Joe Sandbox Cloud Basic Analysis Report
Edit tour

Windows Analysis Report
whost.exe

Overview

General Information

Sample Name:whost.exe
Analysis ID:798066
MD5:c0eb3eac96511077dafc0afa64c6388c
SHA1:33e81f25493eda3bbf0b7cdcddd523547fa6c31e
SHA256:eec4f18f3655f7eab0c08783ad42d2b3ce3ef21ecad7394e165f11acdb41c42a
Infos:

Detection

Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Uses 32bit PE files
Sample file is different than original file name gathered from version info
Tries to load missing DLLs
Program does not show much activity (idle)
Yara detected NetSupport remote tool

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

Process Tree

  • System is w10x64native
  • whost.exe (PID: 7744 cmdline: C:\Users\user\Desktop\whost.exe MD5: C0EB3EAC96511077DAFC0AFA64C6388C)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
whost.exeJoeSecurity_NetSupportYara detected NetSupport remote toolJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    00000001.00000002.17826172223.0000000000932000.00000004.00000001.01000000.00000003.sdmpJoeSecurity_NetSupportYara detected NetSupport remote toolJoe Security
      00000001.00000000.16595979776.0000000000932000.00000002.00000001.01000000.00000003.sdmpJoeSecurity_NetSupportYara detected NetSupport remote toolJoe Security
        00000001.00000002.17826194848.0000000000933000.00000002.00000001.01000000.00000003.sdmpJoeSecurity_NetSupportYara detected NetSupport remote toolJoe Security
          Process Memory Space: whost.exe PID: 7744JoeSecurity_NetSupportYara detected NetSupport remote toolJoe Security

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            1.0.whost.exe.930000.0.unpackJoeSecurity_NetSupportYara detected NetSupport remote toolJoe Security
              1.2.whost.exe.930000.0.unpackJoeSecurity_NetSupportYara detected NetSupport remote toolJoe Security

                Sigma Signatures

                ⊘No Sigma rule has matched

                Snort Signatures

                ⊘No Snort rule has matched

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Source: whost.exeVirustotal: Detection: 14%Perma Link
                Source: whost.exeReversingLabs: Detection: 17%
                Source: whost.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                Source: whost.exeStatic PE information: certificate valid
                Source: whost.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                Source: Binary string: E:\nsmsrc\nsm\1400\1400\client32\release_unicode\client32.pdb source: whost.exe
                Source: whost.exeString found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
                Source: whost.exeString found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
                Source: whost.exeString found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0$
                Source: whost.exeString found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
                Source: whost.exeString found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
                Source: whost.exeString found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
                Source: whost.exeString found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
                Source: whost.exeString found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
                Source: whost.exeString found in binary or memory: http://ocsp.globalsign.com/rootr30;
                Source: whost.exeString found in binary or memory: http://ocsp2.globalsign.com/rootr606
                Source: whost.exeString found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
                Source: whost.exeString found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
                Source: whost.exeString found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
                Source: whost.exeString found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
                Source: whost.exeString found in binary or memory: https://www.globalsign.com/repository/0
                Source: whost.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                Source: whost.exe, 00000001.00000000.16595979776.0000000000932000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameclient32.exe0 vs whost.exe
                Source: whost.exe, 00000001.00000002.17826194848.0000000000933000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameclient32.exe0 vs whost.exe
                Source: whost.exeBinary or memory string: OriginalFilenameclient32.exe0 vs whost.exe
                Source: C:\Users\user\Desktop\whost.exeSection loaded: pcicl32.dllJump to behavior
                Source: whost.exeVirustotal: Detection: 14%
                Source: whost.exeReversingLabs: Detection: 17%
                Source: whost.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                Source: C:\Users\user\Desktop\whost.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                Source: classification engineClassification label: mal48.winEXE@1/0@0/0
                Source: whost.exeStatic PE information: certificate valid
                Source: whost.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                Source: whost.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                Source: Binary string: E:\nsmsrc\nsm\1400\1400\client32\release_unicode\client32.pdb source: whost.exe
                Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
                Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
                Source: Yara matchFile source: whost.exe, type: SAMPLE
                Source: Yara matchFile source: 1.0.whost.exe.930000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 1.2.whost.exe.930000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000001.00000002.17826172223.0000000000932000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000000.16595979776.0000000000932000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.17826194848.0000000000933000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: whost.exe PID: 7744, type: MEMORYSTR

                Mitre Att&ck Matrix

                Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                Valid AccountsWindows Management Instrumentation1
                DLL Side-Loading                		1
                DLL Side-Loading                		1
                DLL Side-Loading                		OS Credential Dumping1
                System Information Discovery                		Remote ServicesData from Local SystemExfiltration Over Other Network MediumData ObfuscationEavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet
                behaviorgraph top1 signatures2 2 Behavior Graph ID: 798066 Sample: whost.exe Startdate: 03/02/2023 Architecture: WINDOWS Score: 48 7 Multi AV Scanner detection for submitted file 2->7 5 whost.exe 2->5         started        process3

                Screenshots

                Download Video

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                whost.exe14%VirustotalBrowse
                whost.exe17%ReversingLabsWin32.Trojan.NetSup

                Dropped Files

                ⊘No Antivirus matches

                Unpacked PE Files

                ⊘No Antivirus matches

                Domains

                ⊘No Antivirus matches

                URLs

                ⊘No Antivirus matches

                Domains and IPs

                Contacted Domains

                ⊘No contacted domains info

                World Map of Contacted IPs

                ⊘No contacted IP infos

                General Information

                Joe Sandbox Version:36.0.0 Rainbow Opal
                Analysis ID:798066
                Start date and time:2023-02-03 18:17:04 +01:00
                Joe Sandbox Product:CloudBasic
                Overall analysis duration:0h 5m 1s
                Hypervisor based Inspection enabled:false
                Report type:full
                Cookbook file name:default.jbs
                Analysis system description:Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
                Number of analysed new started processes analysed:4
                Number of new started drivers analysed:0
                Number of existing processes analysed:0
                Number of existing drivers analysed:0
                Number of injected processes analysed:0
                Technologies:
                • HCA enabled
                • EGA enabled
                • HDC enabled
                • AMSI enabled
                Analysis Mode:default
                Analysis stop reason:Timeout
                Sample file name:whost.exe
                Detection:MAL
                Classification:mal48.winEXE@1/0@0/0
                EGA Information:Failed
                HDC Information:
                • Successful, ratio: 100% (good quality ratio 100%)
                • Quality average: 75%
                • Quality standard deviation: 25%
                HCA Information:
                • Successful, ratio: 100%
                • Number of executed functions: 0
                • Number of non-executed functions: 1
                Cookbook Comments:
                • Found application associated with file extension: .exe
                • Exclude process from analysis (whitelisted): dllhost.exe, backgroundTaskHost.exe
                • Excluded domains from analysis (whitelisted): wdcpalt.microsoft.com, client.wns.windows.com, login.live.com, tile-service.weather.microsoft.com, wdcp.microsoft.com
                • Execution Graph export aborted for target whost.exe, PID 7744 because there are no executed function

                Simulations

                Behavior and APIs

                ⊘No simulations

                Joe Sandbox View / Context

                IPs

                ⊘No context

                Domains

                ⊘No context

                ASNs

                ⊘No context

                JA3 Fingerprints

                ⊘No context

                Dropped Files

                ⊘No context

                Created / dropped Files

                ⊘No created / dropped files found

                Static File Info

                General

                File type:PE32 executable (GUI) Intel 80386, for MS Windows
                Entropy (8bit):5.257879279950983
                TrID:
                • Win32 Executable (generic) a (10002005/4) 99.96%
                • Generic Win/DOS Executable (2004/3) 0.02%
                • DOS Executable Generic (2002/1) 0.02%
                • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                File name:whost.exe
                File size:120232
                MD5:c0eb3eac96511077dafc0afa64c6388c
                SHA1:33e81f25493eda3bbf0b7cdcddd523547fa6c31e
                SHA256:eec4f18f3655f7eab0c08783ad42d2b3ce3ef21ecad7394e165f11acdb41c42a
                SHA512:2632bef55323d9a272e1519e2b2792527d28cbd9fe6a9f9d253e5729978be0de6f36b8e3b2acee70449ba22a33efb41c82c82afe19dad14698b3ada0006ca7fc
                SSDEEP:768:YGpVZl6FhWr80/9P3r2pe/sIQKFKcMkjr2pe/9n/FKFKcMkW:YO0hG1Pbee/6IrTee/7Ira
                TLSH:3AC3B30F429DE173EA42E97DC4819B050DA4BEC5B5B458FB405EF63E3E3138E2B6416A
                File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.g.W.g.W.g.^...U.g.8...T.g.W.f.R.g.8...V.g.8...V.g.8...V.g.RichW.g.........PE..L......c.....................r...... ......

                File Icon

                Icon Hash:050d124130a1c151

                Static PE Info

                General

                Entrypoint:0x401020
                Entrypoint Section:.text
                Digitally signed:true
                Imagebase:0x400000
                Subsystem:windows gui
                Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                Time Stamp:0x631A0A10 [Thu Sep 8 15:28:16 2022 UTC]
                TLS Callbacks:
                CLR (.Net) Version:
                OS Version Major:5
                OS Version Minor:1
                File Version Major:5
                File Version Minor:1
                Subsystem Version Major:5
                Subsystem Version Minor:1
                Import Hash:a9d50692e95b79723f3e76fcf70d023e

                Authenticode Signature

                Signature Valid:true
                Signature Issuer:CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
                Signature Validation Error:The operation completed successfully
                Error Number:0
                Not Before, Not After
                • 17/06/2022 14:01:15 17/06/2025 14:01:15
                Subject Chain
                • E=is@netsupportsoftware.com, CN=NETSUPPORT LTD., O=NETSUPPORT LTD., STREET="Netsupport House Towngate East, Market Deeping", L=Peterborough, S=Cambridgeshire, C=GB, OID.1.3.6.1.4.1.311.60.2.1.3=GB, SERIALNUMBER=02386638, OID.2.5.4.15=Private Organization
                Version:3
                Thumbprint MD5:B4B9567796080BF425A67176A1167937
                Thumbprint SHA-1:120710637F1F0AF0646B4D694DCDAB66DF563E4F
                Thumbprint SHA-256:90BF5505DD3326758B00EF28F9E12548E344470CE4C987130039B26AB2A85137
                Serial:1F6C98CAAD2AE7C18ABBCAAD
                Instruction
                push ebp
                mov ebp, esp
                sub esp, 44h
                push esi
                call dword ptr [00402000h]
                mov esi, eax
                cmp word ptr [esi], 0022h
                jne 00007F638089471Dh
                movzx eax, word ptr [esi+02h]
                add esi, 02h
                test ax, ax
                je 00007F63808946B4h
                cmp ax, 0022h
                je 00007F63808946B4h
                movzx eax, word ptr [esi+02h]
                add esi, 02h
                test ax, ax
                jne 00007F6380894690h
                cmp word ptr [esi], 0022h
                jne 00007F63808946A5h
                add esi, 02h
                movzx eax, word ptr [esi]
                test ax, ax
                je 00007F63808946B4h
                cmp ax, 0020h
                jnbe 00007F63808946AEh
                movzx eax, word ptr [esi+02h]
                add esi, 02h
                test ax, ax
                jne 00007F6380894690h
                lea eax, dword ptr [ebp-44h]
                push eax
                mov dword ptr [ebp-18h], 00000000h
                call dword ptr [0040200Ch]
                test byte ptr [ebp-18h], 00000001h
                movzx eax, word ptr [ebp-14h]
                jne 00007F63808946A7h
                mov eax, 0000000Ah
                push eax
                push esi
                push 00000000h
                push 00000000h
                call dword ptr [00402008h]
                push eax
                call 00007F63808945FDh
                push eax
                call dword ptr [00402004h]
                nop
                cmp word ptr [esi], 0020h
                jbe 00007F6380894648h
                add esi, 02h
                jmp 00007F6380894697h
                int3
                jmp dword ptr [00402014h]
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                add byte ptr [eax], al
                Programming Language:
                • [IMP] VS2008 SP1 build 30729
                • [IMP] VS2010 build 30319
                • [C++] VS2010 build 30319
                • [RES] VS2010 build 30319
                • [LNK] VS2010 build 30319
                NameVirtual AddressVirtual Size Is in Section
                IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                IMAGE_DIRECTORY_ENTRY_IMPORT0x203c0x3c.rdata
                IMAGE_DIRECTORY_ENTRY_RESOURCE0x30000x16c08.rsrc
                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                IMAGE_DIRECTORY_ENTRY_SECURITY0x178000x5da8
                IMAGE_DIRECTORY_ENTRY_BASERELOC0x1a0000x14.reloc
                IMAGE_DIRECTORY_ENTRY_DEBUG0x20200x1c.rdata
                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                IMAGE_DIRECTORY_ENTRY_IAT0x20000x1c.rdata
                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                Sections

                NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                .text0x10000xc20x200False0.318359375data2.779985066068698IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                .rdata0x20000x15e0x200False0.466796875data3.5226937659007778IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                .rsrc0x30000x16c080x16e00False0.10605575478142076data4.132524574049277IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                .reloc0x1a0000x6c0x200False0.060546875data0.22167620545804623IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
                NameRVASizeTypeLanguageCountry
                RT_ICON0x32c80x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors
                RT_ICON0x3b700x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors
                RT_ICON0x40d80x10828Device independent bitmap graphic, 128 x 256 x 32, image size 67584
                RT_ICON0x149000x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600
                RT_ICON0x16ea80x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224
                RT_ICON0x17f500x988Device independent bitmap graphic, 24 x 48 x 32, image size 2400
                RT_ICON0x188d80x6b8Device independent bitmap graphic, 20 x 40 x 32, image size 1680
                RT_ICON0x18f900x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088
                RT_STRING0x193f80x62data
                RT_GROUP_ICON0x1945c0x76data
                RT_VERSION0x194d40x3acdata
                RT_MANIFEST0x198800x385XML 1.0 document, ASCII text, with CRLF line terminators
                DLLImport
                PCICL32.dll_NSMClient32@8
                KERNEL32.dllGetCommandLineW, ExitProcess, GetModuleHandleW, GetStartupInfoW

                Network Behavior

                Report size exceeds maximum size, please checkout the PCAP download to see all network behavior

                Statistics

                CPU Usage

                050100s020406080100

                Click to jump to process

                Memory Usage

                050100s0.00123MB

                Click to jump to process

                System Behavior

                General

                Target ID:1
                Start time:18:18:58
                Start date:03/02/2023
                Path:C:\Users\user\Desktop\whost.exe
                Wow64 process (32bit):true
                Commandline:C:\Users\user\Desktop\whost.exe
                Imagebase:0x930000
                File size:120232 bytes
                MD5 hash:C0EB3EAC96511077DAFC0AFA64C6388C
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Yara matches:
                • Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000001.00000002.17826172223.0000000000932000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
                • Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000001.00000000.16595979776.0000000000932000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
                • Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000001.00000002.17826194848.0000000000933000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
                Reputation:low
                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                Show Windows behavior

                Section Activities

                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
                Show Windows behavior

                Memory Activities

                There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

                Disassembly

                Non-executed Functions

                C-Code - Quality: 100%
                			_entry_() {
				struct _STARTUPINFOW _v72;
				signed int _t11;
				signed int _t13;
				signed int _t16;
				signed short* _t17;

				_t17 = GetCommandLineW();
				if( *_t17 != 0x22) {
					while( *_t17 > 0x20) {
						_t17 =  &(_t17[1]);
					}
					L6:
					_t11 =  *_t17 & 0x0000ffff;
					if(_t11 == 0) {
						L9:
						_v72.dwFlags = 0;
						GetStartupInfoW( &_v72);
						_t13 = _v72.wShowWindow & 0x0000ffff;
						if((_v72.dwFlags & 0x00000001) == 0) {
							_t13 = 0xa;
						}
						ExitProcess(E00931000(GetModuleHandleW(0), 0, _t17, _t13));
					}
					while(_t11 <= 0x20) {
						_t11 = _t17[1] & 0x0000ffff;
						_t17 =  &(_t17[1]);
						if(_t11 != 0) {
							continue;
						}
						goto L9;
					}
					goto L9;
				}
				_t16 = _t17[1] & 0x0000ffff;
				_t17 =  &(_t17[1]);
				if(_t16 == 0) {
					L4:
					if( *_t17 != 0x22) {
						goto L6;
					}
					L5:
					_t17 =  &(_t17[1]);
					goto L6;
				}
				while(_t16 != 0x22) {
					_t16 = _t17[1] & 0x0000ffff;
					_t17 =  &(_t17[1]);
					if(_t16 != 0) {
						continue;
					}
					goto L4;
				}
				goto L5;
			}








                0x0093102d
                0x00931033
                0x009310b0
                0x009310b6
                0x009310b6
                0x0093105c
                0x0093105c
                0x00931062
                0x00931076
                0x0093107a
                0x00931081
                0x0093108b
                0x0093108f
                0x00931091
                0x00931091
                0x009310a9
                0x009310a9
                0x00931064
                0x0093106a
                0x0093106e
                0x00931074
                0x00000000
                0x00000000
                0x00000000
                0x00931074
                0x00000000
                0x00931064
                0x00931035
                0x00931039
                0x0093103f
                0x00931053
                0x00931057
                0x00000000
                0x00000000
                0x00931059
                0x00931059
                0x00000000
                0x00931059
                0x00931041
                0x00931047
                0x0093104b
                0x00931051
                0x00000000
                0x00000000
                0x00000000
                0x00931051
                0x00000000

                APIs
                • GetCommandLineW.KERNEL32 ref: 00931027
                • GetStartupInfoW.KERNEL32(?), ref: 00931081
                • GetModuleHandleW.KERNEL32(00000000,00000000,00000000,?), ref: 0093109C
                • ExitProcess.KERNEL32 ref: 009310A9
                Memory Dump Source
                • Source File: 00000001.00000002.17826145801.0000000000931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00930000, based on PE: true
                • Associated: 00000001.00000002.17826123014.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000001.00000002.17826172223.0000000000932000.00000004.00000001.01000000.00000003.sdmpDownload File
                • Associated: 00000001.00000002.17826194848.0000000000933000.00000002.00000001.01000000.00000003.sdmpDownload File
                Joe Sandbox IDA Plugin
                • Snapshot File: hcaresult_1_2_930000_whost.jbxd
                Yara matches
                Similarity
                • API ID: CommandExitHandleInfoLineModuleProcessStartup
                • String ID:
                • API String ID: 2164999147-0
                • Opcode ID: d3f73105e2820d53bbe148222ed036bb398aa1f103ea876aba3c569cc0e8e576
                • Instruction ID: 050e5f371ed03b93f4db6c1c56d78de0219452893d4ca6521ce3e65e78d1554c
                • Opcode Fuzzy Hash: d3f73105e2820d53bbe148222ed036bb398aa1f103ea876aba3c569cc0e8e576
                • Instruction Fuzzy Hash: 0901DE65C183B196EB382F90890A3BB76FCAF10381F108415FCCAA31A1E7748CC5CAA5
                Uniqueness

                Uniqueness Score: -1.00%