Edit tour

Windows Analysis Report
SyfCbCNRRU.exe

Overview

General Information

Sample Name:	SyfCbCNRRU.exe
Original Sample Name:	d5445d98bdbd8a339bcafe31aa223d9e.exe
Analysis ID:	864080
MD5:	d5445d98bdbd8a339bcafe31aa223d9e
SHA1:	c4036c0b438de8cf23fee5bcc564edc186b954db
SHA256:	413ec94d35627af97c57c6482630e6b2bb299eebf164e187ea7df0a0eb80ecc6
Tags:	32exeMassLogger
Infos:

Detection

AgentTesla

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected AgentTesla

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Contains functionality to capture screen (.Net source)

Tries to harvest and steal ftp login credentials

.NET source code references suspicious native API functions

Machine Learning detection for sample

Tries to harvest and steal browser information (history, passwords, etc)

.NET source code contains potential unpacker

Creates a DirectInput object (often for capturing keystrokes)

Uses 32bit PE files

Found inlined nop instructions (likely shell or obfuscated code)

Queries the volume information (name, serial number etc) of a device

Yara signature match

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

May sleep (evasive loops) to hinder dynamic analysis

Detected potential crypto function

Yara detected Credential Stealer

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Enables debug privileges

Classification

Process Tree

System is w10x64

SyfCbCNRRU.exe (PID: 7040 cmdline: C:\Users\user\Desktop\SyfCbCNRRU.exe MD5: D5445D98BDBD8A339BCAFE31AA223D9E)

RegAsm.exe (PID: 5124 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe MD5: 6FD7592411112729BF6B1F2F6C34899F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based keylogger and RAT readily available to actors. Logs keystrokes and the host's clipboard and beacons this information back to the C2.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/ https://blog.apnic.net/2022/03/31/how-to-detect-and-prevent-common-data-exfiltration-attacks/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.520992752.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.520992752.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd4f2:$a1: get_encryptedPassword 0xd887:$a2: get_encryptedUsername 0xd29c:$a3: get_timePasswordChanged 0xd3a2:$a4: get_passwordField 0xd508:$a5: set_encryptedPassword 0xf0e5:$a7: get_logins 0xedb3:$a8: GetOutlookPasswords 0xeafb:$a9: StartKeylogger 0xf01c:$a10: KeyLoggerEventArgs 0xeb0a:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.265836712.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.265836712.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x105af6:$a1: get_encryptedPassword 0x119d12:$a1: get_encryptedPassword 0x1efb5a:$a1: get_encryptedPassword 0x105e8b:$a2: get_encryptedUsername 0x11a0a7:$a2: get_encryptedUsername 0x1efeef:$a2: get_encryptedUsername 0x1058a0:$a3: get_timePasswordChanged 0x119abc:$a3: get_timePasswordChanged 0x1ef904:$a3: get_timePasswordChanged 0x1059a6:$a4: get_passwordField 0x119bc2:$a4: get_passwordField 0x1efa0a:$a4: get_passwordField 0x105b0c:$a5: set_encryptedPassword 0x119d28:$a5: set_encryptedPassword 0x1efb70:$a5: set_encryptedPassword 0x1076e9:$a7: get_logins 0x11b905:$a7: get_logins 0x1f174d:$a7: get_logins 0x1073b7:$a8: GetOutlookPasswords 0x11b5d3:$a8: GetOutlookPasswords 0x1f141b:$a8: GetOutlookPasswords
Process Memory Space: SyfCbCNRRU.exe PID: 7040	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SyfCbCNRRU.exe PID: 7040	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12dbb:$a1: get_encryptedPassword 0x130e4:$a2: get_encryptedUsername 0x12b79:$a3: get_timePasswordChanged 0x12c7f:$a4: get_passwordField 0x12dd1:$a5: set_encryptedPassword 0x145f9:$a7: get_logins 0x1431e:$a8: GetOutlookPasswords 0x140c8:$a9: StartKeylogger 0x14530:$a10: KeyLoggerEventArgs 0x140d7:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: RegAsm.exe PID: 5124	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegAsm.exe PID: 5124	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 5124	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2ed4:$a1: get_encryptedPassword 0x325a:$a2: get_encryptedUsername 0x2c92:$a3: get_timePasswordChanged 0x2d98:$a4: get_passwordField 0x2eea:$a5: set_encryptedPassword 0x4a6e:$a7: get_logins 0x473c:$a8: GetOutlookPasswords 0x4484:$a9: StartKeylogger 0x49a5:$a10: KeyLoggerEventArgs 0x4493:$a11: KeyLoggerEventArgsEventHandler
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.SyfCbCNRRU.exe.2899404.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SyfCbCNRRU.exe.2899404.2.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0xc61c:$s1: UnHook 0xc623:$s2: SetHook 0xc62b:$s3: CallNextHook 0xc638:$s4: _hook
0.2.SyfCbCNRRU.exe.2899404.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xb8f2:$a1: get_encryptedPassword 0xbc87:$a2: get_encryptedUsername 0xb69c:$a3: get_timePasswordChanged 0xb7a2:$a4: get_passwordField 0xb908:$a5: set_encryptedPassword 0xd4e5:$a7: get_logins 0xd1b3:$a8: GetOutlookPasswords 0xcefb:$a9: StartKeylogger 0xd41c:$a10: KeyLoggerEventArgs 0xcf0a:$a11: KeyLoggerEventArgsEventHandler
1.2.RegAsm.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.2.RegAsm.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegAsm.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0xe41c:$s1: UnHook 0xe423:$s2: SetHook 0xe42b:$s3: CallNextHook 0xe438:$s4: _hook
1.2.RegAsm.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd6f2:$a1: get_encryptedPassword 0xda87:$a2: get_encryptedUsername 0xd49c:$a3: get_timePasswordChanged 0xd5a2:$a4: get_passwordField 0xd708:$a5: set_encryptedPassword 0xf2e5:$a7: get_logins 0xefb3:$a8: GetOutlookPasswords 0xecfb:$a9: StartKeylogger 0xf21c:$a10: KeyLoggerEventArgs 0xed0a:$a11: KeyLoggerEventArgsEventHandler
0.2.SyfCbCNRRU.exe.2899404.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.SyfCbCNRRU.exe.2899404.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SyfCbCNRRU.exe.2899404.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0xe41c:$s1: UnHook 0x22638:$s1: UnHook 0xf8480:$s1: UnHook 0xe423:$s2: SetHook 0x2263f:$s2: SetHook 0xf8487:$s2: SetHook 0xe42b:$s3: CallNextHook 0x22647:$s3: CallNextHook 0xf848f:$s3: CallNextHook 0xe438:$s4: _hook 0x22654:$s4: _hook 0xf849c:$s4: _hook
0.2.SyfCbCNRRU.exe.2899404.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd6f2:$a1: get_encryptedPassword 0x2190e:$a1: get_encryptedPassword 0xf7756:$a1: get_encryptedPassword 0xda87:$a2: get_encryptedUsername 0x21ca3:$a2: get_encryptedUsername 0xf7aeb:$a2: get_encryptedUsername 0xd49c:$a3: get_timePasswordChanged 0x216b8:$a3: get_timePasswordChanged 0xf7500:$a3: get_timePasswordChanged 0xd5a2:$a4: get_passwordField 0x217be:$a4: get_passwordField 0xf7606:$a4: get_passwordField 0xd708:$a5: set_encryptedPassword 0x21924:$a5: set_encryptedPassword 0xf776c:$a5: set_encryptedPassword 0xf2e5:$a7: get_logins 0x23501:$a7: get_logins 0xf9349:$a7: get_logins 0xefb3:$a8: GetOutlookPasswords 0x231cf:$a8: GetOutlookPasswords 0xf9017:$a8: GetOutlookPasswords
0.2.SyfCbCNRRU.exe.27bbbd0.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.SyfCbCNRRU.exe.27bbbd0.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SyfCbCNRRU.exe.27bbbd0.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0xebc50:$s1: UnHook 0xffe6c:$s1: UnHook 0x1d5cb4:$s1: UnHook 0xebc57:$s2: SetHook 0xffe73:$s2: SetHook 0x1d5cbb:$s2: SetHook 0xebc5f:$s3: CallNextHook 0xffe7b:$s3: CallNextHook 0x1d5cc3:$s3: CallNextHook 0xebc6c:$s4: _hook 0xffe88:$s4: _hook 0x1d5cd0:$s4: _hook
0.2.SyfCbCNRRU.exe.27bbbd0.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xeaf26:$a1: get_encryptedPassword 0xff142:$a1: get_encryptedPassword 0x1d4f8a:$a1: get_encryptedPassword 0xeb2bb:$a2: get_encryptedUsername 0xff4d7:$a2: get_encryptedUsername 0x1d531f:$a2: get_encryptedUsername 0xeacd0:$a3: get_timePasswordChanged 0xfeeec:$a3: get_timePasswordChanged 0x1d4d34:$a3: get_timePasswordChanged 0xeadd6:$a4: get_passwordField 0xfeff2:$a4: get_passwordField 0x1d4e3a:$a4: get_passwordField 0xeaf3c:$a5: set_encryptedPassword 0xff158:$a5: set_encryptedPassword 0x1d4fa0:$a5: set_encryptedPassword 0xecb19:$a7: get_logins 0x100d35:$a7: get_logins 0x1d6b7d:$a7: get_logins 0xec7e7:$a8: GetOutlookPasswords 0x100a03:$a8: GetOutlookPasswords 0x1d684b:$a8: GetOutlookPasswords
0.2.SyfCbCNRRU.exe.27b859c.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.SyfCbCNRRU.exe.27b859c.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SyfCbCNRRU.exe.27b859c.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0xef284:$s1: UnHook 0x1034a0:$s1: UnHook 0x1d92e8:$s1: UnHook 0xef28b:$s2: SetHook 0x1034a7:$s2: SetHook 0x1d92ef:$s2: SetHook 0xef293:$s3: CallNextHook 0x1034af:$s3: CallNextHook 0x1d92f7:$s3: CallNextHook 0xef2a0:$s4: _hook 0x1034bc:$s4: _hook 0x1d9304:$s4: _hook
0.2.SyfCbCNRRU.exe.27b859c.0.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xee55a:$a1: get_encryptedPassword 0x102776:$a1: get_encryptedPassword 0x1d85be:$a1: get_encryptedPassword 0xee8ef:$a2: get_encryptedUsername 0x102b0b:$a2: get_encryptedUsername 0x1d8953:$a2: get_encryptedUsername 0xee304:$a3: get_timePasswordChanged 0x102520:$a3: get_timePasswordChanged 0x1d8368:$a3: get_timePasswordChanged 0xee40a:$a4: get_passwordField 0x102626:$a4: get_passwordField 0x1d846e:$a4: get_passwordField 0xee570:$a5: set_encryptedPassword 0x10278c:$a5: set_encryptedPassword 0x1d85d4:$a5: set_encryptedPassword 0xf014d:$a7: get_logins 0x104369:$a7: get_logins 0x1da1b1:$a7: get_logins 0xefe1b:$a8: GetOutlookPasswords 0x104037:$a8: GetOutlookPasswords 0x1d9e7f:$a8: GetOutlookPasswords
Click to see the 14 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SyfCbCNRRU.exe	ReversingLabs: Detection: 27%
Source: SyfCbCNRRU.exe	Virustotal: Detection: 35%			Perma Link

Machine Learning detection for sample

Source: SyfCbCNRRU.exe

Joe Sandbox ML: detected

Source: SyfCbCNRRU.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SyfCbCNRRU.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: F:\Desktop V500\important\CSharp-RunPE-master\RunPE\obj\Debug\SeaCyanPul.pdb source: SyfCbCNRRU.exe, 00000000.00000002.265836712.00000000027A1000.00000004.00000800.00020000.00000000.sdmp, SyfCbCNRRU.exe, 00000000.00000002.268240261.0000000004FD0000.00000004.08000000.00040000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 012A4610h	1_2_012A41F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 012A3825h	1_2_012A2D38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 012A3EC9h	1_2_012A3C08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 012A4610h	1_2_012A41E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 012AF2F1h	1_2_012AF03C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	1_2_012A288B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 012AFBA1h	1_2_012AF8E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 012AE5E9h	1_2_012AE330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 012AEE99h	1_2_012AEBE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	1_2_012A2A6D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	1_2_012A2258
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 012A4610h	1_2_012A453E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 012AF749h	1_2_012AF48F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp 012AEA41h	1_2_012AE787

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SyfCbCNRRU.exe.2899404.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SyfCbCNRRU.exe.27bbbd0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SyfCbCNRRU.exe.27b859c.0.raw.unpack, type: UNPACKEDPE

Source: SyfCbCNRRU.exe, 00000000.00000002.265836712.00000000027A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.520992752.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: SyfCbCNRRU.exe	String found in binary or memory: http://edstarcoordinator.com/api.asmx/GetSystems
Source: SyfCbCNRRU.exe, 00000000.00000002.265836712.00000000027A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.520992752.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture screen (.Net source)

Source: 1.2.RegAsm.exe.400000.0.unpack, KrakenStub/KrakenSteak.cs

.Net Code: TakeScreenshot

Source: SyfCbCNRRU.exe, 00000000.00000002.265275088.0000000000B3A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.SyfCbCNRRU.exe.2899404.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.SyfCbCNRRU.exe.2899404.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.SyfCbCNRRU.exe.2899404.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.SyfCbCNRRU.exe.2899404.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.SyfCbCNRRU.exe.27bbbd0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.SyfCbCNRRU.exe.27bbbd0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.SyfCbCNRRU.exe.27b859c.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.SyfCbCNRRU.exe.27b859c.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000001.00000002.520992752.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.265836712.00000000027A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: SyfCbCNRRU.exe PID: 7040, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: RegAsm.exe PID: 5124, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Source: SyfCbCNRRU.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.SyfCbCNRRU.exe.2899404.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.SyfCbCNRRU.exe.2899404.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.SyfCbCNRRU.exe.2899404.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.SyfCbCNRRU.exe.2899404.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.SyfCbCNRRU.exe.27bbbd0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.SyfCbCNRRU.exe.27bbbd0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.SyfCbCNRRU.exe.27b859c.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.SyfCbCNRRU.exe.27b859c.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000001.00000002.520992752.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.265836712.00000000027A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: SyfCbCNRRU.exe PID: 7040, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: RegAsm.exe PID: 5124, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: SyfCbCNRRU.exe, 00000000.00000002.265836712.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSeaCyanPul.dll" vs SyfCbCNRRU.exe
Source: SyfCbCNRRU.exe, 00000000.00000002.265836712.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameKrakenStub.exe6 vs SyfCbCNRRU.exe
Source: SyfCbCNRRU.exe, 00000000.00000003.256112733.0000000000BB8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDataBasePracticalJob.dllJ vs SyfCbCNRRU.exe
Source: SyfCbCNRRU.exe, 00000000.00000002.267014370.00000000037D4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDataBasePracticalJob.dllJ vs SyfCbCNRRU.exe
Source: SyfCbCNRRU.exe, 00000000.00000000.255167077.00000000004FE000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameRareCommodityHelper.exeH vs SyfCbCNRRU.exe
Source: SyfCbCNRRU.exe, 00000000.00000002.267865549.0000000004E80000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameDataBasePracticalJob.dllJ vs SyfCbCNRRU.exe
Source: SyfCbCNRRU.exe, 00000000.00000002.265275088.0000000000B3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SyfCbCNRRU.exe
Source: SyfCbCNRRU.exe, 00000000.00000002.268240261.0000000004FD0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSeaCyanPul.dll" vs SyfCbCNRRU.exe
Source: SyfCbCNRRU.exe	Binary or memory string: OriginalFilenameRareCommodityHelper.exeH vs SyfCbCNRRU.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Section loaded: sfc.dll

Jump to behavior

Source: C:\Users\user\Desktop\SyfCbCNRRU.exe	Code function: 0_2_0275F9B0	0_2_0275F9B0
Source: C:\Users\user\Desktop\SyfCbCNRRU.exe	Code function: 0_2_027550C0	0_2_027550C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_012AA9C8	1_2_012AA9C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_012AB2A9	1_2_012AB2A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_012A2D38	1_2_012A2D38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_012A3C08	1_2_012A3C08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_012A66B8	1_2_012A66B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_012AF03C	1_2_012AF03C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_012AF8E8	1_2_012AF8E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_012AE330	1_2_012AE330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_012AABE8	1_2_012AABE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_012AEBE0	1_2_012AEBE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_012A2230	1_2_012A2230
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_012AA230	1_2_012AA230
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_012AA240	1_2_012AA240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_012A2258	1_2_012A2258
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_012A1469	1_2_012A1469
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_012AF48F	1_2_012AF48F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 1_2_012AE787	1_2_012AE787

Source: SyfCbCNRRU.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SyfCbCNRRU.exe	ReversingLabs: Detection: 27%
Source: SyfCbCNRRU.exe	Virustotal: Detection: 35%

Source: SyfCbCNRRU.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SyfCbCNRRU.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SyfCbCNRRU.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\SyfCbCNRRU.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SyfCbCNRRU.exe C:\Users\user\Desktop\SyfCbCNRRU.exe
Source: C:\Users\user\Desktop\SyfCbCNRRU.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Source: C:\Users\user\Desktop\SyfCbCNRRU.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Jump to behavior

Source: C:\Users\user\Desktop\SyfCbCNRRU.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SyfCbCNRRU.exe.log

Jump to behavior

Source: classification engine

Classification label: mal96.troj.spyw.evad.winEXE@3/1@0/0

Source: SyfCbCNRRU.exe, RareCommodityHelper/MainForm.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.0.SyfCbCNRRU.exe.4c0000.0.unpack, RareCommodityHelper/MainForm.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 1.2.RegAsm.exe.400000.0.unpack, KrakenStub/KrakenDumpedList.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 1.2.RegAsm.exe.400000.0.unpack, KrakenStub/KrakenSteak.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'

Source: C:\Users\user\Desktop\SyfCbCNRRU.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: SyfCbCNRRU.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SyfCbCNRRU.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Data Obfuscation

.NET source code contains potential unpacker

Source: SyfCbCNRRU.exe, PathNode.cs	.Net Code: ANTR3ND0 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.SyfCbCNRRU.exe.4c0000.0.unpack, PathNode.cs	.Net Code: ANTR3ND0 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: initial sample

Static PE information: section name: .text entropy: 7.693686657770114

Source: C:\Users\user\Desktop\SyfCbCNRRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SyfCbCNRRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SyfCbCNRRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SyfCbCNRRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SyfCbCNRRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SyfCbCNRRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SyfCbCNRRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SyfCbCNRRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SyfCbCNRRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SyfCbCNRRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SyfCbCNRRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SyfCbCNRRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SyfCbCNRRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SyfCbCNRRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SyfCbCNRRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SyfCbCNRRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SyfCbCNRRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SyfCbCNRRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SyfCbCNRRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SyfCbCNRRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SyfCbCNRRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SyfCbCNRRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SyfCbCNRRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SyfCbCNRRU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\SyfCbCNRRU.exe TID: 3132

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\SyfCbCNRRU.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SyfCbCNRRU.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 1_2_012AA9C8 LdrInitializeThunk,

1_2_012AA9C8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\SyfCbCNRRU.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 1.2.RegAsm.exe.400000.0.unpack, KrakenStub/KrakenSteak.cs	Reference to suspicious API methods: ('MapVirtualKey', 'MapVirtualKey@user32.dll')
Source: 1.2.RegAsm.exe.400000.0.unpack, KrakenStub/FFDecryptor.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')

Source: C:\Users\user\Desktop\SyfCbCNRRU.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Jump to behavior

Source: C:\Users\user\Desktop\SyfCbCNRRU.exe	Queries volume information: C:\Users\user\Desktop\SyfCbCNRRU.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SyfCbCNRRU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SyfCbCNRRU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SyfCbCNRRU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SyfCbCNRRU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SyfCbCNRRU.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SyfCbCNRRU.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 5124, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Jump to behavior

Source: Yara match	File source: 0.2.SyfCbCNRRU.exe.2899404.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SyfCbCNRRU.exe.2899404.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SyfCbCNRRU.exe.27bbbd0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SyfCbCNRRU.exe.27b859c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.520992752.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.265836712.00000000027A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SyfCbCNRRU.exe PID: 7040, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5124, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 5124, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	1 Masquerading	2 OS Credential Dumping	1 Process Discovery	Remote Services	1 Screen Capture	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	1 Input Capture	21 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Email Collection	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	21 Virtualization/Sandbox Evasion	Security Account Manager	13 System Information Discovery	SMB/Windows Admin Shares	1 Input Capture	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	11 Process Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	11 Archive Collected Data	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	Remote System Discovery	SSH	2 Data from Local System	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	2 Obfuscated Files or Information	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	12 Software Packing	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SyfCbCNRRU.exe	27%	ReversingLabs	Win32.Trojan.Pwsx
SyfCbCNRRU.exe	36%	Virustotal		Browse
SyfCbCNRRU.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://checkip.dyndns.org/q	0%	URL Reputation	safe
http://edstarcoordinator.com/api.asmx/GetSystems	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot	SyfCbCNRRU.exe, 00000000.00000002.265836712.00000000027A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.520992752.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org/q	SyfCbCNRRU.exe, 00000000.00000002.265836712.00000000027A1000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000001.00000002.520992752.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://edstarcoordinator.com/api.asmx/GetSystems	SyfCbCNRRU.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	864080
Start date and time:	2023-05-11 22:06:41 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	SyfCbCNRRU.exe
Original Sample Name:	d5445d98bdbd8a339bcafe31aa223d9e.exe
Detection:	MAL
Classification:	mal96.troj.spyw.evad.winEXE@3/1@0/0
EGA Information:	Successful, ratio: 50%
HDC Information:	Failed
HCA Information:	Successful, ratio: 98% Number of executed functions: 77 Number of non-executed functions: 10
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com
Execution Graph export aborted for target SyfCbCNRRU.exe, PID 7040 because it is empty
Not all processes where analyzed, report is missing behavior information

Process:	C:\Users\user\Desktop\SyfCbCNRRU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	886
Entropy (8bit):	5.325593152230861
Encrypted:	false
SSDEEP:	24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhgLE4qE4j:MgvjHK5HKXE1qHiYHKhQnogLHqHj
MD5:	AC2CBF71E733CA2B84323E871BD62FDD
SHA1:	6B351F2F58892315B9D344A58451C6390DD108DE
SHA-256:	7439A0D64BAF07FC16F8F3026113B49A1F095C1398837AFD89EF8F21BF3CCBC8
SHA-512:	7D4633EFECEFCA05CB911FAD832C249A80F7C72A5041943D6D4B409DDB3DEE93CD3A9791D44092711FFF305A54A70AF4B2045B7515774A06E6B86EE49F67287F
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..2,"Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.6676674497663875
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	SyfCbCNRRU.exe
File size:	241152
MD5:	d5445d98bdbd8a339bcafe31aa223d9e
SHA1:	c4036c0b438de8cf23fee5bcc564edc186b954db
SHA256:	413ec94d35627af97c57c6482630e6b2bb299eebf164e187ea7df0a0eb80ecc6
SHA512:	ca0ddef9699f03778c769983998f82592f3e917305cbd4beae432751e39617f9be526fe867ba4cbfc461aebaeba6798802eca7e8d5eaed3d9ab21fead12c0dc2
SSDEEP:	6144:X1XQakQjeFxbIBMPL3mtdKWYNRB4vF8VdTcNjj1xmauq:FXQawbB2t4WYXBD6
TLSH:	B334E00433FC4541E6BA6F7E69B492E10B36BD174E75E78D4D8934CD28E1B060AA3B27
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2.Zd..............0.................. ........@.. ....................... ............`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x43c3ae
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x645AD232 [Tue May 9 23:07:30 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3c360	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3e000	0x5f6	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x40000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x3a3b4	0x3a400	False	0.7660105954935622	data	7.693686657770114	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x3e000	0x5f6	0x600	False	0.423828125	data	4.196950651817995	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x40000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x3e0a0	0x36c	data
RT_MANIFEST	0x3e40c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Target ID:	0
Start time:	22:07:41
Start date:	11/05/2023
Path:	C:\Users\user\Desktop\SyfCbCNRRU.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\SyfCbCNRRU.exe
Imagebase:	0x4c0000
File size:	241152 bytes
MD5 hash:	D5445D98BDBD8A339BCAFE31AA223D9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.265836712.00000000027A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.265836712.00000000027A1000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Target ID:	1
Start time:	22:07:45
Start date:	11/05/2023
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Imagebase:	0x9e0000
File size:	64616 bytes
MD5 hash:	6FD7592411112729BF6B1F2F6C34899F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.520992752.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000001.00000002.520992752.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	high

Show Windows behavior

Function 0275F9B0 Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fde9ce44eff013268a2f5a7325340be49aabacba6e7dea8075b57dc2b5a683db
Instruction ID: a3fd3c8a71b135e46e92ea8346ae9e776b48ab27fda5c2c7ee379bd4316db47f
Opcode Fuzzy Hash: fde9ce44eff013268a2f5a7325340be49aabacba6e7dea8075b57dc2b5a683db
Instruction Fuzzy Hash: 04F16E30A00259CFDB08DFA9D454AAEBBB2FF89304F14846DE806AB795DB74EC45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0275C2E9 Relevance: 1.5, Strings: 1, Instructions: 233COMMON

Download Yara Rule

Strings

%, xrefs: 0275C27B

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID: %
API String ID: 0-2567322570
Opcode ID: fa7b162ada3bdf18ef4e479583f90414b7b5a4d3b162bc59d9ea68c38ef8bc9a
Instruction ID: d7680296fd8070c1b27541946683f6c9625c33651cfe10303fb493853965d01d
Opcode Fuzzy Hash: fa7b162ada3bdf18ef4e479583f90414b7b5a4d3b162bc59d9ea68c38ef8bc9a
Instruction Fuzzy Hash: E771A430B04329CFEF1657B8945073ABAA2AF85644B25406FDD07EB361DFA4DD01CB66

Uniqueness

Uniqueness Score: -1.00%

Function 0275BA53 Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

d, xrefs: 0275BBA4

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 07341fdfb6dcd18a91822dab9ed05418e728afaa647d12cf1a54f6cb72c28cda
Instruction ID: 504b4897edcc71680af9e4c9f480c7ef0101c3d613db612c12ef1241be4b5b3b
Opcode Fuzzy Hash: 07341fdfb6dcd18a91822dab9ed05418e728afaa647d12cf1a54f6cb72c28cda
Instruction Fuzzy Hash: 65514674A00A1ACFCB15CF89C5C09AAF7B6FF88314B108569D91997729EB70F951CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02757903 Relevance: 1.3, Instructions: 1332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a505cbd43c1ef2a34e34689292ee1948362b50a31e442e1fbecf55f005fd1c7c
Instruction ID: b84f7750c133cac2694f713c60f8982e417e29c28007fc1558007fd28946946b
Opcode Fuzzy Hash: a505cbd43c1ef2a34e34689292ee1948362b50a31e442e1fbecf55f005fd1c7c
Instruction Fuzzy Hash: 9DE21B35A0425A9FEB25AFA0D955BEDBB32FB88300F10C099D90A27385DF756E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 02757910 Relevance: 1.3, Instructions: 1329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 776341cb54e3544f1d404e0594ea62f6238b3879d643d02b3491c8f5a0128163
Instruction ID: 6166e5d62c3cb14df59e4f74b17c115ab839628abd7e1c83f5d66e1a39779de8
Opcode Fuzzy Hash: 776341cb54e3544f1d404e0594ea62f6238b3879d643d02b3491c8f5a0128163
Instruction Fuzzy Hash: 4BE21A35A0425A9FEB25AFA0D955BEDBB32FB88300F10C099D90A27385DF756E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0275D460 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd69a11a76c4c07ca437c95c66cb4e9f82756a07d0ac7cb6e9b15451fbebc41f
Instruction ID: c21c8e35cf9df0c20381278e08d8700e0d0c083bdf34556678e6890463e9c1df
Opcode Fuzzy Hash: dd69a11a76c4c07ca437c95c66cb4e9f82756a07d0ac7cb6e9b15451fbebc41f
Instruction Fuzzy Hash: 05B147347006638FD7348F69C494A6AFBE6AF88305B144829D846D77A1DBB4EC42CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0275A803 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10cab456788805d927c51a97e0afdd7a2c499c09569d22a58c54d132adde4226
Instruction ID: 6bd2ca06bc312ee7bb664c364c83535023c3974249a754d337d998f34ee20d6b
Opcode Fuzzy Hash: 10cab456788805d927c51a97e0afdd7a2c499c09569d22a58c54d132adde4226
Instruction Fuzzy Hash: C5816230B042298FDF259B79855063DB696BFC4204B1552BAEC42EB361EFB4DC41CB66

Uniqueness

Uniqueness Score: -1.00%

Function 0275751B Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9402b6745f43b204b089b3dce46c5fa935d5d1193fc66f8ed3c0c017d7a8b59
Instruction ID: 83a276725127deb86a587a6ecf50bb8a378a73ab209f8192a40bef9c2e9aa5be
Opcode Fuzzy Hash: b9402b6745f43b204b089b3dce46c5fa935d5d1193fc66f8ed3c0c017d7a8b59
Instruction Fuzzy Hash: 47A14735600642CFD705EF68D584D5ABBB2FF88310B518998E44A9B3B2DB34FD46CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02757520 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec08b173eac95bebb4fd2d9d33ea1886fce5a08f400d90bae6d2b26cd4c67c35
Instruction ID: 8f9cd7a3e9ca8c92758e02462563e1f407a240a724e9956fe0313c64c8887063
Opcode Fuzzy Hash: ec08b173eac95bebb4fd2d9d33ea1886fce5a08f400d90bae6d2b26cd4c67c35
Instruction Fuzzy Hash: 69A14735600642CFC705EF68D484D5ABBB2FF88310B518998E44A9B3B2DB34FD46CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02754E23 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef72ca5a8766a95dcbe470d65a2143d806b2a7455c374692ce3c5e9696946a04
Instruction ID: 12b865c8f941910469f6a03ca58cc8416d59dbc97bc8ca3f6bef6e5ce8d46e5e
Opcode Fuzzy Hash: ef72ca5a8766a95dcbe470d65a2143d806b2a7455c374692ce3c5e9696946a04
Instruction Fuzzy Hash: 2C718D79E00218CFCB44DFA9D594A9DBBB2FF89300F208169E919AB365DB31AD05CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02755B38 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1073706bd3c5b340f46db6fe4e83565c23ae8dadc5ede5252b14ac44ad974beb
Instruction ID: 01c9cbd06656bfe8cf19b90ebd1d5900154506131a2b979695f62866b2762872
Opcode Fuzzy Hash: 1073706bd3c5b340f46db6fe4e83565c23ae8dadc5ede5252b14ac44ad974beb
Instruction Fuzzy Hash: E151C375E01218DFDB44DFA9D890AEDBBB2FF89304F54802AD805A7364DB756942CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0275B3CB Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4443c4061d8ffdf6ec03f4a34360767f43f1c625fcf00aa406f5d9114598c63
Instruction ID: 34504ad7b754a459175aff89052fa9ea2de4442c6677dd0a9a57d2fafcbd00a5
Opcode Fuzzy Hash: b4443c4061d8ffdf6ec03f4a34360767f43f1c625fcf00aa406f5d9114598c63
Instruction Fuzzy Hash: 5A415B36200702CFE715AB74E465A1A77A3EF88305B508D6CE5469B796DE34EC068B91

Uniqueness

Uniqueness Score: -1.00%

Function 02759FCB Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20ab9164fc635b03fa955158a2309c8deb2ec7e23c9bdbe160f202371bc50643
Instruction ID: f154cc238020b03e75daabce54c4582e011136cb6cf37d1d2026444fbfca5731
Opcode Fuzzy Hash: 20ab9164fc635b03fa955158a2309c8deb2ec7e23c9bdbe160f202371bc50643
Instruction Fuzzy Hash: CE419D322007819FE355EB64D551B49BBA2BF85310F91CD1CD146AB7A2CB74F9088BA1

Uniqueness

Uniqueness Score: -1.00%

Function 02755539 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba092bda9a2dd1c86fa5b24b9c37c9c4122730cc301c8f5ab786c21dfbd8646
Instruction ID: 56a9e1e941e6cacacdf9cba9891c0cd91dbbf978601edeb4db3e7363ec10cfd2
Opcode Fuzzy Hash: 9ba092bda9a2dd1c86fa5b24b9c37c9c4122730cc301c8f5ab786c21dfbd8646
Instruction Fuzzy Hash: 67418F75E01219DFCB44DFA9D5949AEBBF2FF89300F24806AE805AB361DB31A901CF55

Uniqueness

Uniqueness Score: -1.00%

Function 02754CAF Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b2a0716e3b816dc6d7f382635be1bcec3b6fa9f6b5dd7b83cdd2ecf2819f304
Instruction ID: 5e8c8056747a516488fa3778e70f1bf1e66796d8611db459a9d83a97fa53d7ba
Opcode Fuzzy Hash: 1b2a0716e3b816dc6d7f382635be1bcec3b6fa9f6b5dd7b83cdd2ecf2819f304
Instruction Fuzzy Hash: 1A41A274E01208DFCB44CFA9D5949ADBBF2FF89310F14806AE905A7360DB30A905CF61

Uniqueness

Uniqueness Score: -1.00%

Function 027544B8 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7afbe71e68f86c410cc73cfc1e42c32783cf444a4e9505d67a4a66c5a3c0d6a6
Instruction ID: 7bc2b1eb6fc078dda5d309f858e1fb390fd82fbc2002b6185e89816f13ca8315
Opcode Fuzzy Hash: 7afbe71e68f86c410cc73cfc1e42c32783cf444a4e9505d67a4a66c5a3c0d6a6
Instruction Fuzzy Hash: 6C312270A00276CFCB249F68D8A497EF7B1FB82384B140566E816D7292DF74DD81C791

Uniqueness

Uniqueness Score: -1.00%

Function 027504D8 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 009ccf1913c1d5c05339f3e0710b6c9f6ba6d6b12b822fecc4eb9c21b59a4e99
Instruction ID: 54a2bdb3fd2e50dc0171eb4a5725b559d98241b1b5fc6fbbb584d7c741b6cfbe
Opcode Fuzzy Hash: 009ccf1913c1d5c05339f3e0710b6c9f6ba6d6b12b822fecc4eb9c21b59a4e99
Instruction Fuzzy Hash: 602124A20080F5CFD703677CE455BD9EB91EF8F310B884A0AD954A73EBC8D80812C6E1

Uniqueness

Uniqueness Score: -1.00%

Function 02756117 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d3f824e9dc90c015ca306b99fe19bd76f4ce4907dbacf6970ddc3eb2ed5f6d3
Instruction ID: 38ce9aafebfc3794536bed56e02e02165acbae1ae7d76a021f235f315f296990
Opcode Fuzzy Hash: 6d3f824e9dc90c015ca306b99fe19bd76f4ce4907dbacf6970ddc3eb2ed5f6d3
Instruction Fuzzy Hash: 6E214972604250CFD702AF28D8507EEB766EF8E354F80892AD442DB3D3EA74D906D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0275A570 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4efe837ed591c4d461b2ab70fe360378a53c0736084a69e9805b69a3a4c6b95
Instruction ID: 7314b4833269631272c6abb60bb78446666293260c2f16b5a48c3e989de8f54e
Opcode Fuzzy Hash: f4efe837ed591c4d461b2ab70fe360378a53c0736084a69e9805b69a3a4c6b95
Instruction Fuzzy Hash: D0218D363013029FF704A672E862B3A2663EFC1215F498D2CE642AF3C5DD75AD0647A1

Uniqueness

Uniqueness Score: -1.00%

Function 02754DD0 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5c4b57e24c7c430d77dd7db3a4a165e765404a4dc162e82dd2691868f4b6f1
Instruction ID: d0cc4f82aea560686dba33b9660845ef0d8d05e84c1b86dfca60dce20368fc4b
Opcode Fuzzy Hash: 0a5c4b57e24c7c430d77dd7db3a4a165e765404a4dc162e82dd2691868f4b6f1
Instruction Fuzzy Hash: AC31D378E01208DFCB44DFA9D594A9DBBB1FF49305F2181A9E905AB361DB31AE02CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0275A580 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e849256f562761f71dc987e4426e55196940dd2f7f11b9fdb8820f33ca36b73f
Instruction ID: 6a18ae4f8b28d1d5ffb01d9b797272a79e7d0a96bee104704fa285f8ca1e8255
Opcode Fuzzy Hash: e849256f562761f71dc987e4426e55196940dd2f7f11b9fdb8820f33ca36b73f
Instruction Fuzzy Hash: C5213E363003025BF708AA76E862B3E2663EFC5215F458D2CE602AF3C5DD75AD0657D1

Uniqueness

Uniqueness Score: -1.00%

Function 02755658 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a3a954907a64c1f983e4796014f788de784f9635fba63564bdf79464d7dc13a
Instruction ID: 31ff6286784511fe66a744aeb71805927f6b2e8206a1c13b9103d2a75c58157b
Opcode Fuzzy Hash: 3a3a954907a64c1f983e4796014f788de784f9635fba63564bdf79464d7dc13a
Instruction Fuzzy Hash: F6312478E00219CFDB04DFA5E9509EEBBB2FF88305F2480A9D405A3354DB399A12CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0275DA98 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ea62a2e83e5fe4165276c1df8312c301acde67677f6825ec2a87d30be2d4ff1
Instruction ID: 2ccb0c08ab6f3245c99d622f1027aafc692af79c24ab1d80ab0c8260d9ccdf28
Opcode Fuzzy Hash: 2ea62a2e83e5fe4165276c1df8312c301acde67677f6825ec2a87d30be2d4ff1
Instruction Fuzzy Hash: EF11C6323052259BDB245B7AB45416AF7ABEFC026A318407BE50AC7794CF7ADC46C790

Uniqueness

Uniqueness Score: -1.00%

Function 0275DC40 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 181d09d6e937fa90092cdb420d14e082f516b0e2ec26904173007e60b1b39c6e
Instruction ID: 269f3de1596c8f3d1e390a524ccefb884a92a46d87e98e200ffab31a4bc11721
Opcode Fuzzy Hash: 181d09d6e937fa90092cdb420d14e082f516b0e2ec26904173007e60b1b39c6e
Instruction Fuzzy Hash: E411B2317027519FE7359F66E480A13FBB6EF81324B18856ED94A8B312C7B5EC85C750

Uniqueness

Uniqueness Score: -1.00%

Function 02755668 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 549beb98181bc33ff143aa50beeb6c7275927d7c79a012f5c99f91573ef9d35e
Instruction ID: 7c496ce76fb4142698b35f770f7393b600e4be70596348236f1e34f0fa447636
Opcode Fuzzy Hash: 549beb98181bc33ff143aa50beeb6c7275927d7c79a012f5c99f91573ef9d35e
Instruction Fuzzy Hash: 0D21E278E01209CFCB04DFA5D950AEEBBF2FB88301F208069D805A3354DB79A955CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02754407 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1037861c5bfdfc090c84b1f06c639d2ba8a231ec7e4caa7ee9b93b2319818d18
Instruction ID: ce6680f81d0367f17a7576b11fd071991d7420118e9899a14372afa2b49cc6f3
Opcode Fuzzy Hash: 1037861c5bfdfc090c84b1f06c639d2ba8a231ec7e4caa7ee9b93b2319818d18
Instruction Fuzzy Hash: E711C2303453409FD7119B69DC55F5A7FA1EF86B10F1580A9E149CF2E2CE619C05C740

Uniqueness

Uniqueness Score: -1.00%

Function 0275A68B Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a32a167403abd70cf8ec978d5f174ff484f4537508b37f8a0b9349544675bc9b
Instruction ID: 4e4bd9ba1a98899631517d6c8d782d87362547e65894100aa59eae70cae01221
Opcode Fuzzy Hash: a32a167403abd70cf8ec978d5f174ff484f4537508b37f8a0b9349544675bc9b
Instruction Fuzzy Hash: A411EF75200B528FD725DF78D490A1EB7A2FF88314B008A2DD5469B352DF79DC028B80

Uniqueness

Uniqueness Score: -1.00%

Function 02756299 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f48e3e87e92c2610d9577a8be5d14e7c07e6bc8e02dca6fc0084f438b266bb70
Instruction ID: 7c2876c93b65bd08036a2e5e26dc3ea575e4c1da4b34890ec63c5c9675e4d9c0
Opcode Fuzzy Hash: f48e3e87e92c2610d9577a8be5d14e7c07e6bc8e02dca6fc0084f438b266bb70
Instruction Fuzzy Hash: 93117C30A00215CBDB14DFA8E4587EDFBB2BF88301F54C529C816B7265CF75584ACBA4

Uniqueness

Uniqueness Score: -1.00%

Function 02759A43 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 301e270caba30581d56d5db81e9cc019dc99ee6b0389019109d5a2a7845b15dd
Instruction ID: 98695ce2292ee8e42c26c5326667ae369074417715fedd0bdde72104a909116a
Opcode Fuzzy Hash: 301e270caba30581d56d5db81e9cc019dc99ee6b0389019109d5a2a7845b15dd
Instruction Fuzzy Hash: C611A272200341CFD711DB68E441B5DBBA2EF88354B54CE2CD105AB396DF75BD0A8BA0

Uniqueness

Uniqueness Score: -1.00%

Function 02759B08 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 896062811cfeb200d03adbb0d627a26a5801ca88dd355608dcb2a5b6d43295c8
Instruction ID: 9c98412a6b3c53a5cd15ebbc05ca26e50fc06652a83b32fa7b3d0195ca2c0d2a
Opcode Fuzzy Hash: 896062811cfeb200d03adbb0d627a26a5801ca88dd355608dcb2a5b6d43295c8
Instruction Fuzzy Hash: 05119331200741CFD716DF38D850956BBB2EFC5214354CD6DD09A9B3A2DB76AC0B8B94

Uniqueness

Uniqueness Score: -1.00%

Function 027562A8 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c8d90bf9e2f0eb7ce429a7398f0dfbd903c51374f74315ea68e23792e77e0a3
Instruction ID: 174a455cab80c9385b6f6309b842fba550c3186cd902b789e45be3c7f2efd82e
Opcode Fuzzy Hash: 8c8d90bf9e2f0eb7ce429a7398f0dfbd903c51374f74315ea68e23792e77e0a3
Instruction Fuzzy Hash: E8116D31A00215CBDB14DFA9D858BADFBB6BF88300F54C529D812B7265DF70584ACBA5

Uniqueness

Uniqueness Score: -1.00%

Function 02759B18 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1022cc077a7694981b21b84b500371a2e57e11a8e1072526df7abc04e788cdb
Instruction ID: 84d86b629dd6c3c3f21b441c862a693cb9627c1715f8f3408a56ec1d17dcf28c
Opcode Fuzzy Hash: d1022cc077a7694981b21b84b500371a2e57e11a8e1072526df7abc04e788cdb
Instruction Fuzzy Hash: FA119E31200741CBD715EF28D88095ABBA2EFC4318354CE2DD09A9B3A2DF75FC0A8B90

Uniqueness

Uniqueness Score: -1.00%

Function 027561DB Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6f582b538d02677eca944d2f6c07217dfd6bb301ed5e68d4aa192b0628d1347
Instruction ID: 2d85099ecb4a20ef54842757272aa7fcb914c5b70c0db35043071acca827f643
Opcode Fuzzy Hash: b6f582b538d02677eca944d2f6c07217dfd6bb301ed5e68d4aa192b0628d1347
Instruction Fuzzy Hash: E1010431200645CBC711EF68E4A0B9E77A7FFC8344F908929D446DB392DEB4990687A1

Uniqueness

Uniqueness Score: -1.00%

Function 02754A90 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13d3611b08d64548e605d8b29d4400b82683532af59d25ff0b6d12259e18ce30
Instruction ID: c3b2ba020ab9222b948b7d8589b08df18ba5efa8f73dcad58017fd63ed55c4f0
Opcode Fuzzy Hash: 13d3611b08d64548e605d8b29d4400b82683532af59d25ff0b6d12259e18ce30
Instruction Fuzzy Hash: 9C214C3490168ACFCB41EFA8E45469D7FB1FF8E301F448966D401A33AAEB781A45DF91

Uniqueness

Uniqueness Score: -1.00%

Function 0275C287 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01ab92339ad27052f91ce9925324e4f37bc62e26dfcf7d15351b8c923850af9e
Instruction ID: 2434fe42f722a81670b8d061ce216065f20501e4998377d20b5829514fab1cf3
Opcode Fuzzy Hash: 01ab92339ad27052f91ce9925324e4f37bc62e26dfcf7d15351b8c923850af9e
Instruction Fuzzy Hash: 1D017B7B9053A34FC7039F88F4A02467B61FD90A1171584BBCA068F313D7699C0B8B68

Uniqueness

Uniqueness Score: -1.00%

Function 0275CF60 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f25f37c753c438f79204e43ae45f9c1b561ed559809932a9ece1615699b79835
Instruction ID: b765079aed0a6300ba44b21898a25be9299f36ee645da510704498422e04310a
Opcode Fuzzy Hash: f25f37c753c438f79204e43ae45f9c1b561ed559809932a9ece1615699b79835
Instruction Fuzzy Hash: 5201A7B27002146FD304977EA854B17FADAEFC9250B10802EE909D7380DD75EC0187A5

Uniqueness

Uniqueness Score: -1.00%

Function 02754AA0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7fde053aef51d9d674728a469e54821dfb024a9967c4e6e3d077131ffea9a31
Instruction ID: 70d23fbe7996477506ba7d270428497498eab121ee537b1e7602b62d07bfeb51
Opcode Fuzzy Hash: a7fde053aef51d9d674728a469e54821dfb024a9967c4e6e3d077131ffea9a31
Instruction Fuzzy Hash: 35110A3490064ADFCB40EFA8E454A9EBBB1FF8D301F408925D801A3359EB786E45DF91

Uniqueness

Uniqueness Score: -1.00%

Function 02755D51 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35c097c95463d07275bc14a5e33f0a3496e0fa9af6c9e08713a66a707445d31f
Instruction ID: 01b03f41c75fc0cde1b107d154f5fef780177169f3f427fa5d2a165f39effddc
Opcode Fuzzy Hash: 35c097c95463d07275bc14a5e33f0a3496e0fa9af6c9e08713a66a707445d31f
Instruction Fuzzy Hash: B1F07837B06221ABF70104535891BBB6B23DBC4260F0A802AED0583281D669CD02A390

Uniqueness

Uniqueness Score: -1.00%

Function 02755D60 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07f196284df0e9d92dee8cb1034da4e6808bc3dcc5421ecf53917ff8c18fd479
Instruction ID: 40b0f6781fd68d00ccd4ac4b815d8c4335e253ff87d75df22e2bf039b19ede40
Opcode Fuzzy Hash: 07f196284df0e9d92dee8cb1034da4e6808bc3dcc5421ecf53917ff8c18fd479
Instruction Fuzzy Hash: 93F0E977B0022667FB1104479C94BBF6A5BDBC46A5F4A803AFE0583340CB76CD51A3A0

Uniqueness

Uniqueness Score: -1.00%

Function 02754368 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f55b77b4b7617fbd3e7afb0dada587766e93ffaafe9a68d65dac07bb2831d52c
Instruction ID: f60bebcf99c91ecda81453e94486b86f3f5cd2d69ae660bef7b4925799d86396
Opcode Fuzzy Hash: f55b77b4b7617fbd3e7afb0dada587766e93ffaafe9a68d65dac07bb2831d52c
Instruction Fuzzy Hash: DB015E34A04688DFCB41FFB9E55194E7FB1BF89200B108DA9C40597266DB345E15DB91

Uniqueness

Uniqueness Score: -1.00%

Function 02754440 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7971edba6f89759080d4891638f2416291e839f25f332b41631b335529eaa8a3
Instruction ID: 8a5877129fafecc49d131649bf1a5291bc7afe35c82060695a495d14a4f24dd9
Opcode Fuzzy Hash: 7971edba6f89759080d4891638f2416291e839f25f332b41631b335529eaa8a3
Instruction Fuzzy Hash: CEF0A7313402046FE714EA6AEC55F577B9AEBC9B54F244024F209DB3D5CEA1AC028794

Uniqueness

Uniqueness Score: -1.00%

Function 02754378 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44e241ead7ff8c1447eda9d965ae82cb6ba02f99916aa872e1c5580809fd36f8
Instruction ID: 11969e427bd77d1ac1c078009172b535544278c0128a4648431c20e774987af9
Opcode Fuzzy Hash: 44e241ead7ff8c1447eda9d965ae82cb6ba02f99916aa872e1c5580809fd36f8
Instruction Fuzzy Hash: 01F04934A00549EFCB40FFB9E58195EBBF1FB88300F208D68D405A7369EB346E459B91

Uniqueness

Uniqueness Score: -1.00%

Function 02754210 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d27878a897aa7433fa68e2681cec2e54bd6914d104cc268251b26af34c3405d7
Instruction ID: 79ecbd678d1d0e2b99a728c401d794fa4cadb473111b24797e178a64c0f3432f
Opcode Fuzzy Hash: d27878a897aa7433fa68e2681cec2e54bd6914d104cc268251b26af34c3405d7
Instruction Fuzzy Hash: 97F0AF30604188EFC716EFACD46198C7F70AF423147018ADDC0406B2A2CA351A00DB51

Uniqueness

Uniqueness Score: -1.00%

Function 0275C263 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef221399e23be04d438afc0072ecd87d74bf874995ee9e64013b922e06f968c5
Instruction ID: 4767d5cde88333146c0bfa19e7d0025e380c6dbfb42860f19da74a79774cee9f
Opcode Fuzzy Hash: ef221399e23be04d438afc0072ecd87d74bf874995ee9e64013b922e06f968c5
Instruction Fuzzy Hash: AAE092725062578FC701AF5CE4A46457BA0FE5571171548B3D6058F323D729AC1A8BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0275DE60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fa5e837d4b4a65312ed4b1ae0cc9e16e0fe922e0e6e02bfa4ffefa0c4e08769
Instruction ID: 1b3b5e6e15a1005bb8d856b8480ae6d9be68501acf3ac3bd8b1715ecd90c8b85
Opcode Fuzzy Hash: 8fa5e837d4b4a65312ed4b1ae0cc9e16e0fe922e0e6e02bfa4ffefa0c4e08769
Instruction Fuzzy Hash: 6DE04F363001249BC7209A4EE404D9ABBAEDBD8771B148177FA08C7320CA71DC5286E4

Uniqueness

Uniqueness Score: -1.00%

Function 0275BC43 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ebdea225a22cc101aafabac1bdddb05b8437d1c433e0723e1e8072c3daa083d
Instruction ID: aba430541c597f3a836ebc91b6886e4c641389e08a0632e647f2d476f20c7006
Opcode Fuzzy Hash: 6ebdea225a22cc101aafabac1bdddb05b8437d1c433e0723e1e8072c3daa083d
Instruction Fuzzy Hash: F0E0D8722147404BC741B764F4525D5BB669ED0324350C96AD0298A5E7DE54594BC3E1

Uniqueness

Uniqueness Score: -1.00%

Function 02754220 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd73b34ebba3c1a0b37b7935cadcecb4c05efe5ae2514eb26f3a873fb357cc42
Instruction ID: 935c1ba362ce103bcd9901245a40347c36b911bee616940ad589ae6a3ccc5756
Opcode Fuzzy Hash: fd73b34ebba3c1a0b37b7935cadcecb4c05efe5ae2514eb26f3a873fb357cc42
Instruction Fuzzy Hash: 69F0F871D00148EBCB40EFB8D552A9CBBB1AB84200F5089A98408A7251EA316F449B95

Uniqueness

Uniqueness Score: -1.00%

Function 02755458 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5d0d92e929ad95826fe8e3e766f8b68af1d20904a518687c5a395460eff9c87
Instruction ID: 28434772e22b846c4c30f96a4db0e6cb901718e6695003132d213dbf4152302a
Opcode Fuzzy Hash: e5d0d92e929ad95826fe8e3e766f8b68af1d20904a518687c5a395460eff9c87
Instruction Fuzzy Hash: 90F03030901248DFCB40FFB8E44468DBBB0FB48306F5089A5D804A3356EB785E45DF91

Uniqueness

Uniqueness Score: -1.00%

Function 02754278 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8ec3c907b160dbd02f6f8e254f30ea82306cc129000351f9391b83bd8e83c11
Instruction ID: 14957931f92471cf5e83e064a584aa0d5c45202970f08e5989b160e1e0ae9bdd
Opcode Fuzzy Hash: f8ec3c907b160dbd02f6f8e254f30ea82306cc129000351f9391b83bd8e83c11
Instruction Fuzzy Hash: 3FE0DF38214200CFC3195B28E9A98AC7BB0EF89350B0881AEE88287362CF294C02CB40

Uniqueness

Uniqueness Score: -1.00%

Function 02750457 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34ca9099d48ab8e9afaaab798d5923037ab15edcf04dd319089c0a243c60be51
Instruction ID: 2c1c0526760fb1f28a6dfa6ee5034ca5160fa5d9b0e8419a226149fc988ead93
Opcode Fuzzy Hash: 34ca9099d48ab8e9afaaab798d5923037ab15edcf04dd319089c0a243c60be51
Instruction Fuzzy Hash: 49E06D74909284DFC701DFB8D89689DBFB1AE9A200716CA9BD809CB362D6355E068B50

Uniqueness

Uniqueness Score: -1.00%

Function 027504E8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fd9ed98439ff7fbda4f0a43fec38ec7c932b628de6684a4cc5d08e9fea8fee8
Instruction ID: 1ced0997048eee6d9ac19517264a2c92df2edbb56350781ad6bc5eda54f7ed6d
Opcode Fuzzy Hash: 4fd9ed98439ff7fbda4f0a43fec38ec7c932b628de6684a4cc5d08e9fea8fee8
Instruction Fuzzy Hash: 30E092362008148FC741EBBDE440A19B3D5EB89301B40C428E50597356CF34EC008FA1

Uniqueness

Uniqueness Score: -1.00%

Function 027545C9 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebedcd5e3b2221fc6ea7f26fefda08c39e9d821fadb1183dca4aa485f2bf9b1c
Instruction ID: 5adef14ebd3fde02450dddbe47b9eb62a2fa83ead91d6317d3c7c6756e1d065e
Opcode Fuzzy Hash: ebedcd5e3b2221fc6ea7f26fefda08c39e9d821fadb1183dca4aa485f2bf9b1c
Instruction Fuzzy Hash: 0BE09A34068282CFC7026F74A07C0697F70DB0B327B042A81E88993352CF390822EBA8

Uniqueness

Uniqueness Score: -1.00%

Function 02750499 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67ad540fdc7bd5251c7ee771bf6f700fb5ea2a614de66b6fb4be17d17bccecf7
Instruction ID: 54584ba75e5333a6f601c8b080e3252ee08623c5345a949b92abe7bc147ca5cf
Opcode Fuzzy Hash: 67ad540fdc7bd5251c7ee771bf6f700fb5ea2a614de66b6fb4be17d17bccecf7
Instruction Fuzzy Hash: 4FE04F3834D6D08FC7069B78A8958597FB2AF8F26432981D5DC49CB377C964EC168B11

Uniqueness

Uniqueness Score: -1.00%

Function 02754330 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e439df1f2e659900a9cf45b5aefd4241229990d38d9b7972796d88db85bd9a61
Instruction ID: 0d34529f78d907a6fc7e4a471e8871b77219fac38a29ac0d33386e404c5e2b26
Opcode Fuzzy Hash: e439df1f2e659900a9cf45b5aefd4241229990d38d9b7972796d88db85bd9a61
Instruction Fuzzy Hash: 36E08C38204780CFD3218B68E824A663FB2EF4A710B0504AAE1868B6B2CE249811CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0275A780 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b30e75f36222abed87c44527966b87878b7a957070058a2389e67171b2335da4
Instruction ID: 9bdc528590264685c88864c331a5d9a5a8f8645ad4459437d7998d9bb033358f
Opcode Fuzzy Hash: b30e75f36222abed87c44527966b87878b7a957070058a2389e67171b2335da4
Instruction Fuzzy Hash: 1EE09274E05209AFCB44EFA9E45459DBBF5AB48304F0085E9A849A7340EA346A048F91

Uniqueness

Uniqueness Score: -1.00%

Function 0275A77B Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba95f623ce2127c92d964be2fc73f317a516bb03b2321da9a6460d88a0e7da34
Instruction ID: 49820fa40f53e71653fa43c5871b11340cf3b2caf9843101a8a2fcaad9c51217
Opcode Fuzzy Hash: ba95f623ce2127c92d964be2fc73f317a516bb03b2321da9a6460d88a0e7da34
Instruction Fuzzy Hash: 92E04F30F4064A9FCB18DFA8D45449CBFB1EB45354F0046D9D5559B391DF342902CB41

Uniqueness

Uniqueness Score: -1.00%

Function 02754288 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 174182fa7144ed51c7cd49b54640f3752ac766d9c15b8222762243775286ad78
Instruction ID: 9aa38b6a83152349c7b66a88032366a0cade9e754f600f481863ea255ef382c1
Opcode Fuzzy Hash: 174182fa7144ed51c7cd49b54640f3752ac766d9c15b8222762243775286ad78
Instruction Fuzzy Hash: C2D05E38310110CFC304AB28E56889C77A9EF88661B0440A5E80687351CB799C008B80

Uniqueness

Uniqueness Score: -1.00%

Function 0275C7B3 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ffed8cb98c5ee99fe5c05f9a29d6409b8a7677cac6cb8cb52a37705fc36ce03
Instruction ID: 97e353672607a51f2b21ba5a394d8d2d33433f7652a0d466e68612b8acbd5a95
Opcode Fuzzy Hash: 8ffed8cb98c5ee99fe5c05f9a29d6409b8a7677cac6cb8cb52a37705fc36ce03
Instruction Fuzzy Hash: 2ED05EB8A083428FE3014BB098645067FA2FBAA300F0240A6D040CB262DD788846CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02750468 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48831d457962bea04db831a0d961d6039dbd76737b2c472fe10bd5c45aaa3bb7
Instruction ID: 9e546f936c4afcf9c1cadf9a44a067025980fc618ec6c7e915082a41c1b3395e
Opcode Fuzzy Hash: 48831d457962bea04db831a0d961d6039dbd76737b2c472fe10bd5c45aaa3bb7
Instruction Fuzzy Hash: A8D05E74900648EFCB40EFB8ED8644DBBB9EB88200B10CDA6E808D7315EA756E019B90

Uniqueness

Uniqueness Score: -1.00%

Function 027504A8 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cb9f1474fbcebe80dee9749f08b31571e1458e9921d93558c08def8e6f2a19f
Instruction ID: 9589a023300bf825e7910ad567e1d7ca94b3cc9a78534b5fba9a356235210c47
Opcode Fuzzy Hash: 1cb9f1474fbcebe80dee9749f08b31571e1458e9921d93558c08def8e6f2a19f
Instruction Fuzzy Hash: 36D09238344A448F9744EBB9E89892577A6BB8C6243608564E80D8B32ADE75EC518A61

Uniqueness

Uniqueness Score: -1.00%

Function 0275A748 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d76c214a5e092448812c35cc6cbde5a0f8eb79d0761592a16d48e4cb225b5650
Instruction ID: f3c393e086540b3abb90e2aaf84f470ae9e74d8f6d14afcefe234675198ebe04
Opcode Fuzzy Hash: d76c214a5e092448812c35cc6cbde5a0f8eb79d0761592a16d48e4cb225b5650
Instruction Fuzzy Hash: 29D01222E4A7994FE716DA149D400583B61D71B300B0505D6D946CB266DE125F1593A3

Uniqueness

Uniqueness Score: -1.00%

Function 027564AB Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1161d3f77953f5720e2fd42c1036569224f6a727b6aef170542e29e74b37b3be
Instruction ID: 59ba0ef12f2c96de16bdee89249e0ce399b30adae58c09d4976596ed6fd05901
Opcode Fuzzy Hash: 1161d3f77953f5720e2fd42c1036569224f6a727b6aef170542e29e74b37b3be
Instruction Fuzzy Hash: 02C08C32500820CFD68D7B18F2624DDA392FED8B103414D18E40A173A6CE580D0B4ADA

Uniqueness

Uniqueness Score: -1.00%

Function 0275A758 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ee7082b06069da3788437ea2be588fa494ff9e1478d0864be2b691fd9944683
Instruction ID: 1f41b7bad857c921b2639abd294f03d08df5d3699dec49b1fa6ed0e5db618a5b
Opcode Fuzzy Hash: 0ee7082b06069da3788437ea2be588fa494ff9e1478d0864be2b691fd9944683
Instruction Fuzzy Hash: 50B0927090670CAF8620DA9A980181ABBACDA0A215B0445D9FA0987710D932A91056D2

Uniqueness

Uniqueness Score: -1.00%

Function 02750442 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee295a319d42bc3f4eef6d34d177ad1cd2495a15a55be8bc34a164f849d49c95
Instruction ID: 09b6c90d4bd7fff6c4a257c0c038443cb8a7ab9dae5a7f6452ab6644c5de80b3
Opcode Fuzzy Hash: ee295a319d42bc3f4eef6d34d177ad1cd2495a15a55be8bc34a164f849d49c95
Instruction Fuzzy Hash: 77B09214C593C08FC3031A310C280807FB0ED4354038E41CB8C80C72A6921D580E9322

Uniqueness

Uniqueness Score: -1.00%

Function 0275C298 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ada6209f81591966712f230336928897b3bed33a94ef631afde09e07322abca
Instruction ID: 008c61d364b5ba2521fdd57f93daf6a70d2d46d333b0c71f4fd6f01f03815108
Opcode Fuzzy Hash: 9ada6209f81591966712f230336928897b3bed33a94ef631afde09e07322abca
Instruction Fuzzy Hash: CCB0123100068F8BC6407B54F425D14372D9948205790CC52E00E057175B6DB8114EA8

Uniqueness

Uniqueness Score: -1.00%

Function 0275BC50 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7df73b618813b7008e8b660919536f3c21633204d1ab49ab5798dad412bc7d3d
Instruction ID: 1f3e4d6b8439f6c00d997bbc4217ea9d64b2980441774576a54183374007f39a
Opcode Fuzzy Hash: 7df73b618813b7008e8b660919536f3c21633204d1ab49ab5798dad412bc7d3d
Instruction Fuzzy Hash: 1FB0123201430887834097D8FC06D2273DC66406343344354A03D8A6E2CE12B853C644

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 027550C0 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.265745671.0000000002750000.00000040.00000800.00020000.00000000.sdmp, Offset: 02750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2750000_SyfCbCNRRU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 627381e0b8895f502efdc5c2a8301fa768e1e990cbb62693c927ef0caf447e70
Instruction ID: c79ff702ae3fb0a0b5c586447fc896c2ce3aabf2a0d9da1b6d34b3a70bd4d2a2
Opcode Fuzzy Hash: 627381e0b8895f502efdc5c2a8301fa768e1e990cbb62693c927ef0caf447e70
Instruction Fuzzy Hash: 1D915134B052189FDB1CDFB5986467EBBB7BFC8300B55892DE806E7385DE7898028791

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exePID: 5124, Parent PID: 7040COMMON

Execution Graph

Execution Coverage:	16.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	14.3%
Total number of Nodes:	21
Total number of Limit Nodes:	0

Executed Functions

Function 012A2D38 Relevance: 2.2, APIs: 1, Instructions: 686
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 012A2E8D

Memory Dump Source

Source File: 00000001.00000002.522539929.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ed2723459908d99d06006ffc729d7a5d8d0d819f3e5a0953c6e4f04723489479
Instruction ID: 666e1094a96b12949b2372eda231d2b47c9445e2cddeec92d6557f0d8684250b
Opcode Fuzzy Hash: ed2723459908d99d06006ffc729d7a5d8d0d819f3e5a0953c6e4f04723489479
Instruction Fuzzy Hash: CF62DD74E112298FDB64DFA9C884BDDBBB2BB89304F5481EAD409A7355DB309E81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 012AA9C8 Relevance: .5, Instructions: 528
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.522539929.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a98b6fcaae4334145384d8aadbe7e86448e625af71d974a20898f99be72a84de
Instruction ID: dfad9f93a67342bc72e3a80e8df9270eb2183c94d28886129277857f65facbf5
Opcode Fuzzy Hash: a98b6fcaae4334145384d8aadbe7e86448e625af71d974a20898f99be72a84de
Instruction Fuzzy Hash: A3225674E10219CFDB14DFA8C884BADFBB2BF88300F5485A9D509AB385DB759985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 012A3C08 Relevance: .3, Instructions: 273
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.522539929.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 807347b13bb94c0e27975989a015df2b4fb6538a7cb1145dcfaa1d95bdeb7763
Instruction ID: 6d78fed2e3c05f022fc09ddf80128ae9b8170d04b345c4cd5e5b48a399bbddbe
Opcode Fuzzy Hash: 807347b13bb94c0e27975989a015df2b4fb6538a7cb1145dcfaa1d95bdeb7763
Instruction Fuzzy Hash: 56D1B374E01218CFDB24DFA5D994B9DBBB2BF89314F2080AAD809A7355DB355E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 012A41E9 Relevance: .2, Instructions: 221
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.522539929.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 334a0aa7a9cd8f9ffb6a9c73c7e825efd21253cec60719c513fa0b2f71bfa612
Instruction ID: 479339e48b5d46521020d26a161a06a6ffde8752aae5981b8c4bda461a8a5ea8
Opcode Fuzzy Hash: 334a0aa7a9cd8f9ffb6a9c73c7e825efd21253cec60719c513fa0b2f71bfa612
Instruction Fuzzy Hash: 7EA1E270D00248CFEB24DFA9D588BDDBBB1FF88314F248269E509AB291DB749985CF54

Uniqueness

Uniqueness Score: -1.00%

Function 012A41F8 Relevance: .2, Instructions: 220
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.522539929.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 894415c05fb526c788e842d9ffce983013f29a4722a226bebf1484487a880fb5
Instruction ID: c544ce63bac0ad9ab675194ce4147452ae4d4c420c34f3ec7c383359d4102627
Opcode Fuzzy Hash: 894415c05fb526c788e842d9ffce983013f29a4722a226bebf1484487a880fb5
Instruction Fuzzy Hash: 42A1F370D00248CFEB24EFA9C948BDDBBB1FF88314F248269E508A7291DB749985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 012A453E Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.522539929.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a12980b34629a3ba4340778ca8a9d54a6884b5507417f226bb57f8efe2ee80cd
Instruction ID: 901da558db36affb188e40b2c627dd4ca86dd141f3b3b00c41ce9d1faf6a18c9
Opcode Fuzzy Hash: a12980b34629a3ba4340778ca8a9d54a6884b5507417f226bb57f8efe2ee80cd
Instruction Fuzzy Hash: 46911770D10248CFEB20DFA8D448BDCBBB1FF89310F2482A9E509A7291DBB49985CF11

Uniqueness

Uniqueness Score: -1.00%

Function 012ADDA8 Relevance: 1.6, APIs: 1, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL(000000FF), ref: 012ADF0A

Memory Dump Source

Source File: 00000001.00000002.522539929.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_RegAsm.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 0bf1ee96e3861380fcd96f5f7d5543fc4fef3df75bfba4140249eb8d5a5be290
Instruction ID: d31198f4cc883cea4b657d4143692419c8dac91fa2a540d4382dd4c29a290625
Opcode Fuzzy Hash: 0bf1ee96e3861380fcd96f5f7d5543fc4fef3df75bfba4140249eb8d5a5be290
Instruction Fuzzy Hash: 3F510FB4D10218DFDB18CFEAD8886DEBBB2BF88310F50C12AE514AB294DB749945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 012ADF43 Relevance: 1.6, APIs: 1, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.522539929.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54b473b999da931f529a21a7b0555348120248262251b1126c3037bcb1e59b4b
Instruction ID: d4e1891e00fa1a3cfb4ea42f1bc8ae24c614b298343a33377a9d8141b684bf78
Opcode Fuzzy Hash: 54b473b999da931f529a21a7b0555348120248262251b1126c3037bcb1e59b4b
Instruction Fuzzy Hash: 53510D74D2020CCFDB24CFE9D4886DDBBB6BB48320FA48529E519BB284D7749886CF14

Uniqueness

Uniqueness Score: -1.00%

Function 012A2E1D Relevance: 1.6, APIs: 1, Instructions: 103
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 012A2E8D

Memory Dump Source

Source File: 00000001.00000002.522539929.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_RegAsm.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: cb2ef8c37ae5c0c9834b9dd7667d39e6c035c93f5c07d4de7dc4ee3cafc9b4a6
Instruction ID: 4905c42f5ed5f2bb33275876941aa409717c352955cefc5682708365f2ba5abb
Opcode Fuzzy Hash: cb2ef8c37ae5c0c9834b9dd7667d39e6c035c93f5c07d4de7dc4ee3cafc9b4a6
Instruction Fuzzy Hash: 3041AB74E11228CFCB65DFA8D984BD9B7B2BB89305F5041E9E409A7361DB359E81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 012A1921 Relevance: 1.6, APIs: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 012A197E

Memory Dump Source

Source File: 00000001.00000002.522539929.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_RegAsm.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 1e7d514829c57b5edbb7771b234e1fcd42866794d64a4610b2bb55b2450780d1
Instruction ID: 115ea68dd99af652ee0b364b614d42220c34157180e5842644546a5c0ea2928d
Opcode Fuzzy Hash: 1e7d514829c57b5edbb7771b234e1fcd42866794d64a4610b2bb55b2450780d1
Instruction Fuzzy Hash: F33189348253468FDB216B70B6AC3AA7B70EB4B72BF146C69F00A8619ACB310585DF11

Uniqueness

Uniqueness Score: -1.00%

Function 012A1930 Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 012A197E

Memory Dump Source

Source File: 00000001.00000002.522539929.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_RegAsm.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 5222057ea6844bbaae68143a92a9ae4610d656fc29a4ad6ccfb69eca6587846a
Instruction ID: 3e67d04bef07f59e37f70ed16d7f92777a6084ad895df9c3842e83981e92cd26
Opcode Fuzzy Hash: 5222057ea6844bbaae68143a92a9ae4610d656fc29a4ad6ccfb69eca6587846a
Instruction Fuzzy Hash: 7731393482130A8FDB246F64B5AC36E7AB5FB4B72BF407C69B00A92199DB710184DF11

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 012A2258 Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.522539929.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bdc417ab21937ca689c22304d9fcc22c0a8f0c252e118cc3bde30f6fae6ebd4
Instruction ID: e74c0b92832e11d9887d22290b8f8cf5c088bc17e7bb3aebae7043cee22db1c5
Opcode Fuzzy Hash: 2bdc417ab21937ca689c22304d9fcc22c0a8f0c252e118cc3bde30f6fae6ebd4
Instruction Fuzzy Hash: 52529C74E01229CFDB68DF69C884B9DBBB2BB89304F1085EAD409A7354DB359E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 012AF8E8 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.522539929.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_RegAsm.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 7fa4306f79241a0aa60d9c97ec59fef3868b76ba33f770ac0812b04bd78327bb
Instruction ID: 52e28225573faa3f3880130be8322ff3884cb487ce63a2d39be8f1f9af9d64fe
Opcode Fuzzy Hash: 7fa4306f79241a0aa60d9c97ec59fef3868b76ba33f770ac0812b04bd78327bb
Instruction Fuzzy Hash: 46D1D474E11218CFDB14DFA5C994BADBBB2BF89304F6080AAD809AB355DB355E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 012AE330 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.522539929.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_RegAsm.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: c6aae706a673efe0c65386e2a6e7bf659f2bc415bee5a7fa4b5bce0f5f20ea06
Instruction ID: 542414e6419eb0e4e8ede97e9248c1873b8e4e19113af1a562e542ffba606603
Opcode Fuzzy Hash: c6aae706a673efe0c65386e2a6e7bf659f2bc415bee5a7fa4b5bce0f5f20ea06
Instruction Fuzzy Hash: EFC1D474E01218CFDB14DFA5D994BADBBB2BF89304F6080AAD809AB355DB355E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 012AEBE0 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.522539929.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_RegAsm.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: d837dc71f4eb4517d678f61e8157895a17c2727cb281ae3e873174df7f22bf1c
Instruction ID: 12acd93533cb76fb56f4849ccbd4f8021a2b84b8108f7d545869dd3a1df76f13
Opcode Fuzzy Hash: d837dc71f4eb4517d678f61e8157895a17c2727cb281ae3e873174df7f22bf1c
Instruction Fuzzy Hash: 88C1C274E01218CFDB14DFA5C994BADBBB2BF89304F6080AAD809AB355DB355E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 012AE787 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.522539929.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_RegAsm.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 65508f440b031540695bbf9d4ae13fdbd37615d8f280d5fbe5b258d9a4b2be95
Instruction ID: aba352635e3a495331bab571707f8a0060e5bfd8b94df355cfdc7b17cfbc13de
Opcode Fuzzy Hash: 65508f440b031540695bbf9d4ae13fdbd37615d8f280d5fbe5b258d9a4b2be95
Instruction Fuzzy Hash: F2D1D375E01218CFDB14DFA5C994BADBBB2BF89304F6080AAD809AB355DB355E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 012AF48F Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.522539929.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_RegAsm.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 4d01b1e02973d5d6c8afcb23043cdba9a32d45850f72a35436504b1adf2d80d8
Instruction ID: 703b791ad6a0c36241cc77c183bd0ae34d82a8a8757625d1723d4dde18a26f8c
Opcode Fuzzy Hash: 4d01b1e02973d5d6c8afcb23043cdba9a32d45850f72a35436504b1adf2d80d8
Instruction Fuzzy Hash: 96C1E374E11218CFDB14DFA5C994BADBBB2BF89304F6080AAD809AB355DB355E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 012AF03C Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.522539929.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_RegAsm.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 226149678260432f330b288317e62ca73db8096e6ace879adf0ed2d89b50865d
Instruction ID: e6968d31e0fd397bd5d98de867f910eeecf2f5aacc3505c26a76c84965006c34
Opcode Fuzzy Hash: 226149678260432f330b288317e62ca73db8096e6ace879adf0ed2d89b50865d
Instruction Fuzzy Hash: FDC1C274E01218CFDB14DFA5D994BADBBB2BF89304F6080AAD809AB355DB355E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 012A288B Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.522539929.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7df6640ccb9910788b8ed3f101401e56f6a8652384766617059fc1615018febb
Instruction ID: 94b44c10c0dc021952fb93c08c6ff17abcf07cf302b43862f0d47ddb55f07b89
Opcode Fuzzy Hash: 7df6640ccb9910788b8ed3f101401e56f6a8652384766617059fc1615018febb
Instruction Fuzzy Hash: C0A19C74A01228CFDB64DF64D898B9ABBB2BF49301F5085EAD50EA7354DB719E80CF50

Uniqueness

Uniqueness Score: -1.00%

Function 012A2A6D Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.522539929.00000000012A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_12a0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c0615184f8b75feddc6919f9ebd242c2f9b7b9d969a1a2cca0cc3153c3556a7
Instruction ID: 203437f62093952f86e5bbc330a53b32a563b40c0dacc590d911b78f070cda2a
Opcode Fuzzy Hash: 2c0615184f8b75feddc6919f9ebd242c2f9b7b9d969a1a2cca0cc3153c3556a7
Instruction Fuzzy Hash: DA51AE34A01229CFCB65DF64D898BAAB7B2BF4A305F5085E9D40AA7354CB319E80CF50

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	API monitoring, File monitoring, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SyfCbCNRRU.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SyfCbCNRRU.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Windows Analysis Report
SyfCbCNRRU.exe