD51910F6B0C51DA7473DDEB75
SHA-256:	E1D9A39AD21577CDB9095396ACEF98CDE2327DAA0765BE57379D4B5649189845
SHA-512:	8F79431845C6C15E25A801CF711AA7F9122256E0F48CBACB1868069DFBDBCC4272D2BE0DECD75423932EA31F66B67026FE2B2D5035CC2BE93167A489E4CFF41C
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="668723" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.372687279708575
Encrypted:	false
SSDEEP:	6144:6FVfpi6ceLP/9skLmb0YyWWSPtaJG8nAge35OlMMhA2AX4WABlguN4iLJ:yV1myWWI/glMM6kF7qqJ
MD5:	1D2CB859DB318AA9D9F0277970218435
SHA1:	10901D2051C0A334DD253099A0D8EBBDDA9029E9
SHA-256:	4346301EB187B60DEF311EC411209EDB5985067793661DA667E8BC94B6A3CDE6
SHA-512:	2B9E0B0CD4BC305DFC09E5424BC2AE53694DE47D741B1B8EA66C8076CDEFBDE7817050EF16E31C81AC7407F902389C336932F06AF93F381C9A219F7136849931
Malicious:	false
Reputation:	low
Preview:	regfC...C....\.Z.................... ....0......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...5.b..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.24119634037318
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Tepe - 20000000826476479.exe
File size:	1'449'984 bytes
MD5:	62fe073a652c373cdcceaf4226e62836
SHA1:	5b3ebbd663f55a13918f73a8aa842330435476f5
SHA256:	ae96c4b2a9f4666798c865510244e61247009328d2f078c7831ee1033c228eba
SHA512:	a6e22f13808ce0478976f35a0b40056591b3514f8c77144b4eca2d685eb84296bb29263b60b322b3401e659aa4fa2446722ce2b5ab7add3a5ee514251a8b8e69
SSDEEP:	24576:pVmUg589C2ejwb+/3qlrCNoh+UagIwhCNoh+JR9FrIJJpCNoh+7gr5omCUJ+gkBc:pVhgB/iJO2URoGg1omvzS0+td1YndN
TLSH:	9465AFB4731075DAEA2A8477C5B0FCC0055B7863637B812AA8D303BA88577CDBE53D96
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...7oig..............0.fg............... ....@...... .......................`............`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67696F37 [Mon Dec 23 14:09:59 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xfa000	0x6b418	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xf6766	0xf6800	07934fb293f0e976dab589edcd9c0de8	False	0.5059128581389453	data	6.632295342119814	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xfa000	0x6b418	0x6b600	8044a40459111471e19ee18ed919b1c7	False	0.9948613940628638	data	7.997814243371014	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
YOKOBAKO	0xfa31c	0x180	data			1.0286458333333333
YOKOBAKO	0xfa49c	0x10	Non-ISO extended-ASCII text, with no line terminators			1.5
YOKOBAKO	0xfa4ac	0x20	data			1.28125
YOKOBAKO	0xfa4cc	0x10	data			1.5
YOKOBAKO	0xfa4dc	0x6a610	data			1.0003235963720487
YOKOBAKO	0x164aec	0x10	data			1.5
RT_VERSION	0x164afc	0x398	OpenPGP Public Key			0.48586956521739133
RT_VERSION	0x164e94	0x398	OpenPGP Public Key	English	United States	0.4880434782608696
RT_MANIFEST	0x16522c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-09T19:20:52.719930+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49704	193.122.130.0	80	TCP
2025-01-09T19:20:58.876061+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49704	193.122.130.0	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 19:20:51.048044920 CET	49704	80	192.168.2.8	193.122.130.0
Jan 9, 2025 19:20:51.053173065 CET	80	49704	193.122.130.0	192.168.2.8
Jan 9, 2025 19:20:51.053276062 CET	49704	80	192.168.2.8	193.122.130.0
Jan 9, 2025 19:20:51.056054115 CET	49704	80	192.168.2.8	193.122.130.0
Jan 9, 2025 19:20:51.060895920 CET	80	49704	193.122.130.0	192.168.2.8
Jan 9, 2025 19:20:52.561574936 CET	80	49704	193.122.130.0	192.168.2.8
Jan 9, 2025 19:20:52.565979958 CET	49704	80	192.168.2.8	193.122.130.0
Jan 9, 2025 19:20:52.572349072 CET	80	49704	193.122.130.0	192.168.2.8
Jan 9, 2025 19:20:52.672745943 CET	80	49704	193.122.130.0	192.168.2.8
Jan 9, 2025 19:20:52.682287931 CET	49706	443	192.168.2.8	104.21.32.1
Jan 9, 2025 19:20:52.682332039 CET	443	49706	104.21.32.1	192.168.2.8
Jan 9, 2025 19:20:52.682461023 CET	49706	443	192.168.2.8	104.21.32.1
Jan 9, 2025 19:20:52.689119101 CET	49706	443	192.168.2.8	104.21.32.1
Jan 9, 2025 19:20:52.689132929 CET	443	49706	104.21.32.1	192.168.2.8
Jan 9, 2025 19:20:52.719929934 CET	49704	80	192.168.2.8	193.122.130.0
Jan 9, 2025 19:20:53.184103966 CET	443	49706	104.21.32.1	192.168.2.8
Jan 9, 2025 19:20:53.184181929 CET	49706	443	192.168.2.8	104.21.32.1
Jan 9, 2025 19:20:53.189102888 CET	49706	443	192.168.2.8	104.21.32.1
Jan 9, 2025 19:20:53.189122915 CET	443	49706	104.21.32.1	192.168.2.8
Jan 9, 2025 19:20:53.189404011 CET	443	49706	104.21.32.1	192.168.2.8
Jan 9, 2025 19:20:53.235421896 CET	49706	443	192.168.2.8	104.21.32.1
Jan 9, 2025 19:20:53.247250080 CET	49706	443	192.168.2.8	104.21.32.1
Jan 9, 2025 19:20:53.291328907 CET	443	49706	104.21.32.1	192.168.2.8
Jan 9, 2025 19:20:53.391930103 CET	443	49706	104.21.32.1	192.168.2.8
Jan 9, 2025 19:20:53.392003059 CET	443	49706	104.21.32.1	192.168.2.8
Jan 9, 2025 19:20:53.392188072 CET	49706	443	192.168.2.8	104.21.32.1
Jan 9, 2025 19:20:53.398585081 CET	49706	443	192.168.2.8	104.21.32.1
Jan 9, 2025 19:20:58.707268000 CET	49704	80	192.168.2.8	193.122.130.0
Jan 9, 2025 19:20:58.712157011 CET	80	49704	193.122.130.0	192.168.2.8
Jan 9, 2025 19:20:58.826674938 CET	80	49704	193.122.130.0	192.168.2.8
Jan 9, 2025 19:20:58.876060963 CET	49704	80	192.168.2.8	193.122.130.0
Jan 9, 2025 19:20:59.158233881 CET	49713	587	192.168.2.8	74.119.238.7
Jan 9, 2025 19:20:59.163137913 CET	587	49713	74.119.238.7	192.168.2.8
Jan 9, 2025 19:20:59.163335085 CET	49713	587	192.168.2.8	74.119.238.7
Jan 9, 2025 19:20:59.829135895 CET	587	49713	74.119.238.7	192.168.2.8
Jan 9, 2025 19:20:59.833349943 CET	49713	587	192.168.2.8	74.119.238.7
Jan 9, 2025 19:20:59.838244915 CET	587	49713	74.119.238.7	192.168.2.8
Jan 9, 2025 19:21:00.000847101 CET	587	49713	74.119.238.7	192.168.2.8
Jan 9, 2025 19:21:00.003684998 CET	49713	587	192.168.2.8	74.119.238.7
Jan 9, 2025 19:21:00.008593082 CET	587	49713	74.119.238.7	192.168.2.8
Jan 9, 2025 19:21:00.155623913 CET	587	49713	74.119.238.7	192.168.2.8
Jan 9, 2025 19:21:00.158099890 CET	49713	587	192.168.2.8	74.119.238.7
Jan 9, 2025 19:21:00.162950993 CET	587	49713	74.119.238.7	192.168.2.8
Jan 9, 2025 19:21:00.328505993 CET	587	49713	74.119.238.7	192.168.2.8
Jan 9, 2025 19:21:00.328526974 CET	587	49713	74.119.238.7	192.168.2.8
Jan 9, 2025 19:21:00.328537941 CET	587	49713	74.119.238.7	192.168.2.8
Jan 9, 2025 19:21:00.328562975 CET	587	49713	74.119.238.7	192.168.2.8
Jan 9, 2025 19:21:00.328598976 CET	49713	587	192.168.2.8	74.119.238.7
Jan 9, 2025 19:21:00.328644037 CET	49713	587	192.168.2.8	74.119.238.7
Jan 9, 2025 19:21:00.353754997 CET	49713	587	192.168.2.8	74.119.238.7
Jan 9, 2025 19:21:00.358741045 CET	587	49713	74.119.238.7	192.168.2.8
Jan 9, 2025 19:21:00.504951000 CET	587	49713	74.119.238.7	192.168.2.8
Jan 9, 2025 19:21:00.512433052 CET	49713	587	192.168.2.8	74.119.238.7
Jan 9, 2025 19:21:00.517549038 CET	587	49713	74.119.238.7	192.168.2.8
Jan 9, 2025 19:21:00.662344933 CET	587	49713	74.119.238.7	192.168.2.8
Jan 9, 2025 19:21:00.666250944 CET	49713	587	192.168.2.8	74.119.238.7
Jan 9, 2025 19:21:00.671158075 CET	587	49713	74.119.238.7	192.168.2.8
Jan 9, 2025 19:21:00.839073896 CET	587	49713	74.119.238.7	192.168.2.8
Jan 9, 2025 19:21:00.843955994 CET	49713	587	192.168.2.8	74.119.238.7
Jan 9, 2025 19:21:00.848875046 CET	587	49713	74.119.238.7	192.168.2.8
Jan 9, 2025 19:21:01.142646074 CET	587	49713	74.119.238.7	192.168.2.8
Jan 9, 2025 19:21:01.143083096 CET	49713	587	192.168.2.8	74.119.238.7
Jan 9, 2025 19:21:01.147958040 CET	587	49713	74.119.238.7	192.168.2.8
Jan 9, 2025 19:21:01.345741034 CET	587	49713	74.119.238.7	192.168.2.8
Jan 9, 2025 19:21:01.346036911 CET	49713	587	192.168.2.8	74.119.238.7
Jan 9, 2025 19:21:01.350891113 CET	587	49713	74.119.238.7	192.168.2.8
Jan 9, 2025 19:21:01.563409090 CET	587	49713	74.119.238.7	192.168.2.8
Jan 9, 2025 19:21:01.563823938 CET	49713	587	192.168.2.8	74.119.238.7
Jan 9, 2025 19:21:01.571538925 CET	587	49713	74.119.238.7	192.168.2.8
Jan 9, 2025 19:21:01.725317955 CET	587	49713	74.119.238.7	192.168.2.8
Jan 9, 2025 19:21:01.725924015 CET	49713	587	192.168.2.8	74.119.238.7
Jan 9, 2025 19:21:01.725991964 CET	49713	587	192.168.2.8	74.119.238.7
Jan 9, 2025 19:21:01.726011992 CET	49713	587	192.168.2.8	74.119.238.7
Jan 9, 2025 19:21:01.726030111 CET	49713	587	192.168.2.8	74.119.238.7
Jan 9, 2025 19:21:01.730747938 CET	587	49713	74.119.238.7	192.168.2.8
Jan 9, 2025 19:21:01.730792046 CET	587	49713	74.119.238.7	192.168.2.8
Jan 9, 2025 19:21:01.730895042 CET	587	49713	74.119.238.7	192.168.2.8
Jan 9, 2025 19:21:01.730916977 CET	587	49713	74.119.238.7	192.168.2.8
Jan 9, 2025 19:21:01.914511919 CET	587	49713	74.119.238.7	192.168.2.8
Jan 9, 2025 19:21:01.969959974 CET	49713	587	192.168.2.8	74.119.238.7
Jan 9, 2025 19:21:22.461850882 CET	59006	53	192.168.2.8	162.159.36.2
Jan 9, 2025 19:21:22.466782093 CET	53	59006	162.159.36.2	192.168.2.8
Jan 9, 2025 19:21:22.467396021 CET	59006	53	192.168.2.8	162.159.36.2
Jan 9, 2025 19:21:22.472289085 CET	53	59006	162.159.36.2	192.168.2.8
Jan 9, 2025 19:21:23.051292896 CET	59006	53	192.168.2.8	162.159.36.2
Jan 9, 2025 19:21:23.056431055 CET	53	59006	162.159.36.2	192.168.2.8
Jan 9, 2025 19:21:23.057373047 CET	59006	53	192.168.2.8	162.159.36.2
Jan 9, 2025 19:21:48.876611948 CET	49704	80	192.168.2.8	193.122.130.0
Jan 9, 2025 19:21:48.881675005 CET	80	49704	193.122.130.0	192.168.2.8
Jan 9, 2025 19:21:48.881752968 CET	49704	80	192.168.2.8	193.122.130.0
Jan 9, 2025 19:22:38.892230988 CET	49713	587	192.168.2.8	74.119.238.7
Jan 9, 2025 19:22:38.897552967 CET	587	49713	74.119.238.7	192.168.2.8
Jan 9, 2025 19:22:39.071489096 CET	587	49713	74.119.238.7	192.168.2.8
Jan 9, 2025 19:22:39.072096109 CET	49713	587	192.168.2.8	74.119.238.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 19:20:50.772507906 CET	57023	53	192.168.2.8	1.1.1.1
Jan 9, 2025 19:20:50.779486895 CET	53	57023	1.1.1.1	192.168.2.8
Jan 9, 2025 19:20:52.674276114 CET	61185	53	192.168.2.8	1.1.1.1
Jan 9, 2025 19:20:52.681684971 CET	53	61185	1.1.1.1	192.168.2.8
Jan 9, 2025 19:20:58.865067959 CET	60105	53	192.168.2.8	1.1.1.1
Jan 9, 2025 19:20:59.156749964 CET	53	60105	1.1.1.1	192.168.2.8
Jan 9, 2025 19:21:22.461225986 CET	53	56568	162.159.36.2	192.168.2.8
Jan 9, 2025 19:21:23.090610981 CET	59522	53	192.168.2.8	1.1.1.1
Jan 9, 2025 19:21:23.098062038 CET	53	59522	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 9, 2025 19:20:50.772507906 CET	192.168.2.8	1.1.1.1	0x893	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:20:52.674276114 CET	192.168.2.8	1.1.1.1	0x5ae9	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:20:58.865067959 CET	192.168.2.8	1.1.1.1	0x36fb	Standard query (0)	mail.alhoneycomb.com	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:21:23.090610981 CET	192.168.2.8	1.1.1.1	0x6650	Standard query (0)	198.187.3.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 9, 2025 19:20:50.779486895 CET	1.1.1.1	192.168.2.8	0x893	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 9, 2025 19:20:50.779486895 CET	1.1.1.1	192.168.2.8	0x893	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:20:50.779486895 CET	1.1.1.1	192.168.2.8	0x893	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:20:50.779486895 CET	1.1.1.1	192.168.2.8	0x893	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:20:50.779486895 CET	1.1.1.1	192.168.2.8	0x893	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:20:50.779486895 CET	1.1.1.1	192.168.2.8	0x893	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:20:52.681684971 CET	1.1.1.1	192.168.2.8	0x5ae9	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:20:52.681684971 CET	1.1.1.1	192.168.2.8	0x5ae9	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:20:52.681684971 CET	1.1.1.1	192.168.2.8	0x5ae9	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:20:52.681684971 CET	1.1.1.1	192.168.2.8	0x5ae9	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:20:52.681684971 CET	1.1.1.1	192.168.2.8	0x5ae9	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:20:52.681684971 CET	1.1.1.1	192.168.2.8	0x5ae9	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:20:52.681684971 CET	1.1.1.1	192.168.2.8	0x5ae9	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:20:59.156749964 CET	1.1.1.1	192.168.2.8	0x36fb	No error (0)	mail.alhoneycomb.com		74.119.238.7	A (IP address)	IN (0x0001)	false
Jan 9, 2025 19:21:23.098062038 CET	1.1.1.1	192.168.2.8	0x6650	Name error (3)	198.187.3.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	193.122.130.0	80	4528	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2025 19:20:51.056054115 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 9, 2025 19:20:52.561574936 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 18:20:52 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 741efe9bf4d3300482fd8e172df7151a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 9, 2025 19:20:52.565979958 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 9, 2025 19:20:52.672745943 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 18:20:52 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a410764abda7428ba100a7d74f2b8347 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 9, 2025 19:20:58.707268000 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 9, 2025 19:20:58.826674938 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 18:20:58 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 6d0e0af029d461b6f3a443f853170f9f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	104.21.32.1	443	4528	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 18:20:53 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-09 18:20:53 UTC	854	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 18:20:53 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1761642 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tKb2zlexQFvppUEsHe4DJAw5XUwrRHcHk7SYc3eN3AhgQSlY2uwPtVeBraqs8lVk5IcfOK5%2BN%2B5GeCNFeB4gF5mNFWUbJE5G4jmpAfscrd8InwU0aZn5Ee9U0t616BE%2BAAn0s5aS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff671a1286a4344-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1688&min_rtt=1680&rtt_var=647&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1670480&cwnd=47&unsent_bytes=0&cid=0b561654782de1d7&ts=224&x=0"
2025-01-09 18:20:53 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jan 9, 2025 19:20:59.829135895 CET	587	49713	74.119.238.7	192.168.2.8	220-md-la-5.webhostbox.net ESMTP Exim 4.96.2 #2 Thu, 09 Jan 2025 23:50:59 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 9, 2025 19:20:59.833349943 CET	49713	587	192.168.2.8	74.119.238.7	EHLO 216041
Jan 9, 2025 19:21:00.000847101 CET	587	49713	74.119.238.7	192.168.2.8	250-md-la-5.webhostbox.net Hello 216041 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jan 9, 2025 19:21:00.003684998 CET	49713	587	192.168.2.8	74.119.238.7	STARTTLS
Jan 9, 2025 19:21:00.155623913 CET	587	49713	74.119.238.7	192.168.2.8	220 TLS go ahead

Target ID:	0
Start time:	13:20:47
Start date:	09/01/2025
Path:	C:\Users\user\Desktop\Tepe - 20000000826476479.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Tepe - 20000000826476479.exe"
Imagebase:	0x260805c0000
File size:	1'449'984 bytes
MD5 hash:	62FE073A652C373CDCCEAF4226E62836
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000000.00000002.1575435424.0000026092608000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1575435424.0000026092608000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.1575435424.0000026092608000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1575435424.0000026092608000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.1574756756.000002608263B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:20:48
Start date:	09/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
Imagebase:
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	13:20:49
Start date:	09/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Imagebase:	0x980000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000003.00000002.2738093564.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2738093564.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000003.00000002.2738093564.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000003.00000002.2738093564.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2739861946.0000000002DA6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000003.00000002.2739861946.0000000002DA6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	13:20:49
Start date:	09/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Imagebase:
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	13:20:50
Start date:	09/01/2025
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 5352 -s 1028
Imagebase:	0x7ff62b0a0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	5
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFB4AFA026B Relevance: 3.2, Strings: 1, Instructions: 1910COMMON

Download Yara Rule

Strings

A, xrefs: 00007FFB4AFA0786

Memory Dump Source

Source File: 00000000.00000002.1577482443.00007FFB4AFA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AFA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4afa0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID: A
API String ID: 0-3554254475
Opcode ID: c0d2188678adb51e1e8c86a67c2d5d04b6a8104dd13aa33d090c676aaf762b20
Instruction ID: 3e9b56e3fb5b32f3166fae1601de998a0dc9be35b824108d8f46425579d4a9dc
Opcode Fuzzy Hash: c0d2188678adb51e1e8c86a67c2d5d04b6a8104dd13aa33d090c676aaf762b20
Instruction Fuzzy Hash: 92C2F4B280DB854FE756EF38D8955E4BFE0EF56300F2905FAD489CB1D2DA286846C781

Function 00007FFB4AECDFE9 Relevance: 2.9, Strings: 1, Instructions: 1679
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

6K_L, xrefs: 00007FFB4AECEE6D

Memory Dump Source

Source File: 00000000.00000002.1577142173.00007FFB4AEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4aec0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID: 6K_L
API String ID: 0-3397539424
Opcode ID: ee7d5098cf1458a3220a0bb3737d367f303f3d0b3e64e25a2dd9801e03baedbf
Instruction ID: 232f742fe39737157efbba667d77bffe4cc6c1ad7fb2ff8b16ea89f559574820
Opcode Fuzzy Hash: ee7d5098cf1458a3220a0bb3737d367f303f3d0b3e64e25a2dd9801e03baedbf
Instruction Fuzzy Hash: 17B2127160CB864FD359EF38C4814B5BBE2FF95301B2446BEE49AC7296DE24E846C781

Function 00007FFB4AEC0CC0 Relevance: 2.0, Strings: 1, Instructions: 724
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 00007FFB4AEC42DF

Memory Dump Source

Source File: 00000000.00000002.1577142173.00007FFB4AEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4aec0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 6605f822dd545b3bf1a13633eacb70e9a60d8b31583670d09815a3d595abec93
Instruction ID: 1a1b880c94e91802beb68e74d6d50b707a38173c5e9cde91dfec630f873c00b8
Opcode Fuzzy Hash: 6605f822dd545b3bf1a13633eacb70e9a60d8b31583670d09815a3d595abec93
Instruction Fuzzy Hash: 942255B195CA4A4FE359FF38D4855B177D0FF85310B2442FAD4AAC719BEE28A8438781

Function 00007FFB4AECB461 Relevance: 1.5, Instructions: 1543COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1577142173.00007FFB4AEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4aec0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e76d8fd83ed96b76284f722a404c7f1abe107bd389f0337c6d753e7f98e5e13d
Instruction ID: e31bb9aff350e06d5fa5b1836f4ae7980febe95c2c986a8c1d8eb0248c12a0dd
Opcode Fuzzy Hash: e76d8fd83ed96b76284f722a404c7f1abe107bd389f0337c6d753e7f98e5e13d
Instruction Fuzzy Hash: 2FB2377151CB8A8FE749EF38C4944B5BBE1FF95300B2445FED49AC72A2DA38A846C741

Function 00007FFB4AEC85B0 Relevance: .9, Instructions: 931
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1577142173.00007FFB4AEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4aec0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fa5710802ada8f22dd39ad222fc9aab1aca218d4edb2b7cabf04a65e776cb03
Instruction ID: 0e85c0d3be5a2777743f0bff58f7a165748891b338fb83b91a5fcb29134ef44f
Opcode Fuzzy Hash: 7fa5710802ada8f22dd39ad222fc9aab1aca218d4edb2b7cabf04a65e776cb03
Instruction Fuzzy Hash: 1352D470A0CA498FDB68FF29D455A7977E5FF99300B2401BDE49EC7292DE24EC428781

Function 00007FFB4AECB080 Relevance: .4, Instructions: 442COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1577142173.00007FFB4AEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4aec0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7ae507583cd753807b26918a7e3b9af4466c9a96cd913588dbfa7de3b4a0ed0
Instruction ID: b5c814123b0e9125280f08cdb7ab97d8fbfe0931f7d3bab9269c293dae923323
Opcode Fuzzy Hash: a7ae507583cd753807b26918a7e3b9af4466c9a96cd913588dbfa7de3b4a0ed0
Instruction Fuzzy Hash: 13D146B150CB864FE71CEF29C4951B5B7D2FFE5301B2446BED4DAC72A1DA28A802C781

Function 00007FFB4AECACBF Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1577142173.00007FFB4AEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4aec0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a47bb184838a2c7b731ceca776935da304226d0a7a3c407ffdb83a801c1be8c2
Instruction ID: 8a33022bbd61603b6a217403ab26d30399066f288a6d944d818dbec9b8437711
Opcode Fuzzy Hash: a47bb184838a2c7b731ceca776935da304226d0a7a3c407ffdb83a801c1be8c2
Instruction Fuzzy Hash: 85917BB1A4DB860FE31DEE399491175BBD3FFC5201B6482BEE4D6C32D1DD2898029381

Function 00007FFB4AED3EFB Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1577142173.00007FFB4AEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4aec0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbf1738d643b4325c1144292cd297171d796f4a1cfd3c87fef0c7f8ca50baca3
Instruction ID: e708f040d08dbabfb46de5c7ea85653efdad3b82c26005f9bd0d9987a696654d
Opcode Fuzzy Hash: fbf1738d643b4325c1144292cd297171d796f4a1cfd3c87fef0c7f8ca50baca3
Instruction Fuzzy Hash: D841267164C78A0FD71EAE38C8561B57BAAEB83210B25C2BFD49BC7197DD2858078391

Function 00007FFB4AED3F48 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1577142173.00007FFB4AEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4aec0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1750643d31a1c46fe6d54fb8e9e6ef579e802157be7e2cfa98fa1ef5bac0032
Instruction ID: 7387fadf46e9c25c3812759f883658eae99bdec706b331b4f05768998d6804f6
Opcode Fuzzy Hash: d1750643d31a1c46fe6d54fb8e9e6ef579e802157be7e2cfa98fa1ef5bac0032
Instruction Fuzzy Hash: BF41296154D7CE0FD31EAE74C8511A67FA9EB93200F1682FBD4DAC7197DD28580B8391

Function 00007FFB4AEC7A75 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 387
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

IJ_L, xrefs: 00007FFB4AEDDBEF

Memory Dump Source

Source File: 00000000.00000002.1577142173.00007FFB4AEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4aec0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID: IJ_L
API String ID: 0-4162620573
Opcode ID: eb4d8a8a228952af95e45cf422a800cc4441fa6e1ae61067c75ec45b7817538e
Instruction ID: e30e9d1c7a42aa15305574ca4c8d437d3b4a2088f55c9f0fc37c3a2f3a3f29b0
Opcode Fuzzy Hash: eb4d8a8a228952af95e45cf422a800cc4441fa6e1ae61067c75ec45b7817538e
Instruction Fuzzy Hash: 8BB129B1A0DA464FE758FE7CD8865B5B7D5FF98310F2042BEE09DC3292DD65A8028781

Function 00007FFB4AFA10C9 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1577482443.00007FFB4AFA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AFA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4afa0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 920a143ccc8502e13790b7c61af5db2ef1644ff3f59fd0e9346607fb55ee43a6
Instruction ID: 39ff3ca191da23f8552e1e016155b76a90b4097a5790c71275ce6018020ccb7c
Opcode Fuzzy Hash: 920a143ccc8502e13790b7c61af5db2ef1644ff3f59fd0e9346607fb55ee43a6
Instruction Fuzzy Hash: 8D415C7290DA8D4FEB56EF24D8914E87BE4FF55300B1505FBD04ACB1D2DA25AC41C781

Function 00007FFB4AFA0A04 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1577482443.00007FFB4AFA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AFA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4afa0000_Tepe - 20000000826476479.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1ddada2fdc3a3d3723ed44fe851841ae9bbb260f94a545a6aa9907019645713
Instruction ID: 88325c2e08871217a9882fadcf93c5838a7db6b02a64827f625a3e0ff2189155
Opcode Fuzzy Hash: a1ddada2fdc3a3d3723ed44fe851841ae9bbb260f94a545a6aa9907019645713
Instruction Fuzzy Hash: 34E01231A0562C8EEF60EB18CC81FEAB3B1FB88300F1041E6D44DE3241CA306A85CF82

Analysis Process: InstallUtil.exePID: 4528, Parent PID: 5352COMMON

Execution Graph

Execution Coverage:	12.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	25%
Total number of Nodes:	56
Total number of Limit Nodes:	4

Executed Functions

Function 012DC168 Relevance: 2.0, APIs: 1, Instructions: 497
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.2739489555.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f311415cb27f6e2326962cdc4690278243b53bff47c4cfb926d362cc2318e8a
Instruction ID: 4d4ed90f36cfe43e22d7bd7eca0969e4e4027ea2e59975ea4d6c7e696a9e30a0
Opcode Fuzzy Hash: 6f311415cb27f6e2326962cdc4690278243b53bff47c4cfb926d362cc2318e8a
Instruction Fuzzy Hash: 56223A74E102198FDB14DFA8C884BADBBB6FF88310F1481A9D409AB355DB719D85CF90

Function 05236998 Relevance: 1.0, Instructions: 963COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a485acb1dbf81c1230dbfa5a82ba8eb34b84ab7d0a234b1b114a1616057bf219
Instruction ID: 19b768912223f58dbfcd31eab5e993ffa4639e910d134cb051045c3e82eecba1
Opcode Fuzzy Hash: a485acb1dbf81c1230dbfa5a82ba8eb34b84ab7d0a234b1b114a1616057bf219
Instruction Fuzzy Hash: 478240B5A102199FDB14DF69C885AAEBBF6FF88300F148559E806EB355DB30ED41CB90

Function 05237770 Relevance: .9, Instructions: 901COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74d3d76e8644823ac98513373eed8a4d6a8cc09d6c0a0c4b9eb234d326700d4a
Instruction ID: 59c2746900db326c505cfe4b3ece80cf78689c27f9cf008377ea9ec76c3f817c
Opcode Fuzzy Hash: 74d3d76e8644823ac98513373eed8a4d6a8cc09d6c0a0c4b9eb234d326700d4a
Instruction Fuzzy Hash: F3824DB4A10606DFDB14CF68C985EAEBBF2FF88310F198555E84A9B2A1D730ED41CB50

Function 05234500 Relevance: .7, Instructions: 745
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4c06b656985a7620f9cb8d7e1b6782ad6e4ae6a4f58157770e57c9abdc5470b
Instruction ID: f23b9667a6bfe8e2b5f3e5cf4e8127bf9d4baab784f3aeebda53b5d573579c6c
Opcode Fuzzy Hash: b4c06b656985a7620f9cb8d7e1b6782ad6e4ae6a4f58157770e57c9abdc5470b
Instruction Fuzzy Hash: C0827E74E012298FDB65DF69C998BDDBBB2BF89301F1081EA940DA7254DB305E85DF40

Function 052315F8 Relevance: .3, Instructions: 296
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b15a980a76f0dde7ddd6678269014abbc98d9e968236698433bf951e17698bc
Instruction ID: bddfdf9a2ed59bc7dc2d9d8efc5dff826d4e17e039a53ebc2443cbafb0da5b77
Opcode Fuzzy Hash: 0b15a980a76f0dde7ddd6678269014abbc98d9e968236698433bf951e17698bc
Instruction Fuzzy Hash: 17E1ADB4E01218CFEB64DFA5C944B9DBBB2BF89300F2081A9D809B7394DB755A85CF54

Function 012D4F08 Relevance: .3, Instructions: 268
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.2739489555.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 949882eeec80fa3509982a57a8125a0531c71336fbf257c5ac5ff55618d8da9f
Instruction ID: 78386d6f05d1a2a926d020005aaa4de2656e56d9e63caa65e02ddd45f203ac5f
Opcode Fuzzy Hash: 949882eeec80fa3509982a57a8125a0531c71336fbf257c5ac5ff55618d8da9f
Instruction Fuzzy Hash: 96C19E78E01218CFDB64DFA9D944B9DBBB2BF88301F2080A9D809A7354DB359E85CF50

Function 012D5363 Relevance: .2, Instructions: 222
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.2739489555.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41d1e1874c8d868bbb7d55f8de6bd73e1fc255407416f3e6dce0232f20ae179d
Instruction ID: f200f382488d6b6aaee6e2d45507caf2dde3f9e536dd0cadbde32656d2060319
Opcode Fuzzy Hash: 41d1e1874c8d868bbb7d55f8de6bd73e1fc255407416f3e6dce0232f20ae179d
Instruction Fuzzy Hash: 78A11474D00209CFEB24DFA8D948B9DBBB1FF88300F208269E509A7395DB759985CF51

Function 012D56AF Relevance: .2, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.2739489555.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12d0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eeeb01b9a68bee557d9e58dbc9cb1f1cc5483c87569fbde4f11689e64ab6cfea
Instruction ID: 0a7f8aaeba0d01ca81500c630bb2b417f012265c43d85fd6f0956faf1728fae8
Opcode Fuzzy Hash: eeeb01b9a68bee557d9e58dbc9cb1f1cc5483c87569fbde4f11689e64ab6cfea
Instruction Fuzzy Hash: 11911374D00208CFEB20DFA8D948BACBBB1FF48300F209259E509AB291DBB59985CF55

Function 05231C58 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d713f22e1672ce8bcc465b92da49c6f3ac99ff03249ba7b926fe3d17fe7c348c
Instruction ID: a2f32086611c95a5a868035f0dd6ad60f1857a46dbaeb137c85f3ae02ac107e8
Opcode Fuzzy Hash: d713f22e1672ce8bcc465b92da49c6f3ac99ff03249ba7b926fe3d17fe7c348c
Instruction Fuzzy Hash: 3381CEB4E1021CCFDB18DFAAD8947ADBBF2BF89300F20816AD419AB254DB305945CF40

Function 052315F3 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 708971dca052dbbe1230e7e13d4c0ffad77b3f17277fa5176703f4f0751987b3
Instruction ID: f0b00c93fb5ec3ce9a2de76f37b8ef1fc3d21b03dcb07f4ba8db13ff4df1460f
Opcode Fuzzy Hash: 708971dca052dbbe1230e7e13d4c0ffad77b3f17277fa5176703f4f0751987b3
Instruction Fuzzy Hash: 0C41B2B0D112098BEB68DFAAC8447EEBBF2BF89300F14C169D418BB294DB755946CF54

Function 012DC76C Relevance: 1.6, APIs: 1, Instructions: 62
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 012DC8AE

Memory Dump Source

Source File: 00000003.00000002.2739489555.00000000012D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_12d0000_InstallUtil.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 53cca5861d50a275fd96367837501aa0fc1dd72f4a702a901e41405eb37aa54c
Instruction ID: 8576fecb8691008a8dc741490d105c5107912546efebbb970ff552534ec3ad83
Opcode Fuzzy Hash: 53cca5861d50a275fd96367837501aa0fc1dd72f4a702a901e41405eb37aa54c
Instruction Fuzzy Hash: 31116A74E142098FDB15DBA8D485EADBBB9FB88314F148129E848E7346D770AD41CB60

Function 05238848 Relevance: .8, Instructions: 781
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 319168a2586ab52772481647988289477d386746657c7282de6b109227070025
Instruction ID: 6dca3f74304782d647c8285e7cf1f425098fdd414f142d9c780dfdf0e3642327
Opcode Fuzzy Hash: 319168a2586ab52772481647988289477d386746657c7282de6b109227070025
Instruction Fuzzy Hash: C6626074A102199FEB24DBA4C860BAEBB72FFC8700F1080A9D50AAB394DF755D85DF51

Function 052365F1 Relevance: .2, Instructions: 220
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab758fc50caa7dfe0691d0f7c25785744c7f65fdb7b7f22af3f1b8917e3757e9
Instruction ID: c135a030f46656b2bcf3f8d4c44503e535acd678fbb5ba7f65335fcf379596bf
Opcode Fuzzy Hash: ab758fc50caa7dfe0691d0f7c25785744c7f65fdb7b7f22af3f1b8917e3757e9
Instruction Fuzzy Hash: A681B5B4B24106EFCB14CF68C485A6ABBBAFF88244B588169D416E7364D731FC41CF50

Function 052362A8 Relevance: .2, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1e02e44632d49ff861108885f3e913852d10c55908d9e5c59c898bf4b669279
Instruction ID: 56719955c8dfb0489fa5897ef4a8d966ba9e8109e4abcfb8e593aaa563b31a8d
Opcode Fuzzy Hash: b1e02e44632d49ff861108885f3e913852d10c55908d9e5c59c898bf4b669279
Instruction Fuzzy Hash: FB71E174710202AFDB299B74D499B3E7BABBFC9601B148469E50ACB384DF74EC42C790

Function 05236130 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca2cdd9ac4fd9c26df57022b7f145b2e00f052685597022c0cdc4a7d2c22718f
Instruction ID: 25de9565472c321c94d96be564c37ce41b480890a68a8c1ca5566e8e66fd353c
Opcode Fuzzy Hash: ca2cdd9ac4fd9c26df57022b7f145b2e00f052685597022c0cdc4a7d2c22718f
Instruction Fuzzy Hash: FC5106B5724212AFDB158F64D849BBE7BFAFF88200F054819E44ACB380DB74E801C790

Function 052384F8 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 354f00d5ee29b7ce88f0fcdaead2ea56d0f0641c64e0e47870bb10b6230976d2
Instruction ID: 4ad22c4f042da08b72762daf757741e88d0a49f5b4a1771aea13e301d8e9865f
Opcode Fuzzy Hash: 354f00d5ee29b7ce88f0fcdaead2ea56d0f0641c64e0e47870bb10b6230976d2
Instruction Fuzzy Hash: 635190B5B251129FCB14DF39C899A7A7BEABF4825070644BAF40ACF361EB70DC018B50

Function 05232508 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b288a636eb0bc13e201fa44b869474e41b68e436dc67dcad08e720702615f1db
Instruction ID: 1ddb4abbc76c5e7b236b2bc431f0cbf8ce51e039e37136ba1e6192729494799a
Opcode Fuzzy Hash: b288a636eb0bc13e201fa44b869474e41b68e436dc67dcad08e720702615f1db
Instruction Fuzzy Hash: 2E518035F102199BDB19EBB5C4506AEBBB2BFC4700F148529E406BB380DF34AD46CB91

Function 052344F0 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e98162bb724360e3d6b4e8e55284a8865656c70060351ab239cc5b5501ae046a
Instruction ID: 6923525316bedbe9f2eb5cbf001903da5c76e07ad07f023a12d15fd8b8858c17
Opcode Fuzzy Hash: e98162bb724360e3d6b4e8e55284a8865656c70060351ab239cc5b5501ae046a
Instruction Fuzzy Hash: 7481B174E112698FDB65DF29D894BEDBBB2BF89300F1080EAD849A7254DB715E81CF40

Function 05235F08 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7f8b6e4b1f5c3dbb72b5e307fc9afac423322cbb5d205b926233261cc17c40a
Instruction ID: ed09048cbad6df9aa47e0a77f0221d1097f0607ec6f1a491e3ffe1c205a9cd2f
Opcode Fuzzy Hash: b7f8b6e4b1f5c3dbb72b5e307fc9afac423322cbb5d205b926233261cc17c40a
Instruction Fuzzy Hash: 2741CE343107028FD724AB39D819B3A7BE6BFC5644F14856DE44ACB3A0EB60EC058B40

Function 05232503 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19ec5bb2e2f9674e30405a371a8b548e9d6a9870243a9e83c378ff7c6f8a7249
Instruction ID: ca6ad2b8ee49e82449b34424443ea138a8b7f8c8fd3c070acbeb98c38193f913
Opcode Fuzzy Hash: 19ec5bb2e2f9674e30405a371a8b548e9d6a9870243a9e83c378ff7c6f8a7249
Instruction Fuzzy Hash: 29415575E1021ADBDB14DFA5C891AEEBBF5BF88700F148129E406B7240DB70AD46CF90

Function 052382F8 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3339959f5ddb4c69efb55dcdfec807395902da296a26e6f5fea7630736d6105
Instruction ID: 0f45e29362c4938491c244a0064ae0e71f625a3d08e0aa0ef0a871f6ef4f825d
Opcode Fuzzy Hash: e3339959f5ddb4c69efb55dcdfec807395902da296a26e6f5fea7630736d6105
Instruction Fuzzy Hash: 8F4148B5624115DFCB18DF68D849AAE7BB2BF88311F110069FA0ACB3A1DB70DD51CB91

Function 05235858 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e257e4d27fb6128656709bd0ca69fd051257459fecf3b60af239920201591ed7
Instruction ID: a3fa4b76cad288c636132591d85d2c7f6dec05a6ec989bbff7bfc55f5687f54f
Opcode Fuzzy Hash: e257e4d27fb6128656709bd0ca69fd051257459fecf3b60af239920201591ed7
Instruction Fuzzy Hash: B041C07971420AAFCF059FA4D899ABE3BB2FF48210F004415F90AD7294DB35CD61DB91

Function 05238729 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b9cf6fe5c74d3fd134ed56a0e08aefb6dfc4e83c0e1ccc3f55ff2c857de7faf
Instruction ID: 020e3f333bc5d918be97c4717029ad9044e3ca7a6960fc2ab9b1d8aab5d7d101
Opcode Fuzzy Hash: 9b9cf6fe5c74d3fd134ed56a0e08aefb6dfc4e83c0e1ccc3f55ff2c857de7faf
Instruction Fuzzy Hash: A92136B93362128BDB249735845573E298BBFC8605F148039E80ACF398EE75CC819381

Function 05238640 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b1881974cd1ec474ba27f623a4381a53b218bd5dab2e516dab99957991ee0a6
Instruction ID: 187df82373ec4a598482e3b99d82a21c356fdf14cd01e332c484e22bfa31468b
Opcode Fuzzy Hash: 5b1881974cd1ec474ba27f623a4381a53b218bd5dab2e516dab99957991ee0a6
Instruction Fuzzy Hash: 0E2180B533A1569BCB14DE669C41A7B7BEBBF89250B144436F816DF244DBB0D801CBA0

Function 0128D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2739199706.000000000128D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0128D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_128d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3af685c6751f00006c4cc921272cab4b7eb6e5f051e9fb4a7fe3b58e1888d20
Instruction ID: 08fd33a722760fc99a93e18c97eec825d93cbf932106a4253a86d18960da2221
Opcode Fuzzy Hash: b3af685c6751f00006c4cc921272cab4b7eb6e5f051e9fb4a7fe3b58e1888d20
Instruction Fuzzy Hash: E6212271618308DFDB11EF54D980B26BBA1FB84314F20C66DD9094B2C2C37AD84BCB62

Function 05231EB9 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 657ce83d49b631a15a5cb2672142d4a240b44d9fbaa8939e5803ee46c0f56353
Instruction ID: 272ffd9e6404ee01f3576962c13f441f67f07014ab8993cb8d54f2c520d28490
Opcode Fuzzy Hash: 657ce83d49b631a15a5cb2672142d4a240b44d9fbaa8939e5803ee46c0f56353
Instruction Fuzzy Hash: 5211E874E502498FDB14DBE8D851BAEBBF5EF88311F048061E808E7348E73199528B51

Function 0128D02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2739199706.000000000128D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0128D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_128d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction ID: dc927a4e6e4ca7ffd1592c5a82cc6c927803883dd4c22298e8fa3ca4e8a3afda
Opcode Fuzzy Hash: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction Fuzzy Hash: B911BB75504288CFCB12DF58D5C0B15BBA2FB84324F28C6AAD9494B697C33AD44BCB62

Function 05232990 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc6ad77892407ff43eb1d17c8a3421eb38d69f733b2cc1b0b82a32e6a9e55246
Instruction ID: d191ff7332c3a5ae2b50ca2649bd1b86875ac08cefe53d54c08c81c7abdca7d7
Opcode Fuzzy Hash: bc6ad77892407ff43eb1d17c8a3421eb38d69f733b2cc1b0b82a32e6a9e55246
Instruction Fuzzy Hash: 781142B680024ADFCB10CF99C845BEEBBF5EF48320F14841AE518A7250D339A594DFA0

Function 05232998 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38d9ea3eb61530b2b6b53522415e28ccbba91726acaae72b479cb81b9a42432b
Instruction ID: 8a7cb385fc46411dba510c35279cb94a8169f109402750db8e197b532f3c26d6
Opcode Fuzzy Hash: 38d9ea3eb61530b2b6b53522415e28ccbba91726acaae72b479cb81b9a42432b
Instruction Fuzzy Hash: 2F1123B6800249DFDB20DF9AC845BEEBFF5EF48320F148419E518A7250C379A554DFA1

Function 05235EF8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5afff07d434394e3685aa9937a2ee9b55b4ae11b9039d21c3b714a49ef38d0c9
Instruction ID: d854d3b8e9b4e881c928dcbed3080003bbc483fb4f4695a1c4a48a3cc556bfe4
Opcode Fuzzy Hash: 5afff07d434394e3685aa9937a2ee9b55b4ae11b9039d21c3b714a49ef38d0c9
Instruction Fuzzy Hash: BD11C274300B068FD725DB29D404B6ABBB2BFC1745F048A59D45E8B661EB70E8088785

Function 052360B0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b1e5be0f0f56b9ac1aba0700a2fde54495547ecb8099efcd3dc6252a64a1a9d
Instruction ID: 9f32259fdd508f79c78e521d1511e537efb97c8355eab96ce82f9624219568a8
Opcode Fuzzy Hash: 1b1e5be0f0f56b9ac1aba0700a2fde54495547ecb8099efcd3dc6252a64a1a9d
Instruction Fuzzy Hash: 340126767241197BCB01DE58D805EAF3BABEFC8650F04802AF509D7280DE719C11D794

Function 052360A0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d27e7bdfdcf3a2b829a3802c5b4de5779a02223c76431186cc48a9d451cfb28
Instruction ID: 2d789aa7331203abe341fad3762f39da8bfd665c918df34c114cf2227076817f
Opcode Fuzzy Hash: 5d27e7bdfdcf3a2b829a3802c5b4de5779a02223c76431186cc48a9d451cfb28
Instruction Fuzzy Hash: 32F0F4B7A14119BBDB11CE94DC06FEF3BAAEF88340F088026F509D7280DA35D911C750

Function 0523274B Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff8e5f220d99169ce17e250de99279085485e32414caf87314463db5cbc7fa81
Instruction ID: de034f36b0ff901a2004ff0a8421a6aa87c0d4c4c57a49e1ae1144001d94b66c
Opcode Fuzzy Hash: ff8e5f220d99169ce17e250de99279085485e32414caf87314463db5cbc7fa81
Instruction Fuzzy Hash: A6F0F63B3043956FCB069FA89854AFE3FB7EFC9210B04442AF545C7251CA3148219765

Function 0523947D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4895f0a1c2d2fec4842b720a03899dfceab2a3793e70a06594ff5e78958201fb
Instruction ID: 5421bfe52e3cdc87f37ca77d7ac96593b45f61a58066b788f770bcd079c4b1f1
Opcode Fuzzy Hash: 4895f0a1c2d2fec4842b720a03899dfceab2a3793e70a06594ff5e78958201fb
Instruction Fuzzy Hash: 61D0673AB00008AFCB149F99EC54DDDF776FB98221B049116F915A3260C6319925DB60

Function 052368A1 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 289c45cbe7418e315bb0836e7463a7e9c344857b135570a03fc401bc7b0d5a7f
Instruction ID: 10ef8c6dfab099e6681eccb22dab536db7376593e11e5e9b2316bd06106bdb47
Opcode Fuzzy Hash: 289c45cbe7418e315bb0836e7463a7e9c344857b135570a03fc401bc7b0d5a7f
Instruction Fuzzy Hash: 20D05E3441432D4FD605FBA8FC45F563B3ABBC0506FC49221E4059A1CEEEB899A48785

Function 052368B0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c65d52c685aab03e614966fa08b146d7095473b2977db89fa7229d82b77cea7b
Instruction ID: fc75e24d32f5fd6ba2b789c9ece9107bea48e5d6b30b29b2233add0045aac49b
Opcode Fuzzy Hash: c65d52c685aab03e614966fa08b146d7095473b2977db89fa7229d82b77cea7b
Instruction Fuzzy Hash: 7DC012340503194FD541FBA5F845A55373A7AC05017C0A610E4055E18DDF745DA54791

Non-executed Functions

Function 0523E928 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 668f57ad2c3f871f141a299c67c5132903a941636c5a36e64c41f36343c8c729
Instruction ID: 928a0d6097fc757a0363d897b9098b98e0c73a9708e29be4a52d94170e4bd931
Opcode Fuzzy Hash: 668f57ad2c3f871f141a299c67c5132903a941636c5a36e64c41f36343c8c729
Instruction Fuzzy Hash: 59C1BF74E01218CFDB54DFA5C984BADBBB2BF89300F6080A9D809AB354DB359E85CF50

Function 0523C530 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fe6468179d02c0d718ef075413f870e625625f10bc25257d6938ef0d2e2b22a
Instruction ID: 5a245824bd99d01aed9b73ac9962ced7836ccf1143d0e1fbafafda53576f9692
Opcode Fuzzy Hash: 1fe6468179d02c0d718ef075413f870e625625f10bc25257d6938ef0d2e2b22a
Instruction Fuzzy Hash: AEC18D74E11218CFDB54DFA5C984BADBBB2BF89300F6080A9D809BB254DB359E85CF50

Function 05230D48 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f48a10d18ce513de60ff14d6e5efef426c8b2d6dca1cab499f8b94e17e5ec4a4
Instruction ID: b1147b527ca602ddf06b210cf7035f15cf17801870b29fedb1fa00ee944740de
Opcode Fuzzy Hash: f48a10d18ce513de60ff14d6e5efef426c8b2d6dca1cab499f8b94e17e5ec4a4
Instruction Fuzzy Hash: 05C1AF78E01218CFDB54DFA5D994BADBBB2BF89300F5080A9D809AB354DB359E85CF50

Function 052311A0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a097ddb9aa4d8eb0b179a468962ea39cdbbbe30ff35a5763f44bb5229c55988a
Instruction ID: 617dd4af1f1d1657f9e68b27be15f1f63fba089e788c367e4af7b3c9133265df
Opcode Fuzzy Hash: a097ddb9aa4d8eb0b179a468962ea39cdbbbe30ff35a5763f44bb5229c55988a
Instruction Fuzzy Hash: 03C19D74E01218CFDB54DFA5C994BADBBB2BF89300F6081A9D809AB354DB359E85CF50

Function 0523ED80 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62fa86f8786df8b675b9b56ce0b55b1bef9286db1e3f10bc8dc9f8645aabd186
Instruction ID: b02eca38a246f1cadf2b30b28dfa2d9293ee5c25161c96425f0002fa17f8a8a8
Opcode Fuzzy Hash: 62fa86f8786df8b675b9b56ce0b55b1bef9286db1e3f10bc8dc9f8645aabd186
Instruction Fuzzy Hash: 28C1BF74E01218CFDB54DFA5D984BADBBB2BF89300F6080A9D809AB354DB359E85CF50

Function 0523C988 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 522323ba46892338ba2715d61c48dec96f2709b8bb52dbf0f88e1169f72edc95
Instruction ID: 84e9e8f739e1e3275670f178b13f2d43fac404fa56c98f7ac492da09f96fff54
Opcode Fuzzy Hash: 522323ba46892338ba2715d61c48dec96f2709b8bb52dbf0f88e1169f72edc95
Instruction Fuzzy Hash: 7DC18B74E11218CFDB54DFA5C994BADBBB2BF89300F6080A9D809BB254DB359E85CF50

Function 0523CDE0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc42d8c69716160e298ce373ac31d7fbb0c9f1bcd11389ba0237d7c905a5cfe1
Instruction ID: c264d8bb66b33b7bfa123a582d83b597f95c137b50c8b427e8f5b0f23701784c
Opcode Fuzzy Hash: fc42d8c69716160e298ce373ac31d7fbb0c9f1bcd11389ba0237d7c905a5cfe1
Instruction Fuzzy Hash: 0FC19E74E11218CFDB54DFA5C984BADBBB2BF89300F6080A9D809AB355DB359E85CF50

Function 0523F1D8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c689da7d66c4e6e3f19a497a4d1e7c7d81209863c3d60e20c6e49c1740322304
Instruction ID: 7b55788db51586dfe14d202a38e474daede2b4ac3841483ee431b63a0782db93
Opcode Fuzzy Hash: c689da7d66c4e6e3f19a497a4d1e7c7d81209863c3d60e20c6e49c1740322304
Instruction Fuzzy Hash: 74C1AF74E11218CFDB54DFA5D984BADBBB2BF89300F6081A9D809AB354DB359E81CF50

Function 0523DC20 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49f9bfbb9d06d9baa4615c5ec9444dbe52af33d56451f419846caf576d97a7ca
Instruction ID: 5a474d68192065e30b19b364a0aa36d323e9ca0b2733cecc3928a5c32bef5cc6
Opcode Fuzzy Hash: 49f9bfbb9d06d9baa4615c5ec9444dbe52af33d56451f419846caf576d97a7ca
Instruction Fuzzy Hash: FCC1AF74E10218CFDB54DFA5C984BADBBB2BF89300F6080A9D809AB355DB359E85CF50

Function 0523B828 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb08f2ea7a1e5e6f94f3c5a1ffb2052ee97022273fd883320ef6ab003d20e671
Instruction ID: 9e403fcb4e31e0e74b0e3d987ff25451704a499bbc52e8df954356ddf0139bdf
Opcode Fuzzy Hash: cb08f2ea7a1e5e6f94f3c5a1ffb2052ee97022273fd883320ef6ab003d20e671
Instruction Fuzzy Hash: C7C1A074E10218CFDB54DFA5C994BADBBB2BF89300F6080A9D409AB364DB359E85CF50

Function 0523E078 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e68b338fb2e15a3fa0d03e089be8eeed9c27903ce9127e18ce9ce29d55bfbd06
Instruction ID: 2da6324dc0062a6342eb2c977609f95c2e1bf016189062b4647d42be51bfb927
Opcode Fuzzy Hash: e68b338fb2e15a3fa0d03e089be8eeed9c27903ce9127e18ce9ce29d55bfbd06
Instruction Fuzzy Hash: 6BC1AF74E10218CFDB54DFA5C984BADBBB2BF89300F6080A9D809AB355DB359E85CF50

Function 05230040 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6b20bc5fc26e12b4d08e48f94103515609b7c81967381c6c93e2ac8005efacc
Instruction ID: 6e26ebdf252c2974bf3f02907b97cd4c77b3557be47e9c1528a63d6fb2542572
Opcode Fuzzy Hash: d6b20bc5fc26e12b4d08e48f94103515609b7c81967381c6c93e2ac8005efacc
Instruction Fuzzy Hash: 47C1AF74E01218CFDB54DFA5D944BADBBB2BF89300F5080A9D809AB355DB359E85CF50

Function 05233C50 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fb57a525e94563903bb7d19534ae22bc95b0f7db05f887dd181d4de15a9f81a
Instruction ID: 595d7c6d358d83caeffb83ade1dd1f85644d17b99c015172775e1e9835cd8493
Opcode Fuzzy Hash: 4fb57a525e94563903bb7d19534ae22bc95b0f7db05f887dd181d4de15a9f81a
Instruction Fuzzy Hash: F3C1A074E11218CFDB54DFA5C944BADBBB2BF89300F6080A9D809AB355DB359E85CF50

Function 052340A8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cecc1b743f05e01e1176e7d45fa8a1d1c3a8a12172341990437d6b6103e9a84b
Instruction ID: 8063f21050db709458f36da4e9de273885252fbb13433ecb43cdb1d4869f43a4
Opcode Fuzzy Hash: cecc1b743f05e01e1176e7d45fa8a1d1c3a8a12172341990437d6b6103e9a84b
Instruction Fuzzy Hash: 57C19E74E10218CFDB54EFA5C984BADBBB2BF89300F6081A9D409AB355DB359E81CF50

Function 0523BC80 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab65d9642cf84491c9c85b8dcde8ba14abf222d5ee8f4fd5978c0a18887bd768
Instruction ID: 921087dd96a1e8892ddd0c5415066c177944a9d32ee5c6b8166d95fec5e10fc0
Opcode Fuzzy Hash: ab65d9642cf84491c9c85b8dcde8ba14abf222d5ee8f4fd5978c0a18887bd768
Instruction Fuzzy Hash: 1AC19D74E10218CFDB54DFA5C984BADBBB2BF89300F6081A9D809AB355DB359E85CF50

Function 05230498 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07b4ff8f80f459072c56eacc9bb1ad9a8a26066a321fec796e4f704a4b236e4
Instruction ID: b32380eb14dddd77f7f8238ee2a2e1ea399aeb9cf44e6163e21bbdbedcfed740
Opcode Fuzzy Hash: b07b4ff8f80f459072c56eacc9bb1ad9a8a26066a321fec796e4f704a4b236e4
Instruction Fuzzy Hash: C6C19D74E01218CFDB54DFA5C994BADBBB2BF89300F6080A9D809AB355DB359E85CF50

Function 052308F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbe47238a7160a46b2ed4649925cbb57afa7319fdedc428d2e350cb76a0b8d25
Instruction ID: 1c92995c1ac82ed78b1d97fb33d5a2ae510883879346cb0f27a1520ce8a0ff75
Opcode Fuzzy Hash: bbe47238a7160a46b2ed4649925cbb57afa7319fdedc428d2e350cb76a0b8d25
Instruction Fuzzy Hash: 0DC1AE74E01218CFDB54DFA5C984BADBBB2BF89300F6081A9D809AB354DB359E85CF50

Function 0523E4D0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cd551924b3063a7484b6334a6a5a0039df82c187f933f0cc38e6a4689fec7cb
Instruction ID: f86c4ea3a42293b472375c6a492c59bac529724384df89b041d31eac1715874e
Opcode Fuzzy Hash: 2cd551924b3063a7484b6334a6a5a0039df82c187f933f0cc38e6a4689fec7cb
Instruction Fuzzy Hash: 24C19F74E11218CFDB54DFA5C984BADBBB2BF89300F6080A9D409AB364DB359E85CF50

Function 0523C0D8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6e346a8a0dcc497f3b9e9a9496639dbb7b6bb2820d860f9da4cd236b5ee0747
Instruction ID: a2138b8ae5274c4a0f368deefa96e02b1635ab9918a34c958ad051654ddddfb2
Opcode Fuzzy Hash: d6e346a8a0dcc497f3b9e9a9496639dbb7b6bb2820d860f9da4cd236b5ee0747
Instruction Fuzzy Hash: C4C19B74E10218CFDB54DFA5C984BADBBB2AF89300F6081A9D809BB254DB359E85CF50

Function 0523AB20 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 668d551b2a3304634449d05783b30cb44399f23151c98f4c0e632fac0bb9c4c5
Instruction ID: 4f387551bef25944c267dc18bb4826868626df33a4d195caea678ab4a11935f2
Opcode Fuzzy Hash: 668d551b2a3304634449d05783b30cb44399f23151c98f4c0e632fac0bb9c4c5
Instruction Fuzzy Hash: 60C1A074E10218CFDB54DFA5C944BADBBB2BF89300F6080A9D809AB355DB359E85CF50

Function 0523AF78 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54b0863229733745b92c4ef28284988c9aac65cbe06bb9b17ddea42ca4020edd
Instruction ID: 72bfb6084c1dd3efdfdba7f6d7b177c24290b6452d16189c56ca812529238796
Opcode Fuzzy Hash: 54b0863229733745b92c4ef28284988c9aac65cbe06bb9b17ddea42ca4020edd
Instruction Fuzzy Hash: 1CC1AF74E11218CFDB54DFA5C984BADBBB2BF89300F6081A9D409AB364DB359E85CF50

Function 05232F48 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c41c02a9ba939b393dc2b604eb46cdbe6f46dbf57e6ae4e67d902bab71c8d3f0
Instruction ID: fe03fa701ce9a83d9bbd6d6c38dbef8213079bce4d62947a70d72fbc76aa6ccf
Opcode Fuzzy Hash: c41c02a9ba939b393dc2b604eb46cdbe6f46dbf57e6ae4e67d902bab71c8d3f0
Instruction Fuzzy Hash: 54C1AF74E00218CFDB54DFA9C984BADBBB2BF89300F6081A9D409AB355DB359E81CF50

Function 052333A0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90df24e77397eb8e96db396c242da3ffd955a4a6efff92c897055e2a221f60e5
Instruction ID: 1d690285feb398fd6b27af588af95e72972d0cda5ab59978874a3ad5c7dbccdc
Opcode Fuzzy Hash: 90df24e77397eb8e96db396c242da3ffd955a4a6efff92c897055e2a221f60e5
Instruction Fuzzy Hash: C9C1AF74E00218CFDB54DFA5C984BADBBB2BF89300F6081A9D809AB354DB359E81CF50

Function 052337F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25b659608dc679676257335d6f88d422f06e52357c8d1db2b9085f221b6e895e
Instruction ID: d0b403e83d8d56373c2e998e1fb406df12e7d1722b2b87d4769a6e934f75afd1
Opcode Fuzzy Hash: 25b659608dc679676257335d6f88d422f06e52357c8d1db2b9085f221b6e895e
Instruction Fuzzy Hash: D1C1AE74E00218CFDB54DFA5C984BADBBB2BF89300F6085A9D809AB355DB359E85CF50

Function 0523B3D0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6534f5b4ab42b915432d70f0fc7f6755899d56c97df5563277ecb65d9e6faf1
Instruction ID: aef14a5bf4b03a0c8b82a5fe0291e24822248c9732b6acccaf278de90d8427d0
Opcode Fuzzy Hash: b6534f5b4ab42b915432d70f0fc7f6755899d56c97df5563277ecb65d9e6faf1
Instruction Fuzzy Hash: 8BC1AE74E01218CFDB54DFA5C994BADBBB2BF89300F6080A9D809AB355DB359E81CF50

Function 0523F630 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f26b25dcec94bd8aa01498fc07d981b7c2e56670802a4666c89707435e2dbef2
Instruction ID: 8339b6304f117038d56d80e80bd50fedee8f9a5de16aa5109dea254d90bfc884
Opcode Fuzzy Hash: f26b25dcec94bd8aa01498fc07d981b7c2e56670802a4666c89707435e2dbef2
Instruction Fuzzy Hash: 6DC1AF74E11218CFDB54DFA5D984BADBBB2BF89300F6080A9D809AB354DB359E85CF50

Function 0523D238 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44f817d70cb2b2012f48c3f85a00981fac7cee3b83d03bb447ece40f1bb6f450
Instruction ID: a85be137240bd6175d9c72ab52ceaebdae67d3507b1fd786a1655d2228907edf
Opcode Fuzzy Hash: 44f817d70cb2b2012f48c3f85a00981fac7cee3b83d03bb447ece40f1bb6f450
Instruction Fuzzy Hash: 61C1BF74E10218CFDB54DFA5C984BADBBB2BF89300F6080A9D809AB354DB359E81CF50

Function 05239E18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fa49f1e95d9ad89f42081a051a7febfc18ebb46b475dbc625886ab73666be68
Instruction ID: 98ccf6aaf5347d9d86179de43e5d838834e4087914998bc85c51529ed7b55408
Opcode Fuzzy Hash: 5fa49f1e95d9ad89f42081a051a7febfc18ebb46b475dbc625886ab73666be68
Instruction Fuzzy Hash: 17C1AF74E11218CFDB54DFA5C994BADBBB2BF89300F6080A9D809AB354DB359E85CF50

Function 0523A270 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d93caf633a5b5f07212249b1ca0c4c5b64d72c3c860d65696dc119e3bc8e35b5
Instruction ID: 77394ea5099a8cca1385da9fd34c5e4a7d1aceb26bc122833c922bab1eadca76
Opcode Fuzzy Hash: d93caf633a5b5f07212249b1ca0c4c5b64d72c3c860d65696dc119e3bc8e35b5
Instruction Fuzzy Hash: 67C1A074E11218CFDB54DFA5C944BADBBB2BF89300F6081A9D809AB354DB359E85CF50

Function 0523FA88 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdd07bb3e99759ea33244d0187ce719f99f508140574a73b6c2d77e70eec09e4
Instruction ID: 16f399850757edc8eb7d5b7a7a3b374ec2db035085e02e67b6b53df7a9a26da3
Opcode Fuzzy Hash: bdd07bb3e99759ea33244d0187ce719f99f508140574a73b6c2d77e70eec09e4
Instruction Fuzzy Hash: C1C1B074E10218CFDB54DFA5D944BADBBB2BF89300F6080A9D809AB365DB359E85CF50

Function 0523D690 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d0d39ef12cde9aa0735a6cfcadd509365fc6b9513d34a02d4ec4167b3b07b52
Instruction ID: e1b837771d29a361b2c7e236fcc2940b79f016419398b24740cb2f240e35c1fa
Opcode Fuzzy Hash: 0d0d39ef12cde9aa0735a6cfcadd509365fc6b9513d34a02d4ec4167b3b07b52
Instruction Fuzzy Hash: 63C1BF74E10218CFDB14DFA5C984BADBBB2BF89300F6480A9D809AB354DB359E81CF50

Function 05232AF0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 146d9c4e1b4e323a13889df4ecacc0d08c50885733867f5b166399705c9ef881
Instruction ID: a6f4b67d35da1df58ae7ff69ee76bd3cc749dddf8b2b8a93a6ba8c5f1670af5f
Opcode Fuzzy Hash: 146d9c4e1b4e323a13889df4ecacc0d08c50885733867f5b166399705c9ef881
Instruction Fuzzy Hash: E3C19F78E11218CFDB54DFA5C954BADBBB2BF89300F6080A9D809AB354DB359E85CF50

Function 0523A6C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2742067362.0000000005230000.00000040.00000800.00020000.00000000.sdmp, Offset: 05230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5230000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16a82e47529e0cb595b05d239ddd23331e5cdda19d2ca8ee6c1ffb26f0a54617
Instruction ID: 582798d3b05c87f5ad69492e99ff91b2443b1b5788425a178ab8257c7e04724a
Opcode Fuzzy Hash: 16a82e47529e0cb595b05d239ddd23331e5cdda19d2ca8ee6c1ffb26f0a54617
Instruction Fuzzy Hash: 95C19E74E11218CFDB54DFA5C984BADBBB2BF89300F6080A9D809AB354DB359E81CF50

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Tepe - 20000000826476479.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: MassLogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Exploits

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Tepe - 200000008_b34044648ff360a99e48402af82a47894a32b5a7_b309c098_24496982-b67a-43e7-943a-8c8fcc4671ba\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6266.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER639F.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER63CF.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
Tepe - 20000000826476479.exe

Function 00007FFB4AECDFE9 Relevance: 2.9, Strings: 1, Instructions: 1679
COMMON

Function 00007FFB4AEC0CC0 Relevance: 2.0, Strings: 1, Instructions: 724
COMMON

Function 00007FFB4AEC85B0 Relevance: .9, Instructions: 931
COMMON

Function 00007FFB4AEC7A75 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 387
COMMON

Function 012DC168 Relevance: 2.0, APIs: 1, Instructions: 497
COMMON

Function 05234500 Relevance: .7, Instructions: 745
COMMON

Function 052315F8 Relevance: .3, Instructions: 296
COMMON

Function 012D4F08 Relevance: .3, Instructions: 268
COMMON

Function 012D5363 Relevance: .2, Instructions: 222
COMMON