Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe
Analysis ID:	1645704
MD5:	fa21bcb264226c07d923d31a1642af8d
SHA1:	4bda85546017addd5943f924e1ab34b3729408a1
SHA256:	b662b694630f0b54c92dc2567e00390492d90d6cea5a50efc231e8b4b227ec69
Tags:	exeuser-SecuriteInfoCom
Infos:

Detection

Score:	64
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Joe Sandbox ML detected suspicious sample

Sigma detected: Potentially Suspicious Malware Callback Communication

Detected TCP or UDP traffic on non-standard ports

Internet Provider seen in connection with other malware

PE file contains more sections than normal

PE file contains sections with non-standard names

Program does not show much activity (idle)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe (PID: 7692 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe" MD5: FA21BCB264226C07D923D31A1642AF8D)

conhost.exe (PID: 7700 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious Malware Callback Communication

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 176.65.138.157, DestinationIsIpv6: false, DestinationPort: 1443, EventID: 3, Image: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe, Initiated: true, ProcessId: 7692, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49720

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Compliance
• Networking
• System Summary
• Data Obfuscation
• Malware Analysis System Evasion
• Anti Debugging
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe	Virustotal: Detection: 30%			Perma Link
Source: SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe	ReversingLabs: Detection: 38%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 96.2% probability

Source: SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE

Source: global traffic

TCP traffic: 192.168.2.4:49720 -> 176.65.138.157:1443

Source: Joe Sandbox View

ASN Name: PALTEL-ASPALTELAutonomousSystemPS PALTEL-ASPALTELAutonomousSystemPS

Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.138.157
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.138.157
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.138.157
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.138.157
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.138.157

Source: SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe

Static PE information: Number of sections : 15 > 10

Source: SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal64.winEXE@2/1@0/1

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7700:120:WilError_03

Source: SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe	Virustotal: Detection: 30%
Source: SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe	ReversingLabs: Detection: 38%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe	Section loaded: mswsock.dll			Jump to behavior

Source: SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe	Static PE information: section name: /4
Source: SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe	Static PE information: section name: /19
Source: SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe	Static PE information: section name: /31
Source: SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe	Static PE information: section name: /45
Source: SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe	Static PE information: section name: /57
Source: SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe	Static PE information: section name: /70
Source: SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe	Static PE information: section name: /81
Source: SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe	Static PE information: section name: /92

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe

Code function: 0_2_004100CB push ds; retf

0_2_004100CC

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe

Code function: 0_2_00401564 GetSystemInfo,GetSystemInfo,

0_2_00401564

Source: SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe, 00000000.00000002.1221678852.000000000081E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe	Code function: 0_2_0040116C Sleep,Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,GetStartupInfoA,_cexit,_initterm,exit,	0_2_0040116C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe	Code function: 0_2_00401160 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,	0_2_00401160
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe	Code function: 0_2_004013C1 SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,	0_2_004013C1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe	Code function: 0_2_0040199C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	0_2_0040199C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe	Code function: 0_2_004019A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	0_2_004019A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe	Code function: 0_2_004011A3 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,	0_2_004011A3

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe

Code function: 0_2_004018E0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_004018E0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Process Injection	OS Credential Dumping	1 System Time Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 DLL Side-Loading	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	3 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe	30%	Virustotal		Browse
SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe	39%	ReversingLabs
SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe	100%	Avira	HEUR/AGEN.1319913

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
176.65.138.157	unknown	Germany		12975	PALTEL-ASPALTELAutonomousSystemPS	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1645704
Start date and time:	2025-03-22 08:23:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe
Detection:	MAL
Classification:	mal64.winEXE@2/1@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 10 Number of non-executed functions: 6
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.204.23.20, 204.79.197.222, 4.175.87.197
Excluded domains from analysis (whitelisted): fp.msedge.net, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PALTEL-ASPALTELAutonomousSystemPS	xenn.ps1	Get hash	malicious	RedLine	Browse	176.65.144.135
	Confirmaci#U00f3n de Pago.js	Get hash	malicious	Remcos	Browse	176.65.144.3
	STEPH.js	Get hash	malicious	FormBook	Browse	176.65.144.3
	nabppc.elf	Get hash	malicious	Unknown	Browse	82.213.50.193
	Rendel#U00e9si k#U00e9relem.exe	Get hash	malicious	DarkCloud	Browse	176.65.144.3
	MUKK.ps1	Get hash	malicious	AgentTesla	Browse	176.65.144.3
	obfuscated (1).js	Get hash	malicious	XWorm	Browse	176.65.144.3
	KIM.ps1	Get hash	malicious	Stealerium	Browse	176.65.144.3
	KENT.ps1	Get hash	malicious	Remcos	Browse	176.65.144.3
	xenbuild.exe	Get hash	malicious	RedLine	Browse	176.65.144.135

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.6818808028034042
Encrypted:	false
SSDEEP:	3:ljR/a2n:ljBn
MD5:	62A7BE59CA4EC4DC0E7EF3474A410A68
SHA1:	45C87A259B3F7D75206B4868E9DC0E8B8B7FC9DD
SHA-256:	D62C958EF5607905CFB4B9B785F526544F78A1BC36EFADBB9931FAE34CF2036C
SHA-512:	3D01752A9C1B3ADD0A4628F6507180F7D7130D1003182DA93EC2B1195833B703BDF6A30362AAC4385D8D95658AE36AB7F1A502025F490D9591020C04B8795BF8
Malicious:	false
Reputation:	low
Preview:	Connection failed..

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	5.9108799652157735
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe
File size:	293'842 bytes
MD5:	fa21bcb264226c07d923d31a1642af8d
SHA1:	4bda85546017addd5943f924e1ab34b3729408a1
SHA256:	b662b694630f0b54c92dc2567e00390492d90d6cea5a50efc231e8b4b227ec69
SHA512:	4f041dbb346d69e4f79fc450a192e67833dbb4d035ac48b3eed614bfce8d19bd9fa020a9331cf38eca4f6ad0c40623daf38427584cc5d791e697d1953f5ea90a
SSDEEP:	6144:x2xqq80/1MW1WqElmz3dWG63acJf2ypi1WqPCTVtq3:A1qHHILgxq+OBQHTvQ
TLSH:	2E542AA0F696FDBAE9558FBD14F11309429EE2C0E71DEB333860FD380159A5C46B364A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g....j..........".....0...............0....@........................................... ............................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4014c0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x67DE0784 [Sat Mar 22 00:42:44 2025 UTC]
TLS Callbacks:	0x401a80, 0x401a30
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b8150e1626853a10621ac84308be19b5

Entrypoint Preview

Instruction
sub esp, 0Ch
mov dword ptr [00405494h], 00000000h
call 00007F6ACD0DBC03h
add esp, 0Ch
jmp 00007F6ACD0DB47Bh
lea esi, dword ptr [esi+00000000h]
sub esp, 1Ch
mov eax, dword ptr [esp+20h]
mov dword ptr [esp], eax
call 00007F6ACD0DCBC6h
test eax, eax
sete al
add esp, 1Ch
movzx eax, al
neg eax
ret
nop
nop
nop
push ebp
mov ebp, esp
sub esp, 18h
mov dword ptr [esp], 00401520h
call 00007F6ACD0DB7C3h
leave
ret
lea esi, dword ptr [esi+00000000h]
lea esi, dword ptr [esi+00h]
nop
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
sub esp, 28h
lea eax, dword ptr [ebp+14h]
mov dword ptr [ebp-10h], eax
mov eax, dword ptr [ebp-10h]
mov dword ptr [esp+0Ch], eax
mov eax, dword ptr [ebp+10h]
mov dword ptr [esp+08h], eax
mov eax, dword ptr [ebp+0Ch]
mov dword ptr [esp+04h], eax
mov eax, dword ptr [ebp+08h]
mov dword ptr [esp], eax
call 00007F6ACD0DCAD9h
mov dword ptr [ebp-0Ch], eax
mov eax, dword ptr [ebp-0Ch]
leave
ret
push ebp
mov ebp, esp
sub esp, 48h
lea eax, dword ptr [ebp-2Ch]
mov dword ptr [esp], eax
mov eax, dword ptr [00406154h]
call eax
sub esp, 04h
movzx eax, word ptr [ebp-2Ch]
cmp ax, 0009h
jne 00007F6ACD0DB7F9h
mov eax, 00404000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6000	0x664	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x40b0	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x6138	0xe8	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1964	0x1a00	6040c077c01269cd24c30d33a0757a41	False	0.5593449519230769	data	5.870853919191518	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x3000	0x30	0x200	d57819111cd7c312e4b58d71f1ef1650	False	0.08984375	data	0.5781491419435547	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x4000	0x694	0x800	b1c92641f76728a04adeff41dc55e7a0	False	0.26513671875	data	4.711862879033733	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x5000	0x4e8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6000	0x664	0x800	f320d04965b1f446c16c295481f4d31e	False	0.35888671875	data	3.9846482031717056	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x7000	0x34	0x200	8260687f18135aef8fc3d7ab41206c16	False	0.072265625	Matlab v4 mat-file (little endian) \300\030@, numeric, rows 4198688, columns 0	0.2748254782599745	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x8000	0x8	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
/4	0x9000	0x2d8	0x400	c1f06c32bb4ff70774a0fc4ffba7f689	False	0.2412109375	Matlab v4 mat-file (little endian) \375\004, rows 2, columns 262144	1.747536435918311	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/19	0xa000	0x35732	0x35800	6fbdf31957df435a69ab0c0ef4863958	False	0.2899888653621495	data	6.013009488695018	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/31	0x40000	0x229e	0x2400	7494e2dd1ed7f7b3b372245d126dd653	False	0.1806640625	data	4.587488917350296	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/45	0x43000	0x2c77	0x2e00	2d561cf00ccda35526126a03f45aa6c4	False	0.33755095108695654	data	5.346475771934375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/57	0x46000	0x748	0x800	7e1dc8bec09e8a0a96fc1d1ab4ea6b8e	False	0.40380859375	data	4.424167454921425	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/70	0x47000	0x4ee	0x600	b8e844e565f9c1616a0d5869b094ecd3	False	0.3678385416666667	data	4.366683744454898	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/81	0x48000	0x11e2	0x1200	c2ca0570b995d66695092059bc4994f2	False	0.3276909722222222	data	3.027796683635334	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/92	0x4a000	0x250	0x400	7fb4be62f4f9a0a0930b93c770d68c97	False	0.2509765625	Matlab v4 mat-file (little endian) \340, rows 16, columns 19, imaginary	1.6779866419342222	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	DeleteCriticalSection, EnterCriticalSection, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetLastError, GetStartupInfoA, GetSystemInfo, GetSystemTimeAsFileTime, GetTickCount, GlobalMemoryStatusEx, InitializeCriticalSection, LeaveCriticalSection, QueryPerformanceCounter, SetUnhandledExceptionFilter, Sleep, TerminateProcess, TlsGetValue, UnhandledExceptionFilter, VirtualProtect, VirtualQuery
msvcrt.dll	__getmainargs, __initenv, __lconv_init, __p__acmdln, __p__fmode, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _initterm, _iob, _onexit, _vsnprintf, abort, calloc, exit, fprintf, free, fwrite, malloc, memcpy, puts, signal, strlen, strncmp, vfprintf
WS2_32.dll	WSACleanup, WSAStartup, closesocket, connect, htons, inet_addr, send, socket

Network Behavior

Download Network PCAP: filtered – full

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 22, 2025 08:24:14.308125973 CET	49720	1443	192.168.2.4	176.65.138.157
Mar 22, 2025 08:24:14.479149103 CET	1443	49720	176.65.138.157	192.168.2.4
Mar 22, 2025 08:24:14.994534969 CET	49720	1443	192.168.2.4	176.65.138.157
Mar 22, 2025 08:24:15.161294937 CET	1443	49720	176.65.138.157	192.168.2.4
Mar 22, 2025 08:24:15.680692911 CET	49720	1443	192.168.2.4	176.65.138.157
Mar 22, 2025 08:24:15.847839117 CET	1443	49720	176.65.138.157	192.168.2.4
Mar 22, 2025 08:24:16.353871107 CET	49720	1443	192.168.2.4	176.65.138.157
Mar 22, 2025 08:24:16.522495031 CET	1443	49720	176.65.138.157	192.168.2.4
Mar 22, 2025 08:24:17.025846958 CET	49720	1443	192.168.2.4	176.65.138.157
Mar 22, 2025 08:24:17.191742897 CET	1443	49720	176.65.138.157	192.168.2.4

Statistics

CPU Usage

• SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe
• conhost.exe

Click to jump to process

Memory Usage

• SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe
• conhost.exe

Click to jump to process

High Level Behavior Distribution

• File
• Network

Click to dive into process behavior distribution

Behavior

• SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe
• conhost.exe

Click to jump to process

Target ID:	0
Start time:	03:24:12
Start date:	22/03/2025
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe"
Imagebase:	0x400000
File size:	293'842 bytes
MD5 hash:	FA21BCB264226C07D923D31A1642AF8D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:24:12
Start date:	22/03/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff62fc20000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	8.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	33.1%
Total number of Nodes:	357
Total number of Limit Nodes:	1

Callgraph

Hide Legend

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0040116C Relevance: 19.7, APIs: 13, Instructions: 204
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 004011B7
SetUnhandledExceptionFilter.KERNEL32 ref: 00401238
__p__acmdln.MSVCRT ref: 00401261
malloc.MSVCRT ref: 004012EB
strlen.MSVCRT ref: 0040131B
malloc.MSVCRT ref: 00401326
memcpy.MSVCRT ref: 0040133C
GetStartupInfoA.KERNEL32 ref: 00401433

Memory Dump Source

Source File: 00000000.00000002.1221552620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1221538281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221573936.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221589712.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221602304.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandled__p__acmdlnmemcpystrlen
String ID:
API String ID: 1672962128-0
Opcode ID: b1ee7d8352319cae9150eead45ad2cecbce749cd6f6f65bd659f45cbfef0020e
Instruction ID: 31d339f947e01fb693a9f7cc325f1ddaf09a3bd9e78bb49fcc57b70c4a085736
Opcode Fuzzy Hash: b1ee7d8352319cae9150eead45ad2cecbce749cd6f6f65bd659f45cbfef0020e
Instruction Fuzzy Hash: 6D819C719046008FDB10EF69DA857AE77E1FB44304F10853EE944BB3A1D779A845CF9A

Function 004013C1 Relevance: 12.1, APIs: 8, Instructions: 108
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00401238
__p__acmdln.MSVCRT ref: 00401261
malloc.MSVCRT ref: 004012EB
strlen.MSVCRT ref: 0040131B
malloc.MSVCRT ref: 00401326
memcpy.MSVCRT ref: 0040133C
_amsg_exit.MSVCRT ref: 004013E2
_initterm.MSVCRT ref: 00401404

Memory Dump Source

Source File: 00000000.00000002.1221552620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1221538281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221573936.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221589712.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221602304.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: malloc$ExceptionFilterUnhandled__p__acmdln_amsg_exit_inittermmemcpystrlen
String ID:
API String ID: 2053141405-0
Opcode ID: 00df0f6b45fa9b03f4d19803fb0ca039e6bd42b5f224ebcffffd213f371fa5bd
Instruction ID: 67fee7102c81470e6c36d64dad3523a64b230410408b2e3bfdc9e5343fe76f77
Opcode Fuzzy Hash: 00df0f6b45fa9b03f4d19803fb0ca039e6bd42b5f224ebcffffd213f371fa5bd
Instruction Fuzzy Hash: 804106B5A046018FDB10EF65DA8475EBBE0FB44304F10853EE984BB3A1D7789945CF9A

Function 004011A3 Relevance: 10.6, APIs: 7, Instructions: 114
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 004011B7
SetUnhandledExceptionFilter.KERNEL32 ref: 00401238
__p__acmdln.MSVCRT ref: 00401261
malloc.MSVCRT ref: 004012EB
strlen.MSVCRT ref: 0040131B
malloc.MSVCRT ref: 00401326
memcpy.MSVCRT ref: 0040133C
_amsg_exit.MSVCRT ref: 004013E2
_initterm.MSVCRT ref: 00401404

Memory Dump Source

Source File: 00000000.00000002.1221552620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1221538281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221573936.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221589712.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221602304.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled__p__acmdln_amsg_exit_inittermmemcpystrlen
String ID:
API String ID: 2230096795-0
Opcode ID: 48f9bb498974ba7f6b2b11b41656a3c6cf18e1478a1957e9b97a47c5ef3458f4
Instruction ID: ef795e9572295aa069d4f734ff055e90b9c036a7c352001c97976244d843facb
Opcode Fuzzy Hash: 48f9bb498974ba7f6b2b11b41656a3c6cf18e1478a1957e9b97a47c5ef3458f4
Instruction Fuzzy Hash: 324118B1A046018FEB10EF69DA8475EBBF0FB44304F10853EE944AB3A1D7789945CF9A

Function 00401160 Relevance: 9.1, APIs: 6, Instructions: 130
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 004011B7
SetUnhandledExceptionFilter.KERNEL32 ref: 00401238
__p__acmdln.MSVCRT ref: 00401261
malloc.MSVCRT ref: 004012EB
strlen.MSVCRT ref: 0040131B
malloc.MSVCRT ref: 00401326
memcpy.MSVCRT ref: 0040133C
GetStartupInfoA.KERNEL32 ref: 00401433

Memory Dump Source

Source File: 00000000.00000002.1221552620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1221538281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221573936.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221589712.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221602304.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandled__p__acmdlnmemcpystrlen
String ID:
API String ID: 1672962128-0
Opcode ID: acd13347ab27ab248bced7b31e04489e1b2e15703b88c806e97055b87229361b
Instruction ID: e9e8a89b1c8dfa4840c54fae9af8206b258e069e7731568e9d07c10cfcf77caa
Opcode Fuzzy Hash: acd13347ab27ab248bced7b31e04489e1b2e15703b88c806e97055b87229361b
Instruction Fuzzy Hash: 225148B1A046018FDB10EFA9DA8475EBBF4FB44304F10853EE944AB3A1D7789945CF9A

Function 00401564 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 21
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE ref: 00401575

Strings

32-bit, xrefs: 00401594
64-bit, xrefs: 00401584
Unknown, xrefs: 0040159B

Memory Dump Source

Source File: 00000000.00000002.1221552620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1221538281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221573936.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221589712.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221602304.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: InfoSystem
String ID: 32-bit$64-bit$Unknown
API String ID: 31276548-642458120
Opcode ID: d220fe4a6df499f89076f25f428d08403f573503201339276a5e8fef182f7ace
Instruction ID: 62ce7129832ecbb45d7e2a12266202d296a782548419a5a72cfcf08c8fb9f74f
Opcode Fuzzy Hash: d220fe4a6df499f89076f25f428d08403f573503201339276a5e8fef182f7ace
Instruction Fuzzy Hash: 23E0B6A49141149ACB00AB7D99455B9B2B4A684748F808433FA92FA3D0E73CD88696AA

Function 00401607 Relevance: 12.1, APIs: 8, Instructions: 83
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00401626
puts.MSVCRT ref: 00401636
socket.WS2_32 ref: 0040165C
puts.MSVCRT ref: 00401671

Memory Dump Source

Source File: 00000000.00000002.1221552620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1221538281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221573936.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221589712.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221602304.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: puts$Startupsocket
String ID:
API String ID: 395126789-0
Opcode ID: 8fde3de2ecfb12ee71b38ca7383442b94bd7b78b0536bb60b03550daf7a61553
Instruction ID: 2f7336bebe8b5cee35e1adf164307ae04fbe61e37d2cdbb50ae41637a735a456
Opcode Fuzzy Hash: 8fde3de2ecfb12ee71b38ca7383442b94bd7b78b0536bb60b03550daf7a61553
Instruction Fuzzy Hash: DC31C7B4904204DFDB00FF78DA8565EBBF0AF44304F01897EE8A5E72A1D77899549F4A

Function 00401296 Relevance: 5.1, APIs: 4, Instructions: 79
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 004012EB
strlen.MSVCRT ref: 0040131B
malloc.MSVCRT ref: 00401326
memcpy.MSVCRT ref: 0040133C

Memory Dump Source

Source File: 00000000.00000002.1221552620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1221538281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221573936.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221589712.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221602304.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: malloc$memcpystrlen
String ID:
API String ID: 3553820921-0
Opcode ID: e3461f500282cd11525847983a2662328add1416995e3fdd5088ef0bf176da1d
Instruction ID: 5cb5bc42b62de7076cded7308b6661e4eaaff1c0b1d4db119d01c7bb8cfece06
Opcode Fuzzy Hash: e3461f500282cd11525847983a2662328add1416995e3fdd5088ef0bf176da1d
Instruction Fuzzy Hash: 043135B5A007018FDB20EF65DA8465EBBF1FB84304F14853ED948A7361E738A945CF89

Function 004013B3 Relevance: 5.1, APIs: 4, Instructions: 65
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 004012EB
strlen.MSVCRT ref: 0040131B
malloc.MSVCRT ref: 00401326
memcpy.MSVCRT ref: 0040133C

Memory Dump Source

Source File: 00000000.00000002.1221552620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1221538281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221573936.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221589712.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221602304.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: malloc$memcpystrlen
String ID:
API String ID: 3553820921-0
Opcode ID: 76b2ce9682316c75f2820bbc22d2d016bf35376532b5ba21952d83d7d0b6c2f4
Instruction ID: b91585b2c04cc7397c547903c23b4239cdfb62678f0a710de18b37565bea0cf4
Opcode Fuzzy Hash: 76b2ce9682316c75f2820bbc22d2d016bf35376532b5ba21952d83d7d0b6c2f4
Instruction Fuzzy Hash: 8721E6B5904601CFDB10EF69DA8465EB7F0FB88304B14853ED948A7361E738A945CF99

Function 004015A2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE ref: 004015B3

Strings

P@, xrefs: 004015DB

Memory Dump Source

Source File: 00000000.00000002.1221552620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1221538281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221573936.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221589712.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221602304.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: InfoSystem
String ID: P@
API String ID: 31276548-191595318
Opcode ID: 5bd4bc48da887309ae7c6fbdfebc28c00f1cb0719bc3fa656270968fd98a2424
Instruction ID: 9e4787628a0dd11eab54821a0926a2223023c376523dede5a2f9caf6befc5a07
Opcode Fuzzy Hash: 5bd4bc48da887309ae7c6fbdfebc28c00f1cb0719bc3fa656270968fd98a2424
Instruction Fuzzy Hash: 7EE0B6B09043049FC700EF68D94A54EBBF4AB84348F40C83AE585A7390E378D4488F96

Function 004015E2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 004015FA

Strings

@, xrefs: 004015E8

Memory Dump Source

Source File: 00000000.00000002.1221552620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1221538281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221573936.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221589712.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221602304.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID: @
API String ID: 1890195054-2766056989
Opcode ID: 01fac1430c1cacc2cebe984f3e2806f8a970f9a57fe9608ca1b01272e7789876
Instruction ID: 1ae3d0658aa4b8584122034f7cb288f6f80b367b9b8ec70c680e7f07caf30c62
Opcode Fuzzy Hash: 01fac1430c1cacc2cebe984f3e2806f8a970f9a57fe9608ca1b01272e7789876
Instruction Fuzzy Hash: 77D0C9B491024C8BCB00EFB8E98598DBBF8BF44208F400124E955B7354E770E85A8B86

Non-executed Functions

Function 004018E0 Relevance: 7.6, APIs: 5, Instructions: 55
timethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 0040191F
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,004014D2), ref: 00401930
GetCurrentThreadId.KERNEL32 ref: 00401938
GetTickCount.KERNEL32 ref: 00401940
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,004014D2), ref: 0040194F

Memory Dump Source

Source File: 00000000.00000002.1221552620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1221538281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221573936.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221589712.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221602304.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: fc8c2d76732fc83df1ce6a6e9f6d837a77a948d5041beb6b55617d944e2dd6df
Instruction ID: a7979860823111bd7cca56da38f816591c8e564a5f8883184c1fa6aefdea0bea
Opcode Fuzzy Hash: fc8c2d76732fc83df1ce6a6e9f6d837a77a948d5041beb6b55617d944e2dd6df
Instruction Fuzzy Hash: 631170B59053008FC300EF79E98854BBBE5FB88365F054C3AE445D7320EA35D959CB96

Function 004019A0 Relevance: 7.6, APIs: 5, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 004019EF
UnhandledExceptionFilter.KERNEL32 ref: 004019FF
GetCurrentProcess.KERNEL32 ref: 00401A08
TerminateProcess.KERNEL32 ref: 00401A19
abort.MSVCRT ref: 00401A22

Memory Dump Source

Source File: 00000000.00000002.1221552620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1221538281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221573936.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221589712.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221602304.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: 913968f87ed5b583e91c67d2cfcffecc74f52b9bd08fd81f0818ed3542fcb971
Instruction ID: 073cd2012325d89299ac364f295ddd6bb47226e633fa073d98b0c12ecca74ebf
Opcode Fuzzy Hash: 913968f87ed5b583e91c67d2cfcffecc74f52b9bd08fd81f0818ed3542fcb971
Instruction Fuzzy Hash: C31123B49052008FC700EF69EA4860EBBF0FB48305F41853DE989AB361E37899548F8A

Function 0040199C Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 004019EF
UnhandledExceptionFilter.KERNEL32 ref: 004019FF
GetCurrentProcess.KERNEL32 ref: 00401A08
TerminateProcess.KERNEL32 ref: 00401A19
abort.MSVCRT ref: 00401A22

Memory Dump Source

Source File: 00000000.00000002.1221552620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1221538281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221573936.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221589712.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221602304.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID:
API String ID: 520269711-0
Opcode ID: 9d5ab7050385d662649b0e4274c3265333d9074af5dcbd66b068a8a0b653aab2
Instruction ID: a5edbd6665176a393142217ce9ec35b91009a5cd70f4b96e1ae43536530bb9c7
Opcode Fuzzy Hash: 9d5ab7050385d662649b0e4274c3265333d9074af5dcbd66b068a8a0b653aab2
Instruction Fuzzy Hash: 771153B5801200DFD700EF79EA4864E7BF0FB08306F41843DE94AAB361E77899548F8A

Function 00401BC0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 124
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fwrite.MSVCRT ref: 00401BEF
vfprintf.MSVCRT ref: 00401C0F
abort.MSVCRT ref: 00401C14
VirtualQuery.KERNEL32 ref: 00401CA7
VirtualProtect.KERNEL32 ref: 00401CFD
GetLastError.KERNEL32 ref: 00401D0A

Strings

@, xrefs: 00401CEE

Memory Dump Source

Source File: 00000000.00000002.1221552620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1221538281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221573936.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221589712.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221602304.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQueryabortfwritevfprintf
String ID: @
API String ID: 1616349570-2766056989
Opcode ID: ecca34f98cdc65aeeca1a735f0b146d20763e9faef7609abf5221a31533d04b6
Instruction ID: 236e55e103048ce71270f33d734916b2187191ef9b8f6d8041716fff023a61a7
Opcode Fuzzy Hash: ecca34f98cdc65aeeca1a735f0b146d20763e9faef7609abf5221a31533d04b6
Instruction Fuzzy Hash: B8415EB15047019FD700EF69D98565BBBE0FF84354F45893EE888A73A1E738E844CB9A

Function 00402050 Relevance: 12.1, APIs: 8, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

signal.MSVCRT ref: 0040208F
signal.MSVCRT ref: 004020D6
signal.MSVCRT ref: 004020EF
signal.MSVCRT ref: 00402116
signal.MSVCRT ref: 0040215A

Memory Dump Source

Source File: 00000000.00000002.1221552620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1221538281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221573936.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221589712.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221602304.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: signal
String ID:
API String ID: 1946981877-0
Opcode ID: cb8ccc5166911e1f8d0c4b5830e9c0a4dd2fbfc72a791690fbc43fca53de752e
Instruction ID: c4006f23d49f6398cdef7e4489ced8a44a13a1b8f75b12636761a7417a4f511c
Opcode Fuzzy Hash: cb8ccc5166911e1f8d0c4b5830e9c0a4dd2fbfc72a791690fbc43fca53de752e
Instruction Fuzzy Hash: BF31EFB05043019AE7106F758A4C32B76D0BB45328F554B2FEAE8AA3D1CBFD8984975B

Function 00402200 Relevance: 5.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,004023CB,?,?,?,?,?,00401A68), ref: 0040220E
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,004023CB,?,?,?,?,?,00401A68), ref: 00402235
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,004023CB,?,?,?,?,?,00401A68), ref: 0040223C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,004023CB,?,?,?,?,?,00401A68), ref: 0040225C

Memory Dump Source

Source File: 00000000.00000002.1221552620.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1221538281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221573936.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221589712.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1221602304.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: e1e3b316b4aa3560c6e44db3fbfadc5d62f60003180bfd34d7f43d5b58e88eba
Instruction ID: ccc19a43c5a5876d2525a8681ce01f410aff69457d79c607b1565b06db7da662
Opcode Fuzzy Hash: e1e3b316b4aa3560c6e44db3fbfadc5d62f60003180bfd34d7f43d5b58e88eba
Instruction Fuzzy Hash: F9F0F4715006108BD7107FB8EE8861B7BB8FA44300B06407DDD857B355D738A855CBAA

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

TCP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exePID: 7692, Parent PID: 3964

General

File Activities

File Opened

File Created

File Written

File Attributes Queried

Volume Information Queried

Windows Analysis Report
SecuriteInfo.com.Win32.Trojan.Agent.QWCKHW.31433.26307.exe