Edit tour

Windows Analysis Report
Wru9ycO2MJ.exe

Overview

General Information

Sample name:	Wru9ycO2MJ.exe renamed because original name is a hash value
Original sample name:	851cadfb7b72af94db5c9db85e0d52dfcbf3fa948c7498627e4b67162cff6e7d.exe
Analysis ID:	1588700
MD5:	e984689ddc606e421d3cf8746ac0783e
SHA1:	209d2263e1baff1943533effa0f3e1964d98b8cd
SHA256:	851cadfb7b72af94db5c9db85e0d52dfcbf3fa948c7498627e4b67162cff6e7d
Tags:	AgentTeslaexeuser-adrian__luca
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

AI detected suspicious sample

Installs a global keyboard hook

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Wru9ycO2MJ.exe (PID: 4120 cmdline: "C:\Users\user\Desktop\Wru9ycO2MJ.exe" MD5: E984689DDC606E421D3CF8746AC0783E)

Wru9ycO2MJ.exe (PID: 4668 cmdline: "C:\Users\user\Desktop\Wru9ycO2MJ.exe" MD5: E984689DDC606E421D3CF8746AC0783E)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.showpiece.trillennium.biz", "Username": "build@showpiece.trillennium.biz", "Password": "3KJ[T.3]fsSW"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.4504072782.0000000002B1C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.4502142983.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.4502142983.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.4504072782.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.4504072782.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2070865518.0000000004330000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2070865518.0000000004330000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Wru9ycO2MJ.exe PID: 4120	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Wru9ycO2MJ.exe PID: 4120	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Wru9ycO2MJ.exe PID: 4120	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Wru9ycO2MJ.exe PID: 4668	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Wru9ycO2MJ.exe PID: 4668	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Wru9ycO2MJ.exe.4330708.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Wru9ycO2MJ.exe.4330708.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Wru9ycO2MJ.exe.4330708.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316f1:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31763:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317ed:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3187f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318e9:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3195b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319f1:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a81:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.2.Wru9ycO2MJ.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.Wru9ycO2MJ.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.Wru9ycO2MJ.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334f1:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33563:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335ed:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3367f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336e9:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3375b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337f1:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33881:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Wru9ycO2MJ.exe.436b128.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Wru9ycO2MJ.exe.436b128.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Wru9ycO2MJ.exe.436b128.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316f1:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31763:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317ed:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3187f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318e9:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3195b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319f1:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a81:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Wru9ycO2MJ.exe.436b128.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Wru9ycO2MJ.exe.436b128.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Wru9ycO2MJ.exe.436b128.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334f1:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6dd11:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33563:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dd83:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335ed:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6de0d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3367f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6de9f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336e9:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6df09:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3375b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6df7b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337f1:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e011:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33881:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e0a1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Wru9ycO2MJ.exe.4330708.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Wru9ycO2MJ.exe.4330708.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Wru9ycO2MJ.exe.4330708.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334f1:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6df11:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa8731:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33563:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6df83:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa87a3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335ed:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6e00d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa882d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3367f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e09f:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa88bf:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336e9:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e109:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa8929:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3375b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e17b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa899b:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337f1:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e211:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa8a31:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 67.23.226.139, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\Wru9ycO2MJ.exe, Initiated: true, ProcessId: 4668, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49708

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.Wru9ycO2MJ.exe.436b128.2.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.showpiece.trillennium.biz", "Username": "build@showpiece.trillennium.biz", "Password": "3KJ[T.3]fsSW"}

Multi AV Scanner detection for submitted file

Source: Wru9ycO2MJ.exe	ReversingLabs: Detection: 63%
Source: Wru9ycO2MJ.exe	Virustotal: Detection: 55%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Wru9ycO2MJ.exe

Joe Sandbox ML: detected

Source: Wru9ycO2MJ.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.5:49706 version: TLS 1.2

Source: Wru9ycO2MJ.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: global traffic

TCP traffic: 192.168.2.5:49708 -> 67.23.226.139:587

Source: Joe Sandbox View	IP Address: 67.23.226.139 67.23.226.139
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.5:49708 -> 67.23.226.139:587

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: mail.showpiece.trillennium.biz

Source: Wru9ycO2MJ.exe, 00000000.00000002.2070019337.0000000002789000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://localhost/arkanoid_server/requests.php
Source: Wru9ycO2MJ.exe, 00000003.00000002.4504072782.0000000002B1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.showpiece.trillennium.biz
Source: Wru9ycO2MJ.exe, 00000003.00000002.4503031346.0000000000E10000.00000004.00000020.00020000.00000000.sdmp, Wru9ycO2MJ.exe, 00000003.00000002.4504072782.0000000002B24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r11.i.lencr.org/0
Source: Wru9ycO2MJ.exe, 00000003.00000002.4503031346.0000000000E10000.00000004.00000020.00020000.00000000.sdmp, Wru9ycO2MJ.exe, 00000003.00000002.4504072782.0000000002B24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r11.o.lencr.org0#
Source: Wru9ycO2MJ.exe, 00000003.00000002.4504072782.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Wru9ycO2MJ.exe, 00000003.00000002.4504072782.0000000002B1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://showpiece.trillennium.biz
Source: Wru9ycO2MJ.exe, 00000003.00000002.4503031346.0000000000EBF000.00000004.00000020.00020000.00000000.sdmp, Wru9ycO2MJ.exe, 00000003.00000002.4508226189.0000000006395000.00000004.00000020.00020000.00000000.sdmp, Wru9ycO2MJ.exe, 00000003.00000002.4503031346.0000000000E86000.00000004.00000020.00020000.00000000.sdmp, Wru9ycO2MJ.exe, 00000003.00000002.4504072782.0000000002B24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Wru9ycO2MJ.exe, 00000003.00000002.4508226189.0000000006395000.00000004.00000020.00020000.00000000.sdmp, Wru9ycO2MJ.exe, 00000003.00000002.4503031346.0000000000E86000.00000004.00000020.00020000.00000000.sdmp, Wru9ycO2MJ.exe, 00000003.00000002.4504072782.0000000002B24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Wru9ycO2MJ.exe, 00000000.00000002.2070865518.0000000004330000.00000004.00000800.00020000.00000000.sdmp, Wru9ycO2MJ.exe, 00000003.00000002.4502142983.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: Wru9ycO2MJ.exe, 00000000.00000002.2070865518.0000000004330000.00000004.00000800.00020000.00000000.sdmp, Wru9ycO2MJ.exe, 00000003.00000002.4502142983.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Wru9ycO2MJ.exe, 00000003.00000002.4504072782.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: Wru9ycO2MJ.exe, 00000003.00000002.4504072782.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: Wru9ycO2MJ.exe, 00000003.00000002.4504072782.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.5:49706 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\Wru9ycO2MJ.exe

Jump to behavior

Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.Wru9ycO2MJ.exe.4330708.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.Wru9ycO2MJ.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Wru9ycO2MJ.exe.436b128.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Wru9ycO2MJ.exe.436b128.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Wru9ycO2MJ.exe.4330708.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 0_2_025D2368	0_2_025D2368
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 0_2_025D0F08	0_2_025D0F08
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 0_2_025D7370	0_2_025D7370
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 0_2_025D2276	0_2_025D2276
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 0_2_025DA4F0	0_2_025DA4F0
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 0_2_025D2BF8	0_2_025D2BF8
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 0_2_025D08F0	0_2_025D08F0
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 0_2_025D0EA7	0_2_025D0EA7
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 0_2_025D2C08	0_2_025D2C08
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_00E0E289	3_2_00E0E289
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_00E0A960	3_2_00E0A960
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_00E04A98	3_2_00E04A98
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_00E03E80	3_2_00E03E80
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_00E041C8	3_2_00E041C8
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_06896698	3_2_06896698
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_06897E20	3_2_06897E20
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_06895648	3_2_06895648
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_0689B2C8	3_2_0689B2C8
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_0689C220	3_2_0689C220
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_06892348	3_2_06892348
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_06897740	3_2_06897740
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_0689E440	3_2_0689E440
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_06895D98	3_2_06895D98
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_06890040	3_2_06890040
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_06981988	3_2_06981988
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_06981983	3_2_06981983
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_06890007	3_2_06890007
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_06890037	3_2_06890037

Source: Wru9ycO2MJ.exe, 00000000.00000002.2070865518.0000000003FC1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs Wru9ycO2MJ.exe
Source: Wru9ycO2MJ.exe, 00000000.00000000.2036258233.00000000004CC000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamePJYe.exe0 vs Wru9ycO2MJ.exe
Source: Wru9ycO2MJ.exe, 00000000.00000002.2074272607.0000000007440000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs Wru9ycO2MJ.exe
Source: Wru9ycO2MJ.exe, 00000000.00000002.2070019337.0000000002789000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs Wru9ycO2MJ.exe
Source: Wru9ycO2MJ.exe, 00000000.00000002.2070865518.0000000003F89000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs Wru9ycO2MJ.exe
Source: Wru9ycO2MJ.exe, 00000000.00000002.2068622769.0000000000A1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Wru9ycO2MJ.exe
Source: Wru9ycO2MJ.exe, 00000000.00000002.2076900911.0000000009200000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs Wru9ycO2MJ.exe
Source: Wru9ycO2MJ.exe, 00000000.00000002.2070865518.0000000004330000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename00b93cc8-4625-4c9d-a44d-5996e806c5f9.exe4 vs Wru9ycO2MJ.exe
Source: Wru9ycO2MJ.exe, 00000000.00000002.2070019337.0000000002B1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename00b93cc8-4625-4c9d-a44d-5996e806c5f9.exe4 vs Wru9ycO2MJ.exe
Source: Wru9ycO2MJ.exe, 00000003.00000002.4502409068.0000000000CF8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Wru9ycO2MJ.exe
Source: Wru9ycO2MJ.exe, 00000003.00000002.4502142983.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename00b93cc8-4625-4c9d-a44d-5996e806c5f9.exe4 vs Wru9ycO2MJ.exe
Source: Wru9ycO2MJ.exe, 00000003.00000002.4503031346.0000000000E18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dll vs Wru9ycO2MJ.exe
Source: Wru9ycO2MJ.exe	Binary or memory string: OriginalFilenamePJYe.exe0 vs Wru9ycO2MJ.exe

Source: Wru9ycO2MJ.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.Wru9ycO2MJ.exe.4330708.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.Wru9ycO2MJ.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Wru9ycO2MJ.exe.436b128.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Wru9ycO2MJ.exe.436b128.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Wru9ycO2MJ.exe.4330708.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: Wru9ycO2MJ.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@2/2

Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Wru9ycO2MJ.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Mutant created: \Sessions\1\BaseNamedObjects\QcatWQLiga

Source: Wru9ycO2MJ.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Wru9ycO2MJ.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Wru9ycO2MJ.exe	ReversingLabs: Detection: 63%
Source: Wru9ycO2MJ.exe	Virustotal: Detection: 55%

Source: unknown	Process created: C:\Users\user\Desktop\Wru9ycO2MJ.exe "C:\Users\user\Desktop\Wru9ycO2MJ.exe"
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process created: C:\Users\user\Desktop\Wru9ycO2MJ.exe "C:\Users\user\Desktop\Wru9ycO2MJ.exe"
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process created: C:\Users\user\Desktop\Wru9ycO2MJ.exe "C:\Users\user\Desktop\Wru9ycO2MJ.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Section loaded: edputil.dll	Jump to behavior

Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: Wru9ycO2MJ.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Wru9ycO2MJ.exe

Static file information: File size 1120256 > 1048576

Source: Wru9ycO2MJ.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_00E086D8 push 8329E905h; retf 0071h	3_2_00E0869F
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_00E07832 push 9191E905h; retf 0071h	3_2_00E07837
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_06982301 push 0C418B05h; ret	3_2_06982313
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_069880D0 push ds; iretd	3_2_069880D2
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_069880D3 push ds; iretd	3_2_069880DA
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_069880F1 push ds; iretd	3_2_069880F2
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_069880F3 push ds; iretd	3_2_069880FA
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_06980CD1 push 10418B05h; ret	3_2_06980CE3
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_06980D80 push 04418B05h; ret	3_2_06980DE3
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_0698ADCB push es; ret	3_2_0698ADD0
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_06980DF0 push 18418B05h; ret	3_2_06980E03
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_06989687 pushad ; iretd	3_2_06989689
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_069876B0 push esp; iretd	3_2_069876B9
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_0698F2FE push 18418B05h; ret	3_2_0698F303
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_06987331 push ss; iretd	3_2_06987332
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_06987CA4 push esp; iretd	3_2_06987CAD
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_0698BCD0 push eax; iretd	3_2_0698BCD2
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_0698BCD3 push eax; iretd	3_2_0698BCD6
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_0698BD83 push eax; iretd	3_2_0698BD8A
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_0698BD78 push eax; iretd	3_2_0698BD82
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_069818AB push 08418B05h; ret	3_2_069818B3
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_069818CE push 14418B05h; ret	3_2_069818D3
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_069818EE push 1C418B05h; ret	3_2_069818F3
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_06981900 push 20418B05h; ret	3_2_06981913
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_0698194E push 28418B05h; ret	3_2_06981953
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Code function: 3_2_0698196E push 2C418B05h; ret	3_2_06981973

Source: Wru9ycO2MJ.exe

Static PE information: section name: .text entropy: 7.749018200049437

Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: Wru9ycO2MJ.exe PID: 4120, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Memory allocated: 25D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Memory allocated: 2780000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Memory allocated: 4780000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Memory allocated: 4E20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Memory allocated: 5E20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Memory allocated: 5F50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Memory allocated: 6F50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Memory allocated: 9EB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Memory allocated: AEB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Memory allocated: B340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Memory allocated: C340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Memory allocated: E00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Memory allocated: 2AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Memory allocated: 4AA0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Window / User API: threadDelayed 1708			Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Window / User API: threadDelayed 8137			Jump to behavior

Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4144	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -29514790517935264s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 2848	Thread sleep count: 1708 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 2848	Thread sleep count: 8137 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -99766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -99547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -99438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -99328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -99219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -99094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -98984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -98875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -98766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -98656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -98547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -98434s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -98328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -98206s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -98078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -97938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -97774s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -97672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -97563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -97438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -97313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -97203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -97094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -96969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -96859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -96750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -96641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -96531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -96422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -96313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -96188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -96078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -95969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -95844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -95734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -95625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -95516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -95371s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -95263s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -95155s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -95045s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -94930s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -94828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -94719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -94610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -94500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -94391s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe TID: 4164	Thread sleep time: -94266s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 99438	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 99328	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 99219	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 99094	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 98984	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 98875	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 98766	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 98656	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 98547	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 98434	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 98328	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 98206	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 98078	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 97938	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 97774	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 97672	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 97563	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 97438	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 97313	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 97203	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 97094	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 96969	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 96859	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 96750	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 96641	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 96531	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 96422	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 96313	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 96188	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 96078	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 95969	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 95844	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 95734	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 95625	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 95516	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 95371	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 95263	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 95155	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 95045	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 94930	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 94828	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 94719	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 94610	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 94500	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 94391	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Thread delayed: delay time: 94266	Jump to behavior

Source: Wru9ycO2MJ.exe, 00000003.00000002.4503031346.0000000000EBF000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe

Process created: C:\Users\user\Desktop\Wru9ycO2MJ.exe "C:\Users\user\Desktop\Wru9ycO2MJ.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Queries volume information: C:\Users\user\Desktop\Wru9ycO2MJ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Queries volume information: C:\Users\user\Desktop\Wru9ycO2MJ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.Wru9ycO2MJ.exe.4330708.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Wru9ycO2MJ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Wru9ycO2MJ.exe.436b128.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Wru9ycO2MJ.exe.436b128.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Wru9ycO2MJ.exe.4330708.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4504072782.0000000002B1C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4502142983.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4504072782.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2070865518.0000000004330000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Wru9ycO2MJ.exe PID: 4120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Wru9ycO2MJ.exe PID: 4668, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Wru9ycO2MJ.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.Wru9ycO2MJ.exe.4330708.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Wru9ycO2MJ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Wru9ycO2MJ.exe.436b128.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Wru9ycO2MJ.exe.436b128.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Wru9ycO2MJ.exe.4330708.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4502142983.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4504072782.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2070865518.0000000004330000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Wru9ycO2MJ.exe PID: 4120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Wru9ycO2MJ.exe PID: 4668, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.Wru9ycO2MJ.exe.4330708.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Wru9ycO2MJ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Wru9ycO2MJ.exe.436b128.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Wru9ycO2MJ.exe.436b128.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Wru9ycO2MJ.exe.4330708.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4504072782.0000000002B1C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4502142983.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4504072782.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2070865518.0000000004330000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Wru9ycO2MJ.exe PID: 4120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Wru9ycO2MJ.exe PID: 4668, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	2 Obfuscated Files or Information	11 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Software Packing	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	111 Security Software Discovery	Distributed Component Object Model	11 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	1 Process Discovery	SSH	1 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	141 Virtualization/Sandbox Evasion	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Wru9ycO2MJ.exe	63%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
Wru9ycO2MJ.exe	56%	Virustotal		Browse
Wru9ycO2MJ.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
api.ipify.org	104.26.13.205	true	false	high
showpiece.trillennium.biz	67.23.226.139	true	false	high
mail.showpiece.trillennium.biz	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://showpiece.trillennium.biz	Wru9ycO2MJ.exe, 00000003.00000002.4504072782.0000000002B1C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.ipify.org	Wru9ycO2MJ.exe, 00000000.00000002.2070865518.0000000004330000.00000004.00000800.00020000.00000000.sdmp, Wru9ycO2MJ.exe, 00000003.00000002.4502142983.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Wru9ycO2MJ.exe, 00000003.00000002.4504072782.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://localhost/arkanoid_server/requests.php	Wru9ycO2MJ.exe, 00000000.00000002.2070019337.0000000002789000.00000004.00000800.00020000.00000000.sdmp	false	high
https://account.dyn.com/	Wru9ycO2MJ.exe, 00000000.00000002.2070865518.0000000004330000.00000004.00000800.00020000.00000000.sdmp, Wru9ycO2MJ.exe, 00000003.00000002.4502142983.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
http://r11.o.lencr.org0#	Wru9ycO2MJ.exe, 00000003.00000002.4503031346.0000000000E10000.00000004.00000020.00020000.00000000.sdmp, Wru9ycO2MJ.exe, 00000003.00000002.4504072782.0000000002B24000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.ipify.org/t	Wru9ycO2MJ.exe, 00000003.00000002.4504072782.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://mail.showpiece.trillennium.biz	Wru9ycO2MJ.exe, 00000003.00000002.4504072782.0000000002B1C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Wru9ycO2MJ.exe, 00000003.00000002.4504072782.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://x1.c.lencr.org/0	Wru9ycO2MJ.exe, 00000003.00000002.4503031346.0000000000EBF000.00000004.00000020.00020000.00000000.sdmp, Wru9ycO2MJ.exe, 00000003.00000002.4508226189.0000000006395000.00000004.00000020.00020000.00000000.sdmp, Wru9ycO2MJ.exe, 00000003.00000002.4503031346.0000000000E86000.00000004.00000020.00020000.00000000.sdmp, Wru9ycO2MJ.exe, 00000003.00000002.4504072782.0000000002B24000.00000004.00000800.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/0	Wru9ycO2MJ.exe, 00000003.00000002.4508226189.0000000006395000.00000004.00000020.00020000.00000000.sdmp, Wru9ycO2MJ.exe, 00000003.00000002.4503031346.0000000000E86000.00000004.00000020.00020000.00000000.sdmp, Wru9ycO2MJ.exe, 00000003.00000002.4504072782.0000000002B24000.00000004.00000800.00020000.00000000.sdmp	false	high
http://r11.i.lencr.org/0	Wru9ycO2MJ.exe, 00000003.00000002.4503031346.0000000000E10000.00000004.00000020.00020000.00000000.sdmp, Wru9ycO2MJ.exe, 00000003.00000002.4504072782.0000000002B24000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
67.23.226.139	showpiece.trillennium.biz	United States		33182	DIMENOCUS	false
104.26.13.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588700
Start date and time:	2025-01-11 04:21:54 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Wru9ycO2MJ.exe renamed because original name is a hash value
Original Sample Name:	851cadfb7b72af94db5c9db85e0d52dfcbf3fa948c7498627e4b67162cff6e7d.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 68 Number of non-executed functions: 9
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.23.242.162, 13.107.246.45, 172.202.163.200
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
22:22:45	API Interceptor	10563651x Sleep call for process: Wru9ycO2MJ.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
67.23.226.139	lUy4SKlE6A.exe	Get hash	malicious	AgentTesla	Browse
	PO#86637.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse
	Quotation.exe	Get hash	malicious	AgentTesla	Browse
	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	3Pd480eWHA.exe	Get hash	malicious	AgentTesla	Browse
	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	COTIZACION.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	Quotation.exe	Get hash	malicious	AgentTesla	Browse
	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
104.26.13.205	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	BiXS3FRoLe.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	lEUy79aLAW.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	Simple1.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	iNFGd6bDZX.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	MyzWeEOlqb.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	5hD3Yjf7xD.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	ukBQ4ch2nE.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	ru52XOQ1p7.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	xJZHVgxQul.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	jG8N6WDJOx.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	HGhGAjCVw5.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	https://glfbanks.com/	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205
	s2Jg1MAahY.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	iNFGd6bDZX.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	n2pGr8w21V.exe	Get hash	malicious	FormBook	Browse	104.18.73.116
	tNXl4XhgmV.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	MyzWeEOlqb.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	02Eh1ah35H.exe	Get hash	malicious	FormBook, GuLoader	Browse	172.67.167.146
	5hD3Yjf7xD.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	MBOaS3GRtF.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.64.1
	https://freesourcecodes70738.emlnk.com/lt.php?x=3DZy~GDLVnab5KCs-Nu4WOae1qEoiN9xvxk1XaPMVXahD5B9-Uy.xuW-242imNX	Get hash	malicious	Unknown	Browse	104.17.205.31
	https://youtube.com0x360x380x370x340x370x340x370x300x370x330x330x610x320x660x320x660x360x310x360x640x360x360x370x320x320x650x370x320x370x350x320x660x370x320x360x620x320x650x370x300x360x380x370x300x330x660x360x390x360x340x330x640x330x320x330x300x330x300x320x360x370x330x360x390x370x340x360x350x350x660x360x390x360x340x330x640x370x330x330x310x320x360x360x350x370x360x360x350x360x650x370x340x330x320x330x640x360x320x360x310x360x650x360x650x360x350x370x320x320x360x360x350x370x360x360x350x360x650x370x340x330x320x330x640x360x330x360x630x360x390x360x330x360x620x320x360x360x350x370x360x360x350x360x650x370x340x330x330x330x640x330x310x320x620x320x350x330x320x340x360x320x620x320x350x330x350x340x320x330x320x330x350x330x300x320x350x330x350x340x340x320x620x320x350x330x350x340x320x360x390x360x650x360x340x360x350x370x380x350x660x360x320x350x660x360x330x320x350x330x350x340x340x320x620x320x350x340x340x330x300x320x350x330x390x330x330x320x350x340x340x330x300x320x350x340x320x340x320x320x350x340x340x330x300x320x350x340x320x330x300x320x350x340x340x330x300x320x350x340x320x330x320x320x350x340x340x330x300x320x350x340x320x340x340x320x350x340x340x330x300x320x350x340x320x330x300x320x350x340x340x330x310x320x350x330x380x340x360x320x620x320x350x340x340x330x310x320x350x330x380x330x310x320x350x340x340x330x310x320x350x330x380x330x320x320x350x340x340x330x340x370x380x360x340x390x320x390x330x370x320x330x300x390x340x370x330x340x300x330x340x2d0x380x380x340x330x340x370x330x340x300x340x390x300x350x370x330x370x340x330x300x340x300x330x340x380x320x2d0x340x300x390x340x380x2d0x320x2d0x340x380x380x320x2d0x330x320x380x380x340x370x370x320x390x390x320x380x380x380x340x370x340x370x320x390x300x340x390x340x370x320x340x300x380x320x340x370x340x370x320x620x320x640x320x620x320x350x340x340x330x300x320x350x330x390x330x340x320x350x340x340x330x300x320x350x340x320x330x350x320x350x340x340x330x300x320x350x340x320x340x330x320x350x340x340x330x300x320x350x340x320x330x380x320x350x340x340x330x300x320x350x340x320x340x310x320x350x340x340x330	Get hash	malicious	Unknown	Browse	172.64.41.3
	fpIGwanLZi.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
DIMENOCUS	loligang.arm7.elf	Get hash	malicious	Mirai	Browse	198.136.58.118
	lUy4SKlE6A.exe	Get hash	malicious	AgentTesla	Browse	67.23.226.139
	ky.ps1	Get hash	malicious	Unknown	Browse	184.171.244.231
	script.vbs	Get hash	malicious	Unknown	Browse	184.171.244.231
	mg.vbs	Get hash	malicious	Unknown	Browse	184.171.244.231
	mj.ps1	Get hash	malicious	Unknown	Browse	184.171.244.231
	ap.ps1	Get hash	malicious	Unknown	Browse	184.171.244.231
	cu.ps1	Get hash	malicious	Unknown	Browse	184.171.244.231
	Scripts_Obfusque.vbs	Get hash	malicious	Unknown	Browse	184.171.244.231
	ni.ps1	Get hash	malicious	Unknown	Browse	184.171.244.231

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	iNFGd6bDZX.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	MyzWeEOlqb.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	5hD3Yjf7xD.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	AJ5zYYsisA.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	AJ5zYYsisA.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	4NG0guPiKA.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.26.13.205
	n0nsAzvYNd.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.26.13.205
	njVvgA8pEB.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.26.13.205
	KtPCqWWnqM.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	YDg44STseR.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.13.205

Process:	C:\Users\user\Desktop\Wru9ycO2MJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.107147348894105
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Wru9ycO2MJ.exe
File size:	1'120'256 bytes
MD5:	e984689ddc606e421d3cf8746ac0783e
SHA1:	209d2263e1baff1943533effa0f3e1964d98b8cd
SHA256:	851cadfb7b72af94db5c9db85e0d52dfcbf3fa948c7498627e4b67162cff6e7d
SHA512:	0141f05b526f817955e1efaf71b277e8dd96a0dc1bd624b58cdb0012e357b7d287da08395d5ecf879fccc20ce4c2154b0b6638a97330e527493294e2ab5b52d9
SSDEEP:	24576:CPIeeUQE6/PCxEF3IKBteMUvV5554HvPtht:2Bey63uERxBghV2PX
TLSH:	8035BF583A95E80FC35289354DF1FE7996384EA96E0A93039AD33DDFBA3CF895D40181
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...K.Og..............0..f............... ........@.. ....................................@................................

File Icon


Icon Hash:	41c0c45471554d45

Static PE Info

General

Entrypoint:	0x4b859e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x674F164B [Tue Dec 3 14:31:39 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb854c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xba000	0x5ac58	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x116000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xb65a4	0xb6600	15a6c0ebc5418b823a9ba80f28e5a3c7	False	0.9026007753598355	data	7.749018200049437	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xba000	0x5ac58	0x5ae00	dd8805746db615b4ffcf31ace4f84736	False	0.38009908012379645	data	5.091346723217829	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x116000	0xc	0x200	20da4a97599fd48f3e258de7f01602ac	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xba250	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 262144	0.3619626002307897
RT_ICON	0xfc278	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	0.40127765290429435
RT_ICON	0x10caa0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	0.4653991497401984
RT_ICON	0x110cc8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	0.5120331950207468
RT_ICON	0x113270	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	0.5834896810506567
RT_ICON	0x114318	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	0.6356382978723404
RT_GROUP_ICON	0x114780	0x5a	data	0.7222222222222222
RT_GROUP_ICON	0x1147dc	0x14	data	1.05
RT_VERSION	0x1147f0	0x278	data	0.46835443037974683
RT_MANIFEST	0x114a68	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:22:46.730545044 CET	49706	443	192.168.2.5	104.26.13.205
Jan 11, 2025 04:22:46.730632067 CET	443	49706	104.26.13.205	192.168.2.5
Jan 11, 2025 04:22:46.730719090 CET	49706	443	192.168.2.5	104.26.13.205
Jan 11, 2025 04:22:46.735546112 CET	49706	443	192.168.2.5	104.26.13.205
Jan 11, 2025 04:22:46.735582113 CET	443	49706	104.26.13.205	192.168.2.5
Jan 11, 2025 04:22:47.219085932 CET	443	49706	104.26.13.205	192.168.2.5
Jan 11, 2025 04:22:47.220084906 CET	49706	443	192.168.2.5	104.26.13.205
Jan 11, 2025 04:22:47.297911882 CET	49706	443	192.168.2.5	104.26.13.205
Jan 11, 2025 04:22:47.297933102 CET	443	49706	104.26.13.205	192.168.2.5
Jan 11, 2025 04:22:47.298322916 CET	443	49706	104.26.13.205	192.168.2.5
Jan 11, 2025 04:22:47.340091944 CET	49706	443	192.168.2.5	104.26.13.205
Jan 11, 2025 04:22:47.567719936 CET	49706	443	192.168.2.5	104.26.13.205
Jan 11, 2025 04:22:47.615331888 CET	443	49706	104.26.13.205	192.168.2.5
Jan 11, 2025 04:22:47.679023027 CET	443	49706	104.26.13.205	192.168.2.5
Jan 11, 2025 04:22:47.679193974 CET	443	49706	104.26.13.205	192.168.2.5
Jan 11, 2025 04:22:47.679250956 CET	49706	443	192.168.2.5	104.26.13.205
Jan 11, 2025 04:22:47.701114893 CET	49706	443	192.168.2.5	104.26.13.205
Jan 11, 2025 04:22:48.702569008 CET	49708	587	192.168.2.5	67.23.226.139
Jan 11, 2025 04:22:48.707505941 CET	587	49708	67.23.226.139	192.168.2.5
Jan 11, 2025 04:22:48.707592010 CET	49708	587	192.168.2.5	67.23.226.139
Jan 11, 2025 04:22:52.250037909 CET	587	49708	67.23.226.139	192.168.2.5
Jan 11, 2025 04:22:52.250976086 CET	49708	587	192.168.2.5	67.23.226.139
Jan 11, 2025 04:22:52.255734921 CET	587	49708	67.23.226.139	192.168.2.5
Jan 11, 2025 04:22:52.368916988 CET	587	49708	67.23.226.139	192.168.2.5
Jan 11, 2025 04:22:52.371634007 CET	49708	587	192.168.2.5	67.23.226.139
Jan 11, 2025 04:22:52.376442909 CET	587	49708	67.23.226.139	192.168.2.5
Jan 11, 2025 04:22:52.491426945 CET	587	49708	67.23.226.139	192.168.2.5
Jan 11, 2025 04:22:52.491884947 CET	49708	587	192.168.2.5	67.23.226.139
Jan 11, 2025 04:22:52.496762037 CET	587	49708	67.23.226.139	192.168.2.5
Jan 11, 2025 04:22:52.629302979 CET	587	49708	67.23.226.139	192.168.2.5
Jan 11, 2025 04:22:52.629384995 CET	587	49708	67.23.226.139	192.168.2.5
Jan 11, 2025 04:22:52.630281925 CET	49708	587	192.168.2.5	67.23.226.139
Jan 11, 2025 04:22:52.630542040 CET	587	49708	67.23.226.139	192.168.2.5
Jan 11, 2025 04:22:52.630552053 CET	587	49708	67.23.226.139	192.168.2.5
Jan 11, 2025 04:22:52.630603075 CET	49708	587	192.168.2.5	67.23.226.139
Jan 11, 2025 04:22:52.715276003 CET	587	49708	67.23.226.139	192.168.2.5
Jan 11, 2025 04:22:52.753947973 CET	49708	587	192.168.2.5	67.23.226.139
Jan 11, 2025 04:22:52.758981943 CET	587	49708	67.23.226.139	192.168.2.5
Jan 11, 2025 04:22:52.872461081 CET	587	49708	67.23.226.139	192.168.2.5
Jan 11, 2025 04:22:52.875611067 CET	49708	587	192.168.2.5	67.23.226.139
Jan 11, 2025 04:22:52.880440950 CET	587	49708	67.23.226.139	192.168.2.5
Jan 11, 2025 04:22:53.005471945 CET	587	49708	67.23.226.139	192.168.2.5
Jan 11, 2025 04:22:53.006767988 CET	49708	587	192.168.2.5	67.23.226.139
Jan 11, 2025 04:22:53.011610985 CET	587	49708	67.23.226.139	192.168.2.5
Jan 11, 2025 04:22:53.125613928 CET	587	49708	67.23.226.139	192.168.2.5
Jan 11, 2025 04:22:53.133029938 CET	49708	587	192.168.2.5	67.23.226.139
Jan 11, 2025 04:22:53.137790918 CET	587	49708	67.23.226.139	192.168.2.5
Jan 11, 2025 04:22:54.766092062 CET	587	49708	67.23.226.139	192.168.2.5
Jan 11, 2025 04:22:54.766892910 CET	49708	587	192.168.2.5	67.23.226.139
Jan 11, 2025 04:22:54.771837950 CET	587	49708	67.23.226.139	192.168.2.5
Jan 11, 2025 04:22:55.072632074 CET	587	49708	67.23.226.139	192.168.2.5
Jan 11, 2025 04:22:55.076916933 CET	587	49708	67.23.226.139	192.168.2.5
Jan 11, 2025 04:22:55.080265045 CET	49708	587	192.168.2.5	67.23.226.139
Jan 11, 2025 04:22:55.082165956 CET	49708	587	192.168.2.5	67.23.226.139
Jan 11, 2025 04:22:55.087009907 CET	587	49708	67.23.226.139	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:22:46.717921972 CET	51742	53	192.168.2.5	1.1.1.1
Jan 11, 2025 04:22:46.725310087 CET	53	51742	1.1.1.1	192.168.2.5
Jan 11, 2025 04:22:48.370675087 CET	61182	53	192.168.2.5	1.1.1.1
Jan 11, 2025 04:22:48.701291084 CET	53	61182	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 04:22:46.717921972 CET	192.168.2.5	1.1.1.1	0x35d8	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:22:48.370675087 CET	192.168.2.5	1.1.1.1	0x4e44	Standard query (0)	mail.showpiece.trillennium.biz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 04:22:46.725310087 CET	1.1.1.1	192.168.2.5	0x35d8	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:22:46.725310087 CET	1.1.1.1	192.168.2.5	0x35d8	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:22:46.725310087 CET	1.1.1.1	192.168.2.5	0x35d8	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:22:48.701291084 CET	1.1.1.1	192.168.2.5	0x4e44	No error (0)	mail.showpiece.trillennium.biz	showpiece.trillennium.biz		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 04:22:48.701291084 CET	1.1.1.1	192.168.2.5	0x4e44	No error (0)	showpiece.trillennium.biz		67.23.226.139	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	104.26.13.205	443	4668	C:\Users\user\Desktop\Wru9ycO2MJ.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 03:22:47 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2025-01-11 03:22:47 UTC	424	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 03:22:47 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 9001c8cf9eae4315-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1582&min_rtt=1580&rtt_var=598&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2819&recv_bytes=769&delivery_rate=1821584&cwnd=218&unsent_bytes=0&cid=eb1e6f65f9e3daa7&ts=471&x=0"
2025-01-11 03:22:47 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jan 11, 2025 04:22:52.250037909 CET	587	49708	67.23.226.139	192.168.2.5	220-super.nseasy.com ESMTP Exim 4.96.2 #2 Fri, 10 Jan 2025 22:22:52 -0500 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jan 11, 2025 04:22:52.250976086 CET	49708	587	192.168.2.5	67.23.226.139	EHLO 783875
Jan 11, 2025 04:22:52.368916988 CET	587	49708	67.23.226.139	192.168.2.5	250-super.nseasy.com Hello 783875 [8.46.123.189] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Jan 11, 2025 04:22:52.371634007 CET	49708	587	192.168.2.5	67.23.226.139	STARTTLS
Jan 11, 2025 04:22:52.491426945 CET	587	49708	67.23.226.139	192.168.2.5	220 TLS go ahead

Target ID:	0
Start time:	22:22:44
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\Wru9ycO2MJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Wru9ycO2MJ.exe"
Imagebase:	0x3c0000
File size:	1'120'256 bytes
MD5 hash:	E984689DDC606E421D3CF8746AC0783E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2070865518.0000000004330000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2070865518.0000000004330000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:22:45
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\Wru9ycO2MJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Wru9ycO2MJ.exe"
Imagebase:	0x790000
File size:	1'120'256 bytes
MD5 hash:	E984689DDC606E421D3CF8746AC0783E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.4504072782.0000000002B1C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.4502142983.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.4502142983.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.4504072782.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.4504072782.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	18
Total number of Limit Nodes:	2

Executed Functions

Function 025D08F0 Relevance: 2.7, Strings: 2, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te]q, xrefs: 025D0F25
Te]q, xrefs: 025D109F

Memory Dump Source

Source File: 00000000.00000002.2069908373.00000000025D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25d0000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID: Te]q$Te]q
API String ID: 0-3320153681
Opcode ID: f4a11fc95bfd845b505b6f2891a21d99a335d7317c22b7ab5ef4cf92fcdc85a4
Instruction ID: 3d79e23d2093eda504dbff39bb5eb894b80b20f43328a6acc830993045e57f53
Opcode Fuzzy Hash: f4a11fc95bfd845b505b6f2891a21d99a335d7317c22b7ab5ef4cf92fcdc85a4
Instruction Fuzzy Hash: 03812B31A141498FCB19CF68C8956FEBBB2FF85310F24845BD446AB291C635DE0ACB59

Function 025D2368 Relevance: 2.7, Strings: 2, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

o^I, xrefs: 025D241E
Qom, xrefs: 025D25FF

Memory Dump Source

Source File: 00000000.00000002.2069908373.00000000025D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25d0000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID: Qom$o^I
API String ID: 0-1946801590
Opcode ID: 7462ee48950db40e2e7033da8121d55eb1c1df7e1df55c17445067a8158d4272
Instruction ID: 57141e0c95019350db2371d37360703a3260fca324900cb4103db69f6b73d581
Opcode Fuzzy Hash: 7462ee48950db40e2e7033da8121d55eb1c1df7e1df55c17445067a8158d4272
Instruction Fuzzy Hash: 0E718275625211CFC728CF6CC98062A7BA5BB94300F929867DD47EF266CB30ED41CB99

Function 025D0EA7 Relevance: 2.7, Strings: 2, Instructions: 181
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te]q, xrefs: 025D0F25
Te]q, xrefs: 025D109F

Memory Dump Source

Source File: 00000000.00000002.2069908373.00000000025D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25d0000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID: Te]q$Te]q
API String ID: 0-3320153681
Opcode ID: 1ac48f5736e37eb6a41499d9a6c9b83c66941e45d17ec6bcd9881d19af2a3ec3
Instruction ID: 32b6adf90bf08c5c9b64ed07279db4cb5d1898ef2d1be8b836165613100a392f
Opcode Fuzzy Hash: 1ac48f5736e37eb6a41499d9a6c9b83c66941e45d17ec6bcd9881d19af2a3ec3
Instruction Fuzzy Hash: CE512731B141498FCB198F69CC516FEBBB2FF85310F25845BE446EB291CA349E0ACB55

Function 025D0F08 Relevance: 2.6, Strings: 2, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te]q, xrefs: 025D0F25
Te]q, xrefs: 025D109F

Memory Dump Source

Source File: 00000000.00000002.2069908373.00000000025D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25d0000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID: Te]q$Te]q
API String ID: 0-3320153681
Opcode ID: 9848b311dec64ac5bd36e60c925ec06a074f60cb4670737b38e63f7bfb246e2f
Instruction ID: 32b45ed0b53a3def6f0184d91dc76147df152f597a9239da46b950f095b58f69
Opcode Fuzzy Hash: 9848b311dec64ac5bd36e60c925ec06a074f60cb4670737b38e63f7bfb246e2f
Instruction Fuzzy Hash: 9E51D631B10016CFCB189FADC9416BEB6F6FB88710F61842AE502EB394CA34CD05CB95

Function 025D2276 Relevance: 1.5, Strings: 1, Instructions: 279
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

o^I, xrefs: 025D241E

Memory Dump Source

Source File: 00000000.00000002.2069908373.00000000025D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25d0000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID: o^I
API String ID: 0-1726515752
Opcode ID: 0fb8317b0b5d34fba9dd77fc3d72841fd8e0d8cfe00d3e1024f5cf72fd47760f
Instruction ID: 9f4399796071172d777e42e7598ecddd18ccd470a2e82933ddb456d02f1182f1
Opcode Fuzzy Hash: 0fb8317b0b5d34fba9dd77fc3d72841fd8e0d8cfe00d3e1024f5cf72fd47760f
Instruction Fuzzy Hash: 2BB1F2322292848BC7568F28D8956FA7FB1FF82210B4648A7DC86DF163C631E946C75D

Function 025DA4F0 Relevance: .2, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2069908373.00000000025D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25d0000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e205c99d29be080b25179ff3d794f82a37d97ca5edd3159689e52c880d7a0b4a
Instruction ID: ca0dadc148e8990cfb6bce8a690055a05e1e9ed01a0ec9067353ef977b51524d
Opcode Fuzzy Hash: e205c99d29be080b25179ff3d794f82a37d97ca5edd3159689e52c880d7a0b4a
Instruction Fuzzy Hash: 545181707002064BCB19ABBCD555B6F7BABBFC4304B10882DD40A9B796EF34ED058B95

Function 025D7370 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2069908373.00000000025D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25d0000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e924a0bc3c62c6318d9c73c07910e325ac8718a6bd628899f198a34339a82459
Instruction ID: e2ca09f1695e6962f7a394369cf0e052d293784db729a9cd954e23df64870b6e
Opcode Fuzzy Hash: e924a0bc3c62c6318d9c73c07910e325ac8718a6bd628899f198a34339a82459
Instruction Fuzzy Hash: C85180707002068BCB19ABBCD955B6F7BABBFC4304F10882DD40A9B799DE34ED058B95

Function 025D8E64 Relevance: 1.6, APIs: 1, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 025D8F21

Memory Dump Source

Source File: 00000000.00000002.2069908373.00000000025D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25d0000_Wru9ycO2MJ.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 1c108bef9e120010acef21ba82037b65669af26b0f5989015b0cd3a67b771334
Instruction ID: 290ade3dada586ff573bd2c8ef9eb3a0b00b4dbd77d067e70ec7b89cf361b750
Opcode Fuzzy Hash: 1c108bef9e120010acef21ba82037b65669af26b0f5989015b0cd3a67b771334
Instruction Fuzzy Hash: 714104B0C00619CFDB24DFA9C948B9DFBF6BF48704F24805AD408AB254DB766946CF91

Function 025D79F4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 025D8F21

Memory Dump Source

Source File: 00000000.00000002.2069908373.00000000025D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25d0000_Wru9ycO2MJ.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a2718dbf4403320fe51b9b3914b88a8ab589bc88353a2b16a6011ca9c23472ca
Instruction ID: ed3b81f9c5e75402e99df410d6da8da2140eae3961c7d2b92bc6d810a0558728
Opcode Fuzzy Hash: a2718dbf4403320fe51b9b3914b88a8ab589bc88353a2b16a6011ca9c23472ca
Instruction Fuzzy Hash: 924102B0C00719CFDB24DFA9C848B9DBBF6BF48704F24806AD408AB254DBB56946CF90

Function 025DE6F8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 025DE75E

Memory Dump Source

Source File: 00000000.00000002.2069908373.00000000025D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25d0000_Wru9ycO2MJ.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 8458fb5b122ad1bf1ae689d17609bcfc90b050c5da81425125df5bbf9a7b3a1d
Instruction ID: 7e56a04ea32cf82cf2de4ba48f15f327c629293bbd9af2469927836135ad4530
Opcode Fuzzy Hash: 8458fb5b122ad1bf1ae689d17609bcfc90b050c5da81425125df5bbf9a7b3a1d
Instruction Fuzzy Hash: A2110FB5C003898FCB20DF9AC444ADEFBF5EB88224F14841AD518A7200D379A545CFA5

Function 00CCD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2069683515.0000000000CCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ccd000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b336ca6f2b6adf5227e6854c9b2eeb267997641454e101a3dc7dad4b4e5955
Instruction ID: ae6e92a9fb1fb82d6f7f2f99e73776adf91a97551f741372630839d85bf70a56
Opcode Fuzzy Hash: 30b336ca6f2b6adf5227e6854c9b2eeb267997641454e101a3dc7dad4b4e5955
Instruction Fuzzy Hash: 1021FFB2500240DFCB05DF14D9C0F26BF65FB98318F20C5BDE90A0A256C33AD956DAA2

Function 00CDD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2069721392.0000000000CDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cdd000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 400fb2ad8c854a75a6a1bd9ca03c1bccbca959d09f5e877b76499866d05e3f19
Instruction ID: 6fae04aa985d7bd9ac7d9ab37f9e720632e946f2cc76210a0a400a2870a93b70
Opcode Fuzzy Hash: 400fb2ad8c854a75a6a1bd9ca03c1bccbca959d09f5e877b76499866d05e3f19
Instruction Fuzzy Hash: F821D371904204DFCB14DF24D9C4B26BB65EB88314F24C56ADA0A4B356C33AE806CA61

Function 00CDD005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2069721392.0000000000CDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cdd000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d38ed897a1ce7a44691d797e6d72c9d1f84f5b59609ceb9a71422c8b48c9a41
Instruction ID: f1aad0934e21a45c9f6427932d414dda2006848364be6f826535a1cee32cc251
Opcode Fuzzy Hash: 9d38ed897a1ce7a44691d797e6d72c9d1f84f5b59609ceb9a71422c8b48c9a41
Instruction Fuzzy Hash: 6A218E755093808FCB12CF24D994715BF71EB86314F28C5EBD9498B6A7C33A980ACB62

Function 00CCD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2069683515.0000000000CCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ccd000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 9433fea157a487db97569865b233066c13c25a65ac534c259108d9d999c2610f
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 2011D3B6504280CFCB16CF14D9C4B16BF71FB98314F24C6ADD94A0B656C336D95ACBA2

Function 00CCD731 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2069683515.0000000000CCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ccd000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc655f422edd832fd78f151da5fe3a26f6ec8c070221e7f64ccca184587b7057
Instruction ID: 33cdb459cf6c021cb93648e7dc028e0c93519b4c50b9a2c86fa7c7324f305d1b
Opcode Fuzzy Hash: bc655f422edd832fd78f151da5fe3a26f6ec8c070221e7f64ccca184587b7057
Instruction Fuzzy Hash: 9001DB710043449AE7109A2ACD84F67FFDCEF45324F28C47EED1A5A29AD2799C40C771

Function 00CCD730 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2069683515.0000000000CCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ccd000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caeff0ba5a1f5ccda9d7f0e808119dae43fd861021dc1ce6e150f27153fbe177
Instruction ID: fccf4dbe01b444c102addfcc7437bf0570f4b96face9e2600c6d852bd55ff4e3
Opcode Fuzzy Hash: caeff0ba5a1f5ccda9d7f0e808119dae43fd861021dc1ce6e150f27153fbe177
Instruction Fuzzy Hash: B8F0F6710043449EE7108A1ACC84B62FFD8EF91734F18C46EED194F286C2799C40CB71

Non-executed Functions

Function 025D2BF8 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2069908373.00000000025D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25d0000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2711e57a97448a96a26d07b82ab4a531e689adec1bdf839fdcbd98904ea0069
Instruction ID: b75957d0bb547a03abae66de309b3980e6151822598195e55a34174b0737e919
Opcode Fuzzy Hash: c2711e57a97448a96a26d07b82ab4a531e689adec1bdf839fdcbd98904ea0069
Instruction Fuzzy Hash: 7941CE71B146028FC725CB2DD885A5ABBF2FF85210F24CC2AE45ACB662D230E941CF55

Function 025D2C08 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2069908373.00000000025D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25d0000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9adac49bfc60ae3575e44d8b7cdd2527717a3655cd3dccf90b32949b857507d1
Instruction ID: 9d752ac3737c474f71b776f52da84c2bfd603c1fc1e0516dadfac676c9f17b71
Opcode Fuzzy Hash: 9adac49bfc60ae3575e44d8b7cdd2527717a3655cd3dccf90b32949b857507d1
Instruction Fuzzy Hash: CC41BE71B106068FC724CB2DD885A5AB7E2FF84210F24DC2AE46ADBA65D230ED41CF55

Analysis Process: Wru9ycO2MJ.exePID: 4668, Parent PID: 4120COMMON

Execution Graph

Execution Coverage:	8.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	17
Total number of Limit Nodes:	4

Executed Functions

Function 06892348 Relevance: 9.0, Strings: 6, Instructions: 1516COMMON

Download Yara Rule

Strings

$]q, xrefs: 0689382B
$]q, xrefs: 06893807
$]q, xrefs: 068937EA
$]q, xrefs: 06893813
$]q, xrefs: 068937DE
$]q, xrefs: 06893837

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: 994823fdca4c2d84531799811b4efd6e32f1925b02b62cafc6397a368408e2f1
Instruction ID: fa65d92d2842d161cbea46b8f8a4e21854d617bb7e26f2da1a39795cd8436629
Opcode Fuzzy Hash: 994823fdca4c2d84531799811b4efd6e32f1925b02b62cafc6397a368408e2f1
Instruction Fuzzy Hash: CEE25734E102098FDB64DF68C594A9DB7F2FF89304F5885A9D409EB265EB30ED85CB90

Function 0689B2C8 Relevance: 8.3, Strings: 6, Instructions: 762COMMON

Download Yara Rule

Strings

$]q, xrefs: 0689BC6D
$]q, xrefs: 0689BCA1
$]q, xrefs: 0689BC79
$]q, xrefs: 0689BC45
$]q, xrefs: 0689BC39
$]q, xrefs: 0689BCAD

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: b35a9dcf329f9a4b8c584354f9be45c3ce348115af1ae8d5131a12987d545744
Instruction ID: 7a2f179582d4ccf864984c361419ed79f4df8587aa513b15287154cf8638f51f
Opcode Fuzzy Hash: b35a9dcf329f9a4b8c584354f9be45c3ce348115af1ae8d5131a12987d545744
Instruction Fuzzy Hash: D5528E30E002098FDF64DF68E5907AEB7B6EB85314F188929E509EB395DB34DD41CBA1

Function 06897E20 Relevance: 3.0, Strings: 2, Instructions: 470
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 0689815D
$]q, xrefs: 06898169

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: bf67e8ace2ce86030cdb25cf7379348f6278faecebdfbe7c39b1224baf647047
Instruction ID: 949122d1864a163bda854131901d4a01f3bd0823cf58f1a39f06ec833011a0ca
Opcode Fuzzy Hash: bf67e8ace2ce86030cdb25cf7379348f6278faecebdfbe7c39b1224baf647047
Instruction Fuzzy Hash: 3C029E30B002069FDF58DF68D990A6EB7A2FF85304F188929D509DB394DB35EC46CBA1

Function 06895648 Relevance: 1.8, Strings: 1, Instructions: 587
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06895D54

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: e419941828951965a9b116229e1ef674e68115eb60a0f4c7dd589c3ffdfb82cb
Instruction ID: 22930d30099b4e3e09db5b2c56a477ae97d4025ba0d9fbf9aaebf00b332f2c4f
Opcode Fuzzy Hash: e419941828951965a9b116229e1ef674e68115eb60a0f4c7dd589c3ffdfb82cb
Instruction Fuzzy Hash: 0922E371F002159FDF65DFA4C4906AEB7B2EF84324F288469D649EB344DA31DD42CBA2

Function 06896698 Relevance: .8, Instructions: 824COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9848aaf07072184496503245eca1e6892f6364e15ae596b77e5b751d572f1ddd
Instruction ID: e38a9dfca2dc13da529439baa5c4895150dd6bfb0e4e989a0d815c7038c6973f
Opcode Fuzzy Hash: 9848aaf07072184496503245eca1e6892f6364e15ae596b77e5b751d572f1ddd
Instruction Fuzzy Hash: F0629130B002049FEF54DB68D954AADB7F2EF84314F188569E505EB395EB35EC86CBA0

Function 0689C220 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03811921470ab86e65c9573616c8e6a2d0195a4eae447837d9d9379982881cea
Instruction ID: 064a1789d03b197a176a1fdeaedacda2c223dff4c1b37bba4091aeca2cb1cbd7
Opcode Fuzzy Hash: 03811921470ab86e65c9573616c8e6a2d0195a4eae447837d9d9379982881cea
Instruction Fuzzy Hash: C832DE30B002099FDF54DF68D990AAEB7B6FB88314F148529E505E7395DB36EC42CBA1

Function 0689AD60 Relevance: 10.4, Strings: 8, Instructions: 390
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 0689AF38
$]q, xrefs: 0689AF0F
$]q, xrefs: 0689AE81
$]q, xrefs: 0689AEE0
$]q, xrefs: 0689AF03
$]q, xrefs: 0689AED4
$]q, xrefs: 0689AE8D
$]q, xrefs: 0689AF2C

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: 4c30f881d7b029955cd6a46953d5bbe40ec6e98a048ffdbf260b15001dfc82d5
Instruction ID: 8f3b1f6c907e8479cce9901e1d3fd01d11180e7c94cb2db03bcadabbe0987274
Opcode Fuzzy Hash: 4c30f881d7b029955cd6a46953d5bbe40ec6e98a048ffdbf260b15001dfc82d5
Instruction Fuzzy Hash: 60E19030E102098FDF69DFA8D5906AEB7B6EF85304F148629E405EB354DB74EC46CBA1

Function 068991E8 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06899258
$]q, xrefs: 06899264
$]q, xrefs: 0689929F
$]q, xrefs: 06899293

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 90968a66a2224228e31b721b404f528c7efafb15c9b0c2dec117c7788bdeb4fa
Instruction ID: a172699144464eb76f4dda52c0ebc7bc42879350cd733d7c3c5e5bb1465381ff
Opcode Fuzzy Hash: 90968a66a2224228e31b721b404f528c7efafb15c9b0c2dec117c7788bdeb4fa
Instruction Fuzzy Hash: 4D915170B0020A9FDF55DF69D9507AEB3F6BF88204F148569C419EB388EF309D468BA1

Function 0689CFE0 Relevance: 4.5, Strings: 3, Instructions: 799
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 0689D3EB
$]q, xrefs: 0689D3D7
$]q, xrefs: 0689D3DF

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q
API String ID: 0-182748909
Opcode ID: e2808038e277296953ef25da9817c618e17df507e5b631ff890e879c98c55c7b
Instruction ID: fd1a826631f33e91c8e1e74b8a7c87e15580b581fca5484447f2f90dfee69e9c
Opcode Fuzzy Hash: e2808038e277296953ef25da9817c618e17df507e5b631ff890e879c98c55c7b
Instruction Fuzzy Hash: 8C62703060060A8FCB59EF68D590A5EB7F6FF85304B248A28D009DF359DB75ED4ACB91

Function 06894C10 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fbq, xrefs: 0689531D
\Obq, xrefs: 06894DC7
XPbq, xrefs: 06894D3D

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID: fbq$XPbq$\Obq
API String ID: 0-4057264190
Opcode ID: 7a0703b51ceb64532d4e9019e2020d428369f6e51122c6c4bbf31358456b5fc0
Instruction ID: 9eca5ae13a2e3bf55186c7b8a96d4bbb4195342ac8b82f71b3704c3427d7d41e
Opcode Fuzzy Hash: 7a0703b51ceb64532d4e9019e2020d428369f6e51122c6c4bbf31358456b5fc0
Instruction Fuzzy Hash: 3F616F30F002099FEF549FA8C8557AEBBF6EF88304F248529E105EB395DE754D468BA1

Function 068991D8 Relevance: 2.7, Strings: 2, Instructions: 169
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06899258
$]q, xrefs: 06899293

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 1582e671ebdd3f5a90d0a05cf1c667fefd5bda29af753d75579fef6437f223c8
Instruction ID: 0faecaba860ccdb2222aff170f452e926a465aef0d7cdf11ac9c5dfe91e124f2
Opcode Fuzzy Hash: 1582e671ebdd3f5a90d0a05cf1c667fefd5bda29af753d75579fef6437f223c8
Instruction Fuzzy Hash: 23518070B002069FDF54DF78D951B6EB3F6EB88204F148929C419DB398EE30EC028BA1

Function 00E0EB20 Relevance: 1.6, APIs: 1, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.4502985029.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e00000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88364fc0c8ae3761b88b35483b6b26cc1570afe035f385ebcc57ea25d9073ff4
Instruction ID: 8cad5625c87d614e235ea27f6b43b76d997daa2be31a40d844ddf9e8a83a09fb
Opcode Fuzzy Hash: 88364fc0c8ae3761b88b35483b6b26cc1570afe035f385ebcc57ea25d9073ff4
Instruction Fuzzy Hash: FC413632D003498FCB14DFB9D8442EEBBB1AF99310F15866BD404B7391EB389885CBA0

Function 00E0EC08 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 00E0EC6F

Memory Dump Source

Source File: 00000003.00000002.4502985029.0000000000E00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e00000_Wru9ycO2MJ.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 6dae30fed70a85812a0fed0e7518beb8f16da7b9232474e77441aced74bbf24e
Instruction ID: 125791899c4cadc5cb7b1d0302337ed391ea3cafc09b71d3bf7f1ba8ca215c68
Opcode Fuzzy Hash: 6dae30fed70a85812a0fed0e7518beb8f16da7b9232474e77441aced74bbf24e
Instruction Fuzzy Hash: 15111FB1C006599BCB10DFAAC544AAEFBF8AF48320F14852AD818B7240D378A940CFE5

Function 06894BDC Relevance: 1.4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

XPbq, xrefs: 06894D3D

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID: XPbq
API String ID: 0-864591470
Opcode ID: 3a457c1e1274b2f3a6b86bb4ef58cd8765a3b1b67bb0def12a404e9b0621c632
Instruction ID: a69b5f3c8f6cfea14cb14333407a8e121f2a93151f3b0982fbb1ba1f267a198b
Opcode Fuzzy Hash: 3a457c1e1274b2f3a6b86bb4ef58cd8765a3b1b67bb0def12a404e9b0621c632
Instruction Fuzzy Hash: 77517334B002099FEF549FA9C8547AEBBF6EF88704F208529E105EB395DE758C058BA1

Function 06894C01 Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

XPbq, xrefs: 06894D3D

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID: XPbq
API String ID: 0-864591470
Opcode ID: a20e910099a0c5423fcc7cacf6f87c242a7b90fc9a5d752e6afe7229c301f3fc
Instruction ID: 1a4f4b79042e1754116002bf44a680daeb95b540c9722d9dab07bb29588a4707
Opcode Fuzzy Hash: a20e910099a0c5423fcc7cacf6f87c242a7b90fc9a5d752e6afe7229c301f3fc
Instruction Fuzzy Hash: BE416030F002099FDB549FA8C855BAEBAF6FF88704F208529E105AB395DE748D058BA1

Function 0689DB68 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0689DCB1

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 40cad1a66fb8552e183b307525c4fde499e41f265bfca941e3a0ca7ee62f6f37
Instruction ID: 759194ca8549a50c1f2a1fe50452d10b6be7e59f40f6a6141bafd72e22397c08
Opcode Fuzzy Hash: 40cad1a66fb8552e183b307525c4fde499e41f265bfca941e3a0ca7ee62f6f37
Instruction Fuzzy Hash: CF41CF30E00B0A9FDF54DFA5C88469EBBB6EF85304F148929E505E7340DBB0D846CBA5

Function 0689DB55 Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

PH]q, xrefs: 0689DCB1

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 74c5a4689a5b0ff9d0c013440421d20e189809332c717dd32919e86c08a6c7e3
Instruction ID: f2b6f7d90174b1bf8d4b47fe1cb03aa8976681b5d01131a93caad4d941fa434f
Opcode Fuzzy Hash: 74c5a4689a5b0ff9d0c013440421d20e189809332c717dd32919e86c08a6c7e3
Instruction Fuzzy Hash: 30419130E00B4A9FDF55DF64C88469EBBB2EF85304F184929E505EB340DB719846CB61

Function 068921AD Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

PH]q, xrefs: 068922FB

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: fdda7be53f2abe7bf753e58b65b550a3c480d353f6de29e92cdc9c395a9679ca
Instruction ID: f554db9e14e8934e54c49228dfee0febd511fb800209a7b1d7a3cede4cd6fa94
Opcode Fuzzy Hash: fdda7be53f2abe7bf753e58b65b550a3c480d353f6de29e92cdc9c395a9679ca
Instruction Fuzzy Hash: E7312330B102059FDF599BB8D96076EBBA2AF89204F184568D406DB395DF35CD06C7B1

Function 068921C0 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH]q, xrefs: 068922FB

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 53a90fc501431e12a107ab8789d00e795120fee9a8b70ccc815ad036df7d5c01
Instruction ID: 8f0974c02e3f16b81202886020e453f6859e5f0ab017faf2dbce5d6c9eed5d73
Opcode Fuzzy Hash: 53a90fc501431e12a107ab8789d00e795120fee9a8b70ccc815ad036df7d5c01
Instruction Fuzzy Hash: A2310F30B202059FDB59ABB8D96076FBBA6AF89204F244538D406DB394DF35DD06CBB1

Function 0689B2BB Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71693164cdbaf207a36ab407ff0004a13e6cb5ffd1258cc984ea136204e2f877
Instruction ID: 4b6c881c7eaf2b84aff6293628ebf5f6b0367cdba4ce9d5d0a3348f677d653a4
Opcode Fuzzy Hash: 71693164cdbaf207a36ab407ff0004a13e6cb5ffd1258cc984ea136204e2f877
Instruction Fuzzy Hash: 37A19570F002098FEF64DAADE9907AFB6B6EB89310F244825E509D7395CA34DC41DBB1

Function 06896298 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 362f0419ef0f3628d65de57d34f7a4a7329b11ddec3d989ab5981d7de81adeec
Instruction ID: 643433d7501ee8477fb9cf775e2227d85fb2d3b6c659c4d4eee829bd3cbb65d6
Opcode Fuzzy Hash: 362f0419ef0f3628d65de57d34f7a4a7329b11ddec3d989ab5981d7de81adeec
Instruction Fuzzy Hash: 1361CF71F000214BDF14AA7EC88066EBADAAF94224B194479D90EDB364EE79DD0287E1

Function 06894348 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b55df4b7b10c5619d503781b58807cbc3250b2e456a6ed634c03c6070f4a9f51
Instruction ID: 9356e4cee0cc7520574bdf61bd8e6d4eb175b0f38c41386bb636cb39911d1eb8
Opcode Fuzzy Hash: b55df4b7b10c5619d503781b58807cbc3250b2e456a6ed634c03c6070f4a9f51
Instruction Fuzzy Hash: A4815B30B0020A9FDF54DFA9C5546AEB7F2AB89308F148528D50ADB394EF75EC478B91

Function 06894358 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2823929cb989249fea6fce9f2e0f3441e5cce87bd0be91ff52946f91e5c6eb59
Instruction ID: b6de8a699476261f8d38b904d0cbf853e0fceff12e385bc22f813263bb994eb6
Opcode Fuzzy Hash: 2823929cb989249fea6fce9f2e0f3441e5cce87bd0be91ff52946f91e5c6eb59
Instruction Fuzzy Hash: E2813B30B0020A9FDF54DFA9D55466EB7F2AB89308F148528D50ADB394DF71EC478BA1

Function 06894664 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b017f1bd51966e922b7fe758e0a8164ccb0d17f66bd9926933927abce1cb460d
Instruction ID: 1521a552e82b565b2e629d4460d1762293344e62b76b48cca80d27eb67f0c017
Opcode Fuzzy Hash: b017f1bd51966e922b7fe758e0a8164ccb0d17f66bd9926933927abce1cb460d
Instruction Fuzzy Hash: EE913D30E102198BDF60DF68C890B9DB7B1FF89314F208599D549FB255EB70AA86CF91

Function 06894678 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08cecaed1bd83f5556bd27a5fd674756bf7a933026364783bc342e5ed19d462c
Instruction ID: 81e5a4b768f4a457127ef43643380e78e68b6f860848c90647d3cedf037ab380
Opcode Fuzzy Hash: 08cecaed1bd83f5556bd27a5fd674756bf7a933026364783bc342e5ed19d462c
Instruction Fuzzy Hash: 96913C30E102198BDF60DF68C890B9DB7B1FF89314F208599D549BB255EB70AA86CF91

Function 0689EBC0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a356b599dafcfb6778c863f35da206152e7ff36432885427578165c4c2ff6b9d
Instruction ID: c68f32ece31ea4861bdb2960b085cd341995f5b0caff88de380d160b59395ec4
Opcode Fuzzy Hash: a356b599dafcfb6778c863f35da206152e7ff36432885427578165c4c2ff6b9d
Instruction Fuzzy Hash: 56711D30A002099FDB54EFA8D994AADBBF6FF88304F148529E505EB355DB30ED46CB61

Function 0689EBB3 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80c142a4398520f62776eb8c47cf2c39aa23a08c4648c69d1aa04ef41ae6ecce
Instruction ID: f3f119b18f7cbb4a4e6f1d804290d412548250cd342ae4cd0d728b40bec29240
Opcode Fuzzy Hash: 80c142a4398520f62776eb8c47cf2c39aa23a08c4648c69d1aa04ef41ae6ecce
Instruction Fuzzy Hash: DA713D30A002099FDB54DFA8D984AADBBF6FF88304F188529E445EB355DB30ED46CB60

Function 0689FD29 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 361a706a29465228fac9c9508929b5014e83639db180a8ce6f94d2d774d3a4be
Instruction ID: ca6fcef11b8bbbad18d9a4b4e0850383c77690a34fc0603a90acea3bc8151620
Opcode Fuzzy Hash: 361a706a29465228fac9c9508929b5014e83639db180a8ce6f94d2d774d3a4be
Instruction Fuzzy Hash: 7B51D531E00109DFDF18AF78E8546AEBBB2EF85315F148869E206DB354DF358945CBA1

Function 0689FAD8 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceefc6bcf93160c7152c7c66f9121cefea0f1bd5a5224dd770ab7408fa4d4e65
Instruction ID: 668220a09507e7b4e769f84ab2f922da3c255726e4b236156558c4779a7b8c46
Opcode Fuzzy Hash: ceefc6bcf93160c7152c7c66f9121cefea0f1bd5a5224dd770ab7408fa4d4e65
Instruction Fuzzy Hash: B251FA70B102195FEF68566CE95477F265EDB89310F24442AEB0AC73D6CA6DCC4683A2

Function 0689FAE8 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 222cb50782736bf333ead6f6dce591581d36328bfc0aa25a12b34438371e7984
Instruction ID: ca535cf6d1fbddd6a9ffdf4354cd21147618e318d57e49befb54d83fbda9d771
Opcode Fuzzy Hash: 222cb50782736bf333ead6f6dce591581d36328bfc0aa25a12b34438371e7984
Instruction Fuzzy Hash: CA51BB70B102195FEF68566CE95473F365EDB89310F24442AEB0AC7399CB6DCC4687B2

Function 06895637 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6884ff5502d344fd4a682ecb318d407ec290a4b3de9a0a616cbab469c5e75e1
Instruction ID: b27a703950a3d3110ea318b3abc7b3c8e2ebf3e64de9a23af85076da1285e5b7
Opcode Fuzzy Hash: b6884ff5502d344fd4a682ecb318d407ec290a4b3de9a0a616cbab469c5e75e1
Instruction Fuzzy Hash: BF517874E102059FDF768F68C4D077EBBB2EB45310F28C929E65ADB281C635D942CB62

Function 068954C8 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e61b5b44a19280181e4e96f4ea36db0d0a4800206cdedcc1d1dddb6f64dcf903
Instruction ID: 20c3112dc903e13bae6d307816fa00310b89c58312c65358737a9865f44ea51c
Opcode Fuzzy Hash: e61b5b44a19280181e4e96f4ea36db0d0a4800206cdedcc1d1dddb6f64dcf903
Instruction Fuzzy Hash: 75416071E006098FDF71CEA9D8C1AAFFBF2EB84310F14492AD216D3651D731E9458BA2

Function 0689DA08 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02d37ac03301414da4e77f08bd1b136c978a1950793cbd4536907350a3afef1d
Instruction ID: 24a69c1bad411b9f106ecb6d7e94516ce794fbd0ce9f1c9b59656d8eb5ab69a4
Opcode Fuzzy Hash: 02d37ac03301414da4e77f08bd1b136c978a1950793cbd4536907350a3afef1d
Instruction Fuzzy Hash: E331E831A1470A8FCF15DF68D98069EBBB6EF85310F148A29E441E7394EB70A946CB51

Function 06892071 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42cf4f7d4069536db2f7769c661e21a15eeb7ff1c78d87148b7390c53edcba95
Instruction ID: 2f98964afdadcabb8e3066e8d06b4048e9cd59c7ac5bf350f669d312551a4d22
Opcode Fuzzy Hash: 42cf4f7d4069536db2f7769c661e21a15eeb7ff1c78d87148b7390c53edcba95
Instruction Fuzzy Hash: ED319034E10609AFCF15CF64D8646AEBBB2FF89700F148529E906E7750DB71AD42CB50

Function 00D5D005 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4502600566.0000000000D5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d5d000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 758957390156dc5f9b505758a14495002d4e1c438638cf783cd432aa6b8dbd46
Instruction ID: ede170b4216afdc72e7b70500ea53d4344dd857a591f28e00d4480a0aa143893
Opcode Fuzzy Hash: 758957390156dc5f9b505758a14495002d4e1c438638cf783cd432aa6b8dbd46
Instruction Fuzzy Hash: 97314E7150E7C48FCB178B24C9A4711BF75AB47214F1985DBD9858F2A7C22A980ECB72

Function 06892080 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b97f6f8efa1e88e592c0c13526fd6e14a3b8f0d9ee65671a0f6dbd1b1bd50120
Instruction ID: 4981826b988e5b89811b03564af6cb2421a4c7689e22a0401a343fbfd7033227
Opcode Fuzzy Hash: b97f6f8efa1e88e592c0c13526fd6e14a3b8f0d9ee65671a0f6dbd1b1bd50120
Instruction Fuzzy Hash: C2318F31E10209ABCF14DF64D864A9EBBB2FF89700F148519E906E7350DB71AD42CB50

Function 06893B48 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2e5815c6cfe8dbd1a6dfd6132ca1d968f06e1fcf95acf2539b082ef9ec0831c
Instruction ID: e6e1b86f90e59bde25a1ed3b1237d99192b5d06e53659fe040574dea2852089c
Opcode Fuzzy Hash: b2e5815c6cfe8dbd1a6dfd6132ca1d968f06e1fcf95acf2539b082ef9ec0831c
Instruction Fuzzy Hash: AF21B075F006159FDF50DFA8D982AEEB7F5EB48318F144025E909E7740EB30D9428BA1

Function 06893B58 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00365b2cdbbd62f945ae40e428b89582b0e14358a320846ba9dc90248774225d
Instruction ID: 4fd78ae8d4ae8dac81e52ac3e6072af98b963d668ed81ab22edbb775b6e2bb36
Opcode Fuzzy Hash: 00365b2cdbbd62f945ae40e428b89582b0e14358a320846ba9dc90248774225d
Instruction Fuzzy Hash: 8121AE75F006159FDF50DFA8D981AAEBBF1EB48318F144029E909E7340EB30E941CBA1

Function 068954B8 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ce3a1261ff3c03863e898b3240bac80eeb193f5b70debe6b074353ecd217a23
Instruction ID: 93182e1eab5aa790c55d9015466f39fb9e9822bf01e8195f23f5ef734cd3930d
Opcode Fuzzy Hash: 2ce3a1261ff3c03863e898b3240bac80eeb193f5b70debe6b074353ecd217a23
Instruction Fuzzy Hash: FE218C31A006099FCF61CEA9D881AAFBBB6EB88310F144929E219D7651D731A845CB92

Function 00D5D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4502600566.0000000000D5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_d5d000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ff1f0901aa2048c3dff875167385d2a5c1fffe2dd6b74ff912d94121ce1d88e
Instruction ID: 9315f624c07d87cb64e2a8e5ca226325e17e928fc86d430774ac7b26f09780ca
Opcode Fuzzy Hash: 5ff1f0901aa2048c3dff875167385d2a5c1fffe2dd6b74ff912d94121ce1d88e
Instruction Fuzzy Hash: 7E21F271504204DFCF24DF28C9C4B26BB66FB84315F24C569ED494B392C73AD84ADA72

Function 06893C68 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eea48d93c3a65aa4a142708adbba47d3cb8ad441bd6daf80bd6a97d032976d7e
Instruction ID: ba266bcf9d29fc6c7db58fae7364dd175ffd21d65308afe5179e803cb433773d
Opcode Fuzzy Hash: eea48d93c3a65aa4a142708adbba47d3cb8ad441bd6daf80bd6a97d032976d7e
Instruction Fuzzy Hash: 8311C432B105285FDF55D679C8146AE73EAEBC8318F044579D50AE7344DE35DC068BE1

Function 068942AB Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f695e0dfd51de75fdc05d48601599a5407859dbfce4f612e39f89eae99ae52c4
Instruction ID: 34db3c4ea677112dbbd3b8e46f5ca1f024ab5f3f911484fdf75abf3477e6aee0
Opcode Fuzzy Hash: f695e0dfd51de75fdc05d48601599a5407859dbfce4f612e39f89eae99ae52c4
Instruction Fuzzy Hash: 1501B531B041141FDF65A6BDD415B2FBBEADBCA620F14892AE10AC7351D965CC4383A1

Function 0689EE31 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84478f711c15cfa6c04033ab288bd9dec5606b106f67226041ae77baf543a1a6
Instruction ID: e52a175db7b5ccb9650bc1e615bd8e55c6e851dd0ffe253a783f0fc9575faac9
Opcode Fuzzy Hash: 84478f711c15cfa6c04033ab288bd9dec5606b106f67226041ae77baf543a1a6
Instruction Fuzzy Hash: 9001B135B104105FCF25DA6D9498B2E7BD6DFC9610F184939F20ACB381DA21DD0243D1

Function 06893928 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7d9bb6ab8398e3386a51510bb7ec1477e3b074f748d4aed3c00148d77d246c5
Instruction ID: 332ba47075dfaee969b5f79b00798179b770a64dec9356de26ee131444bfa334
Opcode Fuzzy Hash: c7d9bb6ab8398e3386a51510bb7ec1477e3b074f748d4aed3c00148d77d246c5
Instruction Fuzzy Hash: 6811B3B5D01259AFCB00DF9AD984ADEFBB8FB49314F10812AE918A7240D374A554CFA5

Function 068942B8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34bab31b95c549d256d3772cb1eff18e4013b656b25785f373c90b5ba5110968
Instruction ID: b0895b5ac8f5027c3842104c4757cade0aef76e2216992ff05983dd70972b999
Opcode Fuzzy Hash: 34bab31b95c549d256d3772cb1eff18e4013b656b25785f373c90b5ba5110968
Instruction Fuzzy Hash: 0801D131B100140BDF64A6BED415B2FA6DBDBC9720F24893AE20EC7354DD61DC4383A1

Function 0689A399 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22dd0d7dbcc8d924ae79b246d9b07641a2dd669d5377cfe8b646d0947079fbba
Instruction ID: 07f0a2bbd061bf18200c0a811ffa05967c16958c83098ee14052c6cc4ef032cf
Opcode Fuzzy Hash: 22dd0d7dbcc8d924ae79b246d9b07641a2dd669d5377cfe8b646d0947079fbba
Instruction Fuzzy Hash: 9801F231B100114FDB68EA3CE565B3EB7E2EB85324F148928E20EC7750DF21EC0287A1

Function 06893921 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 117a7c8544fc5900039a030114ecbcafa4cee043f437a7667ab34f79e0649a2f
Instruction ID: 5c9af15f98b21fd56b573d7f75226f2f72da59edbd83540bb6c812108ffaf330
Opcode Fuzzy Hash: 117a7c8544fc5900039a030114ecbcafa4cee043f437a7667ab34f79e0649a2f
Instruction Fuzzy Hash: 6D219EB5D01219AFCB00DF9AD984A9EFBB8FF49314F10852AE918B7240D378A554CBA5

Function 0689EE40 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33dda796c7146ae000275604e642c6e58e49d7fd601927b1f069a0aafbdbd104
Instruction ID: fd7b48e72a1d0b0ae8bc1da46d5da196fe497af789530f11121022dfe55ee365
Opcode Fuzzy Hash: 33dda796c7146ae000275604e642c6e58e49d7fd601927b1f069a0aafbdbd104
Instruction Fuzzy Hash: 93018135B104145BDF65D96D94A8B3F7BDADFC9610F188939F20AC7340DE25DC0243A1

Function 06893C57 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c915bc14b7d175ae8d24c7db89c740e789c2dee3b1fb1b3335d5c2823ca3d7a
Instruction ID: 212eb224ff88f53615d21fb6242a4b4fd5ddeeee7a899b97c8630a57335a8e4b
Opcode Fuzzy Hash: 4c915bc14b7d175ae8d24c7db89c740e789c2dee3b1fb1b3335d5c2823ca3d7a
Instruction Fuzzy Hash: 8801F732F101245BDF959968CC142EF73AA9BC8218F050179D50AE7340EE648C0647D1

Function 0689A3A8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebdfa44cef726c92bef2d6ca3a46e624759f510af0677d85df29fc81ba050f9c
Instruction ID: d3c3103c31ebc78dfb1e2dec0652a7d481c899868afdfb465c4b92477a4e19bd
Opcode Fuzzy Hash: ebdfa44cef726c92bef2d6ca3a46e624759f510af0677d85df29fc81ba050f9c
Instruction Fuzzy Hash: 0D01D134B100144FDB68EA3CE465B2EB7D6DB85714F108938E20AC7350DE21EC0287A1

Function 06896519 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9af3a63704c34b3d78130521e08f93ae79fdf1ae5151e21368ac8b1b89dea4cd
Instruction ID: aa9ffc008f14757a8931d88e36539e7a3cf18df09e7860bce61c7f22bcb85d2e
Opcode Fuzzy Hash: 9af3a63704c34b3d78130521e08f93ae79fdf1ae5151e21368ac8b1b89dea4cd
Instruction Fuzzy Hash: 48E02671E14149ABFF50CE708A0475E3369EB42208F6689E2D004DB202F176CE428750

Function 06896528 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3f40778c56a94cb1829351910999078a94cedfe7366333d70a95a28b265ea9a
Instruction ID: 19945c97c100bb625b691294c8e953f98c82e11c60bef23ed3543fbcceadbddb
Opcode Fuzzy Hash: a3f40778c56a94cb1829351910999078a94cedfe7366333d70a95a28b265ea9a
Instruction Fuzzy Hash: 5DE0C271E1010DABEF50CEB4C90575E73ACEB02204F6484A4D508C7202F172CE4187A0

Non-executed Functions

Function 06897740 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$]q, xrefs: 068978B1
$]q, xrefs: 06897CE6
$]q, xrefs: 06897C31
$]q, xrefs: 068978A5
$]q, xrefs: 06897880
$]q, xrefs: 06897C3D
$]q, xrefs: 06897CF2
$]q, xrefs: 06897CD0
$]q, xrefs: 06897874
$]q, xrefs: 06897CDC

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-2843079600
Opcode ID: cca7825c0b0732fe9578556661937d2cb78d845b98b84d73a5b5f22fe161ffdb
Instruction ID: e2738888d65c95472ae4ce334cfe672cab2480ac5d80a43fdf617a8df1f1c6ab
Opcode Fuzzy Hash: cca7825c0b0732fe9578556661937d2cb78d845b98b84d73a5b5f22fe161ffdb
Instruction Fuzzy Hash: 3E123A30A112198FDF68DF68C994AADB7F2BF88304F2485A9D509EB355DB309D81CF91

Function 0689A9C8 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$]q, xrefs: 0689AACA
$]q, xrefs: 0689AB86
$]q, xrefs: 0689AB44
$]q, xrefs: 0689AB50
$]q, xrefs: 0689AB25
$]q, xrefs: 0689AB19
$]q, xrefs: 0689AB7A
$]q, xrefs: 0689AABE

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: e1c9f3ffc1b847debdb21f19be996287b51f7c7e4d314428cec9711db8f4c930
Instruction ID: cb33bbd3154256e71fb138549dbc3c5a309c13b0a7a8345473bdedfa85aecf3b
Opcode Fuzzy Hash: e1c9f3ffc1b847debdb21f19be996287b51f7c7e4d314428cec9711db8f4c930
Instruction Fuzzy Hash: A2914F30A002099FDF58DF68D995B6EB7F6EF84308F148529D801EB395DB759941CBA0

Function 06897140 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$]q, xrefs: 068975DC
$]q, xrefs: 0689747C
$]q, xrefs: 06897422
$]q, xrefs: 06897488
.5uq, xrefs: 0689719B
$]q, xrefs: 06897654
$]q, xrefs: 06897648

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID: .5uq$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-981061697
Opcode ID: 9cece5ac835c547785c3986229ded29bd14dac766f5e7f3f6d11b847c5d83b10
Instruction ID: ff8b4504285536d5a975fd3b572e4974b15f9bbfc37f47111c9734b6053fc8e9
Opcode Fuzzy Hash: 9cece5ac835c547785c3986229ded29bd14dac766f5e7f3f6d11b847c5d83b10
Instruction Fuzzy Hash: C2F12E30B10209CFDB59EFA8D555A6EB7B6FF84304F248568D4059B3A9DF35AC82CB90

Function 06898470 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$]q, xrefs: 0689872F
$]q, xrefs: 068986CA
$]q, xrefs: 0689873B
$]q, xrefs: 068986D6

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 713b0f9ae3b54c7697816e1db50648ecce0be9ab8414e90bdbdf2ec701ecf381
Instruction ID: eb2b14294e5886b5f34978d9ff270387d8a2d264ddf33b2575c8b4f70dedbfc7
Opcode Fuzzy Hash: 713b0f9ae3b54c7697816e1db50648ecce0be9ab8414e90bdbdf2ec701ecf381
Instruction Fuzzy Hash: B6B17D70B002098FDB68DFA8D59465EB7B6FF85304F248829D106EB395DB75DC82CBA0

Function 0689AD50 Relevance: 5.2, Strings: 4, Instructions: 177COMMON

Download Yara Rule

Strings

$]q, xrefs: 0689AE81
$]q, xrefs: 0689AF03
$]q, xrefs: 0689AED4
$]q, xrefs: 0689AF2C

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 9ac7647406d516c9060b7f4421a5316f6bb085b01ef60cf74eefa27eea8b4dfc
Instruction ID: 4fc34050cac85a8b1d9eb5053f6e84898e6140b7eb7c137629ff4321ef6237ce
Opcode Fuzzy Hash: 9ac7647406d516c9060b7f4421a5316f6bb085b01ef60cf74eefa27eea8b4dfc
Instruction Fuzzy Hash: 0D51A230A102059FDFADDB68D980AADB7B2EF84315F188529E906E7355DB34DC41CBA0

Function 06898888 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LR]q, xrefs: 0689897B
$]q, xrefs: 06898907
LR]q, xrefs: 068989CA
$]q, xrefs: 06898913

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID: LR]q$LR]q$$]q$$]q
API String ID: 0-3527005858
Opcode ID: f1517add7844d2e0cc48ba303543883183cbe7f4444ebadfdb4dd4041cacbf3f
Instruction ID: cc6c249ccca7032dfef22f37de6ee683b34afa7e70addda05af2acc6a4f802df
Opcode Fuzzy Hash: f1517add7844d2e0cc48ba303543883183cbe7f4444ebadfdb4dd4041cacbf3f
Instruction Fuzzy Hash: ED519070B002069FDB58EF28D981A6EB7E6FF85304F148969E506DB395DB31EC41CB61

Function 0689ADDC Relevance: 5.1, Strings: 4, Instructions: 117COMMON

Download Yara Rule

Strings

$]q, xrefs: 0689AE81
$]q, xrefs: 0689AF03
$]q, xrefs: 0689AED4
$]q, xrefs: 0689AF2C

Memory Dump Source

Source File: 00000003.00000002.4509606599.0000000006890000.00000040.00000800.00020000.00000000.sdmp, Offset: 06890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6890000_Wru9ycO2MJ.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: adcf424aaf19f47b065e6784564e317f077aa72dbf86ba69069a572c71d13bdc
Instruction ID: a714d5f09ae09bda9ed1c4f005ec817af098fc4cd846d7653be4d346beb2db83
Opcode Fuzzy Hash: adcf424aaf19f47b065e6784564e317f077aa72dbf86ba69069a572c71d13bdc
Instruction Fuzzy Hash: AE41AF30A102059FCFA9EB68D980A6D77B2EF84309F288669D901D7295DB34EC42CB60

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Wru9ycO2MJ.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Wru9ycO2MJ.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
Wru9ycO2MJ.exe

Function 025D08F0 Relevance: 2.7, Strings: 2, Instructions: 238
COMMON

Function 025D2368 Relevance: 2.7, Strings: 2, Instructions: 185
COMMON

Function 025D0EA7 Relevance: 2.7, Strings: 2, Instructions: 181
COMMON

Function 025D0F08 Relevance: 2.6, Strings: 2, Instructions: 139
COMMON

Function 025D2276 Relevance: 1.5, Strings: 1, Instructions: 279
COMMON

Function 025DA4F0 Relevance: .2, Instructions: 182
COMMON

Function 025D8E64 Relevance: 1.6, APIs: 1, Instructions: 102
COMMON

Function 025D79F4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 025DE6F8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 06897E20 Relevance: 3.0, Strings: 2, Instructions: 470
COMMON

Function 06895648 Relevance: 1.8, Strings: 1, Instructions: 587
COMMON

Function 0689AD60 Relevance: 10.4, Strings: 8, Instructions: 390
COMMON

Function 068991E8 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Function 0689CFE0 Relevance: 4.5, Strings: 3, Instructions: 799
COMMON

Function 06894C10 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre