Edit tour

Windows Analysis Report
snd.exe

Overview

General Information

Sample Name:	snd.exe
Analysis ID:	568663
MD5:	0a76e0e59456d310419266270c410936
SHA1:	1b6df9f456fbb2f793d8402d78c3338355ed98be
SHA256:	886cb22ffe43a3838ef152ef57bbfa66f52b71c534bfe3d8af3d29ea973daadf
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Found potential dummy code loops (likely to delay analysis)

Machine Learning detection for sample

Uses 32bit PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Queries the volume information (name, serial number etc) of a device

Yara signature match

Sample file is different than original file name gathered from version info

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Sample execution stops while process was sleeping (likely an evasion)

Potential time zone aware malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Program does not show much activity (idle)

Contains long sleeps (>= 3 min)

Enables debug privileges

Classification

Process Tree

System is w10x64

snd.exe (PID: 5692 cmdline: "C:\Users\user\Desktop\snd.exe" MD5: 0A76E0E59456D310419266270C410936)

conhost.exe (PID: 5516 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
snd.exe	MALWARE_Win_ExMatter	Detects BlackMatter data exfiltration tool	ditekSHen	0xf63a1:$s1: Renci.SshNet. 0xf6ce2:$s1: Renci.SshNet. 0xf6da5:$s1: Renci.SshNet. 0xf6e2b:$s1: Renci.SshNet. 0xf7b60:$s1: Renci.SshNet. 0xf7ba6:$s1: Renci.SshNet. 0xf7bf6:$s1: Renci.SshNet. 0xf7e44:$s1: Renci.SshNet. 0xf8298:$s1: Renci.SshNet. 0xf82c0:$s1: Renci.SshNet. 0xf83bd:$s1: Renci.SshNet. 0xfb414:$s1: Renci.SshNet. 0xfb437:$s1: Renci.SshNet. 0xfb605:$s1: Renci.SshNet. 0xfb97f:$s1: Renci.SshNet. 0xfb9a8:$s1: Renci.SshNet. 0xfb9db:$s1: Renci.SshNet. 0xfba06:$s1: Renci.SshNet. 0xfba35:$s1: Renci.SshNet. 0xfba67:$s1: Renci.SshNet. 0xfba89:$s1: Renci.SshNet.

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.snd.exe.d30000.0.unpack	MALWARE_Win_ExMatter	Detects BlackMatter data exfiltration tool	ditekSHen	0xf63a1:$s1: Renci.SshNet. 0xf6ce2:$s1: Renci.SshNet. 0xf6da5:$s1: Renci.SshNet. 0xf6e2b:$s1: Renci.SshNet. 0xf7b60:$s1: Renci.SshNet. 0xf7ba6:$s1: Renci.SshNet. 0xf7bf6:$s1: Renci.SshNet. 0xf7e44:$s1: Renci.SshNet. 0xf8298:$s1: Renci.SshNet. 0xf82c0:$s1: Renci.SshNet. 0xf83bd:$s1: Renci.SshNet. 0xfb414:$s1: Renci.SshNet. 0xfb437:$s1: Renci.SshNet. 0xfb605:$s1: Renci.SshNet. 0xfb97f:$s1: Renci.SshNet. 0xfb9a8:$s1: Renci.SshNet. 0xfb9db:$s1: Renci.SshNet. 0xfba06:$s1: Renci.SshNet. 0xfba35:$s1: Renci.SshNet. 0xfba67:$s1: Renci.SshNet. 0xfba89:$s1: Renci.SshNet.
0.0.snd.exe.d30000.0.unpack	MALWARE_Win_ExMatter	Detects BlackMatter data exfiltration tool	ditekSHen	0xf63a1:$s1: Renci.SshNet. 0xf6ce2:$s1: Renci.SshNet. 0xf6da5:$s1: Renci.SshNet. 0xf6e2b:$s1: Renci.SshNet. 0xf7b60:$s1: Renci.SshNet. 0xf7ba6:$s1: Renci.SshNet. 0xf7bf6:$s1: Renci.SshNet. 0xf7e44:$s1: Renci.SshNet. 0xf8298:$s1: Renci.SshNet. 0xf82c0:$s1: Renci.SshNet. 0xf83bd:$s1: Renci.SshNet. 0xfb414:$s1: Renci.SshNet. 0xfb437:$s1: Renci.SshNet. 0xfb605:$s1: Renci.SshNet. 0xfb97f:$s1: Renci.SshNet. 0xfb9a8:$s1: Renci.SshNet. 0xfb9db:$s1: Renci.SshNet. 0xfba06:$s1: Renci.SshNet. 0xfba35:$s1: Renci.SshNet. 0xfba67:$s1: Renci.SshNet. 0xfba89:$s1: Renci.SshNet.

Sigma Signatures

⊘No Sigma rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: snd.exe	Virustotal: Detection: 52%			Perma Link
Source: snd.exe	ReversingLabs: Detection: 60%

Machine Learning detection for sample

Source: snd.exe

Joe Sandbox ML: detected

Source: snd.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: snd.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: C:\work\file_sender\sender2\sender2\bin\Release\sender2.pdb source: snd.exe
Source:	Binary string: C:\work\file_sender\sender2\sender2\bin\Release\sender2.pdbx source: snd.exe

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.232.192
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.232.192
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.232.192
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.232.192
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.232.192
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.232.192
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.232.192
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.232.192
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.232.192
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.232.192
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.232.192
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.232.192
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.232.192
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.232.192
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.232.192
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.232.192
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.232.192
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.232.192
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.232.192
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.232.192
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.232.192
Source: unknown	TCP traffic detected without corresponding DNS query: 164.92.232.192

Source: snd.exe, 00000000.00000002.519526709.00000000031C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: snd.exe	String found in binary or memory: https://164.92.232.192/data/
Source: snd.exe	String found in binary or memory: https://164.92.232.192/data/3Can
Source: snd.exe, 00000000.00000002.519526709.00000000031C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://164.92.232.192/data/WORKGROUP.813848/
Source: snd.exe, 00000000.00000002.519526709.00000000031C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://164.92.232.192/data/x
Source: snd.exe, 00000000.00000002.519526709.00000000031C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://164.92.232.192x
Source: snd.exe, 00000000.00000002.519656216.000000000327C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://164.92H
Source: snd.exe	String found in binary or memory: https://duckduckgo.com
Source: snd.exe	String found in binary or memory: https://duckduckgo.comqThere
Source: snd.exe	String found in binary or memory: https://tools.ietf.org/html/rfc4253#sec
Source: snd.exe	String found in binary or memory: https://tools.ietf.org/html/rfc4253#section-4.
Source: snd.exe	String found in binary or memory: https://tools.ietf.org/html/rfc4253#section-4.2

System Summary

Malicious sample detected (through community Yara rule)

Source: snd.exe, type: SAMPLE	Matched rule: Detects BlackMatter data exfiltration tool Author: ditekSHen
Source: 0.2.snd.exe.d30000.0.unpack, type: UNPACKEDPE	Matched rule: Detects BlackMatter data exfiltration tool Author: ditekSHen
Source: 0.0.snd.exe.d30000.0.unpack, type: UNPACKEDPE	Matched rule: Detects BlackMatter data exfiltration tool Author: ditekSHen

Source: snd.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: snd.exe, type: SAMPLE	Matched rule: MALWARE_Win_ExMatter hash2 = a5e050f1278473d41c3a3d6f98f3fd82932f51a937bc57d8f5605815f0efb0f8, hash1 = 4a0e10e1e9fea0906379f99fa350b91c2af37f0fd2cc55491643cc71a9887d30, author = ditekSHen, description = Detects BlackMatter data exfiltration tool
Source: 0.2.snd.exe.d30000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_ExMatter hash2 = a5e050f1278473d41c3a3d6f98f3fd82932f51a937bc57d8f5605815f0efb0f8, hash1 = 4a0e10e1e9fea0906379f99fa350b91c2af37f0fd2cc55491643cc71a9887d30, author = ditekSHen, description = Detects BlackMatter data exfiltration tool
Source: 0.0.snd.exe.d30000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_ExMatter hash2 = a5e050f1278473d41c3a3d6f98f3fd82932f51a937bc57d8f5605815f0efb0f8, hash1 = 4a0e10e1e9fea0906379f99fa350b91c2af37f0fd2cc55491643cc71a9887d30, author = ditekSHen, description = Detects BlackMatter data exfiltration tool

Source: snd.exe, 00000000.00000002.518779511.00000000012BC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs snd.exe
Source: snd.exe, 00000000.00000000.250137464.0000000000E7E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesender2.exe0 vs snd.exe
Source: snd.exe	Binary or memory string: OriginalFilenamesender2.exe0 vs snd.exe

Source: snd.exe	Virustotal: Detection: 52%
Source: snd.exe	ReversingLabs: Detection: 60%

Source: snd.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\snd.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\snd.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\snd.exe "C:\Users\user\Desktop\snd.exe"
Source: C:\Users\user\Desktop\snd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5516:120:WilError_01

Source: snd.exe, 00000000.00000002.520557629.0000000003631000.00000004.00000800.00020000.00000000.sdmp, snd.exe, 00000000.00000002.520547699.0000000003621000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C\\?\C:\Program Files (x86)\autoit3\AutoItX\Examples\C++\AutoItX.sln
Source: snd.exe, 00000000.00000002.520557629.0000000003631000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ?C:\Program Files (x86)\autoit3\AutoItX\Examples\C++\AutoItX.sln0y
Source: snd.exe, 00000000.00000002.520557629.0000000003631000.00000004.00000800.00020000.00000000.sdmp, snd.exe, 00000000.00000002.520584273.0000000003669000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AutoItX.sln
Source: snd.exe, 00000000.00000002.520584273.0000000003669000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C\\?\C:\Program Files (x86)\autoit3\AutoItX\Examples\C++\AutoItX.sln(
Source: snd.exe, 00000000.00000002.520547699.0000000003621000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \\?\C:\Program Files (x86)\autoit3\AutoItX\Examples\C++\AutoItX.sln
Source: snd.exe, 00000000.00000002.520584273.0000000003669000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ?C:\Program Files (x86)\autoit3\AutoItX\Examples\C++\AutoItX.sln

Source: classification engine

Classification label: mal64.evad.winEXE@2/1@0/1

Source: snd.exe, Renci.SshNet/Security/KeyExchangeHashData.cs	Suspicious method names: System.Void Renci.SshNet.Security.KeyExchangeHashData::set_ClientPayload(System.Byte[])
Source: snd.exe, Renci.SshNet/Security/KeyExchangeHashData.cs	Suspicious method names: System.Void Renci.SshNet.Security.KeyExchangeHashData::set_ServerPayload(System.Byte[])
Source: snd.exe, Renci.SshNet/Security/KeyExchangeHashData.cs	Suspicious method names: System.Byte[] Renci.SshNet.Security.KeyExchangeHashData::get_ServerPayload()
Source: snd.exe, Renci.SshNet/Security/KeyExchangeHashData.cs	Suspicious method names: System.Byte[] Renci.SshNet.Security.KeyExchangeHashData::get_ClientPayload()
Source: snd.exe, Renci.SshNet/Security/GroupExchangeHashData.cs	Suspicious method names: System.Byte[] Renci.SshNet.Security.GroupExchangeHashData::get_ServerPayload()
Source: snd.exe, Renci.SshNet/Security/GroupExchangeHashData.cs	Suspicious method names: System.Void Renci.SshNet.Security.GroupExchangeHashData::set_ServerPayload(System.Byte[])
Source: snd.exe, Renci.SshNet/Security/GroupExchangeHashData.cs	Suspicious method names: System.Byte[] Renci.SshNet.Security.GroupExchangeHashData::get_ClientPayload()
Source: snd.exe, Renci.SshNet/Security/GroupExchangeHashData.cs	Suspicious method names: System.Void Renci.SshNet.Security.GroupExchangeHashData::set_ClientPayload(System.Byte[])

Source: snd.exe, Alphaleonis/Win32/Security/ProcessContext.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: snd.exe, Alphaleonis/Win32/Security/ProcessContext.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Int32)
Source: snd.exe, Alphaleonis/Win32/Security/ProcessContext.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: snd.exe, Alphaleonis/Win32/Security/ProcessContext.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.SecurityIdentifier)
Source: snd.exe, TakeOwnership/OwnershipTaker.cs	Security API names: System.Void System.IO.Directory::SetAccessControl(System.String,System.Security.AccessControl.DirectorySecurity)
Source: snd.exe, TakeOwnership/OwnershipTaker.cs	Security API names: System.Security.AccessControl.DirectorySecurity System.IO.Directory::GetAccessControl(System.String)
Source: snd.exe, TakeOwnership/OwnershipTaker.cs	Security API names: System.Security.AccessControl.AuthorizationRuleCollection System.Security.AccessControl.CommonObjectSecurity::GetAccessRules(System.Boolean,System.Boolean,System.Type)
Source: snd.exe, TakeOwnership/OwnershipTaker.cs	Security API names: System.Void System.IO.File::SetAccessControl(System.String,System.Security.AccessControl.FileSecurity)
Source: snd.exe, TakeOwnership/OwnershipTaker.cs	Security API names: System.Security.AccessControl.FileSecurity System.IO.File::GetAccessControl(System.String)
Source: snd.exe, Alphaleonis/Win32/Filesystem/Directory.cs	Security API names: System.Security.AccessControl.DirectorySecurity Alphaleonis.Win32.Filesystem.File::GetAccessControlCore<System.Security.AccessControl.DirectorySecurity>(System.Boolean,System.String,System.Security.AccessControl.AccessControlSections,Alphaleonis.Win32.Filesystem.PathFormat)
Source: snd.exe, Alphaleonis/Win32/Filesystem/Directory.cs	Security API names: System.Void Alphaleonis.Win32.Filesystem.File::SetAccessControlCore(System.String,Microsoft.Win32.SafeHandles.SafeFileHandle,System.Security.AccessControl.ObjectSecurity,System.Security.AccessControl.AccessControlSections,Alphaleonis.Win32.Filesystem.PathFormat)
Source: snd.exe, Alphaleonis/Win32/Filesystem/Directory.cs	Security API names: System.Security.AccessControl.DirectorySecurity Alphaleonis.Win32.Filesystem.File::GetAccessControlHandleCore<System.Security.AccessControl.DirectorySecurity>(System.Boolean,System.Boolean,Microsoft.Win32.SafeHandles.SafeFileHandle,System.Security.AccessControl.AccessControlSections,Alphaleonis.Win32.Security.SECURITY_INFORMATION)
Source: snd.exe, Alphaleonis/Win32/Filesystem/File.cs	Security API names: System.Security.AccessControl.FileSecurity Alphaleonis.Win32.Filesystem.File::GetAccessControlCore<System.Security.AccessControl.FileSecurity>(System.Boolean,System.String,System.Security.AccessControl.AccessControlSections,Alphaleonis.Win32.Filesystem.PathFormat)
Source: snd.exe, Alphaleonis/Win32/Filesystem/File.cs	Security API names: System.Security.AccessControl.FileSecurity Alphaleonis.Win32.Filesystem.File::GetAccessControlHandleCore<System.Security.AccessControl.FileSecurity>(System.Boolean,System.Boolean,Microsoft.Win32.SafeHandles.SafeFileHandle,System.Security.AccessControl.AccessControlSections,Alphaleonis.Win32.Security.SECURITY_INFORMATION)
Source: snd.exe, Alphaleonis/Win32/Filesystem/File.cs	Security API names: System.Void Alphaleonis.Win32.Filesystem.File::SetAccessControlCore(System.String,Microsoft.Win32.SafeHandles.SafeFileHandle,System.Security.AccessControl.ObjectSecurity,System.Security.AccessControl.AccessControlSections,Alphaleonis.Win32.Filesystem.PathFormat)
Source: snd.exe, Alphaleonis/Win32/Security/InternalPrivilegeEnabler.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent(System.Security.Principal.TokenAccessLevels)
Source: snd.exe, Alphaleonis/Win32/Filesystem/FileInfo.cs	Security API names: System.Security.AccessControl.FileSecurity Alphaleonis.Win32.Filesystem.File::GetAccessControlCore<System.Security.AccessControl.FileSecurity>(System.Boolean,System.String,System.Security.AccessControl.AccessControlSections,Alphaleonis.Win32.Filesystem.PathFormat)
Source: snd.exe, Alphaleonis/Win32/Filesystem/FileInfo.cs	Security API names: System.Void Alphaleonis.Win32.Filesystem.File::SetAccessControlCore(System.String,Microsoft.Win32.SafeHandles.SafeFileHandle,System.Security.AccessControl.ObjectSecurity,System.Security.AccessControl.AccessControlSections,Alphaleonis.Win32.Filesystem.PathFormat)
Source: snd.exe, Alphaleonis/Win32/Filesystem/DirectoryInfo.cs	Security API names: System.Void Alphaleonis.Win32.Filesystem.File::SetAccessControlCore(System.String,Microsoft.Win32.SafeHandles.SafeFileHandle,System.Security.AccessControl.ObjectSecurity,System.Security.AccessControl.AccessControlSections,Alphaleonis.Win32.Filesystem.PathFormat)
Source: snd.exe, Alphaleonis/Win32/Filesystem/DirectoryInfo.cs	Security API names: System.Security.AccessControl.DirectorySecurity Alphaleonis.Win32.Filesystem.File::GetAccessControlCore<System.Security.AccessControl.DirectorySecurity>(System.Boolean,System.String,System.Security.AccessControl.AccessControlSections,Alphaleonis.Win32.Filesystem.PathFormat)
Source: snd.exe, Alphaleonis/Win32/Filesystem/BackupFileStream.cs	Security API names: System.Void Alphaleonis.Win32.Filesystem.File::SetAccessControlCore(System.String,Microsoft.Win32.SafeHandles.SafeFileHandle,System.Security.AccessControl.ObjectSecurity,System.Security.AccessControl.AccessControlSections,Alphaleonis.Win32.Filesystem.PathFormat)

Source: snd.exe

Static file information: File size 1355264 > 1048576

Source: snd.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: snd.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: snd.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x14a400

Source: snd.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: snd.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\work\file_sender\sender2\sender2\bin\Release\sender2.pdb source: snd.exe
Source:	Binary string: C:\work\file_sender\sender2\sender2\bin\Release\sender2.pdbx source: snd.exe

Source: C:\Users\user\Desktop\snd.exe

Code function: 0_2_00007FFF3016620C push ds; ret

0_2_00007FFF3016620F

Source: C:\Windows\System32\conhost.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\snd.exe	Window / User API: threadDelayed 3965			Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Window / User API: threadDelayed 5815			Jump to behavior

Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -22136092888451448s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -99843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -99703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -99584s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -99435s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -99290s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -99187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -99077s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -98968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -98859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -98750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -98640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -98530s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -98421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -98312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -98202s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -98093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -97983s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -97874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -97765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -97656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -97546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -97437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -97327s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -97218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -97108s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -96998s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -96890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -96780s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -96669s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -96562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -96449s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -96342s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -96234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -96121s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -96015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -95906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -95795s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -95687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -95577s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -95468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -95359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -95241s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -95140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -95031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -94922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -94812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -94703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -94592s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -94483s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe TID: 4592	Thread sleep time: -94373s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\snd.exe

System information queried: CurrentTimeZoneInformation

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\snd.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 99843	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 99703	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 99584	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 99435	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 99290	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 99187	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 99077	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 98968	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 98859	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 98750	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 98640	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 98530	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 98421	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 98312	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 98202	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 98093	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 97983	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 97874	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 97765	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 97656	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 97546	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 97437	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 97327	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 97218	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 97108	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 96998	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 96890	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 96780	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 96669	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 96562	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 96449	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 96342	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 96234	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 96121	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 96015	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 95906	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 95795	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 95687	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 95577	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 95468	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 95359	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 95241	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 95140	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 95031	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 94922	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 94812	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 94703	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 94592	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 94483	Jump to behavior
Source: C:\Users\user\Desktop\snd.exe	Thread delayed: delay time: 94373	Jump to behavior

Source: snd.exe, 00000000.00000002.519127719.000000000131A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: snd.exe, 00000000.00000002.519127719.000000000131A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllD

Anti Debugging

Found potential dummy code loops (likely to delay analysis)

Source: C:\Users\user\Desktop\snd.exe

Process Stats: CPU usage > 90% for more than 60s

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\snd.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\snd.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\snd.exe

Queries volume information: C:\Users\user\Desktop\snd.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\snd.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	2 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	122 Virtualization/Sandbox Evasion	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	11 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Obfuscated Files or Information	NTDS	122 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
snd.exe	53%	Virustotal		Browse
snd.exe	61%	ReversingLabs	ByteCode-MSIL.Trojan.ExMatter
snd.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://164.92.232.192/data/x	0%	Avira URL Cloud	safe
https://164.92.232.192/data/3Can	0%	Avira URL Cloud	safe
https://164.92.232.192/data/WORKGROUP.813848/	0%	Avira URL Cloud	safe
https://duckduckgo.comqThere	0%	Avira URL Cloud	safe
https://164.92.232.192x	0%	Avira URL Cloud	safe
https://164.92.232.192/data/	0%	Avira URL Cloud	safe
https://164.92H	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://164.92.232.192/data/x	snd.exe, 00000000.00000002.519526709.00000000031C1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://164.92.232.192/data/3Can	snd.exe	false	Avira URL Cloud: safe	unknown
https://164.92.232.192/data/WORKGROUP.813848/	snd.exe, 00000000.00000002.519526709.00000000031C1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tools.ietf.org/html/rfc4253#section-4.2	snd.exe	false		high
https://duckduckgo.comqThere	snd.exe	false	Avira URL Cloud: safe	unknown
https://164.92.232.192x	snd.exe, 00000000.00000002.519526709.00000000031C1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	snd.exe, 00000000.00000002.519526709.00000000031C1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://164.92.232.192/data/	snd.exe	false	Avira URL Cloud: safe	unknown
https://tools.ietf.org/html/rfc4253#sec	snd.exe	false		high
https://164.92H	snd.exe, 00000000.00000002.519656216.000000000327C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://tools.ietf.org/html/rfc4253#section-4.	snd.exe	false		high
https://duckduckgo.com	snd.exe	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
164.92.232.192	unknown	United States		46930	ASN-DPSDUS	false

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	568663
Start date:	08.02.2022
Start time:	17:23:19
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	snd.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.evad.winEXE@2/1@0/1
EGA Information:	Failed
HDC Information:	Successful, ratio: 7.1% (good quality ratio 5.6%) Quality average: 55.7% Quality standard deviation: 36.8%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 23.211.6.115
Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, client.wns.windows.com, fs.microsoft.com, store-images.s-microsoft.com, ctldl.windowsupdate.com, store-images.s-microsoft.com-c.edgekey.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
Execution Graph export aborted for target snd.exe, PID 5692 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:24:49	API Interceptor	963x Sleep call for process: snd.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ASN-DPSDUS	a-r.m-4.GHOUL	Get hash	malicious	Browse	164.92.242.51
	a-r.m-5.GHOUL	Get hash	malicious	Browse	164.92.242.51
	a-r.m-6.GHOUL	Get hash	malicious	Browse	164.92.242.51
	i-5.8-6.GHOUL	Get hash	malicious	Browse	164.92.242.51
	a-r.m-7.GHOUL	Get hash	malicious	Browse	164.92.242.51
	m-6.8-k.GHOUL	Get hash	malicious	Browse	164.92.242.51
	m-i.p-s.GHOUL	Get hash	malicious	Browse	164.92.242.51
	m-p.s-l.GHOUL	Get hash	malicious	Browse	164.92.242.51
	x-3.2-.GHOUL	Get hash	malicious	Browse	164.92.242.51
	x-8.6-.GHOUL	Get hash	malicious	Browse	164.92.242.51
	s-h.4-.GHOUL	Get hash	malicious	Browse	164.92.242.51
	da3COg37lh	Get hash	malicious	Browse	164.92.0.33
	lQtBd3ZMbb	Get hash	malicious	Browse	164.93.32.225
	E7OcikDDkV	Get hash	malicious	Browse	164.94.100.152
	90621_Video_Oynat#U0131c#U0131.apk	Get hash	malicious	Browse	164.92.208.209
	37209_Video_Oynat#U0131c#U0131.apk	Get hash	malicious	Browse	164.92.208.209
	28054_Video_Oynat#U0131c#U0131.apk	Get hash	malicious	Browse	164.92.208.209
	60427_Video_Oynat#U0131c#U0131.apk	Get hash	malicious	Browse	164.92.208.209
	59126_Video_Oynat#U0131c#U0131.apk	Get hash	malicious	Browse	164.92.208.209
	arm7	Get hash	malicious	Browse	164.94.41.103

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\snd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	91
Entropy (8bit):	4.298548340139557
Encrypted:	false
SSDEEP:	3:ccFJfwV3XA8nwGA9KYoNRgLcv:FFOjwj9dauLe
MD5:	87449663D541AE83DCD4BDF9CBE96D0F
SHA1:	A1419597141B07ACEBDE8683C16C6D6EB92FA0B8
SHA-256:	803117358C99A080AB7B481E412993F2A9EF6A6128E1BE390A038A249650AC6F
SHA-512:	D7A73F4E32F15A6BC9C5C23B49623C183B7E7F0A76744067FD07561851815078BFF865B2C41276BF0C1C62F7B3E33BB2C2F4AD6D46E0D3DF99F095EACF7F1CC7
Malicious:	false
Reputation:	low
Preview:	Can't make an upload dir One or more errors occurred. falling back..Connecting to host.....

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.04960117701529
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	snd.exe
File size:	1355264
MD5:	0a76e0e59456d310419266270c410936
SHA1:	1b6df9f456fbb2f793d8402d78c3338355ed98be
SHA256:	886cb22ffe43a3838ef152ef57bbfa66f52b71c534bfe3d8af3d29ea973daadf
SHA512:	bc32f32dbabf995a9971b7f34a433f93cd5ef634aa1bc91402b9474b957d115f493f93ca8d738080f2e3bdfd5d5430d694706a1cc6a42e9743edc87c064336ac
SSDEEP:	24576:Jmh0AMeTP7tpKY3sN1XUNPZKoN2ALtSax+:cFBThpKTXUNPZK2jf
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%..a................................. ........@.. ....................... ............@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x54c29e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x61FB1625 [Wed Feb 2 23:39:17 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x14c250	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x14e000	0x596	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x150000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x14c1e0	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x14a2a4	0x14a400	False	0.377296880914	data	6.05319018352	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x14e000	0x596	0x600	False	0.412760416667	data	4.03797800026	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x150000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x14e0a0	0x30c	data
RT_MANIFEST	0x14e3ac	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2021
Assembly Version	1.0.0.0
InternalName	sender2.exe
FileVersion	1.0.0.0
CompanyName
LegalTrademarks
Comments
ProductName	sender2
ProductVersion	1.0.0.0
FileDescription	sender2
OriginalFilename	sender2.exe

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 8, 2022 17:24:23.024465084 CET	49762	443	192.168.2.7	164.92.232.192
Feb 8, 2022 17:24:23.024528027 CET	443	49762	164.92.232.192	192.168.2.7
Feb 8, 2022 17:24:23.024657965 CET	49762	443	192.168.2.7	164.92.232.192
Feb 8, 2022 17:24:23.287492037 CET	49762	443	192.168.2.7	164.92.232.192
Feb 8, 2022 17:24:23.287561893 CET	443	49762	164.92.232.192	192.168.2.7
Feb 8, 2022 17:26:02.606378078 CET	49762	443	192.168.2.7	164.92.232.192
Feb 8, 2022 17:26:02.653862953 CET	443	49762	164.92.232.192	192.168.2.7
Feb 8, 2022 17:26:03.405878067 CET	49849	443	192.168.2.7	164.92.232.192
Feb 8, 2022 17:26:03.405937910 CET	443	49849	164.92.232.192	192.168.2.7
Feb 8, 2022 17:26:03.406033039 CET	49849	443	192.168.2.7	164.92.232.192
Feb 8, 2022 17:26:03.461317062 CET	49849	443	192.168.2.7	164.92.232.192
Feb 8, 2022 17:26:03.461361885 CET	443	49849	164.92.232.192	192.168.2.7
Feb 8, 2022 17:26:06.693900108 CET	49853	22	192.168.2.7	164.92.232.192
Feb 8, 2022 17:26:06.724852085 CET	22	49853	164.92.232.192	192.168.2.7
Feb 8, 2022 17:26:06.724984884 CET	49853	22	192.168.2.7	164.92.232.192
Feb 8, 2022 17:26:06.749135971 CET	49853	22	192.168.2.7	164.92.232.192
Feb 8, 2022 17:26:06.764698982 CET	22	49853	164.92.232.192	192.168.2.7
Feb 8, 2022 17:26:06.816354990 CET	49853	22	192.168.2.7	164.92.232.192
Feb 8, 2022 17:26:07.017211914 CET	49853	22	192.168.2.7	164.92.232.192
Feb 8, 2022 17:26:07.046648979 CET	22	49853	164.92.232.192	192.168.2.7
Feb 8, 2022 17:26:07.047993898 CET	22	49853	164.92.232.192	192.168.2.7
Feb 8, 2022 17:26:07.097641945 CET	49853	22	192.168.2.7	164.92.232.192
Feb 8, 2022 17:26:12.561610937 CET	49853	22	192.168.2.7	164.92.232.192
Feb 8, 2022 17:26:12.590997934 CET	22	49853	164.92.232.192	192.168.2.7
Feb 8, 2022 17:26:14.518470049 CET	49853	22	192.168.2.7	164.92.232.192
Feb 8, 2022 17:26:14.547741890 CET	22	49853	164.92.232.192	192.168.2.7
Feb 8, 2022 17:26:14.555624962 CET	22	49853	164.92.232.192	192.168.2.7
Feb 8, 2022 17:26:14.723253965 CET	49853	22	192.168.2.7	164.92.232.192
Feb 8, 2022 17:26:22.299853086 CET	49853	22	192.168.2.7	164.92.232.192
Feb 8, 2022 17:26:22.328149080 CET	49853	22	192.168.2.7	164.92.232.192
Feb 8, 2022 17:26:22.329166889 CET	22	49853	164.92.232.192	192.168.2.7
Feb 8, 2022 17:26:22.358473063 CET	22	49853	164.92.232.192	192.168.2.7
Feb 8, 2022 17:26:22.358499050 CET	22	49853	164.92.232.192	192.168.2.7
Feb 8, 2022 17:26:22.370834112 CET	49853	22	192.168.2.7	164.92.232.192
Feb 8, 2022 17:26:22.409041882 CET	22	49853	164.92.232.192	192.168.2.7
Feb 8, 2022 17:26:22.421771049 CET	49853	22	192.168.2.7	164.92.232.192
Feb 8, 2022 17:26:22.453186989 CET	22	49853	164.92.232.192	192.168.2.7
Feb 8, 2022 17:26:22.453304052 CET	49853	22	192.168.2.7	164.92.232.192
Feb 8, 2022 17:26:26.199938059 CET	49849	443	192.168.2.7	164.92.232.192

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: snd.exePID: 5692, Parent PID: 660

General

Target ID:	0
Start time:	17:24:45
Start date:	08/02/2022
Path:	C:\Users\user\Desktop\snd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\snd.exe"
Imagebase:	0xd30000
File size:	1355264 bytes
MD5 hash:	0A76E0E59456D310419266270C410936
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5516, Parent PID: 5692

General

Target ID:	1
Start time:	17:24:45
Start date:	08/02/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: snd.exePID: 5692, Parent PID: 660COMMON

Executed Functions

Function 00007FFF30167195 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e083dbe68b01a9119ebcf330bcaaadb1c6313974fa97295a53fafd8eefda2d65
Instruction ID: cfaafebe78957f2e373b9d5fd5379f9db43f3275c281d643f7e5e07c06e5d7c6
Opcode Fuzzy Hash: e083dbe68b01a9119ebcf330bcaaadb1c6313974fa97295a53fafd8eefda2d65
Instruction Fuzzy Hash: 98A1F33190868E4FDB95EF28CC146EA7BE1FF95314F4406BBE85DC7292DA38A846C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF301667BF Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 978ef98f336bce2ae57c252c8e47bf498f4e43b41f073564f75e7bfac687495a
Instruction ID: 76fd588d63d2dde703ffefed3bd3cfbfa6a5c364e3478ded0c1de69582519bb5
Opcode Fuzzy Hash: 978ef98f336bce2ae57c252c8e47bf498f4e43b41f073564f75e7bfac687495a
Instruction Fuzzy Hash: 4181E734919A4E8FDF88EF18C840AA977E1FF55318F5046ADE81DDB396CA34E846CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF30166F67 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86552aeaea6bfa107b10451f3a4edd1287bfcb13bc94aeda3c37f15df37fa153
Instruction ID: a04cfd11c1d618fea3bf1b96e2955b7be7f2646a712b0e35cc8396791285e42a
Opcode Fuzzy Hash: 86552aeaea6bfa107b10451f3a4edd1287bfcb13bc94aeda3c37f15df37fa153
Instruction Fuzzy Hash: 6751AD31918B5C8FDB58EF58D8456EDBBF1FF99310F04826BE449D7252CA34A885CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF301641BA Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae377a17fb2007a10369c44869765034810fe5393534041f75507d1646f1d1cf
Instruction ID: f58d7b62c3053933b368fbcba54db70e7207bc7fb90b328b2fb6acbdaed4c424
Opcode Fuzzy Hash: ae377a17fb2007a10369c44869765034810fe5393534041f75507d1646f1d1cf
Instruction Fuzzy Hash: 3D4118A071891D5FDADCFF5880D2BA976D2FB98306B50497CD40ED328ACD2CA845DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF30167E94 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cb0fdef8be7ee433828d8dce3016920cfa1661486edcbab140ef32a5c53b6b5
Instruction ID: e6baafec7731c4c060ff2d3b272b37ef6d74781432bb3e12b5cf017346cd3376
Opcode Fuzzy Hash: 2cb0fdef8be7ee433828d8dce3016920cfa1661486edcbab140ef32a5c53b6b5
Instruction Fuzzy Hash: DB41183150D68D8FCF89EF58C850AEABBE1FF55314F1405AEE45ADB295CA34A845C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF30166837 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50076468f50bb7721013bf1238505ef59ae4190be7f98268df18290c083a9589
Instruction ID: 1ce7b363f03169f9eff799a8058f05a9ac323aaca9b9f93f6582f54cc7ab871a
Opcode Fuzzy Hash: 50076468f50bb7721013bf1238505ef59ae4190be7f98268df18290c083a9589
Instruction Fuzzy Hash: A741473451864E8FDF89EF18C490A9A77E2FF99304B104669E859DB385C735EC42CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF30166814 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06619013883f5b34cf701ffd2a3a7a87f9ed16af18aa0f16aee783cb173158a1
Instruction ID: 8d0b3140f9849744886ec06fc56f137d28fd7ac6d3821ee0eaef56cd25df1c3c
Opcode Fuzzy Hash: 06619013883f5b34cf701ffd2a3a7a87f9ed16af18aa0f16aee783cb173158a1
Instruction Fuzzy Hash: 45416A3461864E8FDF89EF18C890AA977E1FF59314B10466DD459DB385C635F846CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF30167D21 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86cce537894c3d5d87f2cbc2e843afe32f74fff54df20e28218b71fb0074005e
Instruction ID: be2b90a5098cbf036a71ab5d1549044ed8a36ef275e8a7d0ac24c94e8973617d
Opcode Fuzzy Hash: 86cce537894c3d5d87f2cbc2e843afe32f74fff54df20e28218b71fb0074005e
Instruction Fuzzy Hash: 89212131B189198FDB99FB18C495965B3D2FF9830475485B9E40EC7396DE34EC81DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF30167211 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fa9425380642bfbc052d8d68c1bc94b04d92eb63e8a26a8930ceadb0f7e0c47
Instruction ID: 5382b7ce4ad769e3a0511a56404cfe29ed040a5826c27a06e2e7571dbb2d4ba7
Opcode Fuzzy Hash: 1fa9425380642bfbc052d8d68c1bc94b04d92eb63e8a26a8930ceadb0f7e0c47
Instruction Fuzzy Hash: 9321A127D0C99E0AF7A1B6684C222FB76E0EF59328F04017BF85DC36C3DD1C69195691

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF30166165 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 817638981653f2a82c6e234b0891a08f06c5336a3af73c30d01773d274d8212e
Instruction ID: 9abf362e01fade5c783b946fa16297290050f0ff02fc7ffc3779e1b8110a31e7
Opcode Fuzzy Hash: 817638981653f2a82c6e234b0891a08f06c5336a3af73c30d01773d274d8212e
Instruction Fuzzy Hash: 5D21D234918A4D8FDF99DF18C450AEEBBF1FF99310F541169E499E7391CA34A882CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF3016599F Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c68d26651f13dc79d0eb83785c93c8054552a91b7b4faaf6fbb9d496aa092524
Instruction ID: 5f4defca3b033d14e3de89879a5032f57086f39baa128c388243ea84d4f7c4b2
Opcode Fuzzy Hash: c68d26651f13dc79d0eb83785c93c8054552a91b7b4faaf6fbb9d496aa092524
Instruction Fuzzy Hash: FD115E31A28A0D8FDB94FF68C4455AAB7E1FF98305B10057AE49ED3295DF34E805CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF3016596D Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be084825360aecf49575103652a4562f1dea5d4c7658757d9c63ae39116abdb9
Instruction ID: 3266eefc44b96bbc88c150cc75c0abdeda83eb14964ae5c85116a1625e0bad43
Opcode Fuzzy Hash: be084825360aecf49575103652a4562f1dea5d4c7658757d9c63ae39116abdb9
Instruction Fuzzy Hash: 7A114F31B18A098FDB95FB3884455BD77E1FF59305B5004BAE44AD3292DF38E805DB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF301655CA Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b500486e32bbeede7cf840533020901ee8015acc94490d0a015ef3ccc5975049
Instruction ID: d840df0747b22c35addcc4d1feccf59debc373542a63b59ccc5921734218feea
Opcode Fuzzy Hash: b500486e32bbeede7cf840533020901ee8015acc94490d0a015ef3ccc5975049
Instruction Fuzzy Hash: 6F11032075CE4A5FF699B33840667BDA6D6BFA8310F484279D08ED26C3CE1CA501D395

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF30165A95 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0036d7095b29a4a3289ed2d8990627d3228f80365ec97ea3740bb00459856fb8
Instruction ID: 54b08dde106927a378ed89763d0cb0683abbadb21f7541d14d36b9db7d00a9d3
Opcode Fuzzy Hash: 0036d7095b29a4a3289ed2d8990627d3228f80365ec97ea3740bb00459856fb8
Instruction Fuzzy Hash: 6501D83191D6994FD742F7385C556E13FE1EF46324B0902E7E448CB1A3CA1CAD81C391

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF30167125 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dae329d4b86bde6181d09bbf627c6ad38fca964e46891f5c803791471e53b75
Instruction ID: c1fbe9fa3674d4bb98031570cbb9846d3685df818a5f21b514758e93f58db826
Opcode Fuzzy Hash: 8dae329d4b86bde6181d09bbf627c6ad38fca964e46891f5c803791471e53b75
Instruction Fuzzy Hash: 3201AD2294E3C25FE71363788CA16857FA09F07134F4E02EAD4C58B6E3E59E648AD312

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF301660A7 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6cd53f6e8c2811064442d7c0cbcbe306725271190028206fe70bf2a3863cb38
Instruction ID: cf2aef81e0d4027d85dd3aa899e028651ea40a675e012faaad2fc06cf3373f7e
Opcode Fuzzy Hash: d6cd53f6e8c2811064442d7c0cbcbe306725271190028206fe70bf2a3863cb38
Instruction Fuzzy Hash: D0011730608A4E8FDF89EF54C490EA5B7E2FF543147144669D41DCB296CB35E892CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF3016055D Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d34492c9fd60b05bebca399cab57b8ba9a87e6dbb06112a84b4030eda0615fc7
Instruction ID: dc3337d6d2d21004f70d2aa3058aca9f0fb170f94cabd5868047c51d61e80c9c
Opcode Fuzzy Hash: d34492c9fd60b05bebca399cab57b8ba9a87e6dbb06112a84b4030eda0615fc7
Instruction Fuzzy Hash: B0F04410E1C94A4AF762B7B8948A3BA6BD1AF5A722F1402B7E50DE33C3DD285591C391

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF3016610D Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8623786156f0b9ec2c03a039d557d17705266db0ba660511cd9d8df801f3b9f5
Instruction ID: c78f7e94f0bf24eac2f49ed28050609ae27cf119a87365f26ebe323024a04dca
Opcode Fuzzy Hash: 8623786156f0b9ec2c03a039d557d17705266db0ba660511cd9d8df801f3b9f5
Instruction Fuzzy Hash: 4AF0DA34628B498F8F88EE18C8E5979B7D1FBA8705B50466D944AC7396CE34F842CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF30164B9A Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e364174a380033b4f604e051fbe1dc3f9dd4e758edccdc1df00694dc2da9969
Instruction ID: 69d9ae46e7aaf6056abc4a82a49dbe7146aa1756facbe5f5f76cfdf12846c63b
Opcode Fuzzy Hash: 7e364174a380033b4f604e051fbe1dc3f9dd4e758edccdc1df00694dc2da9969
Instruction Fuzzy Hash: 7AF0A731518D094FE7A6F758A0918FEB3D1EF54320744073AE00AC25D3DF18B5469380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF30160108 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e0a17b693ff5fd1b21af88d3bcfb01292136f2fbe7a412bf04c49434bc00265
Instruction ID: fedda21d9a3001b19d0b158fa881ee902a540a006742b34b89096539ad0bc6c6
Opcode Fuzzy Hash: 0e0a17b693ff5fd1b21af88d3bcfb01292136f2fbe7a412bf04c49434bc00265
Instruction Fuzzy Hash: E7E0ED30A1881D9FD7A4F72C88497657AD1FF98719F4505B5E40DE3269DE28AC809790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF30165383 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9be7c8020a38a9a274f697b52cf145a9c39ff1e59e94570815d08ae64cf022ad
Instruction ID: 7648589346f0bc99c7bdc2765cec8d6dd0c0bc7bb68a0b9266157770f5c34b0c
Opcode Fuzzy Hash: 9be7c8020a38a9a274f697b52cf145a9c39ff1e59e94570815d08ae64cf022ad
Instruction Fuzzy Hash: C2E0E5398196840FE725BBB894450F83BE0FF1130570005BBD045D76D3DD0CA909D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF301663C0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d0662decda0312c6122a25ebb093045bacb921a47dcc9ecaf438da261961c57
Instruction ID: 80e62d944e71c8b82dcecc7109c4b3f60e351b51b9db8a1f7d11ba9175245bcb
Opcode Fuzzy Hash: 0d0662decda0312c6122a25ebb093045bacb921a47dcc9ecaf438da261961c57
Instruction Fuzzy Hash: C7E0123561890D8FDF84EF18D8416E9B7E1FF54718B5001A5E54DC3245CA25E852C7C0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF301604AE Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d60e744ee9057ca658e7614777e97b2e7445d4abfde6072190c977c09feb60de
Instruction ID: ef3aa8d4ee1f9ca503608f7969710a1c88c9ca2bbf4e11f001803bf9a7bd23de
Opcode Fuzzy Hash: d60e744ee9057ca658e7614777e97b2e7445d4abfde6072190c977c09feb60de
Instruction Fuzzy Hash: A1E04F24B28B190BDA98F728944266937D2FB88304B4084B4A00DD338ECE2CAD02D745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF30160502 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df16b8cd0b714d92ea30968e41c20cbe39f9aef81e03c9d7ae1d207c849be407
Instruction ID: 3a99b9da338b3a414805c81dc924db42ee8201d78193204a7ae00fda0fe43ca0
Opcode Fuzzy Hash: df16b8cd0b714d92ea30968e41c20cbe39f9aef81e03c9d7ae1d207c849be407
Instruction Fuzzy Hash: E6E09B20D1860A5EEB90EBE8808D1B97FE0FF19711F4405FAD50DD3386DD281951C391

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF30165D2D Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60c6a8aa0d6c2f20d5bd184682bdcd0b1a7498ba5c0654081702677584fb147d
Instruction ID: 2344c3b5966177bab68ef8e05a841eac1cff698e56449e6a073c6905485b8f53
Opcode Fuzzy Hash: 60c6a8aa0d6c2f20d5bd184682bdcd0b1a7498ba5c0654081702677584fb147d
Instruction Fuzzy Hash: 8CD05E22F4481E0AAB54B7B46C562FDB2E6FFC8215F804436F81ED22C3CD2869115681

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF3016666D Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88b4dcea0ec4b0d3df3034e7a929f9b9399cc9295b68301c9024ba09172c5219
Instruction ID: 79c7f51ee686424e60031545a4d0f25ebc704567e2644db053f492ceab3b30a3
Opcode Fuzzy Hash: 88b4dcea0ec4b0d3df3034e7a929f9b9399cc9295b68301c9024ba09172c5219
Instruction Fuzzy Hash: B8D05E21F4481E1AAB54B778BC462FDB2D6FFC8215B800036E81ED22C3CD2969114681

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF30164B63 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc12bdb0732ed1e87ab53818f9e5a082c55ac54ccbbf14cc877bd9eb304c787e
Instruction ID: f7474def8ba28e1de26087010fe591f98567f0ffe5833993cf9a9821e648d5c4
Opcode Fuzzy Hash: bc12bdb0732ed1e87ab53818f9e5a082c55ac54ccbbf14cc877bd9eb304c787e
Instruction Fuzzy Hash: 89E0E61971890D4FE3D4B63CA4952B952C2EB9C25474C057FD44EC3297DD58A801A640

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF30167BFD Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44e68f63b8430a64de3b070728d1263fb30bc409a9713c0dd700c0df9cf9eba6
Instruction ID: ea1f2046baa32b73b2ce290b0762a3141c8e7d8e11561bb2f89638f3936f0a98
Opcode Fuzzy Hash: 44e68f63b8430a64de3b070728d1263fb30bc409a9713c0dd700c0df9cf9eba6
Instruction Fuzzy Hash: 05D05E22F4481E0AEB64B7746C461FEB2D6FFC8225B800436E81ED2283DD2869114681

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF301678D8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5390a855f2444765058defff54dd31cb4cb880099c73be5d3164e6a1a107664a
Instruction ID: 25555ba0675f9ec099a649788a90ed20ea264a4356f7863e67e5dc1398d0ffbf
Opcode Fuzzy Hash: 5390a855f2444765058defff54dd31cb4cb880099c73be5d3164e6a1a107664a
Instruction Fuzzy Hash: 7BD0C906B29C9E0FA3E0E56C28992B963C6E79856A7440377E81DD374ADC055D1262C5

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF301654D6 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ae29f858a7a062d825d36d3728672917b78077b0fe1e1eebb704003e2b8dd04
Instruction ID: b22fecf7783aa58bab63bb5f5a4d065fe6864ce9575218990be4af29d45e558c
Opcode Fuzzy Hash: 8ae29f858a7a062d825d36d3728672917b78077b0fe1e1eebb704003e2b8dd04
Instruction Fuzzy Hash: 9DD05B14718C4F1BA795F22C54955FD52C2DB94314754047AE40FD37F7DE18A84363C0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF301604CC Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d0d158d4f205d608084d370ec201cd8fddf1cf269f0e69b2e7db6d9b7fcac21
Instruction ID: 8ed73e841a375d01f27a34ad678829dea0d6dd1ba63ce217a642dfcd582fa395
Opcode Fuzzy Hash: 6d0d158d4f205d608084d370ec201cd8fddf1cf269f0e69b2e7db6d9b7fcac21
Instruction Fuzzy Hash: E9D01720A28A1A1AEA98F738484267922D2BF88304B4084B4A40DD738BDE2CAC06D605

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF301654A8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b6daf277b6d44ec4e0928c855420aed53e7d78f76cb79cd4c868936e8918c4
Instruction ID: 30932fa2a0dc5966342d12aa023ce2aabeed482687b125be76fb0cc636e13837
Opcode Fuzzy Hash: 23b6daf277b6d44ec4e0928c855420aed53e7d78f76cb79cd4c868936e8918c4
Instruction Fuzzy Hash: 04D01221708D054FF7A1EA1890947BA53D2AB98251F180165C00DC72C6DE18D802C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF30160520 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd2fcdb64ee2f5ae0489ccbd00a7d7a2fedfc555d72db6101f119c183c50d223
Instruction ID: 1fa227b440639b4dc518aaf3bfbb25d9ff7426e9e7abd0d113b4c65f086de07c
Opcode Fuzzy Hash: bd2fcdb64ee2f5ae0489ccbd00a7d7a2fedfc555d72db6101f119c183c50d223
Instruction Fuzzy Hash: 51E08621C1850B5EE751ABF4409E2F9BFE0EF15711F4402F6A50DE22C2DD241591C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF30164190 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0a4d989fdbefe6c6a968d31b94d9935addc3864f9952a9b734d2d2b1786efd7
Instruction ID: 12f9b0b0b38626c69fa4f67b85c3a8710664d485c005e4187751eca7ff24fa3e
Opcode Fuzzy Hash: c0a4d989fdbefe6c6a968d31b94d9935addc3864f9952a9b734d2d2b1786efd7
Instruction Fuzzy Hash: AAD0A719B0C90D0FB1E4F52C54143B963C0EBB4230740423FDC0EC3693DC09284652C0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF30165489 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c39219556583c672b015d921e3c0f0f1ef9fdaf996ae49eb391dfe2165a72a9
Instruction ID: b03933fad7a6b12012b0c28a0241ffa28217e3120c84b211bfb4f4344c64225f
Opcode Fuzzy Hash: 6c39219556583c672b015d921e3c0f0f1ef9fdaf996ae49eb391dfe2165a72a9
Instruction Fuzzy Hash: A0C08046708D8757D35271381CD91F446C19B7521D78404755C0F93FF3DD0558A19140

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF30167170 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98c27d8e2282e416b1df333a0d025d996150c040143cabbfc033f05f46b8fa5d
Instruction ID: 81779e2cd96b82a09e46565d7667c7a32d74b390a9007f536aadd62b1ac6e4ed
Opcode Fuzzy Hash: 98c27d8e2282e416b1df333a0d025d996150c040143cabbfc033f05f46b8fa5d
Instruction Fuzzy Hash: 70C08C10A3080917DA1CF7BC8CD22A42AD1BB4C200FC00270E409E2286EC6C5880C391

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF301665C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f7eb3bf8fdf79808170321a93e50727b4d509f1e50009420c2b4b2645fc31d8
Instruction ID: 684d0d2cc51282e5129a014e083317eacc213a74dec48fd1943b7f8ac57f6a4b
Opcode Fuzzy Hash: 5f7eb3bf8fdf79808170321a93e50727b4d509f1e50009420c2b4b2645fc31d8
Instruction Fuzzy Hash: 9DC02B2000D184CFCB01FF0880509863BD0AF00304B00010BB045C3353CC10D404D751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFF301673A9 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.522254556.00007FFF30160000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFF30160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fff30160000_snd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d71806700fe1cb5e0cc1011cdc337686e6cfab90ab8ebe5ad69095090e29566d
Instruction ID: 53af6fca1b700bb7bb0616c554fdfd939dd24c18d69bbceef0b583108398b9db
Opcode Fuzzy Hash: d71806700fe1cb5e0cc1011cdc337686e6cfab90ab8ebe5ad69095090e29566d
Instruction Fuzzy Hash: 08B01223C4800DD59B1030C03C010FDB754CB00229F411773F91D411414D1521742181

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report snd.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Unpacked PEs

Sigma Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

TCP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: snd.exePID: 5692, Parent PID: 660

General

Chronological Activities

Windows Analysis Report
snd.exe