Edit tour

Windows Analysis Report
SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe
Analysis ID:	1632699
MD5:	f9fe873316a74e0d1c93357a904e133f
SHA1:	d8a4387af178c7d9b4710c433d6d5c37b89c3d01
SHA256:	b6cbf3bb81c4b91c2aa4552b4767106b9e9510e9e0cc21053913849882609e0c
Tags:	exeuser-SecuriteInfoCom
Infos:

Detection

Poverty Stealer

Score:	72
Range:	0 - 100
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Poverty Stealer

C2 URLs / IPs found in malware configuration

Joe Sandbox ML detected suspicious sample

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe (PID: 8300 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe" MD5: F9FE873316A74E0D1C93357A904E133F)

cleanup

Malware Configuration

Threatname: Poverty Stealer

{
  "C2 url": "185.244.212.106:2227"
}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1420376353.0000000002F04000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
00000000.00000003.1420412965.0000000002EBC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe PID: 8300	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author
0.3.SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe.2f03b80.3.unpack	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
0.3.SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe.2ebb040.5.unpack	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
0.3.SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe.2f03b80.6.unpack	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
0.3.SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe.2f03b80.1.unpack	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security

Joe Sandbox Signatures

• AV Detection
• Compliance
• Spreading
• Networking
• System Summary
• Data Obfuscation
• Malware Analysis System Evasion
• Anti Debugging
• Language, Device and Operating System Detection
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000003.1420376353.0000000002F04000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Poverty Stealer {"C2 url": "185.244.212.106:2227"}

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe

Virustotal: Detection: 29%

Perma Link

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 185.166.143.48:443 -> 192.168.2.5:49707 version: TLS 1.2

Source: SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: H:\new Stub C++ for panel\Release\BigProject.pdb) source: SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe
Source:	Binary string: H:\new Stub C++ for panel\Release\BigProject.pdb source: SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe

Code function: 0_2_0031F791 FindFirstFileExW,

0_2_0031F791

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 185.244.212.106:2227

Source: Joe Sandbox View

IP Address: 185.166.143.48 185.166.143.48

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe

Code function: 0_2_003042E0 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,InternetOpenA,InternetOpenUrlA,FreeLibrary,InternetReadFile,InternetReadFile,FreeLibrary,

0_2_003042E0

Source: global traffic

HTTP traffic detected: GET /microsoftingsoftwares/faw/raw/35a4772e22b353e621019b578e4e1bce5ba5d748/settings HTTP/1.1Accept: */*User-Agent: Chrome/95.0.4638.54Host: bitbucket.org

Source: global traffic

DNS traffic detected: DNS query: bitbucket.org

Source: SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe, 00000000.00000002.1422217807.0000000002E90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/
Source: SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe, 00000000.00000003.1421372610.00000000013CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/microsoftingsoftwares/faw/raw/35a4772e22b353e621019b578e4e1bce5ba5d748/setting
Source: SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe, 00000000.00000002.1422217807.0000000002E90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/t
Source: SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe, 00000000.00000003.1420456885.0000000002EC7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe, 00000000.00000003.1420412965.0000000002EBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dz8aopenkvv6s.cloudfront.net

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707

Source: unknown

HTTPS traffic detected: 185.166.143.48:443 -> 192.168.2.5:49707 version: TLS 1.2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Code function: 0_2_00302880	0_2_00302880
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Code function: 0_2_003059A0	0_2_003059A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Code function: 0_2_003042E0	0_2_003042E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Code function: 0_2_0032A019	0_2_0032A019
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Code function: 0_2_00323162	0_2_00323162
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Code function: 0_2_003219E4	0_2_003219E4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Code function: 0_2_0030D2A1	0_2_0030D2A1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Code function: 0_2_0030E3D0	0_2_0030E3D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Code function: 0_2_00315C20	0_2_00315C20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Code function: 0_2_003024D0	0_2_003024D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Code function: 0_2_0031B4CF	0_2_0031B4CF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Code function: 0_2_0030A760	0_2_0030A760
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Code function: 0_2_00327F60	0_2_00327F60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Code function: 0_2_00312F5E	0_2_00312F5E

Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe

Code function: String function: 0030D970 appears 48 times

Source: SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal72.troj.winEXE@2/0@1/1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Command line argument: 0<3	0_2_003059A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Command line argument: =3	0_2_003059A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Command line argument: =3	0_2_003059A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Command line argument: =3	0_2_003059A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Command line argument: =3	0_2_003059A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Command line argument: =3	0_2_003059A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Command line argument: 0<3	0_2_003059A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Command line argument: user32.dll	0_2_003059A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Command line argument: Nr2	0_2_003271A0

Source: SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe

Virustotal: Detection: 29%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: H:\new Stub C++ for panel\Release\BigProject.pdb) source: SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe
Source:	Binary string: H:\new Stub C++ for panel\Release\BigProject.pdb source: SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe

Code function: 0_2_003059A0 GetTickCount,Sleep,LoadLibraryA,GetProcAddress,FreeLibrary,KiUserCallbackDispatcher,FreeLibrary,GetTickCount,Sleep,MessageBoxW,Concurrency::cancel_current_task,

0_2_003059A0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Code function: 0_2_0030B122 pushad ; retn 0032h		0_2_0030B123
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Code function: 0_2_0030D5CE push ecx; ret		0_2_0030D5E1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe

Code function: 0_2_0031F791 FindFirstFileExW,

0_2_0031F791

Source: SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe, 00000000.00000003.1420771923.0000000001387000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe, 00000000.00000003.1420497399.0000000002EB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe, 00000000.00000003.1421107805.0000000001387000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe, 00000000.00000002.1422270188.0000000002EB4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe, 00000000.00000003.1421181026.0000000001387000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe, 00000000.00000003.1421265311.00000000013C0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe, 00000000.00000002.1421992949.00000000013CF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe, 00000000.00000003.1421372610.00000000013CF000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe

Code function: 0_2_003115E3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_003115E3

Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe

Code function: 0_2_003059A0 GetTickCount,Sleep,LoadLibraryA,GetProcAddress,FreeLibrary,KiUserCallbackDispatcher,FreeLibrary,GetTickCount,Sleep,MessageBoxW,Concurrency::cancel_current_task,

0_2_003059A0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe

Code function: 0_2_003024D0 mov eax, dword ptr fs:[00000030h]

0_2_003024D0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe

Code function: 0_2_0032037D GetProcessHeap,

0_2_0032037D

Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Code function: 0_2_0030D905 SetUnhandledExceptionFilter,	0_2_0030D905
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Code function: 0_2_0030DB13 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0030DB13
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Code function: 0_2_003115E3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_003115E3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Code function: 0_2_0030D779 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0030D779

Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_003228A3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Code function: EnumSystemLocalesW,	0_2_0031A9E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Code function: EnumSystemLocalesW,	0_2_003221DA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Code function: EnumSystemLocalesW,	0_2_00322225
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Code function: EnumSystemLocalesW,	0_2_003222C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_0032234B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Code function: GetLocaleInfoW,	0_2_0032259E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Code function: GetLocaleInfoW,	0_2_0031AE90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_003226C7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00321F2E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	Code function: GetLocaleInfoW,	0_2_003227CD

Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe

Code function: 0_2_003138B9 GetSystemTimeAsFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,

0_2_003138B9

Stealing of Sensitive Information

Yara detected Poverty Stealer

Source: Yara match	File source: 0.3.SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe.2f03b80.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe.2ebb040.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe.2f03b80.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe.2f03b80.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1420376353.0000000002F04000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1420412965.0000000002EBC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe PID: 8300, type: MEMORYSTR

Remote Access Functionality

Yara detected Poverty Stealer

Source: Yara match	File source: 0.3.SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe.2f03b80.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe.2ebb040.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe.2f03b80.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe.2f03b80.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1420376353.0000000002F04000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1420412965.0000000002EBC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe PID: 8300, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	2 Obfuscated Files or Information	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	12 System Information Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe	29%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
185.244.212.106:2227	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bitbucket.org	185.166.143.48	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://bitbucket.org/microsoftingsoftwares/faw/raw/35a4772e22b353e621019b578e4e1bce5ba5d748/settings	false		high
185.244.212.106:2227	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://bitbucket.org/	SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe, 00000000.00000002.1422217807.0000000002E90000.00000004.00000020.00020000.00000000.sdmp	false	high
https://bitbucket.org/microsoftingsoftwares/faw/raw/35a4772e22b353e621019b578e4e1bce5ba5d748/setting	SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe, 00000000.00000003.1421372610.00000000013CF000.00000004.00000020.00020000.00000000.sdmp	false	high
https://bitbucket.org/t	SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe, 00000000.00000002.1422217807.0000000002E90000.00000004.00000020.00020000.00000000.sdmp	false	high
https://dz8aopenkvv6s.cloudfront.net	SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe, 00000000.00000003.1420456885.0000000002EC7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe, 00000000.00000003.1420412965.0000000002EBC000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.166.143.48	bitbucket.org	Germany		16509	AMAZON-02US	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1632699
Start date and time:	2025-03-08 23:23:19 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe
Detection:	MAL
Classification:	mal72.troj.winEXE@2/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 14 Number of non-executed functions: 53
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.166.143.48	http://bitbucket.org/aaa14/aaaa/downloads/dFkbkhk.txt	Get hash	malicious	Unknown	Browse	bitbucket.org/aaa14/aaaa/downloads/dFkbkhk.txt

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bitbucket.org	Dear david@corerecon.com - Your Stay Has Been Successfully Booked Ocean Breeze Retreat.msg	Get hash	malicious	ScreenConnect Tool	Browse	185.166.143.48
	Lead.Upload.Report.Feb.2025.exe	Get hash	malicious	Unknown	Browse	185.166.143.48
	https://bridesrilanka.com/myreservedroom	Get hash	malicious	ScreenConnect Tool	Browse	185.166.143.48
	phish_alert_iocp_v1.4.48 - 2025-03-05T101050.751.eml	Get hash	malicious	ScreenConnect Tool	Browse	185.166.143.49
	MCxU5Fj.exe	Get hash	malicious	LummaC Stealer	Browse	185.166.143.50
	soft.exe	Get hash	malicious	GCleaner, LummaC Stealer, Socks5Systemz	Browse	185.166.143.48
	foUENR5vt.exe	Get hash	malicious	LummaC Stealer	Browse	185.166.143.50
	67c2163c9db39.vbs	Get hash	malicious	LummaC Stealer	Browse	185.166.143.48
	http://getgreenshot.org	Get hash	malicious	Unknown	Browse	185.166.143.48
	MqJtm7S3o1.doc	Get hash	malicious	RedLine	Browse	185.166.143.49

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	sh4.elf	Get hash	malicious	Mirai	Browse	18.180.172.177
	arm.elf	Get hash	malicious	Mirai	Browse	18.182.140.102
	m68k.elf	Get hash	malicious	Mirai	Browse	18.227.209.61
	mpsl.elf	Get hash	malicious	Mirai	Browse	18.141.95.254
	spc.elf	Get hash	malicious	Mirai	Browse	18.190.141.61
	arm7.elf	Get hash	malicious	Mirai	Browse	13.53.253.2
	ppc.elf	Get hash	malicious	Mirai	Browse	13.127.50.187
	x86.elf	Get hash	malicious	Mirai	Browse	13.125.44.240
	na.elf	Get hash	malicious	Prometei	Browse	54.171.230.55
	combined.exe	Get hash	malicious	Unknown	Browse	52.219.152.12

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	SwitchAutoSetup_v0.7.0.3.exe	Get hash	malicious	Vidar	Browse	185.166.143.48
	SecuriteInfo.com.Variant.Zusy.582702.20219.11785.exe	Get hash	malicious	Unknown	Browse	185.166.143.48
	SecuriteInfo.com.Variant.Zusy.582702.20219.11785.exe	Get hash	malicious	Unknown	Browse	185.166.143.48
	Magic_V_pro_setup_stable_latest_release_version_9_709.exe	Get hash	malicious	LummaC Stealer	Browse	185.166.143.48
	Magic_V_pro_setup_stable_latest_release_version_9_709.exe	Get hash	malicious	LummaC Stealer	Browse	185.166.143.48
	1.exe	Get hash	malicious	Unknown	Browse	185.166.143.48
	1.exe	Get hash	malicious	Unknown	Browse	185.166.143.48
	BWllpq4Tel.exe	Get hash	malicious	GuLoader	Browse	185.166.143.48
	uK5pfobYyD.exe	Get hash	malicious	DarkCloud	Browse	185.166.143.48
	MNLS4PjscF.exe	Get hash	malicious	GuLoader	Browse	185.166.143.48

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.578552636544814
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe
File size:	263'168 bytes
MD5:	f9fe873316a74e0d1c93357a904e133f
SHA1:	d8a4387af178c7d9b4710c433d6d5c37b89c3d01
SHA256:	b6cbf3bb81c4b91c2aa4552b4767106b9e9510e9e0cc21053913849882609e0c
SHA512:	f2b7ee2311896b27dc7bb86e8053130cbd903b3d1c0ef4c0788d46dfb9facc5757e21f611bcada16dc9bef567509e810b01c1ae79002aced8942dd04ba8fae80
SSDEEP:	6144:cqvwbHMtaRWwVa2+B1fUaio83mMXSrlGhAOZpEBv:cqvwbPWwU2+XHkxhlEB
TLSH:	2D448F01B5D1C872D972057158B4ABB95A3EB9200F7099FB53D41F3ECE706C0AB73A6A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o...+...+...+...`.......`.......`...1...:K..=...:K..9...:K..d...`.......+...O....K..)....K..*...Rich+...........PE..L....M.g...

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x40d289
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67CB4DAD [Fri Mar 7 19:49:01 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	db3aeeba15dbf2707fad3ba5becf2830

Entrypoint Preview

Instruction
call 00007FF915233149h
jmp 00007FF91523284Fh
cmp ecx, dword ptr [0043F040h]
jne 00007FF9152329D3h
ret
jmp 00007FF91523326Fh
push ebp
mov ebp, esp
and dword ptr [0044033Ch], 00000000h
sub esp, 28h
or dword ptr [0043F018h], 01h
push 0000000Ah
call dword ptr [0042C058h]
test eax, eax
je 00007FF915232CDBh
push ebx
push esi
push edi
xor eax, eax
lea edi, dword ptr [ebp-28h]
xor ecx, ecx
push ebx
cpuid
mov esi, ebx
pop ebx
nop
mov dword ptr [edi], eax
mov dword ptr [edi+04h], esi
mov dword ptr [edi+08h], ecx
xor ecx, ecx
mov dword ptr [edi+0Ch], edx
mov eax, dword ptr [ebp-28h]
mov edi, dword ptr [ebp-24h]
mov dword ptr [ebp-04h], eax
xor edi, 756E6547h
mov eax, dword ptr [ebp-1Ch]
xor eax, 49656E69h
mov dword ptr [ebp-18h], eax
mov eax, dword ptr [ebp-20h]
xor eax, 6C65746Eh
mov dword ptr [ebp-14h], eax
xor eax, eax
inc eax
push ebx
cpuid
mov esi, ebx
pop ebx
nop
lea ebx, dword ptr [ebp-28h]
mov dword ptr [ebx], eax
mov eax, dword ptr [ebp-18h]
or eax, dword ptr [ebp-14h]
or eax, edi
mov dword ptr [ebx+04h], esi
mov dword ptr [ebx+08h], ecx
mov dword ptr [ebx+0Ch], edx
jne 00007FF915232A0Bh
mov eax, dword ptr [ebp-28h]
and eax, 0FFF3FF0h
cmp eax, 000106C0h
je 00007FF9152329F5h
cmp eax, 00020660h
je 00007FF9152329EEh
cmp eax, 00020670h
je 00007FF9152329E7h
cmp eax, 00030650h
je 00007FF9152329E0h
cmp eax, 00000660h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3da50	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x41000	0x21f0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3b190	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x3b200	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3b0d0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2c000	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2a871	0x2aa00	5d92a4c0393a8d49e1de7f6b64ebe6ab	False	0.5427339167888563	data	6.657676969668933	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2c000	0x12176	0x12200	f434dfe0511959e8280c5a216e08dd8c	False	0.4938981681034483	data	5.625546128839358	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3f000	0x1f58	0x1200	ec2b0f8bccfefd6305027b3795d46b1a	False	0.1937934027777778	DOS executable (block device driver \377\377\377\377)	3.127900718317494	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x41000	0x21f0	0x2200	506afc22f15df7ff611ca73eb0f3cce4	False	0.7635569852941176	data	6.598006424266324	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

KERNEL32.dll

GetCurrentProcess, GetModuleHandleA, Sleep, LoadLibraryA, CloseHandle, GetProcAddress, FreeLibrary, GetTickCount, CreateFileW, HeapSize, SetStdHandle, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, MultiByteToWideChar, LCMapStringEx, GetStringTypeW, GetCPInfo, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, GetModuleHandleW, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, TerminateProcess, RtlUnwind, RaiseException, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, ExitProcess, GetModuleHandleExW, GetModuleFileNameW, GetStdHandle, WriteFile, HeapAlloc, HeapFree, GetFileType, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, GetFileSizeEx, SetFilePointerEx, ReadConsoleW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, WriteConsoleW

USER32.dll

MessageBoxW

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 19
• 443 (HTTPS)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 8, 2025 23:24:24.454685926 CET	49707	443	192.168.2.5	185.166.143.48
Mar 8, 2025 23:24:24.454740047 CET	443	49707	185.166.143.48	192.168.2.5
Mar 8, 2025 23:24:24.454830885 CET	49707	443	192.168.2.5	185.166.143.48
Mar 8, 2025 23:24:24.465926886 CET	49707	443	192.168.2.5	185.166.143.48
Mar 8, 2025 23:24:24.465941906 CET	443	49707	185.166.143.48	192.168.2.5
Mar 8, 2025 23:24:26.188783884 CET	443	49707	185.166.143.48	192.168.2.5
Mar 8, 2025 23:24:26.188889027 CET	49707	443	192.168.2.5	185.166.143.48
Mar 8, 2025 23:24:26.541248083 CET	49707	443	192.168.2.5	185.166.143.48
Mar 8, 2025 23:24:26.541285992 CET	443	49707	185.166.143.48	192.168.2.5
Mar 8, 2025 23:24:26.541790009 CET	443	49707	185.166.143.48	192.168.2.5
Mar 8, 2025 23:24:26.541847944 CET	49707	443	192.168.2.5	185.166.143.48
Mar 8, 2025 23:24:26.544790983 CET	49707	443	192.168.2.5	185.166.143.48
Mar 8, 2025 23:24:26.588331938 CET	443	49707	185.166.143.48	192.168.2.5
Mar 8, 2025 23:24:27.183301926 CET	443	49707	185.166.143.48	192.168.2.5
Mar 8, 2025 23:24:27.183343887 CET	443	49707	185.166.143.48	192.168.2.5
Mar 8, 2025 23:24:27.183353901 CET	443	49707	185.166.143.48	192.168.2.5
Mar 8, 2025 23:24:27.183403969 CET	49707	443	192.168.2.5	185.166.143.48
Mar 8, 2025 23:24:27.183425903 CET	443	49707	185.166.143.48	192.168.2.5
Mar 8, 2025 23:24:27.183458090 CET	49707	443	192.168.2.5	185.166.143.48
Mar 8, 2025 23:24:27.183495998 CET	49707	443	192.168.2.5	185.166.143.48
Mar 8, 2025 23:24:27.258419037 CET	443	49707	185.166.143.48	192.168.2.5
Mar 8, 2025 23:24:27.258474112 CET	443	49707	185.166.143.48	192.168.2.5
Mar 8, 2025 23:24:27.258546114 CET	49707	443	192.168.2.5	185.166.143.48
Mar 8, 2025 23:24:27.258558035 CET	443	49707	185.166.143.48	192.168.2.5
Mar 8, 2025 23:24:27.258717060 CET	49707	443	192.168.2.5	185.166.143.48
Mar 8, 2025 23:24:27.258717060 CET	49707	443	192.168.2.5	185.166.143.48
Mar 8, 2025 23:24:27.258728981 CET	443	49707	185.166.143.48	192.168.2.5
Mar 8, 2025 23:24:27.258785009 CET	49707	443	192.168.2.5	185.166.143.48
Mar 8, 2025 23:24:27.284504890 CET	443	49707	185.166.143.48	192.168.2.5
Mar 8, 2025 23:24:27.284575939 CET	443	49707	185.166.143.48	192.168.2.5
Mar 8, 2025 23:24:27.284693003 CET	443	49707	185.166.143.48	192.168.2.5
Mar 8, 2025 23:24:27.284715891 CET	49707	443	192.168.2.5	185.166.143.48
Mar 8, 2025 23:24:27.284715891 CET	49707	443	192.168.2.5	185.166.143.48
Mar 8, 2025 23:24:27.284753084 CET	49707	443	192.168.2.5	185.166.143.48
Mar 8, 2025 23:24:27.284990072 CET	49707	443	192.168.2.5	185.166.143.48
Mar 8, 2025 23:24:27.285011053 CET	443	49707	185.166.143.48	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 8, 2025 23:24:24.439620018 CET	61767	53	192.168.2.5	1.1.1.1
Mar 8, 2025 23:24:24.447052956 CET	53	61767	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 8, 2025 23:24:24.439620018 CET	192.168.2.5	1.1.1.1	0xc33f	Standard query (0)	bitbucket.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 8, 2025 23:24:24.447052956 CET	1.1.1.1	192.168.2.5	0xc33f	No error (0)	bitbucket.org	185.166.143.48	A (IP address)	IN (0x0001)	false
Mar 8, 2025 23:24:24.447052956 CET	1.1.1.1	192.168.2.5	0xc33f	No error (0)	bitbucket.org	185.166.143.49	A (IP address)	IN (0x0001)	false
Mar 8, 2025 23:24:24.447052956 CET	1.1.1.1	192.168.2.5	0xc33f	No error (0)	bitbucket.org	185.166.143.50	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

bitbucket.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49707	185.166.143.48	443	8300	C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-08 22:24:26 UTC	164	OUT	GET /microsoftingsoftwares/faw/raw/35a4772e22b353e621019b578e4e1bce5ba5d748/settings HTTP/1.1 Accept: / User-Agent: Chrome/95.0.4638.54 Host: bitbucket.org
2025-03-08 22:24:27 UTC	5107	IN	HTTP/1.1 200 OK Date: Sat, 08 Mar 2025 22:24:26 GMT Content-Type: text/plain Content-Length: 40280 Server: AtlassianEdge Vary: Authorization, Accept-Language, Origin, Accept-Encoding Cache-Control: s-maxage=900, max-age=900 Last-Modified: Sat, 08 Mar 2025 08:40:02 GMT Etag: "ff3a083964c08b9e6cd494d0ba24307b" X-Used-Mesh: False Content-Language: en X-View-Name: bitbucket.apps.repo2.views.filebrowse_raw X-Dc-Location: Micros-3 X-Served-By: f2c19e895aef X-Version: 1326d250ea44 X-Static-Version: 1326d250ea44 X-Request-Count: 147 X-Render-Time: 0.06316137313842773 X-B3-Traceid: 7d750533d8b1458e8101d7c09f02fa1d X-B3-Spanid: e43b765da1c42613 X-Frame-Options: SAMEORIGIN Content-Security-Policy: object-src 'none'; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com/ https://cdn.cookielaw.org/ https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.net https://bbc-frontbucket-static.prod-east.frontend.public.atl-paas.net https://bbc-frontbucket-canary.prod-east.frontend.public.atl-paas.net https://bbc-frontbucket-exp.prod-east.frontend.public.atl-paas.net app.pendo.io cdn.pendo.io pendo-static-6291417196199936.storage.googleapis.com https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/; base-uri 'self'; frame-ancestors 'self' start.atlassian.com start.stg.atlassian.com atlaskit.atlassian.com bitbucket.org app.pendo.io; connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net atlassianblog.wpengine.com id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci [TRUNCATED] X-Usage-Quota-Remaining: 998018.043 X-Usage-Request-Cost: 1816.07 X-Usage-User-Time: 0.030039 X-Usage-System-Time: 0.008443 X-Usage-Input-Ops: 64 X-Usage-Output-Ops: 0 Age: 0 Accept-Ranges: bytes X-Cache: MISS X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Atl-Traceid: 7d750533d8b1458e8101d7c09f02fa1d Atl-Request-Id: 7d750533-d8b1-458e-8101-d7c09f02fa1d Strict-Transport-Security: max-age=63072000; includeSubDomains; preload Report-To: {"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600} Nel: {"failure_fraction": 0.001, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"} Server-Timing: atl-edge;dur=172,atl-edge-internal;dur=3,atl-edge-upstream;dur=170,atl-edge-pop;desc="aws-eu-central-1" Connection: close
2025-03-08 22:24:27 UTC	11277	IN	Data Raw: 74 76 51 71 7d 7d 2f 7d 7d 7d 7d 65 7d 7d 7d 7d 40 40 38 7d 7d 6c 47 7d 7d 7d 7d 7d 7d 7d 7d 7d 71 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 7d 59 7d 7d 7d 7d 7d 34 46 55 47 34 7d 54 7d 4e 6e 69 42 47 7b 74 2f 30 48 76 7e 48 50 2d 59 7b 57 2d 4d 39 4e 2d 4d 66 54 69 7e 6e 48 42 4d 35 56 44 63 7b 49 3e 73 7b 59 44 77 34 47 3c 77 34 47 72 65 39 74 69 7e 31 56 3e 7e 75 55 64 71 30 6b 6a 7d 7d 7d 7d 7d 7d 7d 7d 7d 63 6c 74 72 70 71 5a 59 58 39 47 38 38 53 46 7c 70 70 6c 68 32 64 52 68 66 21 47 53 30 53 46 7c 70 7e 76 6f 36 64 58 63 58 39 47 38 38 53 46 69 70 4d 6c 68 32 64 4f 78 66 30 47 53 65 53 46 7c 6f 48 2d 78 21 63 5a 49 58 39 47 31 6a 50 7c 32 4a 70 6c 68 32 Data Ascii: tvQq}}/}}}}e}}}}@@8}}lG}}}}}}}}}q}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}Y}}}}}4FUG4}T}NniBG{t/0Hv~HP-Y{W-M9N-MfTi~nHBM5VDc{I>s{YDw4G<w4Gre9ti~1V>~uUdq0kj}}}}}}}}}cltrpqZYX9G88SF\|pplh2dRhf!GS0SF\|p~vo6dXcX9G88SFipMlh2dOxf0GSeSF\|oH-x!cZIX9G1jP\|2Jplh2
2025-03-08 22:24:27 UTC	16384	IN	Data Raw: 71 58 69 49 75 75 2f 36 36 55 6c 72 72 7b 7d 49 75 75 71 49 30 75 71 64 37 34 7d 47 40 47 4c 44 73 73 6c 72 46 49 6c 74 72 63 6b 63 7c 47 69 49 30 78 34 71 69 4c 66 21 69 54 66 65 65 63 6a 72 72 63 6c 72 71 58 69 49 75 75 2f 36 78 78 40 40 40 21 6e 76 42 63 6c 74 72 64 4f 57 46 4e 40 40 57 6e 66 65 69 4c 66 65 69 54 66 56 69 4c 66 37 69 6e 39 37 7d 66 30 71 69 6e 39 37 7d 6a 30 69 7c 6e 39 37 7d 6e 30 73 34 6e 39 37 7d 72 30 77 7c 6e 39 37 7d 71 70 4a 53 65 7d 7d 7d 63 64 46 45 57 68 46 4c 33 50 54 47 7d 7d 7d 69 54 66 66 69 70 7d 7b 69 4c 66 66 69 54 66 66 7e 3c 6c 71 70 58 4d 49 75 78 7d 36 3c 2f 7d 7d 7d 63 6c 72 72 73 64 57 7d 73 6a 72 72 73 6c 72 72 73 6b 71 70 59 69 72 2d 64 50 4a 7d 7d 7d 7d 69 54 66 66 69 70 7d 7b 69 4c 66 66 69 54 66 66 69 54 7d Data Ascii: qXiIuu/66Ulrr{}IuuqI0uqd74}G@GLDsslrFIltrckc\|GiI0x4qiLf!iTfeecjrrclrqXiIuu/6xx@@@!nvBcltrdOWFN@@WnfeiLfeiTfViLf7in97}f0qin97}j0i\|n97}n0s4n97}r0w\|n97}qpJSe}}}cdFEWhFL3PTG}}}iTffip}{iLffiTff~<lqpXMIux}6</}}}clrrsdW}sjrrslrrskqpYir-dPJ}}}}iTffip}{iLffiTffiT}
2025-03-08 22:24:27 UTC	521	IN	Data Raw: 78 2d 69 49 38 39 68 49 75 33 57 36 57 3c 6c 59 34 4c 44 38 65 6f 6c 66 6c 6b 6c 38 4f 54 66 39 69 68 4d 7d 70 5a 40 40 34 68 49 40 57 2f 7d 7d 69 53 65 49 69 54 6e 40 63 75 7d 40 70 40 40 7d 40 64 7b 34 71 51 6c 72 46 71 6c 30 7c 4c 31 36 69 54 31 37 69 4b 75 53 69 56 71 49 30 78 57 56 56 38 64 7d 7d 63 6c 7b 69 69 4a 58 47 56 7b 49 30 33 57 49 71 73 6b 49 30 33 38 49 57 73 6b 69 38 7c 6c 72 45 49 6a 7b 69 50 7b 49 30 78 34 6b 38 7e 6a 74 46 59 64 21 7d 7e 6c 72 46 47 70 48 5a 4a 40 40 40 39 46 78 4c 55 6c 35 76 33 64 76 7c 56 53 75 34 56 3e 2f 38 63 6c 74 71 58 77 49 33 75 69 47 73 73 74 40 57 2f 7d 7d 66 45 6e 64 69 30 65 7d 7d 7d 7d 49 40 37 7b 36 71 6c 5a 51 34 31 36 40 38 44 7e 7b 7d 69 7d 7d 7d 63 66 40 33 47 38 49 57 59 37 49 38 68 7b 36 7d 51 7b Data Ascii: x-iI89hIu3W6W<lY4LD8eolflkl8OTf9ihM}pZ@@4hI@W/}}iSeIiTn@cu}@p@@}@d{4qQlrFql0\|L16iT17iKuSiVqI0xWVV8d}}cl{iiJXGV{I03WIqskI038IWski8\|lrEIj{iP{I0x4k8~jtFYd!}~lrFGpHZJ@@@9FxLUl5v3dv\|VSu4V>/8cltqXwI3uiGsst@W/}}fEndi0e}}}}I@7{6qlZQ416@8D~{}i}}}cf@3G8IWY7I8h{6}Q{
2025-03-08 22:24:27 UTC	12098	IN	Data Raw: 77 34 72 4a 54 31 65 68 6c 4e 78 31 35 42 49 21 76 44 57 31 77 6c 37 69 70 53 73 66 6e 77 49 33 75 71 49 38 66 78 49 33 30 2f 49 76 78 38 49 31 75 69 76 4c 45 6a 72 46 4a 4f 7d 40 33 40 40 34 56 7c 77 76 4d 66 32 33 72 71 2f 39 6a 63 6f 39 50 31 7e 7c 53 7e 49 38 4f 4c 40 57 2f 7d 7d 7d 39 66 59 69 2f 4d 7d 69 47 78 49 72 73 6f 49 7b 71 35 36 5a 63 6c 30 34 56 6f 36 6c 68 39 40 40 40 40 44 46 59 6e 72 42 49 6c 5a 4c 63 6e 75 40 37 4f 49 40 37 40 40 40 39 31 21 69 31 66 55 69 56 78 40 33 78 38 49 38 35 71 36 6f 5a 21 40 40 21 64 58 7b 72 46 78 4c 55 6c 35 76 33 64 3c 7d 7d 66 7d 7d 63 64 57 71 71 5a 30 55 4a 76 31 56 40 40 77 2d 6f 6c 57 44 68 4f 75 34 52 3c 55 4c 76 76 7d 7d 7d 4a 59 49 70 63 7d 38 4b 6c 57 42 4b 5a 2f 57 7d 7d 49 39 7d 4a 57 2d 68 51 7d Data Ascii: w4rJT1ehlNx15BI!vDW1wl7ipSsfnwI3uqI8fxI30/Ivx8I1uivLEjrFJO}@3@@4V\|wvMf23rq/9jco9P1~\|S~I8OL@W/}}}9fYi/M}iGxIrsoI{q56Zcl04Vo6lh9@@@@DFYnrBIlZLcnu@7OI@7@@@91!i1fUiVx@3x8I85q6oZ!@@!dX{rFxLUl5v3d<}}f}}cdWqqZ0UJv1V@@w-olWDhOu4R<ULvv}}}JYIpc}8KlWBKZ/W}}I9}JW-hQ}

Statistics

CPU Usage

• SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe

Click to jump to process

Memory Usage

• SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe

Click to jump to process

Target ID:	0
Start time:	17:24:22
Start date:	08/03/2025
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe"
Imagebase:	0x300000
File size:	263'168 bytes
MD5 hash:	F9FE873316A74E0D1C93357A904E133F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PovertyStealer, Description: Yara detected Poverty Stealer, Source: 00000000.00000003.1420376353.0000000002F04000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PovertyStealer, Description: Yara detected Poverty Stealer, Source: 00000000.00000003.1420412965.0000000002EBC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	5.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	60

Executed Functions

Function 003059A0 Relevance: 51.4, APIs: 11, Strings: 18, Instructions: 614
sleeplibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003138B9: GetSystemTimeAsFileTime.KERNEL32(?,00000000,?,?,?,?,003059B9,00000000,00000000), ref: 003138CE
Part of subcall function 003138B9: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003138ED

GetTickCount.KERNEL32 ref: 00305D91
Sleep.KERNELBASE(?,?,?,?,?,?), ref: 00305DB6
LoadLibraryA.KERNEL32(user32.dll,?,?,?,?,?,?), ref: 00305DC1
GetProcAddress.KERNEL32(00000000,GetSystemMetrics), ref: 00305DD7
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?), ref: 00305DEA
KiUserCallbackDispatcher.NTDLL(00000000,?,?,?,?,?,?), ref: 0030601F
FreeLibrary.KERNEL32(?,?,?,?,?,?,?), ref: 0030602F
GetTickCount.KERNEL32 ref: 00306237
Sleep.KERNEL32(?,?,?,?,?,?,?), ref: 0030625C
MessageBoxW.USER32(00000000,00000000,00000000,00000040), ref: 00306282
Concurrency::cancel_current_task.LIBCPMT ref: 00306294

Strings

4<3, xrefs: 0030591C
user32.dll, xrefs: 00305DBC
0<3, xrefs: 00305A8A
4<3, xrefs: 00305681
0<3, xrefs: 00305D70
_, xrefs: 00305AEF
d, xrefs: 00305B0E
0<3, xrefs: 003055E2
4<3, xrefs: 0030560C
=3, xrefs: 00305C5F, 00305C66
, xrefs: 003058FC
4<3, xrefs: 0030565A
GetSystemMetrics, xrefs: 00305DD1
4<3, xrefs: 003056A8
4<3, xrefs: 00305633
= , xrefs: 003055F1, 00305618, 0030563F, 00305666, 0030568D
func_zamtK_0..., xrefs: 00304DAE
4<3, xrefs: 00305934

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: Library$CountFreeSleepTickTime$AddressCallbackConcurrency::cancel_current_taskDispatcherFileLoadMessageProcSystemUnothrow_t@std@@@User__ehfuncinfo$??2@
String ID: $ = $0<3$0<3$0<3$4<3$4<3$4<3$4<3$4<3$4<3$4<3$GetSystemMetrics$_$d$func_zamtK_0...$user32.dll$=3
API String ID: 1832009041-38214448
Opcode ID: 44042d820e355f50ee69d30a5884aec90e49ae22498156d7bae104d0855e9378
Instruction ID: 4a9d0565ecced699c071566ce6063fd8a955b8538a26b7a91f7d7bc7150833ed
Opcode Fuzzy Hash: 44042d820e355f50ee69d30a5884aec90e49ae22498156d7bae104d0855e9378
Instruction Fuzzy Hash: 9D326A319163418BD717DB34C46679FB7E5BFC5300F008B2DF485AB292EB34A9858B82

Function 003042E0 Relevance: 17.0, APIs: 11, Instructions: 538
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?,00000000,?), ref: 003043FB
GetProcAddress.KERNEL32(?,?), ref: 0030450F
GetProcAddress.KERNEL32(?,?), ref: 00304629
GetProcAddress.KERNEL32(?,?), ref: 00304752
GetProcAddress.KERNEL32(?,?), ref: 00304871
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00304AF6
InternetOpenUrlA.WININET(00000000,?,?,?,04000000,00000000), ref: 00304B47
FreeLibrary.KERNEL32(?), ref: 00304B5C
InternetReadFile.WININET(00000000,00000400,00000400,?), ref: 00304BAD
InternetReadFile.WININET(00000000,?,00000400,?,?,00000000,?,?), ref: 00304C1F
FreeLibrary.KERNEL32(?), ref: 00304C3E

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: AddressInternetProc$Library$FileFreeOpenRead$Load
String ID:
API String ID: 3799963043-0
Opcode ID: 216a3746f4d916e849578517d169cda9ad9e838de7ab398a810b5e963ef0b1ed
Instruction ID: 28eef71e3f99f9fa6fefeb23bf6ba2e5939bd456e03caf95b9685a0508a04c93
Opcode Fuzzy Hash: 216a3746f4d916e849578517d169cda9ad9e838de7ab398a810b5e963ef0b1ed
Instruction Fuzzy Hash: 9542BC71C14B898AD722CB74C8813EAF7F8EF69344F04871EE999B2152EB7176C58B40

Function 00302880 Relevance: 7.4, APIs: 4, Instructions: 1439libraryloaderprocessCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000000), ref: 00302933
GetProcAddress.KERNEL32(00000000,?), ref: 00302A8B
GetProcAddress.KERNEL32(00000000,00000000), ref: 00302B09
CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?), ref: 00303C6F

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: AddressProc$CreateHandleModuleProcess
String ID:
API String ID: 1919063930-0
Opcode ID: 9e99de7832f1567aad711bdebcda9a48571c668e4ea4c8efd7f2ccf178d330c3
Instruction ID: ed9589d73fcee55b40d836b40e491303026e85c66559d60106d3e5b4f9a23a53
Opcode Fuzzy Hash: 9e99de7832f1567aad711bdebcda9a48571c668e4ea4c8efd7f2ccf178d330c3
Instruction Fuzzy Hash: 79F29A31D05B898EE722CB38C8457EAB7F8BF59344F00875EE499A6252EB7176C5CB04

Function 0031ABAD Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,0031ACBC,?,?,00000000,?,?,?,0031AE6A,00000022,FlsSetValue,0032FFBC,0032FFC4,?), ref: 0031AC6E

Strings

api-ms-, xrefs: 0031AC04
ext-ms-, xrefs: 0031AC18

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 9b90367c7f45cf6785a79f5af866e6b664e62f96387bb8b42a91cf1aa65872c6
Instruction ID: d584145a709c63ac04a35c0a415253acd91aa2c42a41ede898c7b0c67e3901a7
Opcode Fuzzy Hash: 9b90367c7f45cf6785a79f5af866e6b664e62f96387bb8b42a91cf1aa65872c6
Instruction Fuzzy Hash: 90213D71A02910EBCB3B9B60DD40ADA776CDF4A761F160124FD06E7290D730ED41C6D1

Function 00311A46 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,00311A40,00000016,003115E2,?,?,84FDAC87,003115E2,?), ref: 00311A57
TerminateProcess.KERNEL32(00000000,?,00311A40,00000016,003115E2,?,?,84FDAC87,003115E2,?), ref: 00311A5E
ExitProcess.KERNEL32 ref: 00311A70

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 32c4e760d5ec68f1bd613004bff8a4eacda8b797df841d78c120d1fd5827af55
Instruction ID: 1188e8814b01526d4a6d7c93003f6ae4075e235b525bb3cada45f5278a246ce1
Opcode Fuzzy Hash: 32c4e760d5ec68f1bd613004bff8a4eacda8b797df841d78c120d1fd5827af55
Instruction Fuzzy Hash: 19D09E31011208EBCF176FA0DD0D9DD3F2EBF44385B059014BA0549031CB31D992DA80

Function 00319744 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00320F1C,?,00000000,?,?,003211BD,?,00000007,?,?,003216B1,?,?), ref: 0031975A
GetLastError.KERNEL32(?,?,00320F1C,?,00000000,?,?,003211BD,?,00000007,?,?,003216B1,?,?), ref: 00319765

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: c8637be7b6cd51ef36478ac57090a52218adc59685c4a98ab432f13c3548680f
Instruction ID: 79c3584680453fe543dd23ca0133dff8e9e95f9f6c470243a0b5c7576d540a92
Opcode Fuzzy Hash: c8637be7b6cd51ef36478ac57090a52218adc59685c4a98ab432f13c3548680f
Instruction Fuzzy Hash: 8EE08632640604EBCB2B2FB0AC4CBD93B5C9F4C792F094015F6089A161CA7098D28784

Function 00309F90 Relevance: 1.7, APIs: 1, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0030A166

Part of subcall function 00301190: ___std_exception_copy.LIBVCRUNTIME ref: 003011CE

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: Concurrency::cancel_current_task___std_exception_copy
String ID:
API String ID: 1979911387-0
Opcode ID: f0889e19c497c0373af77e7d54634ad9379414580978a839744a86a6ac8da8d4
Instruction ID: babd3220c3ab1089edb1cdce0c6ad6849ab5f1cfd263bb90fc129cabc8011315
Opcode Fuzzy Hash: f0889e19c497c0373af77e7d54634ad9379414580978a839744a86a6ac8da8d4
Instruction Fuzzy Hash: 2B51F275B126048FCB1EDF68ECA1B6E77A9AB48310F144229E915DB3D1DB34E904CB81

Function 00308C20 Relevance: 1.6, APIs: 1, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00308D67

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 5551ff29b8990e5b3eca07f980bc36e9c3a6f1d6a6046582034cd12cb8b53426
Instruction ID: 979e57eed105b951bbe5e1814de4726a6d6f3ccb77c9d1b7956b67407e49cb66
Opcode Fuzzy Hash: 5551ff29b8990e5b3eca07f980bc36e9c3a6f1d6a6046582034cd12cb8b53426
Instruction Fuzzy Hash: 3E41F372A021089FDB16EF68DC9069EBBB5EF58300F150669F845DB381DA30DD6187A1

Function 00306D20 Relevance: 1.6, APIs: 1, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00306DFB

Part of subcall function 00301190: ___std_exception_copy.LIBVCRUNTIME ref: 003011CE

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: Concurrency::cancel_current_task___std_exception_copy
String ID:
API String ID: 1979911387-0
Opcode ID: 7840ff986a5c211dd7a836ff085a24b04053c828d164257361be389f283a0d64
Instruction ID: b40353e8aa9cc37c383d853e79cef37de5c287109960c5a864fbae55018a2517
Opcode Fuzzy Hash: 7840ff986a5c211dd7a836ff085a24b04053c828d164257361be389f283a0d64
Instruction Fuzzy Hash: 56312472B023019BD7169F24D862B6AB7A8EF54310F15023AF8158B6D1EB71EDA0C7A1

Function 0031AC78 Relevance: 1.6, APIs: 1, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d20e6feb764a0c4f00bdd1b4088db9c13bb97066033df57e062e729dea4fdf5
Instruction ID: ce6f70409b2d534b72e5f9d7b71333dd2a6b958e4ee652d76b5b84cfc93137d8
Opcode Fuzzy Hash: 5d20e6feb764a0c4f00bdd1b4088db9c13bb97066033df57e062e729dea4fdf5
Instruction Fuzzy Hash: 0E01F9336119259FCB1F8B6CED80A9A33ADB7C9361B654024F900DB169DA31D8C09BD1

Function 0030CD92 Relevance: 1.6, APIs: 1, Instructions: 50
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 003011CE

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: e233d7f0f346ff3eae9795d4458be297b3267382dbdc810ae8b9a51aa8df8ac4
Instruction ID: 36d5d93ec019bd47afd6948bef74fab55127bdbb37479840ff3260cfcb368c66
Opcode Fuzzy Hash: e233d7f0f346ff3eae9795d4458be297b3267382dbdc810ae8b9a51aa8df8ac4
Instruction Fuzzy Hash: 0201DB3551030DA7CB1AABE8EC125D97B9CAE05350B108636FA14DA5D1EB70E594C691

Function 003196E7 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,?,0031954E,00000001,00000364,?,00000005,000000FF,?,?,0030E127,?), ref: 00319728

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 39eb039682b22512450f10e2e127f31aad890f6e20d570de61f3e73a04b41dbf
Instruction ID: da35335e3b7792e036d3c0aa974197e30f1bd57608c7f7961202ef7aba86c518
Opcode Fuzzy Hash: 39eb039682b22512450f10e2e127f31aad890f6e20d570de61f3e73a04b41dbf
Instruction Fuzzy Hash: 93F0B436621520E7DB2F5F659C55BDA374CEF5D760F1A4023ED18DB1D0CE30D98182A0

Function 0031977E Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,0030E127,?,?,?,?,?,00301103,?,?), ref: 003197B0

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9adfc55c13b7a0b8dfd7250fabbcb452e40c278b3293de06f9682e50a2cd47ef
Instruction ID: 847774c1b5b923570604e16defe46bc67a451f7f75d5c1d969812f83d36fa24f
Opcode Fuzzy Hash: 9adfc55c13b7a0b8dfd7250fabbcb452e40c278b3293de06f9682e50a2cd47ef
Instruction Fuzzy Hash: 43E02B35A2051197DA3B3F698C107DB7A4CDF497B0F1E4127EC069A0D1DF61CCC181A1

Function 00316DCA Relevance: 1.5, APIs: 1, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00316DD1

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 0166a5c0a04667e8efadab5fad5bb22dbb9025a74de003927b855d4cc256de3a
Instruction ID: ce33191cb3e5da83c7d3344cdbdb5c63b922c6e63c2f1170c60986d8c678e699
Opcode Fuzzy Hash: 0166a5c0a04667e8efadab5fad5bb22dbb9025a74de003927b855d4cc256de3a
Instruction Fuzzy Hash: 83E09A76C0120D9EDB01DFD4C452BEFBBFCAF08304F508026A605EA181EB7457458BA1

Non-executed Functions

Function 00323162 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00323379

Strings

1#QNAN, xrefs: 00323275
1#SNAN, xrefs: 0032326E
1#INF, xrefs: 00323298
1#IND, xrefs: 00323267

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: b22c4350bf6a37f8290311a012320a8963e4bc287fbf31f31c47bcb7ed9843f6
Instruction ID: a0154d404715fa91b1bedf204bcabc18434b68971ce92d2011497fa3b14bbdb2
Opcode Fuzzy Hash: b22c4350bf6a37f8290311a012320a8963e4bc287fbf31f31c47bcb7ed9843f6
Instruction Fuzzy Hash: 2CD24A71E082388FDB66CE28ED407EAB7B9EB45304F1545EAD40DE7240E778AE858F41

Function 003226C7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,2000000B,003229D9,00000002,00000000,?,?,?,003229D9,?,00000000), ref: 00322760
GetLocaleInfoW.KERNEL32(00000000,20001004,003229D9,00000002,00000000,?,?,?,003229D9,?,00000000), ref: 00322789
GetACP.KERNEL32(?,?,003229D9,?,00000000), ref: 0032279E

Strings

ACP, xrefs: 003226E5
OCP, xrefs: 0032271B

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 5689e7bb6d0b398ae2787e0dc6abc44c517ae073ee2d9dfe8ffb9d1a3fc941f3
Instruction ID: 7b1f257732352ba9a376076180b7d1d5c32447e654115192311d130e4cb0c551
Opcode Fuzzy Hash: 5689e7bb6d0b398ae2787e0dc6abc44c517ae073ee2d9dfe8ffb9d1a3fc941f3
Instruction Fuzzy Hash: 1021C536608120BADB3B8F5CED41AA773AAEF64F60B578434E90AD7112E732DD41C350

Function 003228A3 Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003193B0: GetLastError.KERNEL32(?,00000000,00315BD4,?,?,?,?,00000003,003115E2,?,00311551,?,00000016,00311760), ref: 003193B4
Part of subcall function 003193B0: SetLastError.KERNEL32(00000000,00000016,00311760,?,?,?,?,?,00000000), ref: 00319456

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 003229AB
IsValidCodePage.KERNEL32(00000000), ref: 003229E9
IsValidLocale.KERNEL32(?,00000001), ref: 003229FC
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00322A44
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00322A5F

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 05775229fc69b92f657b9d0dacb87b079bf3d6629e11dde6dec31d0168945db8
Instruction ID: f0b64c9842d54921c4b63d2670605726330bc008c8a3f9afe443c06431448316
Opcode Fuzzy Hash: 05775229fc69b92f657b9d0dacb87b079bf3d6629e11dde6dec31d0168945db8
Instruction Fuzzy Hash: CB516171900226BBDB26DFA5EC41ABF77B8FF14700F054529E911EB190EB719E50CB61

Function 00321F2E Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003193B0: GetLastError.KERNEL32(?,00000000,00315BD4,?,?,?,?,00000003,003115E2,?,00311551,?,00000016,00311760), ref: 003193B4
Part of subcall function 003193B0: SetLastError.KERNEL32(00000000,00000016,00311760,?,?,?,?,?,00000000), ref: 00319456

GetACP.KERNEL32(?,?,?,?,?,?,003178B4,?,?,?,00000055,?,-00000050,?,?,00000000), ref: 00321FED
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,003178B4,?,?,?,00000055,?,-00000050,?,?), ref: 00322024
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00322187

Strings

utf8, xrefs: 003220F6

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 3cd3ccc0f1c4049d721a53a5604e4b4b9c119846a0c8da62519b41255cea8052
Instruction ID: b6ee684ade9477e195264f818111dba44dcb5595f8a4085e42dbcb3ad4fb766e
Opcode Fuzzy Hash: 3cd3ccc0f1c4049d721a53a5604e4b4b9c119846a0c8da62519b41255cea8052
Instruction Fuzzy Hash: 45711932600721BADB2BAB74ED42FBB73ACEF14700F114529F615DB181EB70E950C6A1

Function 00315C20 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c978cbae2d2b2e7e34fda7347b027cb190bd780ef1dc569dc29ed165eb3e7d8e
Instruction ID: e213e81cc160fec4830f470fb49f797a500ea6fc7213e84baf4d861cb39ad51d
Opcode Fuzzy Hash: c978cbae2d2b2e7e34fda7347b027cb190bd780ef1dc569dc29ed165eb3e7d8e
Instruction Fuzzy Hash: 18023D71E01619DBDF19CFA8D8806EDBBB1FF88314F258169D515E7380D731AA41CB90

Function 0030D779 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0030D785
IsDebuggerPresent.KERNEL32 ref: 0030D851
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0030D86A
UnhandledExceptionFilter.KERNEL32(?), ref: 0030D874

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 5c2afbd85ccf532ed32094d824a6c3c9af47e359ee76c67c4616d690a18fcce5
Instruction ID: 165f6e031bfc34d3b816bf2b4022ca7393cda3470142623e4c273b8307139f79
Opcode Fuzzy Hash: 5c2afbd85ccf532ed32094d824a6c3c9af47e359ee76c67c4616d690a18fcce5
Instruction Fuzzy Hash: CA31D875D05218DBDF21DFA4D9497CDBBB8BF08704F1041AAE40DAB290E7719A858F45

Function 0032234B Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 003193B0: GetLastError.KERNEL32(?,00000000,00315BD4,?,?,?,?,00000003,003115E2,?,00311551,?,00000016,00311760), ref: 003193B4
Part of subcall function 003193B0: SetLastError.KERNEL32(00000000,00000016,00311760,?,?,?,?,?,00000000), ref: 00319456

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0032239F
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 003223E9
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 003224AF

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 595e1ae483105a9f95fab70caa4ab5a67b44a1841443f0938b2cd8100fa5dbbf
Instruction ID: c4f9d6e336f944af8c8ef981b346bf6d0afd2cc7d7df00fff1559dadc00e9a47
Opcode Fuzzy Hash: 595e1ae483105a9f95fab70caa4ab5a67b44a1841443f0938b2cd8100fa5dbbf
Instruction Fuzzy Hash: 3E61C271950127AFEB2AEF29EC92BABB7A8EF04300F118179ED05C6581E774DD81CB50

Function 003115E3 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 003116DB
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 003116E5
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 003116F2

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 6b3c9854306eea2cd10dc76ff69f0b421cb2645dfca2b3030042cf272640e821
Instruction ID: a01f51c1d65952d47ff8eae541b638a73ebbbe6030ab26130a888dead40f5e57
Opcode Fuzzy Hash: 6b3c9854306eea2cd10dc76ff69f0b421cb2645dfca2b3030042cf272640e821
Instruction Fuzzy Hash: EE31C374911228ABCB22DF68D8897CCBBB8BF08710F5045EAE41CA7291E7709F818F45

Function 003138B9 Relevance: 3.0, APIs: 2, Instructions: 44timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,00000000,?,?,?,?,003059B9,00000000,00000000), ref: 003138CE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003138ED

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: Time$FileSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 1518329722-0
Opcode ID: 1f8b7d6958c2185181b5fb7862bb88f196e35870d9d5196b5879b927da283c31
Instruction ID: 3b664e52c546ad1fac2c542508e575d4950f8be673b39c125e339c0c013da878
Opcode Fuzzy Hash: 1f8b7d6958c2185181b5fb7862bb88f196e35870d9d5196b5879b927da283c31
Instruction Fuzzy Hash: 61F0F4B1A00118BB4B29CF6D8804ADEBEEDEBC93707258259E819E7340D6B0CE41C690

Function 00312F5E Relevance: 2.8, Strings: 2, Instructions: 333COMMON

Download Yara Rule

Strings

z-1, xrefs: 003131FA, 0031321C, 00313200, 00313229
0z-1, xrefs: 00313166, 0031316C

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0z-1$z-1
API String ID: 0-2286291861
Opcode ID: f05cc9cb2b648b8057d755e897dfcd2b0930626eb8c498e6cff64f67a484ca15
Instruction ID: f9d7f5900fcb0a2f5cbead7c964f69db96792ed0061a778b033b27c6f9267d99
Opcode Fuzzy Hash: f05cc9cb2b648b8057d755e897dfcd2b0930626eb8c498e6cff64f67a484ca15
Instruction Fuzzy Hash: 07C1BD309006469FCB2EDF68C9846FABBF5AF0D300F154A29D4579BA91C731AEC6CB51

Function 0031B4CF Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0031B4CA,?,?,00000008,?,?,0032708B,00000000), ref: 0031B6FC

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 1433bf5c82515d58cf8f477758c3b56c6ac7103995a4b7ce07ba753add8e1666
Instruction ID: 868af986f099a9cdf8e3826888c5fa09769cfdc18a1ec36ca190e3a38c1f8315
Opcode Fuzzy Hash: 1433bf5c82515d58cf8f477758c3b56c6ac7103995a4b7ce07ba753add8e1666
Instruction Fuzzy Hash: 29B13031510609DFD71ACF28C48ABA5BBE1FF49364F2A8658E899CF2E1C335D991CB40

Function 0030D2A1 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0030D2B7

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: e2fcb0c0681811faa579b162a6da20272c8d6a359b875ef9e5a8fcb26cfe0d8f
Instruction ID: 7e0cd61c8306313d41cf3fe23cd68c25a894887a34236e3cd622d5366b427dfd
Opcode Fuzzy Hash: e2fcb0c0681811faa579b162a6da20272c8d6a359b875ef9e5a8fcb26cfe0d8f
Instruction Fuzzy Hash: ADA1A0B9E112058FDB2ACF99E9D169DBBF4FB49314F15812AD815EB3A1C3349940CF90

Function 0031F791 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 132b80a9e25dc5bd74b1979453bb12e8d2433b99222c17f7877a2717289312c0
Instruction ID: 9cfca902f8f3b0bc92b7737cb3674bda5624ceb01d56b990bd5b0d7671c50a11
Opcode Fuzzy Hash: 132b80a9e25dc5bd74b1979453bb12e8d2433b99222c17f7877a2717289312c0
Instruction Fuzzy Hash: E031D776900219AFDB25DFB8CC85DEBB76DEB88354F154569F80597141EA30AD808B50

Function 0032259E Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 003193B0: GetLastError.KERNEL32(?,00000000,00315BD4,?,?,?,?,00000003,003115E2,?,00311551,?,00000016,00311760), ref: 003193B4
Part of subcall function 003193B0: SetLastError.KERNEL32(00000000,00000016,00311760,?,?,?,?,?,00000000), ref: 00319456

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 003225F2

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 3dd551594bf5d98548fbcccd828ae398e1c22ebfdbf548226fde00341a4e2bd8
Instruction ID: 6516729cf93b55d8fc961e0ad74c27f45684e1cc7ca48a0e191d438e5039e931
Opcode Fuzzy Hash: 3dd551594bf5d98548fbcccd828ae398e1c22ebfdbf548226fde00341a4e2bd8
Instruction Fuzzy Hash: 50219232611216BFDB2A9A65EC52ABB73ACEF44710F10417AFD02DA141EBB4ED51CB50

Function 00322225 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003193B0: GetLastError.KERNEL32(?,00000000,00315BD4,?,?,?,?,00000003,003115E2,?,00311551,?,00000016,00311760), ref: 003193B4
Part of subcall function 003193B0: SetLastError.KERNEL32(00000000,00000016,00311760,?,?,?,?,?,00000000), ref: 00319456

EnumSystemLocalesW.KERNEL32(0032234B,00000001,00000000,?,-00000050,?,0032297F,00000000,?,?,?,00000055,?), ref: 00322297

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 0c983bb050a5765f8f3483bfd3845a5905ea3b4c42c394fbbcbf33bd343dcfcc
Instruction ID: e3d81b8a44b11d3656007d89a6bf31b340a336e4457fffad3be078d08ea3b407
Opcode Fuzzy Hash: 0c983bb050a5765f8f3483bfd3845a5905ea3b4c42c394fbbcbf33bd343dcfcc
Instruction Fuzzy Hash: DF11E93A204701AFDB199F39DC916BBB791FF84358B15482DEA4787B40D776A943C740

Function 003227CD Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 003193B0: GetLastError.KERNEL32(?,00000000,00315BD4,?,?,?,?,00000003,003115E2,?,00311551,?,00000016,00311760), ref: 003193B4
Part of subcall function 003193B0: SetLastError.KERNEL32(00000000,00000016,00311760,?,?,?,?,?,00000000), ref: 00319456

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00322567,00000000,00000000,?), ref: 003227F9

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: afe60a5e1595b110ac790819ad5dbef2b89ca4150853f67be08e1f5598083883
Instruction ID: addafe50b24f26b30630bf6869e99e0ba1e750f12ca52ce8ad9734fbd71d896f
Opcode Fuzzy Hash: afe60a5e1595b110ac790819ad5dbef2b89ca4150853f67be08e1f5598083883
Instruction Fuzzy Hash: D401F437A10222BBDB2D9A249C16FFB7768EF40754F164429ED4AE7180EA34FE41C6D0

Function 003222C0 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003193B0: GetLastError.KERNEL32(?,00000000,00315BD4,?,?,?,?,00000003,003115E2,?,00311551,?,00000016,00311760), ref: 003193B4
Part of subcall function 003193B0: SetLastError.KERNEL32(00000000,00000016,00311760,?,?,?,?,?,00000000), ref: 00319456

EnumSystemLocalesW.KERNEL32(0032259E,00000001,00000000,?,-00000050,?,00322947,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 0032230A

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 03ebf65950737797f0fdd651f4521b79b361d209c7c3ce0d957051c71880d174
Instruction ID: 37b65c936d0cce84af123727d372645e978bd5fa0104832fdfbd45dcb1ce08ba
Opcode Fuzzy Hash: 03ebf65950737797f0fdd651f4521b79b361d209c7c3ce0d957051c71880d174
Instruction Fuzzy Hash: 29F0463A2003046FCB269F35AC81B7BBB90EF80768F15842DFA028B680C775AC42C790

Function 0031A9E0 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00313A77: EnterCriticalSection.KERNEL32(?,?,0031643D,00000000,0033D530,0000000C,00316405,?,?,0031971A,?,?,0031954E,00000001,00000364,?), ref: 00313A86

EnumSystemLocalesW.KERNEL32(0031A9D3,00000001,0033D710,0000000C,0031AD8C,00000000), ref: 0031AA18

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 0c5ed4d7602a13891f3093819ea4eacf8cc3ae639095d5e192d100e1939b2c77
Instruction ID: a9aeab5354eb0a20463cebe3ece6e7513b00d4b380ed1444fe058348b2b4bfb0
Opcode Fuzzy Hash: 0c5ed4d7602a13891f3093819ea4eacf8cc3ae639095d5e192d100e1939b2c77
Instruction Fuzzy Hash: C3F04976A50604DFD70ADF98E842B9D77F4FB09722F00812AF511DB2A1DB7559818F80

Function 003221DA Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003193B0: GetLastError.KERNEL32(?,00000000,00315BD4,?,?,?,?,00000003,003115E2,?,00311551,?,00000016,00311760), ref: 003193B4
Part of subcall function 003193B0: SetLastError.KERNEL32(00000000,00000016,00311760,?,?,?,?,?,00000000), ref: 00319456

EnumSystemLocalesW.KERNEL32(00322133,00000001,00000000,?,?,003229A1,-00000050,?,?,?,00000055,?,-00000050,?,?,00000000), ref: 00322211

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 5b74d54fda6e86b7c873194e6ab3f0de3df2b40d1f5141e395f61bc9adfad949
Instruction ID: 0af98fe328fc3887dc8c8f65f2281b5619d98c29fc6b7f6567a421f7bfcbfa14
Opcode Fuzzy Hash: 5b74d54fda6e86b7c873194e6ab3f0de3df2b40d1f5141e395f61bc9adfad949
Instruction Fuzzy Hash: ADF0203A300214A7CB069F35EC05BABBB94EBC1750B068059EE068B291C672A842C7D0

Function 0031AE90 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,0031842A,?,20001004,00000000,00000002,?,?,00317A1C), ref: 0031AEC4

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: b4374d60f6d30f01b4b06eefa9082f00c957c2e8df3b5ab04391bcd9d6ab0853
Instruction ID: d8fb5c162b71a5709c5856822f367107df02eeb8908fd5001796e7875313bd28
Opcode Fuzzy Hash: b4374d60f6d30f01b4b06eefa9082f00c957c2e8df3b5ab04391bcd9d6ab0853
Instruction Fuzzy Hash: 1EE04F31501518BBCF2B2F61DC09EEE7E1AEF4C751F014014FD0566121CB718D61AAE1

Function 0030D905 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000D911,0030D100), ref: 0030D90A

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: cbfd3b8fba67218ba40266a844e73e9650cf64b7d5370c6f05e63f75a347c8ce
Instruction ID: 329dd14aad91adb5181505f1196a27c02671cd16ab631c8c13b7d2d32f5b2d57
Opcode Fuzzy Hash: cbfd3b8fba67218ba40266a844e73e9650cf64b7d5370c6f05e63f75a347c8ce
Instruction Fuzzy Hash:

Function 003024D0 Relevance: 1.5, Strings: 1, Instructions: 225COMMON

Download Yara Rule

Strings

~~~~~~~~, xrefs: 003027C7

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: ~~~~~~~~
API String ID: 0-3303759636
Opcode ID: f8f2d961c6690bde5257882181bc010ca5d15dd02701106ccb974acb415ca544
Instruction ID: 22bcf7a22f73fd2b71cb357ec7340c1717cf5900722a29e7853b116216d2c4ed
Opcode Fuzzy Hash: f8f2d961c6690bde5257882181bc010ca5d15dd02701106ccb974acb415ca544
Instruction Fuzzy Hash: 5FA1E235905646CFD726CF24C468BF6F3B0FF55704F0A82E9D8496B2A2EB706981CB84

Function 0032037D Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0032037D

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 6400cb917b6eaa0b882eca85984b531dd2b4e5ad11aa88e74a959105f5ee8559
Instruction ID: dacc3ef51bc94f71f0cc3884ebca8dc4d639bf57e06347a983bab37c51afeab3
Opcode Fuzzy Hash: 6400cb917b6eaa0b882eca85984b531dd2b4e5ad11aa88e74a959105f5ee8559
Instruction Fuzzy Hash: 2FA012343005018B93414F315E0560C359C65063C0B0540189510C4120DA3050A14601

Function 00327F60 Relevance: .7, Instructions: 651COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 505ec60201b935deb26aca79220dbf4afa4b9f889aed919791c54395606646be
Instruction ID: 24d1ee0faf4dde827e485a0331e6fd42a22a55fe0de7fef30d0ec2ab62465de3
Opcode Fuzzy Hash: 505ec60201b935deb26aca79220dbf4afa4b9f889aed919791c54395606646be
Instruction Fuzzy Hash: 60323731D2AF510DD7639738E862335A24CAFB73C4F65D727E826B5AA6EF2994C34100

Function 0032A019 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ff73776b8a4b52318948c1afd28b6513f75bd478226d09df3f171f2496f895b
Instruction ID: 780130c149e9f8717821bacb7e70e556bc535ed686b22887cb524b702a04354c
Opcode Fuzzy Hash: 6ff73776b8a4b52318948c1afd28b6513f75bd478226d09df3f171f2496f895b
Instruction Fuzzy Hash: DE323432D28F114ED7239638ED62335A25DAFB73C5F15C727E81AB59A9EB29C4834102

Function 003219E4 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: e7acbe54955f26cea3d96212787b6dacb706edb25820ffcb4b951e1b31c1cf72
Instruction ID: 8e9d630e9caaad6141cad2bdbcc72d24dcd98183a59153feea394b564c507666
Opcode Fuzzy Hash: e7acbe54955f26cea3d96212787b6dacb706edb25820ffcb4b951e1b31c1cf72
Instruction Fuzzy Hash: 2FB106765007118BDB3ADF24DD82AB7B3A8EF64308F55452DEA8386580EBB5E981CB10

Function 0030A760 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f46c0e91adab112642c3e90fed2600fbcfb01e74a8d2e52180c0110742978013
Instruction ID: 1dce619828b898fe13df8b8ee784b10a9d76fe8726bf0fb7e6b0e73669b23752
Opcode Fuzzy Hash: f46c0e91adab112642c3e90fed2600fbcfb01e74a8d2e52180c0110742978013
Instruction Fuzzy Hash: 1741B132B21A118BD718CE3CC8526A6B7E5FB98310F198B7DE42AC73C1D734AD058B84

Function 0030E3D0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 541b97f2c18f1582727c3137f986e6837cc8b3c6c9d3cafb87b795f92ee3d370
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: B7113DBB30304283D617CA3FD4B86B7E795EBC532176F4BBAD1414B7D4D122E9459500

Function 003096C0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0030972F
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0030984D
std::_Lockit::~_Lockit.LIBCPMT ref: 003098E4
Concurrency::cancel_current_task.LIBCPMT ref: 00309907
Concurrency::cancel_current_task.LIBCPMT ref: 0030990C
Concurrency::cancel_current_task.LIBCPMT ref: 00309911

Strings

true, xrefs: 00309828
false, xrefs: 003097FE
bad locale name, xrefs: 003098FD

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: Concurrency::cancel_current_taskstd::_$Lockit$Locinfo::_Locinfo_dtorLockit::_Lockit::~_
String ID: bad locale name$false$true
API String ID: 2199893758-1062449267
Opcode ID: 49f549e3f96a8e446d8bcc31b82cf8b07409ab9a282ebd4f1f293d84272f1460
Instruction ID: 2f73f1003e3dc3af47bbbb3207ef467fae54084b13667e00be489bdb287f76b3
Opcode Fuzzy Hash: 49f549e3f96a8e446d8bcc31b82cf8b07409ab9a282ebd4f1f293d84272f1460
Instruction Fuzzy Hash: E1618FB49013489BEF22DFA4D855B9EBBB4AF05300F14812DE808AF382E7B5DA45CB51

Function 0031DA1E Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 0031DC98, 0031DC9D

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: b8bad6860940e0e7bb2577a03442faa595405026bac0e86e334fa4d534f346f1
Instruction ID: f669370deed23efae4ef83235fc3e16b79b5ec02195a03d7282fdbb1ae6d2c2a
Opcode Fuzzy Hash: b8bad6860940e0e7bb2577a03442faa595405026bac0e86e334fa4d534f346f1
Instruction Fuzzy Hash: 96B1E670A086099FDB1BDFA8D881BEE7BB5FF4E314F154159E5019B392C770A981CBA0

Function 0030CBAA Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 0030CBF1
__alloca_probe_16.LIBCMT ref: 0030CC1D
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 0030CC5C
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0030CC79
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 0030CCB8
__alloca_probe_16.LIBCMT ref: 0030CCD5
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 0030CD17
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 0030CD3A

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 63deaa3650a3bf956e76321c2e066cdf4a2f55aba4b689db71807641fe66c021
Instruction ID: fd121f0cf9dad972a1fbd59c8fc102311156752621be82fbdef6754e1b1e16e5
Opcode Fuzzy Hash: 63deaa3650a3bf956e76321c2e066cdf4a2f55aba4b689db71807641fe66c021
Instruction Fuzzy Hash: AE51BE72522206ABEB228F64CC55FEB7BA9EF44740F154628F915EA1E0D734CC019BA0

Function 0031998D Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00319A13

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 55ae62c56f390a00837b9fb55f96d229920877030498453fd125425627efc205
Instruction ID: 903a706be1e81ccd9e52807eeb5402d197d8672642035d6fa90a10fb408313bc
Opcode Fuzzy Hash: 55ae62c56f390a00837b9fb55f96d229920877030498453fd125425627efc205
Instruction Fuzzy Hash: E8B17872A042659FDB1BCF28DCA1BEE7BE5EF5D310F158156E844AF282D270D981C7A0

Function 003104F4 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00310613
___TypeMatch.LIBVCRUNTIME ref: 0031071E
CallUnexpected.LIBVCRUNTIME ref: 0031088C

Strings

csm, xrefs: 0031059E
csm, xrefs: 0031064A
csm, xrefs: 00310531

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: 4b91fd3ad8db1f97f1648b0c266565681778c13e6a694e4c91e40d0a7655091d
Instruction ID: 663ba3bdf730da2dc94d1b57a408be62fc19aecc309d5a086666b2f72794bb8d
Opcode Fuzzy Hash: 4b91fd3ad8db1f97f1648b0c266565681778c13e6a694e4c91e40d0a7655091d
Instruction Fuzzy Hash: 38B14771800209AFCF1EDFA4C9819EEB7B5BF58310B11456AE8146B252D7B4EAE1CF91

Function 0030FFC0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0030FFF7
___except_validate_context_record.LIBVCRUNTIME ref: 0030FFFF
_ValidateLocalCookies.LIBCMT ref: 00310088
__IsNonwritableInCurrentImage.LIBCMT ref: 003100B3
_ValidateLocalCookies.LIBCMT ref: 00310108

Strings

csm, xrefs: 0031009D

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 2e04353876eb6b7f5109acb4fc71564f34585b8f5f0afd4b160ab6726e8d9a42
Instruction ID: c6a74ca57d86eec2b42124e5bdb828a0182349850f46d98f2bab4fec5f96370a
Opcode Fuzzy Hash: 2e04353876eb6b7f5109acb4fc71564f34585b8f5f0afd4b160ab6726e8d9a42
Instruction Fuzzy Hash: 0541C534A002089FCF1ADF68C881BDEBBA5BF0D314F158065E9185B352D775EA95CB90

Function 00310184 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0031017B,0030E32B,0030D955), ref: 00310192
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 003101A0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 003101B9
SetLastError.KERNEL32(00000000,0031017B,0030E32B,0030D955), ref: 0031020B

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 97875e542886928a479ed3c9d1e6c6a7a0e96a2fcd12e73b0cecdbfce66e13d6
Instruction ID: 1cae698d8088dd4ad624a974d0f0012ee8644f248cfd6f47d663e04f028ab63a
Opcode Fuzzy Hash: 97875e542886928a479ed3c9d1e6c6a7a0e96a2fcd12e73b0cecdbfce66e13d6
Instruction Fuzzy Hash: 2501F53650D3156EEA2F26B87DC6AEB2A48EB0D770FA00739F520484F2EF954CC59140

Function 0030B61B Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0030B622
std::_Lockit::_Lockit.LIBCPMT ref: 0030B62C
int.LIBCPMT ref: 0030B643

Part of subcall function 00301E90: std::_Lockit::_Lockit.LIBCPMT ref: 00301EA1
Part of subcall function 00301E90: std::_Lockit::~_Lockit.LIBCPMT ref: 00301EBB

codecvt.LIBCPMT ref: 0030B666
std::_Lockit::~_Lockit.LIBCPMT ref: 0030B69D
Concurrency::cancel_current_task.LIBCPMT ref: 0030B6AA

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Concurrency::cancel_current_taskH_prolog3codecvt
String ID:
API String ID: 2746682151-0
Opcode ID: 2bf81d67d81b9b1c0299dd765fbfc7f3380833b67c3025dfa89fa84777a1da81
Instruction ID: 7d928e1984984f1692c0b155cc17b6719e0b1de76db0e266879be00340c864b9
Opcode Fuzzy Hash: 2bf81d67d81b9b1c0299dd765fbfc7f3380833b67c3025dfa89fa84777a1da81
Instruction Fuzzy Hash: 17018035A021199FCB07EBA4C8656BDB7A9BF81320F254509F9156F2D1CF71AA058B80

Function 00301FA0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00302019
__Getctype.LIBCPMT ref: 0030207E
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0030209A
std::_Lockit::~_Lockit.LIBCPMT ref: 0030212F

Strings

bad locale name, xrefs: 0030214C

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: std::_$Lockit$GetctypeLocinfo::_Locinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 3327844093-1405518554
Opcode ID: 2054260a67269d52ac8163d300d9785c3c41294a805ca979fb764ea2aba7463d
Instruction ID: 14ce0e75a4a3fe5079bc163ef43e5eafbe54491e91adb84d6686ae5810eaf6d3
Opcode Fuzzy Hash: 2054260a67269d52ac8163d300d9785c3c41294a805ca979fb764ea2aba7463d
Instruction Fuzzy Hash: D051A2B1D053489BDF11DFE4D855B8EFBB8AF14700F144129E804AB281E775EA48CBA2

Function 00311A90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,84FDAC87,?,?,00000000,0032B6CB,000000FF,?,00311A6C,?,?,00311A40,00000016), ref: 00311AC5
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00311AD7
FreeLibrary.KERNEL32(00000000,?,00000000,0032B6CB,000000FF,?,00311A6C,?,?,00311A40,00000016), ref: 00311AF9

Strings

mscoree.dll, xrefs: 00311ABE
CorExitProcess, xrefs: 00311ACF

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: fda0cf8fe93bf8d79af105b719163f8e56a6af782350a1de62fb36ec19361ed6
Instruction ID: 6e1045ab380ac6866ac933cd8c178ea3c6cc8b22d22e98157be99f0906b83486
Opcode Fuzzy Hash: fda0cf8fe93bf8d79af105b719163f8e56a6af782350a1de62fb36ec19361ed6
Instruction Fuzzy Hash: ED01DB71950626EFCB278F44DD05BEEBBBDFF04B54F000529F911A22A0DBB49900CA90

Function 0031EB5E Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0031EBE3
__alloca_probe_16.LIBCMT ref: 0031ECAC
__freea.LIBCMT ref: 0031ED13

Part of subcall function 0031977E: RtlAllocateHeap.NTDLL(00000000,?,?,?,0030E127,?,?,?,?,?,00301103,?,?), ref: 003197B0

__freea.LIBCMT ref: 0031ED26
__freea.LIBCMT ref: 0031ED33

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: c56f8300e5ebd9d239acdba053bc9ec9eaa3a844af39e43079a234a0eafce3b6
Instruction ID: 96875a9e43826ad74fe234f88a71ebb6e900b7ea189f45c916da83108fc8895d
Opcode Fuzzy Hash: c56f8300e5ebd9d239acdba053bc9ec9eaa3a844af39e43079a234a0eafce3b6
Instruction Fuzzy Hash: 5951B4B261020AAFDB2B5F64DC41EFB7BADDF4C710F160929FD05DA151EA72DC9086A0

Function 003091B0 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 003091D3
std::_Lockit::_Lockit.LIBCPMT ref: 003091F6
std::_Lockit::~_Lockit.LIBCPMT ref: 00309216
std::_Lockit::~_Lockit.LIBCPMT ref: 003092A3
Concurrency::cancel_current_task.LIBCPMT ref: 003092BB

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Concurrency::cancel_current_task
String ID:
API String ID: 3053331623-0
Opcode ID: d09178f85fa5e04cb7f0deaabc95d8ce747396867ac6916a9b0a1f661ca8297a
Instruction ID: 757acda84aac04069065b01593d61a4fd113556a1823356b838ba555a9961e3d
Opcode Fuzzy Hash: d09178f85fa5e04cb7f0deaabc95d8ce747396867ac6916a9b0a1f661ca8297a
Instruction Fuzzy Hash: 6B31C275902219DFCB27DF54D85076EB778FB01720F15465AE9056B392DB30AD44CBD0

Function 00308B00 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00308B23
std::_Lockit::_Lockit.LIBCPMT ref: 00308B46
std::_Lockit::~_Lockit.LIBCPMT ref: 00308B66
std::_Lockit::~_Lockit.LIBCPMT ref: 00308BF3
Concurrency::cancel_current_task.LIBCPMT ref: 00308C0B

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Concurrency::cancel_current_task
String ID:
API String ID: 3053331623-0
Opcode ID: bdb39cd9799f77f2478b9dde26c9b188780e13e053a0a089da9182e825f8086c
Instruction ID: 1b99affe7e42c9c0c1de72782d715dfe878fd903c9d909d250f36c800f8c49d1
Opcode Fuzzy Hash: bdb39cd9799f77f2478b9dde26c9b188780e13e053a0a089da9182e825f8086c
Instruction Fuzzy Hash: 7931E1B5A022158FCB27DF44D860AAEBBB4FB05320F154269E9856B392DB30BD05CBD0

Function 00308670 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00308693
std::_Lockit::_Lockit.LIBCPMT ref: 003086B6
std::_Lockit::~_Lockit.LIBCPMT ref: 003086D6
std::_Lockit::~_Lockit.LIBCPMT ref: 00308763
Concurrency::cancel_current_task.LIBCPMT ref: 0030877B

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Concurrency::cancel_current_task
String ID:
API String ID: 3053331623-0
Opcode ID: 786c8924f89008ec652cc8ef7b338e31f228b5455902ff1d125a50d3d2b06697
Instruction ID: 125ca33abcff237d661731a14cc1f494265c30b1ff3c226920642cc46736d941
Opcode Fuzzy Hash: 786c8924f89008ec652cc8ef7b338e31f228b5455902ff1d125a50d3d2b06697
Instruction Fuzzy Hash: 5631E179A0121ACFCB17CF44D890AAEBB78FB01720F250259E9456B392DB30BD44CBD0

Function 0030C465 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0030C46C
std::_Lockit::_Lockit.LIBCPMT ref: 0030C477
std::_Lockit::~_Lockit.LIBCPMT ref: 0030C4E5

Part of subcall function 0030C5C9: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0030C5E1

std::locale::_Setgloballocale.LIBCPMT ref: 0030C492
_Yarn.LIBCPMT ref: 0030C4A8

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 2c90f4942aa31347d702cf8e7a870656673abddfcfaf1c47483658c094ce7a64
Instruction ID: 86f3c3836e0342a03fca13123ce7adacbfc9a11fa8a71e6b597ef53e229b02c6
Opcode Fuzzy Hash: 2c90f4942aa31347d702cf8e7a870656673abddfcfaf1c47483658c094ce7a64
Instruction Fuzzy Hash: C2019A796122209BC70BEB609C6697C7B69BF86300F145009E9015B3D1CF34AE02CBC0

Function 00308D80 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 385COMMON

Download Yara Rule

APIs

_strcspn.LIBCMT ref: 00308E01
_strcspn.LIBCMT ref: 00308E23

Strings

<3, xrefs: 00308DD3
<3, xrefs: 00308DDD

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: _strcspn
String ID: <3$<3
API String ID: 3709121408-544789574
Opcode ID: 071e9a408d6d56a26dfb34ee5547a62e6f2816c54c2d37f3122c2e9393cb7ab7
Instruction ID: 33037e70282648c96d64547106a8626199fa4207a0ea288b3a2e7bd18c0bddff
Opcode Fuzzy Hash: 071e9a408d6d56a26dfb34ee5547a62e6f2816c54c2d37f3122c2e9393cb7ab7
Instruction Fuzzy Hash: 19E1A071A01149DFDF05CFA8C8A4AEEBBB6FF48304F148159E955AB292D731ED41CB60

Function 00309920 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00309988
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 003099F3
std::_Lockit::~_Lockit.LIBCPMT ref: 00309A8A

Strings

bad locale name, xrefs: 00309AA3

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: std::_$Lockit$Locinfo::_Locinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 3553999535-1405518554
Opcode ID: 71762c4f2f501b933416d6ab0329a6fb5c36cc442e6c0d82260126d04e615c00
Instruction ID: aeda46a12bd7227a8fa06e110264899a607b7081c5a40faacb44e401bb0f3ac7
Opcode Fuzzy Hash: 71762c4f2f501b933416d6ab0329a6fb5c36cc442e6c0d82260126d04e615c00
Instruction Fuzzy Hash: 714171B5E05248ABDF12DFE4D855BDEFBB8AF18710F144069E804AB382E774DA04CB91

Function 003023A0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0030243F

Part of subcall function 0030E360: RaiseException.KERNEL32(E06D7363,00000001,00000003,003011AC,?,?,?,?,003011AC,?,0033D954), ref: 0030E3C1

Strings

ios_base::failbit set, xrefs: 003022F8, 003023E1
ios_base::badbit set, xrefs: 003023D7, 00302402, 00302423
ios_base::eofbit set, xrefs: 003023E6

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3109751735-1866435925
Opcode ID: 059065d12314d0ccd1c6ac594a9ed9023d52636ba7cf55a281927bc43c52fbd4
Instruction ID: db0f46b923edc2c74b59c093a01b53c5a0f393624cff06493779acfff64eb61c
Opcode Fuzzy Hash: 059065d12314d0ccd1c6ac594a9ed9023d52636ba7cf55a281927bc43c52fbd4
Instruction Fuzzy Hash: 1A1127BAA007086BC712DE58D856B97B3DCAF14310F14896AF918DB681F774A954CBE0

Function 003112D7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00311288,00000000,?,003406A4,?,?,?,0031142B,00000004,InitializeCriticalSectionEx,0032DCA8,InitializeCriticalSectionEx), ref: 003112E4
GetLastError.KERNEL32(?,00311288,00000000,?,003406A4,?,?,?,0031142B,00000004,InitializeCriticalSectionEx,0032DCA8,InitializeCriticalSectionEx,00000000,?,00311072), ref: 003112EE
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00311316

Strings

api-ms-, xrefs: 003112FB

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 408f735228af26e2e014d4155596b7dee522299533422925b230597d05c17463
Instruction ID: 02a25d37862d2663dd5fd899d318ac2fa557461da5c6b5f70d33faffc92f67c4
Opcode Fuzzy Hash: 408f735228af26e2e014d4155596b7dee522299533422925b230597d05c17463
Instruction Fuzzy Hash: 42E04830740208FBDF271B61ED06BDD7E59AB08B40F118434FA0DA84E1D762D9558554

Function 0031BF30 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(84FDAC87,00000000,00000000,00000000), ref: 0031BF93

Part of subcall function 0031F3A3: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0031ED09,?,00000000,-00000008), ref: 0031F404

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0031C1E5
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0031C22B
GetLastError.KERNEL32 ref: 0031C2CE

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 4c20048b047659029f1b5cf1325e10ee563ab25e565b8b77ec1c874108b5b561
Instruction ID: 63c0afdf4bb25958d2d9f4e77cff353eaa4bfbadd5a19b27e6c1f49b66e69b6b
Opcode Fuzzy Hash: 4c20048b047659029f1b5cf1325e10ee563ab25e565b8b77ec1c874108b5b561
Instruction Fuzzy Hash: 1FD17A75E542589FCF1ACFE8C8909EDBBB9FF0D314F24452AE416EB251D630A982CB50

Function 0031029C Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00310363
___AdjustPointer.LIBCMT ref: 00310386
___AdjustPointer.LIBCMT ref: 00310422

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 7fdb9dd1f1481e3a65dfaab32236fc22916896af1164fccc306ac20fba742c57
Instruction ID: af379d4da69955c649f12b5a5dc694801ae22d05cc5104588a59f652603ad821
Opcode Fuzzy Hash: 7fdb9dd1f1481e3a65dfaab32236fc22916896af1164fccc306ac20fba742c57
Instruction Fuzzy Hash: 9851DE7A601202DFDB2E8F10D941BEA73A8FF48300F154829E9659B691EBB1ECC1CB50

Function 003260D9 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,00324B04,00000000,00000001,0000000C,00000000,?,0031C322,00000000,00000000,00000000), ref: 003260F0
GetLastError.KERNEL32(?,00324B04,00000000,00000001,0000000C,00000000,?,0031C322,00000000,00000000,00000000,00000000,00000000,?,0031C8C5,?), ref: 003260FC

Part of subcall function 003260C2: CloseHandle.KERNEL32(FFFFFFFE,0032610C,?,00324B04,00000000,00000001,0000000C,00000000,?,0031C322,00000000,00000000,00000000,00000000,00000000), ref: 003260D2

___initconout.LIBCMT ref: 0032610C

Part of subcall function 00326084: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,003260B3,00324AF1,00000000,?,0031C322,00000000,00000000,00000000,00000000), ref: 00326097

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,00324B04,00000000,00000001,0000000C,00000000,?,0031C322,00000000,00000000,00000000,00000000), ref: 00326121

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: b75e2105f573c431dbcec2c73b28d6671b0cd7784c2b1205e4cf648e31d86883
Instruction ID: ebc1b0515950b4d8995aef73b62abf683e38ac9f700d4ed79ad131fa066252d1
Opcode Fuzzy Hash: b75e2105f573c431dbcec2c73b28d6671b0cd7784c2b1205e4cf648e31d86883
Instruction Fuzzy Hash: C5F0C036915164BBCF232F95EC06A9D3F6AFF087A5F058524FA1996531C6329C30EBD0

Function 0030D9B5 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0030D9C7
GetCurrentThreadId.KERNEL32 ref: 0030D9D6
GetCurrentProcessId.KERNEL32 ref: 0030D9DF
QueryPerformanceCounter.KERNEL32(?), ref: 0030D9EC

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 20010370f4c15845bbdd26a4db3f74f898e53243397a7abda639061795290e38
Instruction ID: 93c363de6ed1b913abbe016b3e83b86b2426cb7184713f41d06b64a2c5c4936e
Opcode Fuzzy Hash: 20010370f4c15845bbdd26a4db3f74f898e53243397a7abda639061795290e38
Instruction Fuzzy Hash: 2CF0AF70C2020CEBCB05DBB4DA4899EBBF8EF1D300B91969AA412E6110E630AA498B50

Function 003022C0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 150COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0030243F

Part of subcall function 0030E360: RaiseException.KERNEL32(E06D7363,00000001,00000003,003011AC,?,?,?,?,003011AC,?,0033D954), ref: 0030E3C1

Strings

ios_base::failbit set, xrefs: 003022F8
ios_base::badbit set, xrefs: 003023D7, 00302402, 00302423

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::failbit set
API String ID: 3109751735-1240500531
Opcode ID: 0084649b0ddc7917ee29709f60c71197d1dbe60d34f10afc4562c30d08bc25b5
Instruction ID: e76bea583e47643b737088c8c7b9c7eda8b0e0bffc59ce5e6858458e8805535a
Opcode Fuzzy Hash: 0084649b0ddc7917ee29709f60c71197d1dbe60d34f10afc4562c30d08bc25b5
Instruction Fuzzy Hash: 80414676910208ABCB06DF68DC95BAFF7B8FF45310F14825AF9149B681E774A940CBA0

Function 00310897 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 003108BC

Strings

MOC, xrefs: 003108CE
RCC, xrefs: 003108D6

Memory Dump Source

Source File: 00000000.00000002.1421497800.0000000000301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00300000, based on PE: true

Associated: 00000000.00000002.1421478437.0000000000300000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421524477.000000000032C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421545894.000000000033F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1421561944.0000000000341000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_300000_SecuriteInfo.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 5c4d140ceb9e289587c05addfb6deed56901b60f87a84538757895c957bf9f26
Instruction ID: 89e4a147aab61f98d2a72e83a418e2c913ee9eb1ef8cf9f0fe2dd3bf41fe706d
Opcode Fuzzy Hash: 5c4d140ceb9e289587c05addfb6deed56901b60f87a84538757895c957bf9f26
Instruction Fuzzy Hash: 07418971900209EFDF1ADF98CD91AEEBBB5BF48304F158099F905AB262D3B599D0CB50

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Poverty Stealer

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Windows Analysis Report
SecuriteInfo.com.Variant.Fragtor.519143.19980.21167.exe

Function 003059A0 Relevance: 51.4, APIs: 11, Strings: 18, Instructions: 614
sleeplibraryloaderCOMMON

Function 003042E0 Relevance: 17.0, APIs: 11, Instructions: 538
libraryloadernetworkCOMMON

Function 0031ABAD Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 00311A46 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 00319744 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Function 00309F90 Relevance: 1.7, APIs: 1, Instructions: 172
COMMON