Create Interactive Tour

Windows Analysis Report iso.iso

Overview

General Information

Sample Name:	iso.iso (renamed file extension from iso to img)
Analysis ID:	736
MD5:	00a47f21fea32a81de7a9e798fb32704
SHA1:	b68d87592f56444443a2a17cdeea2fc3c8575b6a
SHA256:	5d627575522c96ffb6af26bf7472f1f55a0a1e4ef4af7e75b062529f72304845
Infos:
Most interesting Screenshot:
Errors Corrupt sample or wrongly selected analyzer. Details: No application is associated with the specified file for this operation.

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Sigma detected: Copying Sensitive Files with Credential Data

Sample execution stops while process was sleeping (likely an evasion)

PE file contains more sections than normal

Drops PE files to the application program directory (C:\ProgramData)

PE file contains an invalid checksum

Drops PE files

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

PE file contains sections with non-standard names

Binary contains a suspicious time stamp

Detected potential crypto function

Classification

Process Tree

System is start

cmd.exe (PID: 7464 cmdline: 'C:\Windows\System32\cmd.exe' /c xcopy /H /y temp.dll c:\programdata && start /B /min C:\Windows\System32\rundll32.exe c:\programdata\temp.dll,ClearNode MD5: 9D59442313565C2E0860B88BF32B2277)

conhost.exe (PID: 7456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: C5E9B1D1103EDCEA2E408E9497A5A88F)

xcopy.exe (PID: 4780 cmdline: xcopy /H /y temp.dll c:\programdata MD5: F359375C36D2C540DFF1141B11BF2F7F)

rundll32.exe (PID: 3348 cmdline: C:\Windows\System32\rundll32.exe c:\programdata\temp.dll,ClearNode MD5: F68AF942FD7CCC0E7BAB1A2335D2AD26)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

System Summary:

Sigma detected: Copying Sensitive Files with Credential Data

Show sources

Source: Process started

Author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community: Data: Command: xcopy /H /y temp.dll c:\programdata , CommandLine: xcopy /H /y temp.dll c:\programdata , CommandLine|base64offset|contains: ), Image: C:\Windows\System32\xcopy.exe, NewProcessName: C:\Windows\System32\xcopy.exe, OriginalFileName: C:\Windows\System32\xcopy.exe, ParentCommandLine: 'C:\Windows\System32\cmd.exe' /c xcopy /H /y temp.dll c:\programdata && start /B /min C:\Windows\System32\rundll32.exe c:\programdata\temp.dll,ClearNode, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7464, ProcessCommandLine: xcopy /H /y temp.dll c:\programdata , ProcessId: 4780

Jbx Signature Overview

• AV Detection
• System Summary
• Data Obfuscation
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for dropped file

Show sources

Source: C:\ProgramData\temp.dll

Avira: detection malicious, Label: HEUR/AGEN.1144327

System Summary:

Source: temp.dll.8.dr

Static PE information: Number of sections : 11 > 10

Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000000C0000C22DC	9_2_000000C0000C22DC
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000000C0000CC5D0	9_2_000000C0000CC5D0
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000000C0000C05EC	9_2_000000C0000C05EC
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000000C0000BA1E8	9_2_000000C0000BA1E8
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000000C0000C4FE0	9_2_000000C0000C4FE0
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000000C0000C15FC	9_2_000000C0000C15FC
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000000C0000C540C	9_2_000000C0000C540C
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000000C0000CA204	9_2_000000C0000CA204
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000000C0000C4310	9_2_000000C0000C4310
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000000C0000BC82C	9_2_000000C0000BC82C
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000000C0000C6320	9_2_000000C0000C6320
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000000C0000BEA34	9_2_000000C0000BEA34
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000000C0000B7D4C	9_2_000000C0000B7D4C
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000000C0000B9840	9_2_000000C0000B9840
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000000C0000BA644	9_2_000000C0000BA644
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000000C0000BD450	9_2_000000C0000BD450
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000000C0000C9464	9_2_000000C0000C9464
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000000C0000C7084	9_2_000000C0000C7084
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000000C0000C4994	9_2_000000C0000C4994
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000000C0000BB4A8	9_2_000000C0000BB4A8
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000000C0000BC2BC	9_2_000000C0000BC2BC
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000000C0000C0EB4	9_2_000000C0000C0EB4
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000001673E9B8EBC	9_2_000001673E9B8EBC
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000001673E9C4C24	9_2_000001673E9C4C24
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000001673E9C2F20	9_2_000001673E9C2F20
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000001673E9C210B	9_2_000001673E9C210B
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000001673E9B6440	9_2_000001673E9B6440
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000001673E9B7244	9_2_000001673E9B7244
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000001673E9B942C	9_2_000001673E9B942C
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000001673E9C6064	9_2_000001673E9C6064
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000001673E9C2057	9_2_000001673E9C2057
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000001673E9BA050	9_2_000001673E9BA050
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000001673E9B494C	9_2_000001673E9B494C
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000001673E9BB67C	9_2_000001673E9BB67C
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000001673E9BDAB4	9_2_000001673E9BDAB4
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000001673E9B80A8	9_2_000001673E9B80A8
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000001673E9C1BE0	9_2_000001673E9C1BE0
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000001673E9BEEDC	9_2_000001673E9BEEDC
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000001673E9C15CF	9_2_000001673E9C15CF
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000001673E9C91D0	9_2_000001673E9C91D0
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000001673E9C6E04	9_2_000001673E9C6E04
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000001673E9BE1FC	9_2_000001673E9BE1FC
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000001673E9C40FD	9_2_000001673E9C40FD
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000001673E9B6DE8	9_2_000001673E9B6DE8
Source: C:\Windows\System32\rundll32.exe	Code function: 9_2_000001673E9BD1EC	9_2_000001673E9BD1EC

Source: C:\Windows\System32\xcopy.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: classification engine

Classification label: mal52.winIMG@6/1@0/0

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe c:\programdata\temp.dll,ClearNode

Source: unknown	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c xcopy /H /y temp.dll c:\programdata && start /B /min C:\Windows\System32\rundll32.exe c:\programdata\temp.dll,ClearNode
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /H /y temp.dll c:\programdata
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe c:\programdata\temp.dll,ClearNode
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /H /y temp.dll c:\programdata	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe c:\programdata\temp.dll,ClearNode	Jump to behavior

Source: iso.iso

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Source: C:\Windows\System32\conhost.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: iso.img

Static file information: File size 1757184 > 1048576

Source: temp.dll.8.dr

Static PE information: real checksum: 0x1a433b should be: 0x1a031c

Source: temp.dll.8.dr

Static PE information: section name: .xdata

Source: temp.dll.8.dr

Static PE information: 0xA7CAD086 [Mon Mar 17 00:32:06 2059 UTC]

Source: C:\Windows\System32\xcopy.exe

File created: C:\ProgramData\temp.dll

Jump to dropped file

Source: C:\Windows\System32\xcopy.exe

File created: C:\ProgramData\temp.dll

Jump to dropped file

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: rundll32.exe, 00000009.00000002.9766480277.0000016717D31000.00000004.00000020.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\rundll32.exe

Thread delayed: delay time: 72000

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Code function: 9_2_000001673E9B9AA0 GetProcessHeap,HeapAlloc,RtlAllocateHeap,

9_2_000001673E9B9AA0

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\xcopy.exe xcopy /H /y temp.dll c:\programdata			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe c:\programdata\temp.dll,ClearNode			Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection11	Rundll321	OS Credential Dumping	Security Software Discovery11	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Virtualization/Sandbox Evasion1	LSASS Memory	Virtualization/Sandbox Evasion1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection11	Security Account Manager	File and Directory Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Timestomp1	NTDS	System Information Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\temp.dll	100%	Avira	HEUR/AGEN.1144327

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	736
Start date:	28.10.2021
Start time:	09:07:26
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 4m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	iso.iso (renamed file extension from iso to img)
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	3
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal52.winIMG@6/1@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 62.6% (good quality ratio 55.9%) Quality average: 53.9% Quality standard deviation: 27%
HCA Information:	Successful, ratio: 80% Number of executed functions: 3 Number of non-executed functions: 45
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): cdfs.sys, vhdmp.sys, BackgroundTransferHost.exe, SIHClient.exe, backgroundTaskHost.exe, fsdepends.sys, svchost.exe Excluded IPs from analysis (whitelisted): 2.21.142.245, 20.190.159.132, 20.190.159.136, 40.126.31.8, 20.190.159.134, 40.126.31.135, 40.126.31.139, 40.126.31.143, 40.126.31.1, 40.126.31.4, 40.126.31.141, 20.190.160.2, 20.190.160.75, 20.190.160.8, 20.190.160.4, 20.190.160.73, 20.190.160.6, 20.190.160.67, 20.190.160.132, 20.190.159.138, 40.126.31.137, 52.152.110.14, 40.126.31.2, 20.190.159.137, 40.126.31.142, 40.126.31.7, 40.126.31.9, 40.126.31.3, 40.126.31.5, 20.190.159.135, 20.54.110.249, 20.82.210.154, 40.112.88.60, 8.253.95.120, 8.248.133.254, 8.248.115.254, 8.248.119.254, 8.248.145.254, 20.199.120.85, 20.199.120.182, 92.123.194.82, 92.123.194.20, 20.199.120.151, 52.109.88.34, 20.50.102.62 Excluded domains from analysis (whitelisted): fg.download.windowsupdate.com.c.footprint.net, slscr.update.microsoft.com, www.tm.lg.prod.aadmsa.akadns.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, www.tm.a.prd.aadg.trafficmanager.net, e12564.dspb.akamaiedge.net, wns.notify.trafficmanager.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, login.live.com, sls.update.microsoft.com, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, glb.sls.prod.dcat.dsp.trafficmanager.net, client.wns.windows.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, wu-shim.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, www.tm.a.prd.aadg.akadns.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, login.msa.msidentity.com, prod.nexusrules.live.com.akadns.net, ris.api.iris.microsoft.com, store-images.s-microsoft.com, nexusrules.officeapps.live.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net, www.tm.lg.prod.aadmsa.trafficmanager.net Not all processes where analyzed, report is missing behavior information
Errors:	Corrupt sample or wrongly selected analyzer. Details: No application is associated with the specified file for this operation.

Simulations

Behavior and APIs

Time	Type	Description
09:08:33	API Interceptor	2x Sleep call for process: rundll32.exe modified

Created / dropped Files

C:\ProgramData\temp.dll Download File
Process:	C:\Windows\System32\xcopy.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1702400
Entropy (8bit):	6.178198204344416
Encrypted:	false
SSDEEP:	24576:yarBYucHPcCsi/GkU1C2LRB+HbkZ7TCYzaIXM:tYuegAGkU1CIu7wTC
MD5:	411074A668721B9FE2EF22197E9F7E48
SHA1:	E38E6555BF3D01EB3FA2CEE3F3A75128728F2DC2
SHA-256:	95347BEA5432C09CC216F5DB771B956EB78A43139789036AF9446139967B1C7F
SHA-512:	651EF9F23E050A7049E0BC0D9F1E2D8985982CDBB9D1E4379072595811538709AA81BF5235E205B8D8B33F7C50A720142C021ACEA180C387BB0C329F15299304
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................."..)..^..........P.........E.....................................;C....`... ......................................0.......@...............p...............p..`v...........................c..(....................B..p............................text....\.......^..................`.``.data........p.......b..............@.`..rdata...............h..............@.`@.pdata.......p.......X..............@.0@.xdata...............b..............@.0@.bss..................................`..edata.......0.......j..............@.0@.idata.......@.......r..............@.0..CRT....X....P.......~..............@.@..tls.........`......................@.@..reloc..`v...p...x..................@.0B........................................................................................................................................................................

Static File Info

General
File type:	ISO 9660 CD-ROM filesystem data ''
Entropy (8bit):	6.056353001538691
TrID:	ImgBurn Image (2052548/1) 49.86% null bytes (2050048/1) 49.80% Photoshop Action (5010/6) 0.12% Lotus 123 Worksheet (generic) (2007/4) 0.05% HSC music composer song (1267/141) 0.03%
File name:	iso.img
File size:	1757184
MD5:	00a47f21fea32a81de7a9e798fb32704
SHA1:	b68d87592f56444443a2a17cdeea2fc3c8575b6a
SHA256:	5d627575522c96ffb6af26bf7472f1f55a0a1e4ef4af7e75b062529f72304845
SHA512:	472bbe491d65e32252069c8ba3976dc3b4d1d2b3bacce8bcd2ed6e7fef1855246cc6ca9bfce08c8f580356947b668ccb4f898316d8f095fd2434bb090d27d2c3
SSDEEP:	24576:JarBYucHPcCsi/GkU1C2LRB+HbkZ7TCYzaIXM:0YuegAGkU1CIu7wTC
File Content Preview:	...............................................................................................................................................................................................................................................................

File Icon


Icon Hash:	74f0ccccd4c4ecf4

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

• cmd.exe
• conhost.exe
• xcopy.exe
• rundll32.exe

Click to jump to process

Memory Usage

• cmd.exe
• conhost.exe
• xcopy.exe
• rundll32.exe

Click to jump to process

Behavior

• cmd.exe
• conhost.exe
• xcopy.exe
• rundll32.exe

Click to jump to process

System Behavior

Analysis Process: cmd.exe PID: 7464 Parent PID: 3676

Function Logs

General

Start time:	09:08:31
Start date:	28/10/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\cmd.exe' /c xcopy /H /y temp.dll c:\programdata && start /B /min C:\Windows\System32\rundll32.exe c:\programdata\temp.dll,ClearNode
Imagebase:	0x7ff633bc0000
File size:	280064 bytes
MD5 hash:	9D59442313565C2E0860B88BF32B2277
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

File Activities

File Opened

File Attributes Queried

Show Windows behavior

Section Activities

Sections loaded by Windows

Show Windows behavior

Registry Activities

Show Windows behavior

Process Activities

Process Created

Process Information Set

Show Windows behavior

Thread Activities

Show Windows behavior

Memory Activities

Memory Usage Statistics

Show Windows behavior

System Activities

Show Windows behavior

LPC Port Activities

Chronological Activities

Analysis Process: conhost.exe PID: 7456 Parent PID: 7464

Function Logs

General

Start time:	09:08:31
Start date:	28/10/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff703e40000
File size:	885760 bytes
MD5 hash:	C5E9B1D1103EDCEA2E408E9497A5A88F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

File Activities

Volume Information Queried

Show Windows behavior

Section Activities

Sections loaded by Windows

Sections loaded by Program

Show Windows behavior

Registry Activities

Show Windows behavior

Mutex Activities

Mutex Created

Show Windows behavior

Process Activities

Show Windows behavior

Memory Activities

LPC Port Activities

Chronological Activities

Analysis Process: xcopy.exe PID: 4780 Parent PID: 7464

Function Logs

General

Start time:	09:08:32
Start date:	28/10/2021
Path:	C:\Windows\System32\xcopy.exe
Wow64 process (32bit):	true
Commandline:	xcopy /H /y temp.dll c:\programdata
Imagebase:	0x9e0000
File size:	47616 bytes
MD5 hash:	F359375C36D2C540DFF1141B11BF2F7F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

File Activities

Show Windows behavior

Section Activities

Sections loaded by Windows

Show Windows behavior

Registry Activities

Show Windows behavior

Process Activities

Process Information Set

Show Windows behavior

Memory Activities

Show Windows behavior

System Activities

Show Windows behavior

LPC Port Activities

Chronological Activities

Analysis Process: rundll32.exe PID: 3348 Parent PID: 7464

Function Logs

General

Start time:	09:08:33
Start date:	28/10/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\rundll32.exe c:\programdata\temp.dll,ClearNode
Imagebase:	0x7ff61cb30000
File size:	71168 bytes
MD5 hash:	F68AF942FD7CCC0E7BAB1A2335D2AD26
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

File Activities

File Written

File Attributes Queried

Show Windows behavior

Section Activities

Sections loaded by Windows

Sections loaded by Program

Show Windows behavior

Registry Activities

Show Windows behavior

Mutex Activities

Show Windows behavior

Process Activities

Process Queried

Process Information Set

Show Windows behavior

Memory Activities

Memory Allocated

Memory Usage Statistics

Show Windows behavior

System Activities

System Information Queried

Show Windows behavior

Timing Activities

Show Windows behavior

Windows UI Activities

Window Created

Window UI Enumerated

Show Windows behavior

LPC Port Activities

Chronological Activities

Disassembly

Code Analysis

Analysis Process: rundll32.exe PID: 3348 Parent PID: 7464 rundll32.exeCOMMON

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	31.8%
Total number of Nodes:	132
Total number of Limit Nodes:	5

Executed Functions

Function 000001673E9B8EBC, Relevance: 4.0, APIs: 3, Instructions: 245
sleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 000001673E9B8F8E
VirtualAlloc.KERNEL32 ref: 000001673E9B912F
VirtualFree.KERNEL32 ref: 000001673E9B9187

Memory Dump Source

Source File: 00000009.00000002.9770624450.000001673E9B0000.00000040.00000001.sdmp, Offset: 000001673E9B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1673e9b0000_rundll32.jbxd

Similarity

API ID: Virtual$AllocFreeSleep
String ID:
API String ID: 3875540815-0
Opcode ID: 91a20d18f6369290bfbf3b7e20f87574a947ecbf2a0b2a8b51b5a924e45c2469
Instruction ID: 1671b6db6a5b328e4b8267fc140ec6f60a1e914301c0494f3b65ae916a82d71b
Opcode Fuzzy Hash: 91a20d18f6369290bfbf3b7e20f87574a947ecbf2a0b2a8b51b5a924e45c2469
Instruction Fuzzy Hash: E3A1E9B2629A0587EB68DF18CD443EC73A5F744B88F148826DA9A837D1DB36DC60E741

Uniqueness

Uniqueness Score: -1.00%

Function 000001673E9B9AA0, Relevance: 2.5, APIs: 2, Instructions: 26
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000001673E9B9AB0
HeapAlloc.KERNEL32 ref: 000001673E9B9ABE

Memory Dump Source

Source File: 00000009.00000002.9770624450.000001673E9B0000.00000040.00000001.sdmp, Offset: 000001673E9B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1673e9b0000_rundll32.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 9145f3d558a7ceb0ca93f2402a6124cb5227b151d3c91854a273210ea69cf88d
Instruction ID: 9f2e3e96b7990ad9c6b86edf4b8d23b7ae26cb1d310498ed0c53204f36b0987d
Opcode Fuzzy Hash: 9145f3d558a7ceb0ca93f2402a6124cb5227b151d3c91854a273210ea69cf88d
Instruction Fuzzy Hash: 88E0D87073F74755FE599FA61C503A500C8BF1D78CF284D2A4987423C1EB5A0C456312

Uniqueness

Uniqueness Score: -1.00%

Function 000001673E9BBDEC, Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 000001673E9BBE3B

Memory Dump Source

Source File: 00000009.00000002.9770624450.000001673E9B0000.00000040.00000001.sdmp, Offset: 000001673E9B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1673e9b0000_rundll32.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 8123317d3123158b8624dd414f442dd0825b429c1488d5d94955d649091043a1
Instruction ID: 709c6bcd79a3bc2440e9d9864ceba1b00ac26dfc0ec09dcfdd39ca5451fc25ce
Opcode Fuzzy Hash: 8123317d3123158b8624dd414f442dd0825b429c1488d5d94955d649091043a1
Instruction Fuzzy Hash: BD216B32B24B1189FB10EFB1DC512DC37B4BB88748F980826DA8967BCADF36C5519351

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 000000C0000CA204, Relevance: 91.9, Strings: 73, Instructions: 696
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

jHXv, xrefs: 000000C0000CA9DC
i)JG, xrefs: 000000C0000CAA2C
VQsG, xrefs: 000000C0000CB446
U&xk, xrefs: 000000C0000CAAA4
rNzr, xrefs: 000000C0000CB31A
3, xrefs: 000000C0000CB4AC
&M, xrefs: 000000C0000CAC4E
~CB', xrefs: 000000C0000CAB08
;lU, xrefs: 000000C0000CA2F5
=c1, xrefs: 000000C0000CAC80
aYvI, xrefs: 000000C0000CB428
E pG, xrefs: 000000C0000CAA54
{D|, xrefs: 000000C0000CB356
oHfN, xrefs: 000000C0000CA9E6
( ?, xrefs: 000000C0000CB034
z@H`, xrefs: 000000C0000CB40A
BYmV, xrefs: 000000C0000CB3E2
rdg, xrefs: 000000C0000CB27E
~5PS, xrefs: 000000C0000CAA68
5%5], xrefs: 000000C0000CAA4A
+%u7, xrefs: 000000C0000CB0D4
4s-, xrefs: 000000C0000CB03E
5F91, xrefs: 000000C0000CAA22
JsN, xrefs: 000000C0000CB26A
B$Kq, xrefs: 000000C0000CAAEA
r\c, xrefs: 000000C0000CB3B0
i(pJ, xrefs: 000000C0000CA297
=g[, xrefs: 000000C0000CABFE
)8A2, xrefs: 000000C0000CB0E8
ZXv, xrefs: 000000C0000CA904
i(pg, xrefs: 000000C0000CA29F
3ZI, xrefs: 000000C0000CAC30
YMsg, xrefs: 000000C0000CB3A6
?8, xrefs: 000000C0000CAC1C
\, xrefs: 000000C0000CAEC6
?" -, xrefs: 000000C0000CB0A2
j%1T, xrefs: 000000C0000CAACC
g[p, xrefs: 000000C0000CB36A
fvQG, xrefs: 000000C0000CB3F6
c(,7, xrefs: 000000C0000CB0B6
[sH, xrefs: 000000C0000CB1AC
5ZFt, xrefs: 000000C0000CAA18
[C~, xrefs: 000000C0000CB292
ZD7, xrefs: 000000C0000CB1FC
j!KS, xrefs: 000000C0000CAA86
znU, xrefs: 000000C0000CB18E
IC!, xrefs: 000000C0000CABA4
K+4., xrefs: 000000C0000CAA40
EEli, xrefs: 000000C0000CAA72
5 9p, xrefs: 000000C0000CAAD6
l=tj, xrefs: 000000C0000CAA90
VCQ], xrefs: 000000C0000CB3C4
{3L8, xrefs: 000000C0000CB02A
U?B, xrefs: 000000C0000CA41A
:85, xrefs: 000000C0000CAC62
XWO, xrefs: 000000C0000CB2BA
f$tW, xrefs: 000000C0000CAA0E
<#w', xrefs: 000000C0000CA9D2
/M, xrefs: 000000C0000CA39D
RseD, xrefs: 000000C0000CB400
Wg|, xrefs: 000000C0000CB22E
c/*;, xrefs: 000000C0000CB0DE
48Vw, xrefs: 000000C0000CAAAE
nIT, xrefs: 000000C0000CA373
_InF, xrefs: 000000C0000CB34C
g#6), xrefs: 000000C0000CA9F0
jsPD, xrefs: 000000C0000CB432
3!=3, xrefs: 000000C0000CB315
t@o/, xrefs: 000000C0000CAA9A
ip[A, xrefs: 000000C0000CB43C
w5, xrefs: 000000C0000CA436
`Y, xrefs: 000000C0000CA4BF
DTsK, xrefs: 000000C0000CB374

Memory Dump Source

Source File: 00000009.00000002.9765385894.000000C0000B4000.00000004.00000001.sdmp, Offset: 000000C0000B4000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_c0000b4000_rundll32.jbxd

Similarity

API ID:
String ID: r\c${D|$/M$ 4s-$&M$( ?$)8A2$+%u7$3!=3$3ZI$3$48Vw$5 9p$5%5]$5F91$5ZFt$:85$;lU$<#w'$=c1$=g[$?" -$?8$B$Kq$BYmV$DTsK$E pG$EEli$IC!$K+4.$RseD$U&xk$U?B$VCQ]$VQsG$YMsg$ZXv$_InF$`Y$aYvI$c(,7$c/*;$f$tW$fvQG$g#6)$g[p$i(pJ$i(pg$i)JG$ip[A$j!KS$j%1T$jHXv$jsPD$l=tj$nIT$oHfN$rNzr$t@o/$w5$z@H`${3L8$~5PS$~CB'$JsN$Wg|$XWO$ZD7$[C~$[sH$rdg$znU$\
API String ID: 0-38973088
Opcode ID: b39804cc145b3c2fa27090e442bc94d912d4229f91518052c9281603afd96ab4
Instruction ID: 6b2e58539d8fdf45db8a889c994033e76d2f90599a8254052e38c1c0a1a2e833
Opcode Fuzzy Hash: b39804cc145b3c2fa27090e442bc94d912d4229f91518052c9281603afd96ab4
Instruction Fuzzy Hash: E9A2F8B26056C08FE774CF66AA947DD7BA0F349B4CFA08208D7595FA19DB348242CF49

Uniqueness

Uniqueness Score: -1.00%

Function 000001673E9C6E04, Relevance: 91.9, Strings: 73, Instructions: 696
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ZXv, xrefs: 000001673E9C7504
RseD, xrefs: 000001673E9C8000
\, xrefs: 000001673E9C7AC6
;lU, xrefs: 000001673E9C6EF5
5%5], xrefs: 000001673E9C764A
)8A2, xrefs: 000001673E9C7CE8
[sH, xrefs: 000001673E9C7DAC
=c1, xrefs: 000001673E9C7880
VQsG, xrefs: 000001673E9C8046
B$Kq, xrefs: 000001673E9C76EA
znU, xrefs: 000001673E9C7D8E
`Y, xrefs: 000001673E9C70BF
3ZI, xrefs: 000001673E9C7830
XWO, xrefs: 000001673E9C7EBA
rNzr, xrefs: 000001673E9C7F1A
Wg|, xrefs: 000001673E9C7E2E
:85, xrefs: 000001673E9C7862
=g[, xrefs: 000001673E9C77FE
5F91, xrefs: 000001673E9C7622
&M, xrefs: 000001673E9C784E
EEli, xrefs: 000001673E9C7672
VCQ], xrefs: 000001673E9C7FC4
j%1T, xrefs: 000001673E9C76CC
/M, xrefs: 000001673E9C6F9D
r\c, xrefs: 000001673E9C7FB0
g[p, xrefs: 000001673E9C7F6A
ip[A, xrefs: 000001673E9C803C
K+4., xrefs: 000001673E9C7640
fvQG, xrefs: 000001673E9C7FF6
c(,7, xrefs: 000001673E9C7CB6
w5, xrefs: 000001673E9C7036
3, xrefs: 000001673E9C80AC
<#w', xrefs: 000001673E9C75D2
5 9p, xrefs: 000001673E9C76D6
i)JG, xrefs: 000001673E9C762C
nIT, xrefs: 000001673E9C6F73
3!=3, xrefs: 000001673E9C7F15
jsPD, xrefs: 000001673E9C8032
{3L8, xrefs: 000001673E9C7C2A
z@H`, xrefs: 000001673E9C800A
[C~, xrefs: 000001673E9C7E92
~CB', xrefs: 000001673E9C7708
4s-, xrefs: 000001673E9C7C3E
48Vw, xrefs: 000001673E9C76AE
( ?, xrefs: 000001673E9C7C34
YMsg, xrefs: 000001673E9C7FA6
g#6), xrefs: 000001673E9C75F0
?8, xrefs: 000001673E9C781C
IC!, xrefs: 000001673E9C77A4
JsN, xrefs: 000001673E9C7E6A
l=tj, xrefs: 000001673E9C7690
rdg, xrefs: 000001673E9C7E7E
jHXv, xrefs: 000001673E9C75DC
5ZFt, xrefs: 000001673E9C7618
aYvI, xrefs: 000001673E9C8028
i(pg, xrefs: 000001673E9C6E9F
U&xk, xrefs: 000001673E9C76A4
oHfN, xrefs: 000001673E9C75E6
?" -, xrefs: 000001673E9C7CA2
BYmV, xrefs: 000001673E9C7FE2
{D|, xrefs: 000001673E9C7F56
i(pJ, xrefs: 000001673E9C6E97
U?B, xrefs: 000001673E9C701A
j!KS, xrefs: 000001673E9C7686
ZD7, xrefs: 000001673E9C7DFC
t@o/, xrefs: 000001673E9C769A
DTsK, xrefs: 000001673E9C7F74
E pG, xrefs: 000001673E9C7654
f$tW, xrefs: 000001673E9C760E
~5PS, xrefs: 000001673E9C7668
c/*;, xrefs: 000001673E9C7CDE
_InF, xrefs: 000001673E9C7F4C
+%u7, xrefs: 000001673E9C7CD4

Memory Dump Source

Source File: 00000009.00000002.9770624450.000001673E9B0000.00000040.00000001.sdmp, Offset: 000001673E9B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1673e9b0000_rundll32.jbxd

Similarity

API ID:
String ID: r\c${D|$/M$ 4s-$&M$( ?$)8A2$+%u7$3!=3$3ZI$3$48Vw$5 9p$5%5]$5F91$5ZFt$:85$;lU$<#w'$=c1$=g[$?" -$?8$B$Kq$BYmV$DTsK$E pG$EEli$IC!$K+4.$RseD$U&xk$U?B$VCQ]$VQsG$YMsg$ZXv$_InF$`Y$aYvI$c(,7$c/*;$f$tW$fvQG$g#6)$g[p$i(pJ$i(pg$i)JG$ip[A$j!KS$j%1T$jHXv$jsPD$l=tj$nIT$oHfN$rNzr$t@o/$w5$z@H`${3L8$~5PS$~CB'$JsN$Wg|$XWO$ZD7$[C~$[sH$rdg$znU$\
API String ID: 0-38973088
Opcode ID: 78a9b579b5f7a436b638f65c866e7110ccc151b8437862654c73cf7ec66033e7
Instruction ID: 59e3c808c65feaf41911c74a1bd34725a60808998e8473242c28535ffaee96df
Opcode Fuzzy Hash: 78a9b579b5f7a436b638f65c866e7110ccc151b8437862654c73cf7ec66033e7
Instruction Fuzzy Hash: 3DA2E7B26096C08FD774CF26AA903ED7BA0F345B4CF908609D7991FA19DB358242CF49

Uniqueness

Uniqueness Score: -1.00%

Function 000000C0000BD450, Relevance: 19.4, Strings: 15, Instructions: 689
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1VK, xrefs: 000000C0000BDFE0
I{+|, xrefs: 000000C0000BE120
sng, xrefs: 000000C0000BDFC2
VN(, xrefs: 000000C0000BD53D
,*67, xrefs: 000000C0000BE07B
? q\, xrefs: 000000C0000BE053
{&>Q, xrefs: 000000C0000BE071
;$OM, xrefs: 000000C0000BE0E9
LzC, xrefs: 000000C0000BD515
11N, xrefs: 000000C0000BDFEA
9;Y, xrefs: 000000C0000BDFD6
/!u, xrefs: 000000C0000BE067
se, xrefs: 000000C0000BDE7F
(%#7, xrefs: 000000C0000BE05D
Jy>, xrefs: 000000C0000BE12A

Memory Dump Source

Source File: 00000009.00000002.9765385894.000000C0000B4000.00000004.00000001.sdmp, Offset: 000000C0000B4000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_c0000b4000_rundll32.jbxd

Similarity

API ID:
String ID: Jy>$(%#7$,*67$/!u$;$OM$? q\$I{+|$se${&>Q$11N$1VK$9;Y$LzC$VN($sng
API String ID: 0-2078040707
Opcode ID: 401f4ae59521fcb328f9ea5b2f16be958f9c658b16d95f13b3317b3a042898fb
Instruction ID: 9fcffb9d39b82d1fe3004e041ace321c78c8b73a80bae783f540a6e9a47e5b4c
Opcode Fuzzy Hash: 401f4ae59521fcb328f9ea5b2f16be958f9c658b16d95f13b3317b3a042898fb
Instruction Fuzzy Hash: 217266B26042C0CEEB25CF25D9507ED7BA1E78578CFA54615EB862BB1DEB78C601CB10

Uniqueness

Uniqueness Score: -1.00%

Function 000001673E9BA050, Relevance: 19.4, Strings: 15, Instructions: 689
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1VK, xrefs: 000001673E9BABE0
sng, xrefs: 000001673E9BABC2
se, xrefs: 000001673E9BAA7F
LzC, xrefs: 000001673E9BA115
/!u, xrefs: 000001673E9BAC67
? q\, xrefs: 000001673E9BAC53
11N, xrefs: 000001673E9BABEA
I{+|, xrefs: 000001673E9BAD20
,*67, xrefs: 000001673E9BAC7B
{&>Q, xrefs: 000001673E9BAC71
VN(, xrefs: 000001673E9BA13D
9;Y, xrefs: 000001673E9BABD6
;$OM, xrefs: 000001673E9BACE9
(%#7, xrefs: 000001673E9BAC5D
Jy>, xrefs: 000001673E9BAD2A

Memory Dump Source

Source File: 00000009.00000002.9770624450.000001673E9B0000.00000040.00000001.sdmp, Offset: 000001673E9B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1673e9b0000_rundll32.jbxd

Similarity

API ID:
String ID: Jy>$(%#7$,*67$/!u$;$OM$? q\$I{+|$se${&>Q$11N$1VK$9;Y$LzC$VN($sng
API String ID: 0-2078040707
Opcode ID: f59db2886387d65f367faaa339c31c00bacb244b09e194ed08360d579bd9f91d
Instruction ID: dcbb502d7b9aa18ff4530862a9c91cbe5f2c78a7f66fd0cd418be92d160be604
Opcode Fuzzy Hash: f59db2886387d65f367faaa339c31c00bacb244b09e194ed08360d579bd9f91d
Instruction Fuzzy Hash: B47279B22082C18EEB28CF36D9502DD7BA1F74578CF44491ADB861BB5DEBB9C601DB10

Uniqueness

Uniqueness Score: -1.00%

Function 000000C0000C7084, Relevance: 11.8, Strings: 8, Instructions: 1764COMMON

Download Yara Rule

Strings

bnbI, xrefs: 000000C0000C743B
YtSG, xrefs: 000000C0000C8306
v|*, xrefs: 000000C0000C8386
1ee, xrefs: 000000C0000C8C42
0123456789ABCDEFR, xrefs: 000000C0000C8959
@, xrefs: 000000C0000C7D26
u(@, xrefs: 000000C0000C71EB
@B, xrefs: 000000C0000C71FF

Memory Dump Source

Source File: 00000009.00000002.9765385894.000000C0000B4000.00000004.00000001.sdmp, Offset: 000000C0000B4000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_c0000b4000_rundll32.jbxd

Similarity

API ID:
String ID: 0123456789ABCDEFR$1ee$@$@B$YtSG$bnbI$u(@$v|*
API String ID: 0-1400767620
Opcode ID: 314952ac009838435bb6b7e5f9baacf2f9cad5df5641b5113d9610ccecdd3220
Instruction ID: 9c06018c6f6b201e0c4bd27dcaa868fe5484d5c8a0ac62df6d8d0612e25e4e45
Opcode Fuzzy Hash: 314952ac009838435bb6b7e5f9baacf2f9cad5df5641b5113d9610ccecdd3220
Instruction Fuzzy Hash: 5F03BA722057C0CAFB75DF25D840BED7BA1FB45B8CF668219DA491BB99DB388605CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000C0000C9464, Relevance: 9.5, Strings: 7, Instructions: 756COMMON

Download Yara Rule

Strings

`IQt, xrefs: 000000C0000C9B94
I)-, xrefs: 000000C0000C9E61
R-=_, xrefs: 000000C0000C99FB
D-J, xrefs: 000000C0000CA01A
z=oD, xrefs: 000000C0000C9E55
`Xde, xrefs: 000000C0000C9BA2
dmd~, xrefs: 000000C0000C9B9B

Memory Dump Source

Source File: 00000009.00000002.9765385894.000000C0000B4000.00000004.00000001.sdmp, Offset: 000000C0000B4000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_c0000b4000_rundll32.jbxd

Similarity

API ID:
String ID: I)-$D-J$R-=_$`IQt$`Xde$dmd~$z=oD
API String ID: 0-1938568667
Opcode ID: 9a24a01d1b5c68672d51f10109505c85d14fa6a4b5cb96a06c22ae75e63bfcbd
Instruction ID: 474e4fad8010cc49de8682ebba9ce1609d93d128d7e4c869a9cfa25b9a1b66e7
Opcode Fuzzy Hash: 9a24a01d1b5c68672d51f10109505c85d14fa6a4b5cb96a06c22ae75e63bfcbd
Instruction Fuzzy Hash: D6827D72701A80CAFB25CF65E940F983BE0E74978CF6A4718DA495BB99EB78C541CB01

Uniqueness

Uniqueness Score: -1.00%

Function 000001673E9C6064, Relevance: 9.5, Strings: 7, Instructions: 756COMMON

Download Yara Rule

Strings

z=oD, xrefs: 000001673E9C6A55
`IQt, xrefs: 000001673E9C6794
D-J, xrefs: 000001673E9C6C1A
`Xde, xrefs: 000001673E9C67A2
I)-, xrefs: 000001673E9C6A61
R-=_, xrefs: 000001673E9C65FB
dmd~, xrefs: 000001673E9C679B

Memory Dump Source

Source File: 00000009.00000002.9770624450.000001673E9B0000.00000040.00000001.sdmp, Offset: 000001673E9B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1673e9b0000_rundll32.jbxd

Similarity

API ID:
String ID: I)-$D-J$R-=_$`IQt$`Xde$dmd~$z=oD
API String ID: 0-1938568667
Opcode ID: 775ad047f6099a42e8bed6977e714076cd7abaddeb37ed9494d455c2ff3faa6c
Instruction ID: 09291e90ea7ab9a3eafca5476440fa1772c125e6d877e5b400a4cfb12ddc1d13
Opcode Fuzzy Hash: 775ad047f6099a42e8bed6977e714076cd7abaddeb37ed9494d455c2ff3faa6c
Instruction Fuzzy Hash: 7282A4716597848AEB20DF25AD403D83BA4F745B8CF144C1AD6C91BBDAEB3AC581DF02

Uniqueness

Uniqueness Score: -1.00%

Function 000001673E9C4C24, Relevance: 5.8, Strings: 4, Instructions: 795
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0123456789ABCDEFR, xrefs: 000001673E9C5559
1ee, xrefs: 000001673E9C5842
v|*, xrefs: 000001673E9C4F86
YtSG, xrefs: 000001673E9C4F06

Memory Dump Source

Source File: 00000009.00000002.9770624450.000001673E9B0000.00000040.00000001.sdmp, Offset: 000001673E9B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1673e9b0000_rundll32.jbxd

Similarity

API ID:
String ID: 0123456789ABCDEFR$1ee$YtSG$v|*
API String ID: 0-3001268231
Opcode ID: f8a229a7c4cfcc76a0c7407a830669d1ac3a7edb0575b8d269bd729ec905c25d
Instruction ID: f543538940221c39c36d4bc0a77dc34680c9229d3146e36e8821ce0c7cc57981
Opcode Fuzzy Hash: f8a229a7c4cfcc76a0c7407a830669d1ac3a7edb0575b8d269bd729ec905c25d
Instruction Fuzzy Hash: 6672E2767047C08AEB21AF29DC403ED7BA1FB45B8CF48451ACA891BBD9DB39C645DB01

Uniqueness

Uniqueness Score: -1.00%

Function 000000C0000C540C, Relevance: 5.8, Strings: 4, Instructions: 781COMMON

Download Yara Rule

Strings

|gFA, xrefs: 000000C0000C554A
2xFU, xrefs: 000000C0000C5535
uxJ\, xrefs: 000000C0000C553C
2j]W, xrefs: 000000C0000C5543

Memory Dump Source

Source File: 00000009.00000002.9765385894.000000C0000B4000.00000004.00000001.sdmp, Offset: 000000C0000B4000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_c0000b4000_rundll32.jbxd

Similarity

API ID:
String ID: 2j]W$2xFU$uxJ\$|gFA
API String ID: 0-2595514560
Opcode ID: f2cac8906f89d109d6377761237cbb4398d87897c9c6d81693a3b052af1e6ca3
Instruction ID: 54c7406b34a6bfa3b36281cd8747b5d83a457957d0e7764567ea20c8690cfa4c
Opcode Fuzzy Hash: f2cac8906f89d109d6377761237cbb4398d87897c9c6d81693a3b052af1e6ca3
Instruction Fuzzy Hash: 84824732200BC0CAFB64CF64D890BDD77A4F744788F654229DA896BB9ACF34D5A6D710

Uniqueness

Uniqueness Score: -1.00%

Function 000001673E9B6440, Relevance: 5.6, Strings: 4, Instructions: 639
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

V{', xrefs: 000001673E9B6B77
RjM, xrefs: 000001673E9B695E
50, xrefs: 000001673E9B6ABE
>1"R, xrefs: 000001673E9B691B

Memory Dump Source

Source File: 00000009.00000002.9770624450.000001673E9B0000.00000040.00000001.sdmp, Offset: 000001673E9B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1673e9b0000_rundll32.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: 50$>1"R$V{'$RjM
API String ID: 3859560861-168007915
Opcode ID: a3e92adb96b447af456c8efde9ab049051fdfd552e5dd40782002e614e772544
Instruction ID: 9c6389855e8d48429e5614f9ef9f3f121e50e69c365a1c3f57b5759209841c3c
Opcode Fuzzy Hash: a3e92adb96b447af456c8efde9ab049051fdfd552e5dd40782002e614e772544
Instruction Fuzzy Hash: 3552FF326097858AEF14CF65E8503EE3BB0F78574CF048819DA8A6BB9EDB39D505DB01

Uniqueness

Uniqueness Score: -1.00%

Function 000000C0000B9840, Relevance: 5.6, Strings: 4, Instructions: 624
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

RjM, xrefs: 000000C0000B9D5E
>1"R, xrefs: 000000C0000B9D1B
50, xrefs: 000000C0000B9EBE
V{', xrefs: 000000C0000B9F77

Memory Dump Source

Source File: 00000009.00000002.9765385894.000000C0000B4000.00000004.00000001.sdmp, Offset: 000000C0000B4000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_c0000b4000_rundll32.jbxd

Similarity

API ID:
String ID: 50$>1"R$V{'$RjM
API String ID: 0-168007915
Opcode ID: 5b1d124956e47e3a08fb9cedf0fafcd9824b72326c35a7e4038469c0e41be914
Instruction ID: 5e3587661e721b812051b228a654ed7b32b37c42d59bda3c547da12cba30e09b
Opcode Fuzzy Hash: 5b1d124956e47e3a08fb9cedf0fafcd9824b72326c35a7e4038469c0e41be914
Instruction Fuzzy Hash: 8C529B72705780CAEB24CF39E550BAE3BB0F78574CF2586189B896BB59DB38C905CB10

Uniqueness

Uniqueness Score: -1.00%

Function 000001673E9C210B, Relevance: 5.6, Strings: 4, Instructions: 583
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

uxJ\, xrefs: 000001673E9C213C
|gFA, xrefs: 000001673E9C214A
2xFU, xrefs: 000001673E9C2135
2j]W, xrefs: 000001673E9C2143

Memory Dump Source

Source File: 00000009.00000002.9770624450.000001673E9B0000.00000040.00000001.sdmp, Offset: 000001673E9B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1673e9b0000_rundll32.jbxd

Similarity

API ID:
String ID: 2j]W$2xFU$uxJ\$|gFA
API String ID: 0-2595514560
Opcode ID: 42f83fc9a6e80b06c3af0088fb6d183c7d2a0dae591b96b705e11cc3111a0fcc
Instruction ID: bdebf5434ebe1d7680b59f461cef1e884bbd76465fda7a9d201f64c16ca5989b
Opcode Fuzzy Hash: 42f83fc9a6e80b06c3af0088fb6d183c7d2a0dae591b96b705e11cc3111a0fcc
Instruction Fuzzy Hash: D1625672204BC18AEB64DF75E8803DD37A4F744788F54481ADB896BBA9CF31C5A6E701

Uniqueness

Uniqueness Score: -1.00%

Function 000000C0000C22DC, Relevance: 5.6, Strings: 4, Instructions: 556
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

&K}g, xrefs: 000000C0000C2489
-OHW, xrefs: 000000C0000C249E
vatc, xrefs: 000000C0000C2D91
EUDS, xrefs: 000000C0000C2DE6

Memory Dump Source

Source File: 00000009.00000002.9765385894.000000C0000B4000.00000004.00000001.sdmp, Offset: 000000C0000B4000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_c0000b4000_rundll32.jbxd

Similarity

API ID:
String ID: &K}g$-OHW$EUDS$vatc
API String ID: 0-1212930380
Opcode ID: 56765ba2d39660e30ec840d43a7b9b27e50efdd83fc8feea4f472af215f0e517
Instruction ID: de72270f69c2caa8b10d4b314f008a51a8758301da4480a12e941319d40894eb
Opcode Fuzzy Hash: 56765ba2d39660e30ec840d43a7b9b27e50efdd83fc8feea4f472af215f0e517
Instruction Fuzzy Hash: EE6253B26052C0CEEB24CF659990BED3BA1F34574CFA14618EA895FF49DB788646CF40

Uniqueness

Uniqueness Score: -1.00%

Function 000001673E9BEEDC, Relevance: 5.6, Strings: 4, Instructions: 556
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

vatc, xrefs: 000001673E9BF991
EUDS, xrefs: 000001673E9BF9E6
-OHW, xrefs: 000001673E9BF09E
&K}g, xrefs: 000001673E9BF089

Memory Dump Source

Source File: 00000009.00000002.9770624450.000001673E9B0000.00000040.00000001.sdmp, Offset: 000001673E9B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1673e9b0000_rundll32.jbxd

Similarity

API ID:
String ID: &K}g$-OHW$EUDS$vatc
API String ID: 0-1212930380
Opcode ID: 97567781d9f1832e7a99bfd3abd22102227f4b18fa2f0e3859c8a764d13a6cb4
Instruction ID: a76110a0f3f90177cb40e8644534295aa5b1d4ac778d8f130d3a1671bb488fef
Opcode Fuzzy Hash: 97567781d9f1832e7a99bfd3abd22102227f4b18fa2f0e3859c8a764d13a6cb4
Instruction Fuzzy Hash: 256285B26092C18EEB24CF7599903EC3BA1F34574CF50490AEA856FB8DDB798646CF41

Uniqueness

Uniqueness Score: -1.00%

Function 000000C0000BA644, Relevance: 4.5, Strings: 3, Instructions: 782COMMON

Download Yara Rule

Strings

AX|L, xrefs: 000000C0000BB14A
ocB, xrefs: 000000C0000BAC79
_Mt, xrefs: 000000C0000BAC72

Memory Dump Source

Source File: 00000009.00000002.9765385894.000000C0000B4000.00000004.00000001.sdmp, Offset: 000000C0000B4000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_c0000b4000_rundll32.jbxd

Similarity

API ID:
String ID: _Mt$ocB$AX|L
API String ID: 0-438003525
Opcode ID: e20e65a26d14688a3fe2b169c21dd3a5133e29b3ef24b75c63e78fa42e210e2e
Instruction ID: 6ea9f87c300cf69572582af448e71d58c43f484335e96237cfbd672fd721ae12
Opcode Fuzzy Hash: e20e65a26d14688a3fe2b169c21dd3a5133e29b3ef24b75c63e78fa42e210e2e
Instruction Fuzzy Hash: 03620172701380CAFB24CF65D850BEE7BA1FB4978CF664229DA5A5BB89DB78C501C710

Uniqueness

Uniqueness Score: -1.00%

Function 000001673E9B7244, Relevance: 4.5, Strings: 3, Instructions: 781COMMON

Download Yara Rule

Strings

AX|L, xrefs: 000001673E9B7D4A
ocB, xrefs: 000001673E9B7879
_Mt, xrefs: 000001673E9B7872

Memory Dump Source

Source File: 00000009.00000002.9770624450.000001673E9B0000.00000040.00000001.sdmp, Offset: 000001673E9B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1673e9b0000_rundll32.jbxd

Similarity

API ID:
String ID: _Mt$ocB$AX|L
API String ID: 0-438003525
Opcode ID: fb04c1e50a3a7331cb6697ec5d25189f38d511496c48f32da466b06ea9ae8dc8
Instruction ID: f827f883eb9f6e22acc39b3d2130331f033629c8584b8b2d0573df0d89d78a9c
Opcode Fuzzy Hash: fb04c1e50a3a7331cb6697ec5d25189f38d511496c48f32da466b06ea9ae8dc8
Instruction Fuzzy Hash: 7862F2727187828AEB24CF659C403ED7BA1FB447CCF444A1ADA8A5BBC9DB3AC501D741

Uniqueness

Uniqueness Score: -1.00%

Function 000000C0000B7D4C, Relevance: 4.3, Strings: 3, Instructions: 508COMMON

Download Yara Rule

Strings

gfff, xrefs: 000000C0000B7E21
gfff, xrefs: 000000C0000B7DB9
Y*=, xrefs: 000000C0000B7F18

Memory Dump Source

Source File: 00000009.00000002.9765385894.000000C0000B4000.00000004.00000001.sdmp, Offset: 000000C0000B4000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_c0000b4000_rundll32.jbxd

Similarity

API ID:
String ID: Y*=$gfff$gfff
API String ID: 0-4005661508
Opcode ID: 14c27f9c4c1cac1fccd021351c7cb7988ca8a330c3b0565a83fd70f09222f175
Instruction ID: 1c78e9c859bb391ced98d5d54eeb13586a029766b29013c47d690b4259bc7c4d
Opcode Fuzzy Hash: 14c27f9c4c1cac1fccd021351c7cb7988ca8a330c3b0565a83fd70f09222f175
Instruction Fuzzy Hash: DF22BE72608280CEFB14CF799150BEE7BB1E78978CFA54619EA855BB5ECB38C505CB10

Uniqueness

Uniqueness Score: -1.00%

Function 000001673E9B494C, Relevance: 4.3, Strings: 3, Instructions: 508COMMON

Download Yara Rule

Strings

Y*=, xrefs: 000001673E9B4B18
gfff, xrefs: 000001673E9B49B9
gfff, xrefs: 000001673E9B4A21

Memory Dump Source

Source File: 00000009.00000002.9770624450.000001673E9B0000.00000040.00000001.sdmp, Offset: 000001673E9B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1673e9b0000_rundll32.jbxd

Similarity

API ID:
String ID: Y*=$gfff$gfff
API String ID: 0-4005661508
Opcode ID: f3136231ebee3eda709011cdbd12e438870e391f2afe79d87fae62082305f674
Instruction ID: 6e2ed364042e029211270b4b06ae5b17f30ad20ae2a67d87f7fa970c521725c0
Opcode Fuzzy Hash: f3136231ebee3eda709011cdbd12e438870e391f2afe79d87fae62082305f674
Instruction Fuzzy Hash: B322E2767082818EEB14CF35A9503EE7BA1F78578CF40480AEAD55BB8DD73AC401EB02

Uniqueness

Uniqueness Score: -1.00%

Function 000000C0000C0EB4, Relevance: 2.9, Strings: 2, Instructions: 435COMMON

Download Yara Rule

Strings

aZFS, xrefs: 000000C0000C1420
trC5, xrefs: 000000C0000C11E3

Memory Dump Source

Source File: 00000009.00000002.9765385894.000000C0000B4000.00000004.00000001.sdmp, Offset: 000000C0000B4000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_c0000b4000_rundll32.jbxd

Similarity

API ID:
String ID: aZFS$trC5
API String ID: 0-3468201609
Opcode ID: 82381726f1dd34a24922e63707dfe87e601f8d3b12f4e70843febb8bf3877a62
Instruction ID: 1c376e1b636a1b08782d2b75dcab44527a1470f78189c06760174a1daa0f2971
Opcode Fuzzy Hash: 82381726f1dd34a24922e63707dfe87e601f8d3b12f4e70843febb8bf3877a62
Instruction Fuzzy Hash: 68225A726047C0CAFB20DF65E450BDD7BA0F78674CFA54229EA895BB4ADB35C946CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000001673E9BDAB4, Relevance: 2.9, Strings: 2, Instructions: 435COMMON

Download Yara Rule

Strings

aZFS, xrefs: 000001673E9BE020
trC5, xrefs: 000001673E9BDDE3

Memory Dump Source

Source File: 00000009.00000002.9770624450.000001673E9B0000.00000040.00000001.sdmp, Offset: 000001673E9B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1673e9b0000_rundll32.jbxd

Similarity

API ID:
String ID: aZFS$trC5
API String ID: 0-3468201609
Opcode ID: 6f8a57b20962e6cd28641ad64ec2d76ac99eae4e32063c46e89701ba2c4e7180
Instruction ID: efa5e832d7cf4f7208662193c3a66c04e1639864af9d573a2959b0f8564bb167
Opcode Fuzzy Hash: 6f8a57b20962e6cd28641ad64ec2d76ac99eae4e32063c46e89701ba2c4e7180
Instruction Fuzzy Hash: FB228B726087C58EEB24CF25E8902DD7BA0F38574CF94442AEA895BB8DDB35C945DB01

Uniqueness

Uniqueness Score: -1.00%

Function 000000C0000C15FC, Relevance: 2.0, Strings: 1, Instructions: 767COMMON

Download Yara Rule

Strings

4[u, xrefs: 000000C0000C21A1

Memory Dump Source

Source File: 00000009.00000002.9765385894.000000C0000B4000.00000004.00000001.sdmp, Offset: 000000C0000B4000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_c0000b4000_rundll32.jbxd

Similarity

API ID:
String ID: 4[u
API String ID: 0-1357948871
Opcode ID: f3bb393a9d3ec2dc299221f010e8f70ff72a6c68711b2374eef2e7b71259c4ad
Instruction ID: 67a734ae742c46f407cc86dcccd2b6ce46167218624aa74447f114ef4314d87e
Opcode Fuzzy Hash: f3bb393a9d3ec2dc299221f010e8f70ff72a6c68711b2374eef2e7b71259c4ad
Instruction Fuzzy Hash: 57827B726056C0CAFB60CF65E850FED3BA1F74578CF664219DA8A5BB9ADB38C541CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000001673E9BE1FC, Relevance: 2.0, Strings: 1, Instructions: 767COMMON

Download Yara Rule

Strings

4[u, xrefs: 000001673E9BEDA1

Memory Dump Source

Source File: 00000009.00000002.9770624450.000001673E9B0000.00000040.00000001.sdmp, Offset: 000001673E9B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1673e9b0000_rundll32.jbxd

Similarity

API ID:
String ID: 4[u
API String ID: 0-1357948871
Opcode ID: 2961ccc4e3e14d4e70db66a19b8395aab64f78d3008fe6a2814544d370cef201
Instruction ID: cf9c45d7b009c3777302a6a982fef2596270c46b0af13e78836292f81fb9193b
Opcode Fuzzy Hash: 2961ccc4e3e14d4e70db66a19b8395aab64f78d3008fe6a2814544d370cef201
Instruction Fuzzy Hash: 7482AE726087C58EEB68CF35E8507ED3BA4F74478CF44481ADA8A5BB89DB39C541EB01

Uniqueness

Uniqueness Score: -1.00%

Function 000000C0000C05EC, Relevance: 1.8, Strings: 1, Instructions: 584COMMON

Download Yara Rule

Strings

q5Y, xrefs: 000000C0000C090C

Memory Dump Source

Source File: 00000009.00000002.9765385894.000000C0000B4000.00000004.00000001.sdmp, Offset: 000000C0000B4000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_c0000b4000_rundll32.jbxd

Similarity

API ID:
String ID: q5Y
API String ID: 0-465541591
Opcode ID: 117153ea3d542a13b5efd9ad79bf10819877f732172d0f2a3ac8f0a6d58634f3
Instruction ID: b17e6b678238fdca66c1df150dbbe8d3dec2fa22754428049b3e9b2419b6839b
Opcode Fuzzy Hash: 117153ea3d542a13b5efd9ad79bf10819877f732172d0f2a3ac8f0a6d58634f3
Instruction Fuzzy Hash: 9742D172605780CAFB65CF24E440FAD7BA4F74478CF664719EA8A0BB89DB38C945CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000001673E9BD1EC, Relevance: 1.8, Strings: 1, Instructions: 584COMMON

Download Yara Rule

Strings

q5Y, xrefs: 000001673E9BD50C

Memory Dump Source

Source File: 00000009.00000002.9770624450.000001673E9B0000.00000040.00000001.sdmp, Offset: 000001673E9B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1673e9b0000_rundll32.jbxd

Similarity

API ID:
String ID: q5Y
API String ID: 0-465541591
Opcode ID: 41678b3da634816d6ee4b264a5eec00e926735b9c5272691b048ee1a44d999ac
Instruction ID: d36186911363c682e6e861e7e5ed574c0d404cc76793c240504e1d5d05de9477
Opcode Fuzzy Hash: 41678b3da634816d6ee4b264a5eec00e926735b9c5272691b048ee1a44d999ac
Instruction Fuzzy Hash: CC42D17620D782D9EB15CF25A8403EE7BA4F74578CF44481AEAC907BC9D73AC945EB01

Uniqueness

Uniqueness Score: -1.00%

Function 000000C0000C4310, Relevance: 1.7, Strings: 1, Instructions: 412COMMON

Download Yara Rule

Strings

c6g, xrefs: 000000C0000C454C

Memory Dump Source

Source File: 00000009.00000002.9765385894.000000C0000B4000.00000004.00000001.sdmp, Offset: 000000C0000B4000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_c0000b4000_rundll32.jbxd

Similarity

API ID:
String ID: c6g
API String ID: 0-3546307900
Opcode ID: 7e85fdcfaef46ea576958985c8364f98799448bca5ba387ee1cd5ae375de3700
Instruction ID: cc5bb825acc77b5a3944b41004ea7192c0a84353fb5932cce5b35a5d8df53b27
Opcode Fuzzy Hash: 7e85fdcfaef46ea576958985c8364f98799448bca5ba387ee1cd5ae375de3700
Instruction Fuzzy Hash: 9E127932604B80CAFB60CF64E990BED77E4FB4578CF664219EA895BB99DB34C545CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000C0000C4994, Relevance: 1.6, Strings: 1, Instructions: 358COMMON

Download Yara Rule

Strings

.xDa, xrefs: 000000C0000C4D7C

Memory Dump Source

Source File: 00000009.00000002.9765385894.000000C0000B4000.00000004.00000001.sdmp, Offset: 000000C0000B4000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_c0000b4000_rundll32.jbxd

Similarity

API ID:
String ID: .xDa
API String ID: 0-2515264822
Opcode ID: 5a4b652798f890c03fb00f4ec91067b07ca68e5d570935ac50b58f2237a3a0aa
Instruction ID: 07749703c6f77db599c3d72e02135ed680e9d339f13bd1640e5b600c5f49a273
Opcode Fuzzy Hash: 5a4b652798f890c03fb00f4ec91067b07ca68e5d570935ac50b58f2237a3a0aa
Instruction Fuzzy Hash: F6023832204680CAFB60CF65E890F9D7BB0F788B88F654225EF995BB59CB34C556DB10

Uniqueness

Uniqueness Score: -1.00%

Function 000001673E9C15CF, Relevance: 1.6, Strings: 1, Instructions: 328COMMON

Download Yara Rule

Strings

.xDa, xrefs: 000001673E9C197C

Memory Dump Source

Source File: 00000009.00000002.9770624450.000001673E9B0000.00000040.00000001.sdmp, Offset: 000001673E9B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1673e9b0000_rundll32.jbxd

Similarity

API ID:
String ID: .xDa
API String ID: 0-2515264822
Opcode ID: 5a0568ef909919d2dff8495ab79afe05f83796aeda0ada86b68be17b52b0ed16
Instruction ID: 0e08c22dc19c1bc78da6d3d94193149a9fb6dac80702d100565531e33bb193cb
Opcode Fuzzy Hash: 5a0568ef909919d2dff8495ab79afe05f83796aeda0ada86b68be17b52b0ed16
Instruction Fuzzy Hash: 70F17B322086808AEB20DF66E8407DD77B0F788B8CF544916DF9D5BB99DB35C592EB04

Uniqueness

Uniqueness Score: -1.00%

Function 000000C0000BC82C, Relevance: 1.5, Strings: 1, Instructions: 286COMMON

Download Yara Rule

Strings

{F.], xrefs: 000000C0000BC94C

Memory Dump Source

Source File: 00000009.00000002.9765385894.000000C0000B4000.00000004.00000001.sdmp, Offset: 000000C0000B4000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_c0000b4000_rundll32.jbxd

Similarity

API ID:
String ID: {F.]
API String ID: 0-4155518358
Opcode ID: 88777eb5903a4d84b2d734bf990e3103a94104ec931c4afa7421d121b685df4b
Instruction ID: 85dfbd0cebe419d9397701ea647b004d31752c8230e5a655d696c018ba8032a8
Opcode Fuzzy Hash: 88777eb5903a4d84b2d734bf990e3103a94104ec931c4afa7421d121b685df4b
Instruction Fuzzy Hash: 37E1AB72610684DEFB10CF74D4A1FED3BB1E35538CFA20225EA0A6BA9DE7B48546C744

Uniqueness

Uniqueness Score: -1.00%

Function 000001673E9B942C, Relevance: 1.5, Strings: 1, Instructions: 286COMMON

Download Yara Rule

Strings

{F.], xrefs: 000001673E9B954C

Memory Dump Source

Source File: 00000009.00000002.9770624450.000001673E9B0000.00000040.00000001.sdmp, Offset: 000001673E9B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1673e9b0000_rundll32.jbxd

Similarity

API ID:
String ID: {F.]
API String ID: 0-4155518358
Opcode ID: 88777eb5903a4d84b2d734bf990e3103a94104ec931c4afa7421d121b685df4b
Instruction ID: 395438c38d276ae0bf2bfe6dba32ac842a40d7e36f9fd49463db4de57336ae43
Opcode Fuzzy Hash: 88777eb5903a4d84b2d734bf990e3103a94104ec931c4afa7421d121b685df4b
Instruction Fuzzy Hash: 64E1D3326686418EEB10DF74D8916ED37B5F31578CF800816DA8A2BBEDE772C541EB42

Uniqueness

Uniqueness Score: -1.00%

Function 000000C0000C4FE0, Relevance: 1.5, Strings: 1, Instructions: 277COMMON

Download Yara Rule

Strings

}]PH, xrefs: 000000C0000C5362

Memory Dump Source

Source File: 00000009.00000002.9765385894.000000C0000B4000.00000004.00000001.sdmp, Offset: 000000C0000B4000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_c0000b4000_rundll32.jbxd

Similarity

API ID:
String ID: }]PH
API String ID: 0-516525640
Opcode ID: b61b12e815004e17e66413bbd812c9d2c78981c97bf104e233f14f9f37bf11b6
Instruction ID: a0433e5d6be7b265376daa483be8ba10c8ae46b305d92faf7e83d5d64dd0e828
Opcode Fuzzy Hash: b61b12e815004e17e66413bbd812c9d2c78981c97bf104e233f14f9f37bf11b6
Instruction Fuzzy Hash: D4D17766B04A80DEFB10CFB8C891BEC37F0A70578CF554A65DE496BA9ADB30D656C310

Uniqueness

Uniqueness Score: -1.00%

Function 000001673E9C1BE0, Relevance: 1.5, Strings: 1, Instructions: 277COMMON

Download Yara Rule

Strings

}]PH, xrefs: 000001673E9C1F62

Memory Dump Source

Source File: 00000009.00000002.9770624450.000001673E9B0000.00000040.00000001.sdmp, Offset: 000001673E9B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1673e9b0000_rundll32.jbxd

Similarity

API ID:
String ID: }]PH
API String ID: 0-516525640
Opcode ID: a6e4aa2ee780097f67e8da65096b73e3d9e6036c9c20f87cd3da60671f6920c0
Instruction ID: 699ac102e9d07263623e451197b60f49e268afd338b9f65a53d7e4780bbe0463
Opcode Fuzzy Hash: a6e4aa2ee780097f67e8da65096b73e3d9e6036c9c20f87cd3da60671f6920c0
Instruction Fuzzy Hash: 23D16672B086809EEB10DFB9D8916EC37F0F70878CF04485ADE896BB99DA30C556E715

Uniqueness

Uniqueness Score: -1.00%

Function 000001673E9C2057, Relevance: .7, Instructions: 673COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.9770624450.000001673E9B0000.00000040.00000001.sdmp, Offset: 000001673E9B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1673e9b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d056ce18b7daf42d52397ce6b264c4c0e2f1f651ac6fdc02f85c12e3e0687a86
Instruction ID: beb197fb24d62ec0b5f04b3301a5b0148b3309dcf62b5c5d1e72a933cab1e112
Opcode Fuzzy Hash: d056ce18b7daf42d52397ce6b264c4c0e2f1f651ac6fdc02f85c12e3e0687a86
Instruction Fuzzy Hash: 6E726832208BC18AEB64DF75E8903DD37A4F744788F54481ADA896BBE9CF35C5A1E701

Uniqueness

Uniqueness Score: -1.00%

Function 000000C0000BEA34, Relevance: .5, Instructions: 542COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.9765385894.000000C0000B4000.00000004.00000001.sdmp, Offset: 000000C0000B4000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_c0000b4000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90557d1a0cfa63e53d660415746253f8ae6610a9177f2b7e37e0b6ee05ce0d57
Instruction ID: eb655ad27a07d3f19a2406848b11f5155fc8214e2a1210b3c3c38223bcfe373b
Opcode Fuzzy Hash: 90557d1a0cfa63e53d660415746253f8ae6610a9177f2b7e37e0b6ee05ce0d57
Instruction Fuzzy Hash: A022DA22701681C6FB64DF35D440BBE77A2EB44B8CF6642269E4A67B9ADF38D801C340

Uniqueness

Uniqueness Score: -1.00%

Function 000001673E9C40FD, Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.9770624450.000001673E9B0000.00000040.00000001.sdmp, Offset: 000001673E9B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1673e9b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a68bd124c6ec6cdd766a7890341b13d7b2e2c8873580eb3b537684fe02b98c4b
Instruction ID: 7a17de71b221f1342d3ee80484ad0e379cf91afe567e6c322f95c6e9101a4e29
Opcode Fuzzy Hash: a68bd124c6ec6cdd766a7890341b13d7b2e2c8873580eb3b537684fe02b98c4b
Instruction Fuzzy Hash: 3922C1323187C18AEB74AF25AC403ED37A5F74578CF44491A9A8A0BBD9DF36C681DB01

Uniqueness

Uniqueness Score: -1.00%

Function 000001673E9BB67C, Relevance: .4, Instructions: 400COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.9770624450.000001673E9B0000.00000040.00000001.sdmp, Offset: 000001673E9B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1673e9b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7e0af15235c868a0dc6e32b63abcff88fdfae3149a850da9816f387f8dcf7e0
Instruction ID: 73fb53d49ec9b6c4aa76ff388a9879e4c033fe614980049716fe83b4a867de90
Opcode Fuzzy Hash: e7e0af15235c868a0dc6e32b63abcff88fdfae3149a850da9816f387f8dcf7e0
Instruction Fuzzy Hash: 24F19D3271964292FF689F25D9503ED63A5FB40B8CF4448178ACA47BD9EF3AD841E342

Uniqueness

Uniqueness Score: -1.00%

Function 000000C0000C6320, Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.9765385894.000000C0000B4000.00000004.00000001.sdmp, Offset: 000000C0000B4000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_c0000b4000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1bfac3f4f665cda493c0f9279fd2e9d9b54eb2782428e57f85b3bf585eb31e4
Instruction ID: beed5f3257b859494d2ddef321aaa263fedb08d8400c2f85d7f5463dbe5bb7d7
Opcode Fuzzy Hash: c1bfac3f4f665cda493c0f9279fd2e9d9b54eb2782428e57f85b3bf585eb31e4
Instruction Fuzzy Hash: 91E17C77A283848EFB50CF65A150BAE7BB1E38978CF614214EA916BE4DD739C402CF00

Uniqueness

Uniqueness Score: -1.00%

Function 000001673E9C2F20, Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.9770624450.000001673E9B0000.00000040.00000001.sdmp, Offset: 000001673E9B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1673e9b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1bfac3f4f665cda493c0f9279fd2e9d9b54eb2782428e57f85b3bf585eb31e4
Instruction ID: c3f3ed0cd0aa2bdf248574650d467d238d827a5f5b20a971e72e337f5386b3d8
Opcode Fuzzy Hash: c1bfac3f4f665cda493c0f9279fd2e9d9b54eb2782428e57f85b3bf585eb31e4
Instruction Fuzzy Hash: 19E1BF73A282848EEB10DF69A5902EE7BB1F38A78CF544445EA856BF8DC735D442CF01

Uniqueness

Uniqueness Score: -1.00%

Function 000000C0000BB4A8, Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.9765385894.000000C0000B4000.00000004.00000001.sdmp, Offset: 000000C0000B4000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_c0000b4000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eafa93db8affc2acd5c2647060db7e72c7aa54e0deba0679f763eee4a553a23f
Instruction ID: 544b86d1d5508f5e4d8fd1d7061a5b8f660b18ecb2cff7a9efff4a6adb3b1651
Opcode Fuzzy Hash: eafa93db8affc2acd5c2647060db7e72c7aa54e0deba0679f763eee4a553a23f
Instruction Fuzzy Hash: F5B1BB32B04B80CBFB60CFB99550BAD77F1A784B8CF6646249E4967B89DB74C912C740

Uniqueness

Uniqueness Score: -1.00%

Function 000001673E9B80A8, Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.9770624450.000001673E9B0000.00000040.00000001.sdmp, Offset: 000001673E9B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1673e9b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dc573999a4a489040ee3d90808dca3b63cee57a8638242c92b7da4cb7b6b843
Instruction ID: 873b89c1441440456606a7a133dbb1026972dec4be9641b4dbbac489ba5d49bd
Opcode Fuzzy Hash: 1dc573999a4a489040ee3d90808dca3b63cee57a8638242c92b7da4cb7b6b843
Instruction Fuzzy Hash: 1AB1BE32709B828AFB20CF7999503ED77F1B748B8CF544856DE8967B89DA31C802E741

Uniqueness

Uniqueness Score: -1.00%

Function 000000C0000BC2BC, Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.9765385894.000000C0000B4000.00000004.00000001.sdmp, Offset: 000000C0000B4000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_c0000b4000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6810dc0806fbf3be3849a878c1d3b2cf35c7c6c2631d218b6b2266839d65108b
Instruction ID: 6ad78d9d9e3beb829426b9cd1acdae3bbda4a2d90a939f80084cdbdfb662395d
Opcode Fuzzy Hash: 6810dc0806fbf3be3849a878c1d3b2cf35c7c6c2631d218b6b2266839d65108b
Instruction Fuzzy Hash: C8A190B2721A40C7FB68DF29C550F6C73A1F744B88F268229DB5A83791DB35E9A1C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000C0000CC5D0, Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.9765385894.000000C0000B4000.00000004.00000001.sdmp, Offset: 000000C0000B4000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_c0000b4000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bbca2a66ea913d627b39250e4efa62feb7a4d560ef1894817cf344283eb5cb6
Instruction ID: 2fc652545db391cf16abcdbbf0f1ab53a96aa73dccac60848d809f005a5ffd00
Opcode Fuzzy Hash: 5bbca2a66ea913d627b39250e4efa62feb7a4d560ef1894817cf344283eb5cb6
Instruction Fuzzy Hash: 57B11672604B91C9FB10CF65E880B9D7BB0F789B8CFA54225EA8D97A59DF38C545CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000001673E9C91D0, Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.9770624450.000001673E9B0000.00000040.00000001.sdmp, Offset: 000001673E9B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1673e9b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 139721b40f1e7df55d03e211bf99104f26b9bf6e8e547466ca31d28a7c18e22c
Instruction ID: 4fe089ef091ff9424234a0cb4d10dfc27c1c0b60ad9e700421d8d14ef5b79974
Opcode Fuzzy Hash: 139721b40f1e7df55d03e211bf99104f26b9bf6e8e547466ca31d28a7c18e22c
Instruction Fuzzy Hash: 8DB13B72608B8189EB10DF66EC802DD7BB4F78978CF944416EA8D97B98DF35C485DB01

Uniqueness

Uniqueness Score: -1.00%

Function 000000C0000BA1E8, Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.9765385894.000000C0000B4000.00000004.00000001.sdmp, Offset: 000000C0000B4000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_c0000b4000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5415d0cee7b52ba9f6e14514716308b70a6160731cec158b641d646adbbc0632
Instruction ID: 849ac46f27792df1590a62373768bb6693b8989988b967d9be62e0bff80b5b80
Opcode Fuzzy Hash: 5415d0cee7b52ba9f6e14514716308b70a6160731cec158b641d646adbbc0632
Instruction Fuzzy Hash: D271CF677287848ADB15CF39D090AAC7FB4F38AF88B5A9241DF9D5375ACA36C405C710

Uniqueness

Uniqueness Score: -1.00%

Function 000001673E9B6DE8, Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.9770624450.000001673E9B0000.00000040.00000001.sdmp, Offset: 000001673E9B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1673e9b0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de03435933f17e5b8cddd10df6daf317a5b0202f989fccf81ae4220b9c4bc2a1
Instruction ID: 82b5e5e6c86e8672aa7d1026c2219eb9a6bda9057a7ec0eda847f291ccd294dc
Opcode Fuzzy Hash: de03435933f17e5b8cddd10df6daf317a5b0202f989fccf81ae4220b9c4bc2a1
Instruction Fuzzy Hash: 8B71BC67618B948ACB15CF39D4908AC7FB4F389F8874A9646DF9E537AACA22C405C710

Uniqueness

Uniqueness Score: -1.00%

Function 000000C0000CCD3C, Relevance: 5.4, Strings: 4, Instructions: 440
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

"ulG, xrefs: 000000C0000CCF9B
pSnK, xrefs: 000000C0000CCFA2
pQuG, xrefs: 000000C0000CCF94
eUoG, xrefs: 000000C0000CCF8D

Memory Dump Source

Source File: 00000009.00000002.9765385894.000000C0000B4000.00000004.00000001.sdmp, Offset: 000000C0000B4000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_c0000b4000_rundll32.jbxd

Similarity

API ID:
String ID: "ulG$eUoG$pQuG$pSnK
API String ID: 0-2204601796
Opcode ID: 0277dc61248155910f18bfbff929d731adb5e516d9612a44ff7ae1c293a82f31
Instruction ID: 8dc03491963c5b4c34e4517c2c53cb765c20252b30760ca7c332963cdc23ffa2
Opcode Fuzzy Hash: 0277dc61248155910f18bfbff929d731adb5e516d9612a44ff7ae1c293a82f31
Instruction Fuzzy Hash: BB128972701780EAFB29CF24C150FAC37A1FB05748F66862ADB4927B99DB34D962D300

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report iso.iso

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Created / dropped Files

Static File Info

General

File Icon

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: cmd.exe PID: 7464 Parent PID: 3676

General

File Activities

File Opened

File Created

File Attributes Queried

Other File Operations

Volume Information Queried

Section Activities

Sections loaded by Windows

Registry Activities

Key Monitored

Process Activities

Process Created

Process Queried

Process Information Set

Process Terminated

Thread Activities

Thread Execution Resumed

Memory Activities

Memory Written

Memory Usage Statistics

System Activities

System Information Queried

LPC Port Activities

Port Request Wait Reply