Edit tour

Windows Analysis Report
G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe

Overview

General Information

Sample name:	G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe
Analysis ID:	1501084
MD5:	94117aff03dec1ed2036aab93e6ee76c
SHA1:	d095d0607a47c54ed7bc407362ddd73ad3175258
SHA256:	06ce17c25d36e66683f7eab6a010de3f388a3097312e47875ba3eda13c6dd4c1
Tags:	exe
Infos:

Detection

AgentTesla, DarkTortilla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected DarkTortilla Crypter

AI detected suspicious sample

Contains functionality to log keystrokes (.Net Source)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality to launch a process as a different user

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Outbound SMTP Connections

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe (PID: 6968 cmdline: "C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe" MD5: 94117AFF03DEC1ED2036AAB93E6EE76C)

cmd.exe (PID: 1192 cmdline: "cmd" /c ping 127.0.0.1 -n 17 > nul && copy "C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe" "C:\Users\user\AppData\Roaming\po.exe" && ping 127.0.0.1 -n 17 > nul && "C:\Users\user\AppData\Roaming\po.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 3892 cmdline: ping 127.0.0.1 -n 17 MD5: B3624DD758CCECF93A1226CEF252CA12)

PING.EXE (PID: 7096 cmdline: ping 127.0.0.1 -n 17 MD5: B3624DD758CCECF93A1226CEF252CA12)

po.exe (PID: 2712 cmdline: "C:\Users\user\AppData\Roaming\po.exe" MD5: 94117AFF03DEC1ED2036AAB93E6EE76C)

AppLaunch.exe (PID: 2328 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" MD5: 89D41E1CF478A3D3C2C701A27A5692B2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Name	Description	Attribution	Blogpost URLs	Link
DarkTortilla	DarkTortilla is a complex and highly configurable .NET-based crypter that has possibly been active since at least August 2015. It typically delivers popular information stealers and remote access trojans (RATs) such as AgentTesla, AsyncRat, NanoCore, and RedLine. While it appears to primarily deliver commodity malware, Secureworks Counter Threat Unit (CTU) researchers identified DarkTortilla samples delivering targeted payloads such as Cobalt Strike and Metasploit. It can also deliver "addon packages" such as additional malicious payloads, benign decoy documents, and executables. It features robust anti-analysis and anti-tamper controls that can make detection, analysis, and eradication challenging.From January 2021 through May 2022, an average of 93 unique DarkTortilla samples per week were uploaded to the VirusTotal analysis service. Code similarities suggest possible links between DarkTortilla and other malware: a crypter operated by the RATs Crew threat group, which was active between 2008 and 2012, and the Gameloader malware that emerged in 2021.	No Attribution	https://www.secureworks.com/research/darktortilla-malware-analysis	https://malpedia.caad.fkie.fraunhofer.de/details/win.darktortilla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "25", "Host": "mail.iaa-airferight.com", "Username": "mail@iaa-airferight.com", "Password": "Asaprocky11"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000A.00000002.3317600419.0000000004296000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.3317600419.0000000004296000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000002.3611482014.0000000006A31000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.3611482014.0000000006A31000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000002.3611482014.0000000006A5C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000A.00000002.3317600419.0000000004344000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
0000000A.00000002.3317600419.0000000004344000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.3317600419.0000000004344000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2517202114.0000000004916000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
0000000B.00000002.3608105838.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.3608105838.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000A.00000002.3317600419.00000000042F3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.3317600419.00000000042F3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2512152964.0000000003091000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
00000000.00000002.2536597554.0000000007610000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
00000000.00000002.2534549381.0000000006211000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
0000000A.00000002.3308368525.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
0000000A.00000002.3308368525.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.3308368525.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2517202114.000000000497F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
Process Memory Space: G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe PID: 6968	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
Process Memory Space: G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe PID: 6968	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: po.exe PID: 2712	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
Process Memory Space: po.exe PID: 2712	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: po.exe PID: 2712	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: po.exe PID: 2712	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: AppLaunch.exe PID: 2328	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: AppLaunch.exe PID: 2328	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 23 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
10.2.po.exe.43446a8.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.po.exe.43446a8.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
10.2.po.exe.43446a8.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316f7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31769:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317f3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31885:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318ef:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31961:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319f7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a87:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
10.2.po.exe.42f4688.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.po.exe.42f4688.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.AppLaunch.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.po.exe.42f4688.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334f7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33569:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335f3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33685:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336ef:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33761:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337f7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33887:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
11.2.AppLaunch.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
10.2.po.exe.42f4688.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.po.exe.42f4688.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.AppLaunch.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334f7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33569:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335f3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33685:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336ef:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33761:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337f7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33887:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
10.2.po.exe.42f4688.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316f7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31769:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317f3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31885:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318ef:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31961:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319f7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a87:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
10.2.po.exe.43446a8.2.raw.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
10.2.po.exe.43446a8.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
10.2.po.exe.43446a8.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
10.2.po.exe.43446a8.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334f7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33569:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335f3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33685:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336ef:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33761:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337f7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33887:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe.4d486d8.0.raw.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
0.2.G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe.7610000.3.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
0.2.G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe.7610000.3.raw.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
0.2.G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe.4d486d8.0.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
0.2.G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe.4c486b8.1.raw.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
Click to see the 16 entries

Sigma Signatures

System Summary

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe, ProcessId: 6968, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\po.lnk

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 46.175.148.58, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe, Initiated: true, ProcessId: 2328, Protocol: tcp, SourceIp: 192.168.2.12, SourceIsIpv6: false, SourcePort: 49729

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://mail.iaa-airferight.com

Avira URL Cloud: Label: malware

Found malware configuration

Source: 11.2.AppLaunch.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "25", "Host": "mail.iaa-airferight.com", "Username": "mail@iaa-airferight.com", "Password": "Asaprocky11"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\po.exe

ReversingLabs: Detection: 71%

Multi AV Scanner detection for submitted file

Source: G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe

ReversingLabs: Detection: 71%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\po.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe

Joe Sandbox ML: detected

Source: G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.12:49728 version: TLS 1.2

Source: G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb OU source: G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe, 00000000.00000002.2510967632.00000000012D4000.00000004.00000020.00020000.00000000.sdmp

Networking

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 17

Source: Joe Sandbox View	IP Address: 46.175.148.58 46.175.148.58
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

ASN Name: ASLAGIDKOM-NETUA ASLAGIDKOM-NETUA

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.12:49729 -> 46.175.148.58:25

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: mail.iaa-airferight.com

Source: cmd.exe, 00000004.00000003.2654856365.0000000002DD7000.00000004.00000020.00020000.00000000.sdmp, G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe, po.exe.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: cmd.exe, 00000004.00000003.2654856365.0000000002DBE000.00000004.00000020.00020000.00000000.sdmp, G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe, po.exe.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: cmd.exe, 00000004.00000003.2654856365.0000000002DD7000.00000004.00000020.00020000.00000000.sdmp, G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe, po.exe.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: cmd.exe, 00000004.00000003.2654856365.0000000002DBE000.00000004.00000020.00020000.00000000.sdmp, G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe, po.exe.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: cmd.exe, 00000004.00000003.2654856365.0000000002DBE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000003.2654856365.0000000002DD7000.00000004.00000020.00020000.00000000.sdmp, G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe, po.exe.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: cmd.exe, 00000004.00000003.2654856365.0000000002DBE000.00000004.00000020.00020000.00000000.sdmp, G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe, po.exe.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: cmd.exe, 00000004.00000003.2654856365.0000000002DD7000.00000004.00000020.00020000.00000000.sdmp, G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe, po.exe.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: cmd.exe, 00000004.00000003.2654856365.0000000002DBE000.00000004.00000020.00020000.00000000.sdmp, G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe, po.exe.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: po.exe.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: cmd.exe, 00000004.00000003.2654856365.0000000002DD7000.00000004.00000020.00020000.00000000.sdmp, G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe, po.exe.4.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: cmd.exe, 00000004.00000003.2654856365.0000000002DD7000.00000004.00000020.00020000.00000000.sdmp, G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe, po.exe.4.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: cmd.exe, 00000004.00000003.2654856365.0000000002DD7000.00000004.00000020.00020000.00000000.sdmp, G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe, po.exe.4.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: AppLaunch.exe, 0000000B.00000002.3611482014.0000000006A5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.iaa-airferight.com
Source: cmd.exe, 00000004.00000003.2654856365.0000000002DBE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000003.2654856365.0000000002DD7000.00000004.00000020.00020000.00000000.sdmp, G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe, po.exe.4.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: cmd.exe, 00000004.00000003.2654856365.0000000002DBE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000003.2654856365.0000000002DD7000.00000004.00000020.00020000.00000000.sdmp, G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe, po.exe.4.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: cmd.exe, 00000004.00000003.2654856365.0000000002DD7000.00000004.00000020.00020000.00000000.sdmp, G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe, po.exe.4.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: cmd.exe, 00000004.00000003.2654856365.0000000002DBE000.00000004.00000020.00020000.00000000.sdmp, G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe, po.exe.4.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: AppLaunch.exe, 0000000B.00000002.3611482014.00000000069E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: cmd.exe, 00000004.00000003.2654856365.0000000002DD7000.00000004.00000020.00020000.00000000.sdmp, G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe, po.exe.4.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: po.exe, 0000000A.00000002.3317600419.0000000004344000.00000004.00000800.00020000.00000000.sdmp, po.exe, 0000000A.00000002.3317600419.0000000004296000.00000004.00000800.00020000.00000000.sdmp, po.exe, 0000000A.00000002.3317600419.00000000042F3000.00000004.00000800.00020000.00000000.sdmp, po.exe, 0000000A.00000002.3308368525.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.3608105838.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: po.exe, 0000000A.00000002.3317600419.0000000004344000.00000004.00000800.00020000.00000000.sdmp, po.exe, 0000000A.00000002.3317600419.0000000004296000.00000004.00000800.00020000.00000000.sdmp, po.exe, 0000000A.00000002.3317600419.00000000042F3000.00000004.00000800.00020000.00000000.sdmp, po.exe, 0000000A.00000002.3308368525.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.3611482014.00000000069E1000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.3608105838.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: AppLaunch.exe, 0000000B.00000002.3611482014.00000000069E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: AppLaunch.exe, 0000000B.00000002.3611482014.00000000069E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: cmd.exe, 00000004.00000003.2654856365.0000000002DD7000.00000004.00000020.00020000.00000000.sdmp, G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe, po.exe.4.dr	String found in binary or memory: https://www.digicert.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.12:49728 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 10.2.po.exe.43446a8.2.raw.unpack, abAX9N.cs	.Net Code: BFeixnEv
Source: 10.2.po.exe.42f4688.1.raw.unpack, abAX9N.cs	.Net Code: BFeixnEv

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 10.2.po.exe.43446a8.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 10.2.po.exe.42f4688.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.2.AppLaunch.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 10.2.po.exe.42f4688.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 10.2.po.exe.43446a8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe

Source: C:\Users\user\AppData\Roaming\po.exe

Code function: 10_2_0A1CA308 CreateProcessAsUserW,

10_2_0A1CA308

Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Code function: 0_2_016F6ED8	0_2_016F6ED8
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Code function: 0_2_016FAE98	0_2_016FAE98
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Code function: 0_2_016F7B28	0_2_016F7B28
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Code function: 0_2_016FAE68	0_2_016FAE68
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Code function: 0_2_0A360040	0_2_0A360040
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Code function: 0_2_0A3676B8	0_2_0A3676B8
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Code function: 0_2_0A36B3B1	0_2_0A36B3B1
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Code function: 0_2_0A36B3C0	0_2_0A36B3C0
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Code function: 0_2_0A560040	0_2_0A560040
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Code function: 0_2_0A56C4A8	0_2_0A56C4A8
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Code function: 0_2_0A560006	0_2_0A560006
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Code function: 0_2_0A8E4507	0_2_0A8E4507
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Code function: 0_2_0A8E2AF0	0_2_0A8E2AF0
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Code function: 0_2_0A8E2B00	0_2_0A8E2B00
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Code function: 0_2_0A8EA378	0_2_0A8EA378
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_00E96ED8	10_2_00E96ED8
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_00E9AE98	10_2_00E9AE98
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_00E97B28	10_2_00E97B28
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_00E9AE68	10_2_00E9AE68
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_087C003A	10_2_087C003A
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_087CBA30	10_2_087CBA30
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_087CBA21	10_2_087CBA21
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_087C94F4	10_2_087C94F4
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_08960448	10_2_08960448
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_08968720	10_2_08968720
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_0896A328	10_2_0896A328
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_09C90040	10_2_09C90040
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_09C976B8	10_2_09C976B8
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_09C9B3C0	10_2_09C9B3C0
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_09C9B3B1	10_2_09C9B3B1
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_09C9EF58	10_2_09C9EF58
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_09E7C150	10_2_09E7C150
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_09E7CB21	10_2_09E7CB21
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_09E7BA28	10_2_09E7BA28
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_09E7DA30	10_2_09E7DA30
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_09E79E18	10_2_09E79E18
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_09E7ADE9	10_2_09E7ADE9
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_09E7D9C3	10_2_09E7D9C3
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_09E7B98D	10_2_09E7B98D
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_09E7F4C0	10_2_09E7F4C0
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_09E7E8C9	10_2_09E7E8C9
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_09E7F4D0	10_2_09E7F4D0
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_09E7E8D8	10_2_09E7E8D8
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_09E7F7C0	10_2_09E7F7C0
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_09E7FB40	10_2_09E7FB40
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_09E70748	10_2_09E70748
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_09E7FB31	10_2_09E7FB31
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_09E90040	10_2_09E90040
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_09E9FB61	10_2_09E9FB61
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_09E9FB70	10_2_09E9FB70
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_09E9EE71	10_2_09E9EE71
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_0A1C564F	10_2_0A1C564F
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_0A1C3428	10_2_0A1C3428
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_0A1CA570	10_2_0A1CA570
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_0A1CAD90	10_2_0A1CAD90
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_0A1CFA38	10_2_0A1CFA38
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_0A1CE698	10_2_0A1CE698
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_0A1C36C8	10_2_0A1C36C8
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_0A1C36C7	10_2_0A1C36C7
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_0A1C0B31	10_2_0A1C0B31
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_0A1C7348	10_2_0A1C7348
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_0A1C7347	10_2_0A1C7347
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_0A1C0B88	10_2_0A1C0B88
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_0A1C4B80	10_2_0A1C4B80
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_0A1C43BF	10_2_0A1C43BF
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_0A1C43C0	10_2_0A1C43C0
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_0A1C8C38	10_2_0A1C8C38
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_0A1C342A	10_2_0A1C342A
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_0A1C0040	10_2_0A1C0040
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_0A1C8508	10_2_0A1C8508
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_0A1C3D58	10_2_0A1C3D58
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_0A1C3D57	10_2_0A1C3D57
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_0A1CE9B0	10_2_0A1CE9B0
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_09E90011	10_2_09E90011
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 11_2_04DCADF0	11_2_04DCADF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 11_2_04DC3E80	11_2_04DC3E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 11_2_04DCA968	11_2_04DCA968
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 11_2_04DC4A98	11_2_04DC4A98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 11_2_04DC41C8	11_2_04DC41C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 11_2_04DCF8A5	11_2_04DCF8A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 11_2_0950A140	11_2_0950A140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 11_2_0950E0C8	11_2_0950E0C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 11_2_0950C358	11_2_0950C358
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 11_2_09500338	11_2_09500338
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 11_2_09503578	11_2_09503578
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 11_2_095045A0	11_2_095045A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 11_2_09503CA0	11_2_09503CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 11_2_09505650	11_2_09505650

Source: G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe

Static PE information: invalid certificate

Source: G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe, 00000000.00000000.2350896489.0000000000CE4000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameOculusSetup.exe: vs G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe
Source: G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe, 00000000.00000002.2536597554.0000000007610000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameHPzFG9.dll" vs G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe
Source: G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe, 00000000.00000002.2510814259.000000000129E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe
Source: G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe, 00000000.00000002.2517202114.000000000497F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameHPzFG9.dll" vs G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe
Source: G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe, 00000000.00000002.2534549381.0000000006211000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameHPzFG9.dll" vs G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe
Source: G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Binary or memory string: OriginalFilenameOculusSetup.exe: vs G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe

Source: G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 10.2.po.exe.43446a8.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 10.2.po.exe.42f4688.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.2.AppLaunch.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 10.2.po.exe.42f4688.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 10.2.po.exe.43446a8.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe, Ec6.cs	Cryptographic APIs: 'CreateDecryptor'
Source: po.exe.4.dr, Ec6.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 10.2.po.exe.43446a8.2.raw.unpack, RsYAkkzVoy.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 10.2.po.exe.43446a8.2.raw.unpack, Kqqzixk.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 10.2.po.exe.43446a8.2.raw.unpack, xROdzGigX.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 10.2.po.exe.43446a8.2.raw.unpack, ywes.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 10.2.po.exe.43446a8.2.raw.unpack, iPVW0zV.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 10.2.po.exe.43446a8.2.raw.unpack, 1Pi9sgbHwoV.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 10.2.po.exe.43446a8.2.raw.unpack, YUgDfWK2g4.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 10.2.po.exe.43446a8.2.raw.unpack, YUgDfWK2g4.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@12/5@2/3

Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\po.lnk

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1416:120:WilError_03

Source: G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe

ReversingLabs: Detection: 71%

Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe

File read: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe "C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe"
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c ping 127.0.0.1 -n 17 > nul && copy "C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe" "C:\Users\user\AppData\Roaming\po.exe" && ping 127.0.0.1 -n 17 > nul && "C:\Users\user\AppData\Roaming\po.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 17
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 17
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\po.exe "C:\Users\user\AppData\Roaming\po.exe"
Source: C:\Users\user\AppData\Roaming\po.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c ping 127.0.0.1 -n 17 > nul && copy "C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe" "C:\Users\user\AppData\Roaming\po.exe" && ping 127.0.0.1 -n 17 > nul && "C:\Users\user\AppData\Roaming\po.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 17	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 17	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\po.exe "C:\Users\user\AppData\Roaming\po.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"	Jump to behavior

Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Section loaded: edputil.dll	Jump to behavior

Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Source: po.lnk.0.dr

LNK file: ..\..\..\..\..\po.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe

Static file information: File size 2628152 > 1048576

Source: G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x220a00

Source: G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Data Obfuscation

Yara detected DarkTortilla Crypter

Source: Yara match	File source: 10.2.po.exe.43446a8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe.4d486d8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe.7610000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe.7610000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe.4d486d8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe.4c486b8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.3317600419.0000000004344000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2517202114.0000000004916000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2512152964.0000000003091000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2536597554.0000000007610000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2534549381.0000000006211000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3308368525.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2517202114.000000000497F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe PID: 6968, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: po.exe PID: 2712, type: MEMORYSTR

Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Code function: 0_2_0A36AE3B push esp; iretd	0_2_0A36AE41
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Code function: 0_2_0A566205 push eax; ret	0_2_0A56630E
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Code function: 0_2_0A8E7FCD push eax; retf	0_2_0A8E810D
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Code function: 0_2_0A8EAB3D push FFFFFF8Bh; iretd	0_2_0A8EAB3F
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Code function: 0_2_0A8E8115 push ebx; retf	0_2_0A8E81D2
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Code function: 0_2_0A8E2573 push ebx; ret	0_2_0A8E2579
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_055E9900 push esp; ret	10_2_055E9901
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_055E9A00 pushfd ; ret	10_2_055E9A01
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_09E7797E push ds; retf	10_2_09E7797F
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_09E969E1 push eax; ret	10_2_09E969F3
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_09E97191 push ecx; ret	10_2_09E971A2
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_09E9E91B push ebx; ret	10_2_09E9E921
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_09E97080 pushad ; ret	10_2_09E97093
Source: C:\Users\user\AppData\Roaming\po.exe	Code function: 10_2_09E96205 push eax; ret	10_2_09E9630E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 11_2_04DC0C45 push ebx; retf	11_2_04DC0C52
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 11_2_04DC0C6D push edi; retf	11_2_04DC0C7A

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\po.exe

Jump to dropped file

Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\po.lnk

Jump to behavior

Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\po.lnk

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	File opened: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe\:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	File opened: C:\Users\user\AppData\Roaming\po.exe\:Zone.Identifier read attributes \| delete			Jump to behavior

Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe PID: 6968, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: po.exe PID: 2712, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Uses ping.exe to sleep

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 17
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 17
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 17	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 17	Jump to behavior

Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Memory allocated: 16B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Memory allocated: 3090000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Memory allocated: 5090000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Memory allocated: 6210000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Memory allocated: 5950000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Memory allocated: 7800000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Memory allocated: 8800000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Memory allocated: E90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Memory allocated: 2A30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Memory allocated: 2980000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Memory allocated: 5BA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Memory allocated: 52B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Memory allocated: 7090000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Memory allocated: 8090000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Memory allocated: 7090000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Memory allocated: A1D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Memory allocated: B1D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Memory allocated: B670000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Memory allocated: 4DC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Memory allocated: 69E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Memory allocated: 6710000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Window / User API: threadDelayed 6006	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Window / User API: threadDelayed 2438	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Window / User API: threadDelayed 6774	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Window / User API: threadDelayed 1705	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Window / User API: threadDelayed 1890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Window / User API: threadDelayed 7941	Jump to behavior

Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe TID: 6204	Thread sleep time: -24903104499507879s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe TID: 6988	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe TID: 652	Thread sleep time: -64000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe TID: 3336	Thread sleep time: -26747778906878833s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe TID: 4240	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -35971150943733603s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 6384	Thread sleep count: 1890 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 6384	Thread sleep count: 7941 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -99766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -99641s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -99516s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -99407s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -99282s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -99157s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -99047s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -98938s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -98813s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -98688s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -98563s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -98438s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -98325s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -98213s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -98000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -97879s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -97750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -97640s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -97531s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -97422s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -97313s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -97188s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -97063s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -96953s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -96844s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -96719s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -96609s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -96500s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -96391s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -96281s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -96172s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -96063s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -95938s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -95828s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -95719s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -95594s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -95484s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -95375s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -95239s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -95124s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -95014s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -94900s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -94786s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -94665s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -94563s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -94453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -94344s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -94235s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -94110s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 3636	Thread sleep time: -93985s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 99641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 99516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 99407	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 99282	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 99157	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 99047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 98938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 98813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 98688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 98563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 98438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 98325	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 98213	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 98000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 97879	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 97750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 97640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 97531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 97422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 97313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 97188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 97063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 96953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 96844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 96719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 96609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 96500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 96391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 96281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 96172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 96063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 95938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 95828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 95719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 95594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 95484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 95375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 95239	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 95124	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 95014	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 94900	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 94786	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 94665	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 94563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 94453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 94344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 94235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 94110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 93985	Jump to behavior

Source: G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe, 00000000.00000002.2536100794.0000000007410000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}h
Source: G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe, 00000000.00000002.2512152964.0000000003091000.00000004.00000800.00020000.00000000.sdmp, G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe, 00000000.00000002.2536597554.0000000007610000.00000004.08000000.00040000.00000000.sdmp, G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe, 00000000.00000002.2517202114.000000000497F000.00000004.00000800.00020000.00000000.sdmp, G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe, 00000000.00000002.2534549381.0000000006211000.00000004.00000800.00020000.00000000.sdmp, po.exe, 0000000A.00000002.3308368525.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VBoxTray
Source: po.exe, 0000000A.00000002.3308368525.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q#SOFTWARE\VMware, Inc.\VMware VGAuth
Source: G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe, 00000000.00000002.2534549381.0000000006211000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 806010189GSOFTWARE\VMware, Inc.\VMware VGAuth
Source: G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe, 00000000.00000002.2536100794.0000000007410000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\)
Source: AppLaunch.exe, 0000000B.00000002.3618301282.0000000009BDA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Roaming\po.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Roaming\po.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 43C000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 43E000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 672008	Jump to behavior

Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c ping 127.0.0.1 -n 17 > nul && copy "C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe" "C:\Users\user\AppData\Roaming\po.exe" && ping 127.0.0.1 -n 17 > nul && "C:\Users\user\AppData\Roaming\po.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 17	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 17	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\po.exe "C:\Users\user\AppData\Roaming\po.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"	Jump to behavior

Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Queries volume information: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Queries volume information: C:\Users\user\AppData\Roaming\po.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\po.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 10.2.po.exe.43446a8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.po.exe.42f4688.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.AppLaunch.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.po.exe.42f4688.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.po.exe.43446a8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.3317600419.0000000004296000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3611482014.0000000006A31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3611482014.0000000006A5C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3317600419.0000000004344000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3608105838.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3317600419.00000000042F3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3308368525.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: po.exe PID: 2712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AppLaunch.exe PID: 2328, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 10.2.po.exe.43446a8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.po.exe.42f4688.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.AppLaunch.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.po.exe.42f4688.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.po.exe.43446a8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.3317600419.0000000004296000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3611482014.0000000006A31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3317600419.0000000004344000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3608105838.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3317600419.00000000042F3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3308368525.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: po.exe PID: 2712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AppLaunch.exe PID: 2328, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 10.2.po.exe.43446a8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.po.exe.42f4688.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.AppLaunch.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.po.exe.42f4688.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.po.exe.43446a8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.3317600419.0000000004296000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3611482014.0000000006A31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3611482014.0000000006A5C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3317600419.0000000004344000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3608105838.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3317600419.00000000042F3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3308368525.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: po.exe PID: 2712, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AppLaunch.exe PID: 2328, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Valid Accounts	1 Valid Accounts	1 Deobfuscate/Decode Files or Information	21 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	2 Registry Run Keys / Startup Folder	1 Access Token Manipulation	1 Obfuscated Files or Information	1 Credentials in Registry	221 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	211 Process Injection	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	21 Input Capture	23 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	2 Registry Run Keys / Startup Folder	1 Masquerading	LSA Secrets	151 Virtualization/Sandbox Evasion	SSH	1 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Valid Accounts	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	151 Virtualization/Sandbox Evasion	Proc Filesystem	11 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	211 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Hidden Files and Directories	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	71%	ReversingLabs	Win32.Spyware.Negasteal
G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\po.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\po.exe	71%	ReversingLabs	Win32.Spyware.Negasteal

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
https://api.ipify.org/t	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://mail.iaa-airferight.com	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.iaa-airferight.com	46.175.148.58	true	true		unknown
api.ipify.org	172.67.74.152	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	po.exe, 0000000A.00000002.3317600419.0000000004344000.00000004.00000800.00020000.00000000.sdmp, po.exe, 0000000A.00000002.3317600419.0000000004296000.00000004.00000800.00020000.00000000.sdmp, po.exe, 0000000A.00000002.3317600419.00000000042F3000.00000004.00000800.00020000.00000000.sdmp, po.exe, 0000000A.00000002.3308368525.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.3611482014.00000000069E1000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.3608105838.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.dyn.com/	po.exe, 0000000A.00000002.3317600419.0000000004344000.00000004.00000800.00020000.00000000.sdmp, po.exe, 0000000A.00000002.3317600419.0000000004296000.00000004.00000800.00020000.00000000.sdmp, po.exe, 0000000A.00000002.3317600419.00000000042F3000.00000004.00000800.00020000.00000000.sdmp, po.exe, 0000000A.00000002.3308368525.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 0000000B.00000002.3608105838.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org/t	AppLaunch.exe, 0000000B.00000002.3611482014.00000000069E1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	AppLaunch.exe, 0000000B.00000002.3611482014.00000000069E1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mail.iaa-airferight.com	AppLaunch.exe, 0000000B.00000002.3611482014.0000000006A5C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
46.175.148.58	mail.iaa-airferight.com	Ukraine		56394	ASLAGIDKOM-NETUA	true
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1501084
Start date and time:	2024-08-29 12:10:44 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@12/5@2/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 177 Number of non-executed functions: 5
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe

Simulations

Behavior and APIs

Time	Type	Description
06:11:46	API Interceptor	42x Sleep call for process: G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe modified
06:12:33	API Interceptor	75x Sleep call for process: po.exe modified
06:13:18	API Interceptor	256x Sleep call for process: AppLaunch.exe modified
12:11:51	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\po.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
46.175.148.58	PO 102675-PI C247SH45.exe	Get hash	malicious	AgentTesla	Browse
	Purchase Order 0042040896.pdf.exe	Get hash	malicious	AgentTesla	Browse
	Great Wall Motor Sale Bank_Sift_Copy.Pdf.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse
	SecuriteInfo.com.BackDoor.SpyBotNET.62.13095.12836.exe	Get hash	malicious	AgentTesla	Browse
	PO 102675-PI C247SH45.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse
	NINGBO-Invoices-Past Due.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse
	Payment Advice-DPEB08-2SDC - SS25 Price C246SH32.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse
	New RFQ Compliance_Matrix_Product.exe	Get hash	malicious	AgentTesla, RedLine	Browse
	New PO Compliance_Matrix_Product.exe	Get hash	malicious	AgentTesla, RedLine	Browse
	Shipmernt copy.exe	Get hash	malicious	AgentTesla	Browse
172.67.74.152	zE7Ken4cFt.dll	Get hash	malicious	Quasar	Browse	api.ipify.org/
	FormPlayer.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	PandaClient.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	golang-modules.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	SecuriteInfo.com.Trojan.Win64.Agent.14415.19839.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	242764.exe	Get hash	malicious	Ficker Stealer, Rusty Stealer	Browse	api.ipify.org/?format=wef
	K8mzlntJVN.msi	Get hash	malicious	Unknown	Browse	api.ipify.org/
	stub.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	stub.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Sonic-Glyder.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.iaa-airferight.com	PO 102675-PI C247SH45.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Purchase Order 0042040896.pdf.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Great Wall Motor Sale Bank_Sift_Copy.Pdf.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	46.175.148.58
	SecuriteInfo.com.BackDoor.SpyBotNET.62.13095.12836.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	PO 102675-PI C247SH45.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	46.175.148.58
	NINGBO-Invoices-Past Due.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	46.175.148.58
	Payment Advice-DPEB08-2SDC - SS25 Price C246SH32.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	46.175.148.58
	New RFQ Compliance_Matrix_Product.exe	Get hash	malicious	AgentTesla, RedLine	Browse	46.175.148.58
	New PO Compliance_Matrix_Product.exe	Get hash	malicious	AgentTesla, RedLine	Browse	46.175.148.58
	Shipmernt copy.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
api.ipify.org	Great Wall Motor Sale Bank_Sift_Copy.Pdf.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	104.26.13.205
	Programa de Mentoring y Apoyo a la Internacionalizaci#U00f3n.exe	Get hash	malicious	GuLoader	Browse	104.26.13.205
	5649237431_23-10-23-08.49.23.0107.07.exe	Get hash	malicious	GuLoader	Browse	104.26.12.205
	Hua San Particulars.doc.scr.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Catalina - Particulars.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	SecuriteInfo.com.BackDoor.SpyBotNET.62.13095.12836.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	rARKMONEY.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	z55enyioma.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://request-label-13956753.pages.dev/help/contact/135346556695032	Get hash	malicious	Unknown	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASLAGIDKOM-NETUA	PO 102675-PI C247SH45.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Purchase Order 0042040896.pdf.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Great Wall Motor Sale Bank_Sift_Copy.Pdf.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	46.175.148.58
	SecuriteInfo.com.BackDoor.SpyBotNET.62.13095.12836.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	PO 102675-PI C247SH45.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	46.175.148.58
	NINGBO-Invoices-Past Due.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	46.175.148.58
	Payment Advice-DPEB08-2SDC - SS25 Price C246SH32.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	46.175.148.58
	New RFQ Compliance_Matrix_Product.exe	Get hash	malicious	AgentTesla, RedLine	Browse	46.175.148.58
	New PO Compliance_Matrix_Product.exe	Get hash	malicious	AgentTesla, RedLine	Browse	46.175.148.58
	Shipmernt copy.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
CLOUDFLARENETUS	Offer 2024-30496.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	pagamento.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	Po#70831.exe	Get hash	malicious	Azorult	Browse	172.67.128.117
	payment PAGO 2974749647839452.js	Get hash	malicious	Unknown	Browse	162.159.130.233
	Document_pdf.exe	Get hash	malicious	FormBook	Browse	104.21.62.58
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	Great Wall Motor Sale Bank_Sift_Copy.Pdf.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	104.26.13.205
	https://my.manychat.com/r?act=179c825ab8add5f9e8bacb82e520a126&u=7459244230843026&p=108345799024755&h=708b8c96be&fbclid=IwZXh0bgNhZW0CMTAAAR07FD8Q65AMa77uMdYFT9FANMjTbvHV0BrVDR-o7WBQKwVAUtHYk2rnVVU_aem_OFd7GNUGsZzyslAWr711gg	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://tinyurl.com/NDCEurope	Get hash	malicious	Unknown	Browse	104.18.86.42

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	payment PAGO 2974749647839452.js	Get hash	malicious	Unknown	Browse	172.67.74.152
	Great Wall Motor Sale Bank_Sift_Copy.Pdf.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	172.67.74.152
	https://paquete.centrodelvaquero.com/	Get hash	malicious	Unknown	Browse	172.67.74.152
	QUOTATION_AUGQTRA071244#U00b7PDF.scr	Get hash	malicious	Unknown	Browse	172.67.74.152
	QUOTATION_AUGQTRA071244#U00b7PDF.scr	Get hash	malicious	Unknown	Browse	172.67.74.152
	8468281651.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.74.152
	file.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	input.htm	Get hash	malicious	Unknown	Browse	172.67.74.152
	SecuriteInfo.com.Trojan.Inject5.5513.6456.21079.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152

Process:	C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
Category:	dropped
Size (bytes):	862
Entropy (8bit):	3.0668858765696716
Encrypted:	false
SSDEEP:	12:8wl0FsXoCl/tz0/CSLvx1MJmgTCNfBT/v4t2YZ/elFlSJm:8G1WLJqEVpdqy
MD5:	16FC50BA1F43056DE04D32CC6B6AFE63
SHA1:	09C0D5ACD95282672866EAEC94CDCD7E3BC03563
SHA-256:	261273561DA381B137B2EB47E1847F9DDC7295213A120E945826F5ED3B84286D
SHA-512:	4F9179551743BA16796694CB36309E2002C918AFCC33ADDF5F8C038F77EBE0C1BE1339E4FAFC8E7CFE0F904AF5FE15ECCAC9C749609E2BEF530F906AEE8607F8
Malicious:	false
Reputation:	low
Preview:	L..................F.............................................................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....P.1...........user.<............................................a.l.b.u.s.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....T.2...........po.exe..>............................................p.o...e.x.e.............\.....\.....\.....\.....\.p.o...e.x.e.%.C.:.\.U.s.e.r.s.\.a.l.b.u.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.p.o...e.x.e.............y.............>.e.L.:..er.=y...............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.3.................

C:\Users\user\AppData\Roaming\po.exe

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2628152
Entropy (8bit):	7.766468006073971
Encrypted:	false
SSDEEP:	49152:5ZCif8dHfbds+Ee0HpEG3dNAGC/KpMxUQao54X9ioWN6MkdJSnN:PCifX+7qEpVw+J4N8rkdw
MD5:	94117AFF03DEC1ED2036AAB93E6EE76C
SHA1:	D095D0607A47C54ED7BC407362DDD73AD3175258
SHA-256:	06CE17C25D36E66683F7EAB6A010DE3F388A3097312E47875BA3EDA13C6DD4C1
SHA-512:	B15DFAA0AAAB45CE9BF20C8FD8A3CE466F1F9A77D88018262255BC67DC15436FC9FE857B5ABBE224B45DE6C2818B60571821C8EE65393CFF64F0475F5FD075D4
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....&.O.................."..........)".. ...@"...@.. .......................@(...........`..................................)".K....@".I.............'.8.... (...................................................... ............... ..H............text.....".. ...."................. ..`.rsrc...I....@".......".............@..@.reloc....... (.......'.............@..B.................)".....H.........!..U.......... ...."!..........................................h.......q...B...I..]...h:......C.......+.......4V..D...S?..:?...q...........0......P................B...F...<..y....4..~d..Q....g..*K.....".......R....]..2....H.......O..L6...D..j....`..jc...h...&..%>..@$...=...p......h..-....Z......<...........)......6........s......ZC../X..:x...o......n.......m......^.............../...............>@..........L...H%.......l..ZD...U..o...CK..mf...u......BF...~...U..

C:\Users\user\AppData\Roaming\po.exe:Zone.Identifier

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

\Device\Null

Download File

Process:	C:\Windows\SysWOW64\PING.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1068
Entropy (8bit):	4.814991866910862
Encrypted:	false
SSDEEP:	12:PKMRJpTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeT0slJtCAFSkIrxMVlmJHaVzvv:/SGJsAokItULVDv
MD5:	C7F5131E6A85CF8BDA74092C9805F755
SHA1:	CA57A3BA51ECBE46FBC8143C31EED0AE4EADFA20
SHA-256:	54AC7EBA5E4DC544DFF04A56D60FB34322AE6D30B4246215139B50BFFD39B8EA
SHA-512:	79D2E71160915F618E91E181B3ABDF323B93BCC6CAACC7A364C39033118FFAF19E6CAC1F291EE3FFFBFC3992B62E4A5D282CE6E8C2D03063B3F1967A19A2ECF6
Malicious:	false
Preview:	..Pinging 127.0.0.1 with 32 bytes of data:..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128....Ping statistics for 127.0.0.1:.. Packets: Sent = 17, Received = 17, Lost = 0 (0% loss),..Approximate round trip times

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.766468006073971
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe
File size:	2'628'152 bytes
MD5:	94117aff03dec1ed2036aab93e6ee76c
SHA1:	d095d0607a47c54ed7bc407362ddd73ad3175258
SHA256:	06ce17c25d36e66683f7eab6a010de3f388a3097312e47875ba3eda13c6dd4c1
SHA512:	b15dfaa0aaab45ce9bf20c8fd8a3ce466f1f9a77d88018262255bc67dc15436fc9fe857b5abbe224b45de6c2818b60571821c8ee65393cff64f0475f5fd075d4
SSDEEP:	49152:5ZCif8dHfbds+Ee0HpEG3dNAGC/KpMxUQao54X9ioWN6MkdJSnN:PCifX+7qEpVw+J4N8rkdw
TLSH:	46C59D807F78D987F30A9834E0B0A6F4B0A71DA6C51B0087E47EFD69F77E614299E119
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....&.O.................."..........)".. ...@"...@.. .......................@(...........`................................

File Icon


Icon Hash:	01392c2c794e1b07

Static PE Info

General

Entrypoint:	0x6229de
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4FE226CB [Wed Jun 20 19:38:51 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	25/05/2021 02:00:00 30/05/2024 01:59:59
Subject Chain	CN="Oculus VR, LLC", OU="Facebook Technologies, LLC", O="Oculus VR, LLC", L=Menlo Park, S=California, C=US
Version:	3
Thumbprint MD5:	7885AA7AA1FCC7BA4717886C139633CC
Thumbprint SHA-1:	2764A796D381E88A2B8AAD23B22AFAD09A37E147
Thumbprint SHA-256:	48FBA3244794EA26D81022CFC7E239B2E851C29C099D7B1CA7A57710C95847E9
Serial:	0C9344432C064405C0799B9A49E9EF89

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x222990	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x224000	0x5dd49	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x27ec00	0x2e38	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x282000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2209e4	0x220a00	1d2405c32c9eff94a112eacd336ddcc4	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x224000	0x5dd49	0x5de00	f0cee70574b102c515fb750fb22d12be	False	0.07783112100532623	data	5.0314406428521625	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x282000	0xc	0x200	fcdb585104b4dd41ba763c94b404b56a	False	0.044921875	MacBinary, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040 """	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x224280	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 0			0.08968709333964273
RT_ICON	0x234aa8	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 0			0.16987482286254132
RT_ICON	0x238cd0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0			0.2183609958506224
RT_ICON	0x23b278	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 0			0.253698224852071
RT_ICON	0x23cce0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0			0.3198874296435272
RT_ICON	0x23dd88	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0			0.37540983606557377
RT_ICON	0x23e710	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0			0.5283687943262412
RT_ICON	0x23eb78	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 0			0.048961446282214396
RT_GROUP_ICON	0x280ba0	0x76	data			0.7457627118644068
RT_VERSION	0x280c18	0x31c	data	English	United States	0.4396984924623116
RT_MANIFEST	0x280f34	0xe15	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF, LF line terminators			0.3908460471567268

Imports

DLL	Import
mscoree.dll	_CorExeMain

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 29, 2024 12:13:18.137417078 CEST	49728	443	192.168.2.12	172.67.74.152
Aug 29, 2024 12:13:18.137464046 CEST	443	49728	172.67.74.152	192.168.2.12
Aug 29, 2024 12:13:18.137521029 CEST	49728	443	192.168.2.12	172.67.74.152
Aug 29, 2024 12:13:18.148715973 CEST	49728	443	192.168.2.12	172.67.74.152
Aug 29, 2024 12:13:18.148731947 CEST	443	49728	172.67.74.152	192.168.2.12
Aug 29, 2024 12:13:18.611124992 CEST	443	49728	172.67.74.152	192.168.2.12
Aug 29, 2024 12:13:18.611207008 CEST	49728	443	192.168.2.12	172.67.74.152
Aug 29, 2024 12:13:18.649151087 CEST	49728	443	192.168.2.12	172.67.74.152
Aug 29, 2024 12:13:18.649172068 CEST	443	49728	172.67.74.152	192.168.2.12
Aug 29, 2024 12:13:18.649554014 CEST	443	49728	172.67.74.152	192.168.2.12
Aug 29, 2024 12:13:18.694139004 CEST	49728	443	192.168.2.12	172.67.74.152
Aug 29, 2024 12:13:18.968723059 CEST	49728	443	192.168.2.12	172.67.74.152
Aug 29, 2024 12:13:19.012511969 CEST	443	49728	172.67.74.152	192.168.2.12
Aug 29, 2024 12:13:19.072658062 CEST	443	49728	172.67.74.152	192.168.2.12
Aug 29, 2024 12:13:19.072732925 CEST	443	49728	172.67.74.152	192.168.2.12
Aug 29, 2024 12:13:19.072798014 CEST	49728	443	192.168.2.12	172.67.74.152
Aug 29, 2024 12:13:19.078236103 CEST	49728	443	192.168.2.12	172.67.74.152
Aug 29, 2024 12:13:19.630177021 CEST	49729	25	192.168.2.12	46.175.148.58
Aug 29, 2024 12:13:20.631628036 CEST	49729	25	192.168.2.12	46.175.148.58
Aug 29, 2024 12:13:22.631674051 CEST	49729	25	192.168.2.12	46.175.148.58
Aug 29, 2024 12:13:26.631779909 CEST	49729	25	192.168.2.12	46.175.148.58
Aug 29, 2024 12:13:34.631773949 CEST	49729	25	192.168.2.12	46.175.148.58

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 29, 2024 12:13:18.086446047 CEST	65230	53	192.168.2.12	1.1.1.1
Aug 29, 2024 12:13:18.099723101 CEST	53	65230	1.1.1.1	192.168.2.12
Aug 29, 2024 12:13:19.587357044 CEST	64424	53	192.168.2.12	1.1.1.1
Aug 29, 2024 12:13:19.629549980 CEST	53	64424	1.1.1.1	192.168.2.12

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 29, 2024 12:13:18.086446047 CEST	192.168.2.12	1.1.1.1	0x984	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Aug 29, 2024 12:13:19.587357044 CEST	192.168.2.12	1.1.1.1	0xdce7	Standard query (0)	mail.iaa-airferight.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Aug 29, 2024 12:13:18.099723101 CEST	1.1.1.1	192.168.2.12	0x984	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Aug 29, 2024 12:13:18.099723101 CEST	1.1.1.1	192.168.2.12	0x984	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Aug 29, 2024 12:13:18.099723101 CEST	1.1.1.1	192.168.2.12	0x984	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Aug 29, 2024 12:13:19.629549980 CEST	1.1.1.1	192.168.2.12	0xdce7	No error (0)	mail.iaa-airferight.com	46.175.148.58	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.12	49728	172.67.74.152	443	2328	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 10:13:18 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-08-29 10:13:19 UTC	211	IN	HTTP/1.1 200 OK Date: Thu, 29 Aug 2024 10:13:19 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8babc489df9172b1-EWR
2024-08-29 10:13:19 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Target ID:	0
Start time:	06:11:43
Start date:	29/08/2024
Path:	C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe"
Imagebase:	0xac0000
File size:	2'628'152 bytes
MD5 hash:	94117AFF03DEC1ED2036AAB93E6EE76C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000000.00000002.2517202114.0000000004916000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000000.00000002.2512152964.0000000003091000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000000.00000002.2536597554.0000000007610000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000000.00000002.2534549381.0000000006211000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000000.00000002.2517202114.000000000497F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:11:57
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd" /c ping 127.0.0.1 -n 17 > nul && copy "C:\Users\user\Desktop\G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe" "C:\Users\user\AppData\Roaming\po.exe" && ping 127.0.0.1 -n 17 > nul && "C:\Users\user\AppData\Roaming\po.exe"
Imagebase:	0x1f0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:11:57
Start date:	29/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff704000000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:11:57
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 17
Imagebase:	0xfb0000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:12:13
Start date:	29/08/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 17
Imagebase:	0xfb0000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	06:12:30
Start date:	29/08/2024
Path:	C:\Users\user\AppData\Roaming\po.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\po.exe"
Imagebase:	0xe0000
File size:	2'628'152 bytes
MD5 hash:	94117AFF03DEC1ED2036AAB93E6EE76C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.3317600419.0000000004296000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000002.3317600419.0000000004296000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 0000000A.00000002.3317600419.0000000004344000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.3317600419.0000000004344000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000002.3317600419.0000000004344000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.3317600419.00000000042F3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000002.3317600419.00000000042F3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 0000000A.00000002.3308368525.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.3308368525.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000A.00000002.3308368525.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 71%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	06:12:43
Start date:	29/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
Imagebase:	0xb80000
File size:	103'528 bytes
MD5 hash:	89D41E1CF478A3D3C2C701A27A5692B2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.3611482014.0000000006A31000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.3611482014.0000000006A31000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.3611482014.0000000006A5C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.3608105838.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.3608105838.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	25%
Dynamic/Decrypted Code Coverage:	95%
Signature Coverage:	0%
Total number of Nodes:	40
Total number of Limit Nodes:	2

Executed Functions

Function 0A560006 Relevance: 5.6, Instructions: 5571
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2538705428.000000000A560000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a560000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f5a5a99af38ebcf73d2cb089f40a7477bc08596b34a1e3441c529697a2da42a
Instruction ID: 3ee3f3ad12de4034318c599088be77b5f3fc1cc39c0eb1c01a2db421218d85c2
Opcode Fuzzy Hash: 7f5a5a99af38ebcf73d2cb089f40a7477bc08596b34a1e3441c529697a2da42a
Instruction Fuzzy Hash: A5B32A74A012188FCB58EF38E89969CBBF2FF89200F4084EAD449A7650EF345E95DF55

Function 0A560040 Relevance: 5.5, Instructions: 5545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2538705428.000000000A560000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a560000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48dd367e70a3ac74817412d93abeaec179b36c5b72c49af0514068123c6e29ff
Instruction ID: 5d780e905645bd9243014065ccf42162cfd7b1039686d6494e264927f67c9153
Opcode Fuzzy Hash: 48dd367e70a3ac74817412d93abeaec179b36c5b72c49af0514068123c6e29ff
Instruction Fuzzy Hash: 8DB32A74A012188FCB58EF38E89969CBBF2FF89200F4084EAD449A7650EF345E95DF55

Function 0A360040 Relevance: 5.2, Instructions: 5226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2538520685.000000000A360000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a360000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee5c0299f43c40e0760a75e9a18881245824f172af414325300dc30f61f20d8d
Instruction ID: a06918a5a6b0430c80ace5afbd237eb1b67b401e705fc858e26f4da233ef610c
Opcode Fuzzy Hash: ee5c0299f43c40e0760a75e9a18881245824f172af414325300dc30f61f20d8d
Instruction Fuzzy Hash: 75B31B70A012198BCB18EF38E9996ACBBF5FB88300F4085F9D489A7250DF345E95DF95

Function 0A8E4507 Relevance: 3.6, Instructions: 3614
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2538860490.000000000A8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a8e0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 187bb351dfe59afab1866e0efa7d93058daaff8d8d13c460972125cebb146fe7
Instruction ID: cf9c6136166e9034207634c174cada510ae0641c89407889eb4812540df66002
Opcode Fuzzy Hash: 187bb351dfe59afab1866e0efa7d93058daaff8d8d13c460972125cebb146fe7
Instruction Fuzzy Hash: B9638DB0B01219CBCB44EF78E899B9DBBF1FB48210F5088E9E449E7354DE385D849B65

Function 0A56C4A8 Relevance: 2.2, Strings: 1, Instructions: 930COMMON

Download Yara Rule

Strings

], xrefs: 0A56CAB6

Memory Dump Source

Source File: 00000000.00000002.2538705428.000000000A560000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a560000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID: ]
API String ID: 0-3352871620
Opcode ID: ccccdd2479a128880ac58fcdd1db7c9056ec8f63801f80a586a9493573721b0c
Instruction ID: 251e032981a6950b116dcf603fd947bc30997bdeed7a7a7ac3e1d9cc1fc7085d
Opcode Fuzzy Hash: ccccdd2479a128880ac58fcdd1db7c9056ec8f63801f80a586a9493573721b0c
Instruction Fuzzy Hash: 77729B31B002199FDB64EF69C854BAE7BB6BF88600F148069E546EB399CF34DC41CB91

Function 016F7B28 Relevance: 1.0, Instructions: 988COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511583959.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16f0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37d8a3b8be7167516dd974ff3b866ec333b3ec4e23cb21c290d43eea1a4cab59
Instruction ID: 3a8af7a6ce1883c81ce75e3dfb5af381009b9947bd9d6a0eba600babb03895a7
Opcode Fuzzy Hash: 37d8a3b8be7167516dd974ff3b866ec333b3ec4e23cb21c290d43eea1a4cab59
Instruction Fuzzy Hash: 22925A31A01209DFCB15CF68C884AAEBBF6FF88314F1585A9E6159B3A6D731ED41CB50

Function 016F6ED8 Relevance: .9, Instructions: 917COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511583959.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16f0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cae3daa5ae0d53a508a72469ad32a84c34e8aa32df008f8a85b739ee08316590
Instruction ID: 05105bb10c524e24bf7638587fd88a3e2a1bff730d48ee2f1158298d0377c7e1
Opcode Fuzzy Hash: cae3daa5ae0d53a508a72469ad32a84c34e8aa32df008f8a85b739ee08316590
Instruction Fuzzy Hash: 20826E70A002199FDB15DFA9C844AAEBBF6FF88300F158469EA15EB3A5DB34DD41CB50

Function 016FAE98 Relevance: .7, Instructions: 692COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511583959.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16f0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cb61970e5ff84b1afe0b449f98d437ba00e62587d29c34645268aff9c55c817
Instruction ID: e52591d75ee62074f06dc2b4b864eb51fb4fe2e28c97895a9c87fa075a159867
Opcode Fuzzy Hash: 0cb61970e5ff84b1afe0b449f98d437ba00e62587d29c34645268aff9c55c817
Instruction Fuzzy Hash: 5A523034B01219CFDB249B79CC5476D7AB2FB88300F1484AED60AAB399DB749D81CF55

Function 016FAE68 Relevance: .5, Instructions: 516COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511583959.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16f0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46fbe82bceb5199afdb65aad1df4a7c9b3d8110bb8487becc88a1195069c6b71
Instruction ID: 506531cd92a43723df128cc0585e7d578a2af07450affdb20d5db248c2247d01
Opcode Fuzzy Hash: 46fbe82bceb5199afdb65aad1df4a7c9b3d8110bb8487becc88a1195069c6b71
Instruction Fuzzy Hash: 2A127330A01219CFDB259B69CC5476D7BB2FF89301F1484AED60AAB398DB348D82CF55

Function 0A3676B8 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2538520685.000000000A360000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a360000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18b26828a9ca6986c7ab3ab27d364f02131eabd64da213b6a0b441e0ab9836c
Instruction ID: 1bb2a3d8068b23deac0b9752fb3041eee3ac3c16a2807b363729fb362d0bd71f
Opcode Fuzzy Hash: b18b26828a9ca6986c7ab3ab27d364f02131eabd64da213b6a0b441e0ab9836c
Instruction Fuzzy Hash: 1C816038B002199FDF28AF75945467E7AF7BFC9700BA4852EE416E7398CE348C518B61

Function 0A56A4FC Relevance: 2.8, Strings: 2, Instructions: 296
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

F, xrefs: 0A56A5AA
H@, xrefs: 0A56A514

Memory Dump Source

Source File: 00000000.00000002.2538705428.000000000A560000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a560000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID: F$H@
API String ID: 0-698397363
Opcode ID: 55d56d9689b2ca602498ae1d9d2524dd2a00aef9a66d85a12a08dffa161b2872
Instruction ID: 58686b0c5ff0d02ab3153910c0a4b411aa1aae465978993614cd1a04c808fa67
Opcode Fuzzy Hash: 55d56d9689b2ca602498ae1d9d2524dd2a00aef9a66d85a12a08dffa161b2872
Instruction Fuzzy Hash: 91A11670B093858FC702AB78E85575A7FF1FF86250F1644EBD485E7296EA385C09C3A2

Function 0A56DF3A Relevance: 1.9, Strings: 1, Instructions: 610
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

7, xrefs: 0A56DFC4

Memory Dump Source

Source File: 00000000.00000002.2538705428.000000000A560000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a560000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID: 7
API String ID: 0-1790921346
Opcode ID: b1cdf54725d388cf37106c846629f1cd57cb8f2cbabd8b8f863e3adbcd5e23a9
Instruction ID: c794a90c717d70b9e5b5a0ed464c41c0be990d30e2a019472f18e8030947baff
Opcode Fuzzy Hash: b1cdf54725d388cf37106c846629f1cd57cb8f2cbabd8b8f863e3adbcd5e23a9
Instruction Fuzzy Hash: F012D074A062458FC705FF78E89969D7BF1FF4A200F1548AAE481E72A1EE385C09D7A1

Function 0A367CFF Relevance: 1.6, APIs: 1, Instructions: 93
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000), ref: 0A367DA8

Memory Dump Source

Source File: 00000000.00000002.2538520685.000000000A360000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a360000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 18d130a8a97ef0aae123a8fa9e89bb71585a4b72b8564222533e73cdde59eb98
Instruction ID: 3d0206b498821f9419b8ef9ee64931ec767ece0a038bae659813c571f84c2c97
Opcode Fuzzy Hash: 18d130a8a97ef0aae123a8fa9e89bb71585a4b72b8564222533e73cdde59eb98
Instruction Fuzzy Hash: EE31A3B5C097858FCB12CFA5C8547D9BFB4AF47214F1A81D7C494EB292D3385909CBA2

Function 0A367D38 Relevance: 1.6, APIs: 1, Instructions: 56
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000), ref: 0A367DA8

Memory Dump Source

Source File: 00000000.00000002.2538520685.000000000A360000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a360000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: d68e0fd9a31c1a2daefdd5a7ef89ab37b4d7224cb468aa1f498eca26db8ec528
Instruction ID: 068a8476e6994656b74a8e61cfc83e4b433f896b4514d2ef19b8c9e0624bdff7
Opcode Fuzzy Hash: d68e0fd9a31c1a2daefdd5a7ef89ab37b4d7224cb468aa1f498eca26db8ec528
Instruction Fuzzy Hash: 7F1147B1C0065A9FCB10CF9AC444BEEFBB4FF48724F11856AD818A7240D778A940CFA5

Function 0A8E88C8 Relevance: 1.5, APIs: 1, Instructions: 44
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,?,?,?), ref: 0A8E8925

Memory Dump Source

Source File: 00000000.00000002.2538860490.000000000A8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a8e0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: e51b2df4eee0e1a1e6abc9350bf75530915c5ad3341f15dd53461ed261a06f9b
Instruction ID: fa3d67914a61db2a7eedaada7528d1fd638a17ec983b63d32b55d1df6e6fe66e
Opcode Fuzzy Hash: e51b2df4eee0e1a1e6abc9350bf75530915c5ad3341f15dd53461ed261a06f9b
Instruction Fuzzy Hash: 4D11E2B5800349DFDB20DF9AD885BDEFBF8EB48724F10841AD958A7210C379A944CFA5

Function 0A8E88C0 Relevance: 1.5, APIs: 1, Instructions: 44
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,?,?,?), ref: 0A8E8925

Memory Dump Source

Source File: 00000000.00000002.2538860490.000000000A8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a8e0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 18bca85380d1f88ed6a4c3bdb7b5b99ae8ebaf6ef13cc2a634c7b939f24b148b
Instruction ID: 792368196e95104e733ee80a7aa0a90653fe44496f19289f7aa4fcf05bcb1292
Opcode Fuzzy Hash: 18bca85380d1f88ed6a4c3bdb7b5b99ae8ebaf6ef13cc2a634c7b939f24b148b
Instruction Fuzzy Hash: D311F2B6C00249DFDB10CF9AD985BDEFBF4EB48720F10840AD558A7200C375A984CFA5

Function 0A56A93E Relevance: .9, Instructions: 944
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2538705428.000000000A560000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a560000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fa16b30539a7f2ffa3d17d17b06aa29b470f0cf044cf7b0b7912835e7a14384
Instruction ID: 89f4287b53f1ec758213b3ba177db4c86d074be7ac07ff13e5b749db0c112b02
Opcode Fuzzy Hash: 8fa16b30539a7f2ffa3d17d17b06aa29b470f0cf044cf7b0b7912835e7a14384
Instruction Fuzzy Hash: E572B270B012198BD704BFB8E89875DBBF1FF84210F4249AAE489E7354DF385C599BA1

Function 0A56A9B8 Relevance: .9, Instructions: 900
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2538705428.000000000A560000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a560000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ee1942b64d9e6326fa0664180ccf5c1301fe60e4d8d3326318ad938b1543ea4
Instruction ID: 4b68190a2d49186af7ace52326d25baa1d16ed2e374ff7b898d5709d78f04aeb
Opcode Fuzzy Hash: 2ee1942b64d9e6326fa0664180ccf5c1301fe60e4d8d3326318ad938b1543ea4
Instruction Fuzzy Hash: 3362A370B112198BDB04BFB8E89976DBBF1FF84200F4189AAE449E7354DF385C589B91

Function 0A56D538 Relevance: .7, Instructions: 702COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2538705428.000000000A560000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a560000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94072da733b28b56f9e05b8428053536d320fc6314b9954213f673c466253f83
Instruction ID: afb5cfddc088d7e9807d6ce9f569f08b1492e3a3b2a8c4e25d0559a5afeaedc6
Opcode Fuzzy Hash: 94072da733b28b56f9e05b8428053536d320fc6314b9954213f673c466253f83
Instruction Fuzzy Hash: 76428C71B116198FCB04EF78E458B6E7BF6FB88610F118869E405E7398DE389C05DBA1

Function 0A5688D1 Relevance: .4, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2538705428.000000000A560000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a560000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9c3292fe01b351836445fe362257c133641aac17ba9ee93bc0da3f28ae3f0fc
Instruction ID: 79104cc15a85c2329671c88fb4d7120ff3cc8e30ec40077093801f44d3d0cbd5
Opcode Fuzzy Hash: a9c3292fe01b351836445fe362257c133641aac17ba9ee93bc0da3f28ae3f0fc
Instruction Fuzzy Hash: 4BF16C70B11219CBCB04BFB8E898A5EBBF6FB88210F504969E445E7354EF389C15DB91

Function 0A5688E0 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2538705428.000000000A560000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a560000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b1dc09faaeba22a58f6449a2496ea841b255ac34fa6498851c5cd36ef27c202
Instruction ID: 72ab1d82e4e2e27b0a075cc141cf8aa1a7764b10711ac8c35872a5c8718afc76
Opcode Fuzzy Hash: 3b1dc09faaeba22a58f6449a2496ea841b255ac34fa6498851c5cd36ef27c202
Instruction Fuzzy Hash: 71F16A70B11219CBCB04BFB8E898A5EB7F2FB88210F504969E445E7394EF389C15DB91

Function 0A569E88 Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2538705428.000000000A560000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a560000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 194e59952a261ea98bcb89123aef47f0736f90f5f94b55a7fe9763bd59eded48
Instruction ID: 35cbb80c2941ebd650fe21146982a51b41f642632344087002c61a7a324e0bd8
Opcode Fuzzy Hash: 194e59952a261ea98bcb89123aef47f0736f90f5f94b55a7fe9763bd59eded48
Instruction Fuzzy Hash: FDE1ACB07152068BC704FF78E59962EBBF1FB88650F41486DF485E3354EE389C19AB92

Function 0A56E830 Relevance: .4, Instructions: 436COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2538705428.000000000A560000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a560000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 875077138a28154ebaf4b3c088a47788dec07a50d41c03beac7f02cee873cd2c
Instruction ID: c4ddc5081da7f05526ba342ce2b77b3da24690a2f1300a4cdf26e357958166e6
Opcode Fuzzy Hash: 875077138a28154ebaf4b3c088a47788dec07a50d41c03beac7f02cee873cd2c
Instruction Fuzzy Hash: C0023974E0121A8FCB14BF78E98969D7BF1FB88310F104869E446E7348EB384D49DB95

Function 0A5682F8 Relevance: .4, Instructions: 376COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2538705428.000000000A560000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a560000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cead87ee46579d7489bab99e49afadf05a98c14cc4af25eac9f94d842be89fca
Instruction ID: f410940b998d0bf920f93748547c2db931bc4b1d4f0d3cbf1213aaff912a1cd0
Opcode Fuzzy Hash: cead87ee46579d7489bab99e49afadf05a98c14cc4af25eac9f94d842be89fca
Instruction Fuzzy Hash: 86D19E71B112068BC704BFB8E49966E7BF2FB88210F558839E445E7344EE3C9C55EB90

Function 0A56981B Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2538705428.000000000A560000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a560000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 532a9fe62586a40a0f73c32229d38f7006dc5b3b0209927bf1ef2cbed9fcaaa7
Instruction ID: a05234ecf98f80537e63705e9664720e6e074ce1640d4dafc0112669fda29645
Opcode Fuzzy Hash: 532a9fe62586a40a0f73c32229d38f7006dc5b3b0209927bf1ef2cbed9fcaaa7
Instruction Fuzzy Hash: D5C18C70B11209CBC704FF78E599AAEBBF5FB88210F514869E445E3354EE389C19E7A1

Function 0A5697FC Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2538705428.000000000A560000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a560000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a46a24b9b766a4b9d3e8ddd5c8ca81ec124877115ba7e87513f870661c1e1ab
Instruction ID: 54906c33a8f0376bd5447eac4481f0be46ec13a66d408ee6afa36cff0174dd6e
Opcode Fuzzy Hash: 0a46a24b9b766a4b9d3e8ddd5c8ca81ec124877115ba7e87513f870661c1e1ab
Instruction Fuzzy Hash: 63B17C70B11209CBC704FF78E599AADBBF1FB88210F514869E445E7354EE389C19E7A1

Function 016F636D Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511583959.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16f0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0734fa1756e99c146eb8a99e70a9ad53712481e7f74ff27cce198d7fe415798d
Instruction ID: 5f6ecf372627903feeac03c74b1945d3ab8d9d406efa69655c2c9defe4279693
Opcode Fuzzy Hash: 0734fa1756e99c146eb8a99e70a9ad53712481e7f74ff27cce198d7fe415798d
Instruction Fuzzy Hash: 41B1CF307012199FDB05EF68D858BAE7BB6FB88750F14802DE6029B399DB74DC42CB91

Function 016F49C8 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511583959.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16f0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9abe9fc80db4bbdd9048220f816664a45df754b9ba0f0ca83f9a48796f8fe374
Instruction ID: 03a9cb81ccc73235536580befc6c43c1f72d2ba530af159cbbc6333a0a2744e8
Opcode Fuzzy Hash: 9abe9fc80db4bbdd9048220f816664a45df754b9ba0f0ca83f9a48796f8fe374
Instruction Fuzzy Hash: 59A19231B04219DBEB149AB9DC5477F76B6BBC4700F24482DE606DB78CEE348C868795

Function 016F498F Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511583959.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16f0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d1d542c3ff8858d1abb63a294d2a646cdc39320e893b030a81bd7ad019a0fb4
Instruction ID: a663619e3c6d420c542d29862755af7cd2c634f0f3a9d84cb6fb7e416fa117d9
Opcode Fuzzy Hash: 2d1d542c3ff8858d1abb63a294d2a646cdc39320e893b030a81bd7ad019a0fb4
Instruction Fuzzy Hash: 4A91AF31B04208DBEB149AB9DC5476F77B2BB84310F14482DE606DB788EF388C868B95

Function 0A56C038 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2538705428.000000000A560000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a560000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d22ad16b2af16f23180b03f9703e6606c69728cca9e1caf0236a79f148c83761
Instruction ID: 597b7636e3b4a90fdaa5994f693a7999181202954761a288250c49b628f90ffa
Opcode Fuzzy Hash: d22ad16b2af16f23180b03f9703e6606c69728cca9e1caf0236a79f148c83761
Instruction Fuzzy Hash: 65A18D30B002199FDB15EF64D854AAE7BB2FF88710F148429F856AB398DB34DD52CB91

Function 0A5682E8 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2538705428.000000000A560000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a560000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12ff54a286ab470e88bfb876ab3072b173614790dfac27ae40cf049399b72b89
Instruction ID: ebf0d0801b8c1f089be7b4a8e652aa54b7e3a624935af9acc039f6a0c56fa563
Opcode Fuzzy Hash: 12ff54a286ab470e88bfb876ab3072b173614790dfac27ae40cf049399b72b89
Instruction Fuzzy Hash: 5991AD75B112068FC704AF78E49966E7BF2FB88210F558839E841E7384DE7D9C45EBA0

Function 016F4AAC Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511583959.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16f0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 145f983c9d17c0464943901fb21fa18ea59b6d7ee2fb84d627e8572bd9ee98dd
Instruction ID: 360c837246f3fd92c8d533b17ddb72969cc9c751efa36768a5529d4d6b12246f
Opcode Fuzzy Hash: 145f983c9d17c0464943901fb21fa18ea59b6d7ee2fb84d627e8572bd9ee98dd
Instruction Fuzzy Hash: 28818131B04209DBEB159BA9DC5477F76B2BB84301F24482DE606DB78CDF398C868B95

Function 016F6AA8 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511583959.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16f0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f6595b761a082d36a4d703bd65c87bdbe2cde69eb33f1a24e9cf6587145602c
Instruction ID: 376f799a3bd8896fdc7f3b1c62116ebd410afa4fe8f62949966aaf3996be53c4
Opcode Fuzzy Hash: 3f6595b761a082d36a4d703bd65c87bdbe2cde69eb33f1a24e9cf6587145602c
Instruction Fuzzy Hash: 71817834A001098FDB14DF6DC884AAABBB2FF89710B15816DDA56EB365DB31E841CB90

Function 016FB3B4 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511583959.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16f0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 960e810f785c78434b7882495dde70ca216dd21989eaf14bbd36378fe2c814f5
Instruction ID: 271bf7a624abad51506837bdc9b0213b10e9206aa2ac72a21ced8501041823dc
Opcode Fuzzy Hash: 960e810f785c78434b7882495dde70ca216dd21989eaf14bbd36378fe2c814f5
Instruction Fuzzy Hash: 53818F70A00209CBEB24DB69DC54B7EBBB2FB85300F14846ED606DB399DB748D82CB55

Function 016FB3C3 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511583959.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16f0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f985dd991130f125156c82355a25fded89eefd6aef05ede604897071f59c71bd
Instruction ID: 99c58f426402287a85e0e341791ccde0a83ab00a8669501d3817ff47b8b22449
Opcode Fuzzy Hash: f985dd991130f125156c82355a25fded89eefd6aef05ede604897071f59c71bd
Instruction Fuzzy Hash: 6E819F30A00209CFEB249B69DC54B7EBBB2FB85300F14846ED606DB399DB748D82CB55

Function 016F66B0 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511583959.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16f0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fdf7379a8a605635b22d546e460598bad192e02c3ed8c74809af3c66b8d1018
Instruction ID: a08a3c94950f4d355e266d49cb85d0bd09769298f851d549b448739f42717a4a
Opcode Fuzzy Hash: 9fdf7379a8a605635b22d546e460598bad192e02c3ed8c74809af3c66b8d1018
Instruction Fuzzy Hash: 0F6101707002508FDB15AB39C858B3A7BA6AF84654F14853DD656CB3AADF78CC42C7A1

Function 0A56A613 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2538705428.000000000A560000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a560000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acd944889261b04cb82ef6748011ba5ecdd203d8cb7bb71c5c038bbe81a13ed2
Instruction ID: 9a9989fcf48153a6d4df8fd56a71f01b9194d6cd58579c2425af4e8d37ab356f
Opcode Fuzzy Hash: acd944889261b04cb82ef6748011ba5ecdd203d8cb7bb71c5c038bbe81a13ed2
Instruction Fuzzy Hash: C751D571B111168BC704FFB8E895B6E76F6FB88250F618829E545F3344EE389C0597D1

Function 016FBC58 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511583959.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16f0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2da96e447d1473e2a444bccfd0127ac224f7af58c87099c0df6c8aa940e043f6
Instruction ID: 16951ac1e3e792ed14266fa2132b18e4433d94b5f8a41427e4e6adbdd3321e64
Opcode Fuzzy Hash: 2da96e447d1473e2a444bccfd0127ac224f7af58c87099c0df6c8aa940e043f6
Instruction Fuzzy Hash: 66614075A05108DFDB14DFA9D850BAEB7B2FB84340F25406DE7069B399CB319D42CB92

Function 016F9318 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511583959.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16f0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75e4a33cd35f2467674d8b22b5d9d7a55463b1bef4da287e4d5d7a4a6b014ebc
Instruction ID: d189c176b9f248733b8adbc62aa9dac0ba19e9b5259c07aed3ba85284aaf4bb5
Opcode Fuzzy Hash: 75e4a33cd35f2467674d8b22b5d9d7a55463b1bef4da287e4d5d7a4a6b014ebc
Instruction Fuzzy Hash: E45138327150118FDB14DE3DCC88B6A7BE6BF9835874944AEFA06CB365EB21DC028B50

Function 0A56A663 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2538705428.000000000A560000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a560000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ad51d2d4c8ea80311952a4654f16e9b8634b254d385a71ca2dd93d1f532ea8a
Instruction ID: ca1c83bab9a5f961f994c3d12c014e8dca71d992d0f2a6b871ba567e841a3779
Opcode Fuzzy Hash: 4ad51d2d4c8ea80311952a4654f16e9b8634b254d385a71ca2dd93d1f532ea8a
Instruction Fuzzy Hash: 6651C071B1111A8BCB04FFB8E89576EBBF6FB88250F618829E545E3344EE389C0597D1

Function 0A56BF98 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2538705428.000000000A560000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a560000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7356be797274938165d1799d33e3837cd5464a181bc5d6dcced9b28df903a64
Instruction ID: 355348e4d78160ef64919b1d0a489cfa7d0f8eac55a547062b670144d31d25fa
Opcode Fuzzy Hash: b7356be797274938165d1799d33e3837cd5464a181bc5d6dcced9b28df903a64
Instruction Fuzzy Hash: 49518E317002199FDB14EF69D854AAE7BA6FF88304F128069E915DB3A0DB31EC46CF91

Function 0A56BB70 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2538705428.000000000A560000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a560000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 384a3b877e5501e1de74d600591336ed68920b866994caa27745a1fa0c2320d3
Instruction ID: b390486769a7e1ea3c2e03d211c3ae1fbc13d6928d5b6aaedbf1ae1a44e2190f
Opcode Fuzzy Hash: 384a3b877e5501e1de74d600591336ed68920b866994caa27745a1fa0c2320d3
Instruction Fuzzy Hash: D1514835A50109DFDB14DF68C854A9DBBB2FF48721F118469E902E73A5DB319D41CFA0

Function 016FBF60 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511583959.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16f0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3de80f8d532f2235b063a6fc6e0cde5c643e6ad847c0e71b64ef0ee681a990b2
Instruction ID: eadc1b31afb02872cee40abe336d1b602c696bb19d01215c07b577a1ba7f5abb
Opcode Fuzzy Hash: 3de80f8d532f2235b063a6fc6e0cde5c643e6ad847c0e71b64ef0ee681a990b2
Instruction Fuzzy Hash: 23413772E012198FCB15EBB9C8546EEBFF2EFC9211B14816AD505E7388DB309D06CB91

Function 016FC238 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511583959.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16f0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 941bd3e5a635edd69c47c4e9619e6dc4832619a7c5b07e087cad8e58f06c94d8
Instruction ID: 31060cb338c04ccad33d08597e4c0a5eb7798c70fc3f4131f182bf8f8aa74d04
Opcode Fuzzy Hash: 941bd3e5a635edd69c47c4e9619e6dc4832619a7c5b07e087cad8e58f06c94d8
Instruction Fuzzy Hash: A441F832B052458FCB15CF69DC80B9BBBB5EF81320B1881ABD54CDB286D734E505CBA1

Function 016F8768 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511583959.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16f0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 018cf5a09dd84c45b97cb81f2c6644ccbae7171102e6b65cbe24f1bb11109ac2
Instruction ID: 57cc184e6917b1738a61a40d3a903d8a655d9b59a1d575253ecc089c3e439d8d
Opcode Fuzzy Hash: 018cf5a09dd84c45b97cb81f2c6644ccbae7171102e6b65cbe24f1bb11109ac2
Instruction Fuzzy Hash: 30418E357002049FDB14AB69D854AAE7BBAFFC8710F148469E616D7399DF359C02CBA0

Function 016FF670 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511583959.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16f0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77fafa22444694c1665acf75226b403adb3fb24fed579c8516b2d5ea60a728a7
Instruction ID: 025ae27a447dde76c935be62f82df0db2e6ad01e75b17d34c990f73acb455194
Opcode Fuzzy Hash: 77fafa22444694c1665acf75226b403adb3fb24fed579c8516b2d5ea60a728a7
Instruction Fuzzy Hash: 3241E7323002159FCB15AF69EC14A7A7BE6FF89751B1440AEEA06C73A5CB39DC01C751

Function 0A5666FD Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2538705428.000000000A560000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a560000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e736a582bade66287564d7f3452996fcd9906ea7976864b2dd3fef33703ef87
Instruction ID: 2b6a1f24409424382afe8e07cd23278b93d9f4d053f85c9f9dc598eec95d6b99
Opcode Fuzzy Hash: 8e736a582bade66287564d7f3452996fcd9906ea7976864b2dd3fef33703ef87
Instruction Fuzzy Hash: D031D2B1B111168BCB04BFB8E895B6EB7F2FB88250F618869D545F3344EE389C05A7D1

Function 016F9118 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511583959.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16f0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab00066ec329503c4ff1ce4503e39bdcfcc64dd2dca2c59da7cd9b956f7e007a
Instruction ID: 798459437dfa1a51ecb3d3fbf00e36a18e8df7427d8bb1bbbb232f3c0d105c37
Opcode Fuzzy Hash: ab00066ec329503c4ff1ce4503e39bdcfcc64dd2dca2c59da7cd9b956f7e007a
Instruction Fuzzy Hash: E94122756001099FDB15DF68DC88BAA7BB6FB88319F108069FA169B3A5CB34DD41CB90

Function 0A56BA95 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2538705428.000000000A560000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a560000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83c75322fdb4201a7c31ad6542faea428629fb8114e699863a8ee0d3745bc7aa
Instruction ID: 61278cc9a63888e8eb4f4f4d52bff9b1c24518368745b23f9f4c97ae75ef4b5f
Opcode Fuzzy Hash: 83c75322fdb4201a7c31ad6542faea428629fb8114e699863a8ee0d3745bc7aa
Instruction Fuzzy Hash: B3414C7150E3C49FCB039B64D8646D87FB1BF4B210F0A40EBD481EB2A3D6254C5ACB62

Function 0A56C498 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2538705428.000000000A560000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a560000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16d36a9ed9714e1acdd60669032805ca280a855be5963f09667a28860d2b9f0a
Instruction ID: ebdea67703b89ffa3e1a65af9ca775a2edc80719c899d588e0517982f8a3f490
Opcode Fuzzy Hash: 16d36a9ed9714e1acdd60669032805ca280a855be5963f09667a28860d2b9f0a
Instruction Fuzzy Hash: 5F419E307001099FCB64EF69D454AAE7BF6FB8C600F148068E946A7398DB39DC01CF60

Function 016F4EA8 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511583959.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16f0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 618f0638dac9aa78e58dfd070ed812c2b53fdfe007570c903197a37fcb63c0cf
Instruction ID: ea129de667e5571a6551713f350ba46740c3cbe1c4a839d03f18302f1e926c4a
Opcode Fuzzy Hash: 618f0638dac9aa78e58dfd070ed812c2b53fdfe007570c903197a37fcb63c0cf
Instruction Fuzzy Hash: AB416170E01209DFCB04DFA5C824A5EBBB1FF44300F18C99AC6265B359EB358E45DB92

Function 0A56BA54 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2538705428.000000000A560000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a560000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2ab35e352a99db9a53f68759dfcd884d97b35bd3855655be725bd2542d814d6
Instruction ID: 782e27ad195cee1ac660c645f6de07c357fa5497c423f38fdf2792d9d6cfe609
Opcode Fuzzy Hash: b2ab35e352a99db9a53f68759dfcd884d97b35bd3855655be725bd2542d814d6
Instruction Fuzzy Hash: B841397154E3C59FCB039B74D8605987FB0BF4B210B0A41DBD582EB2B3D6255C1ACB62

Function 016F9547 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511583959.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16f0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb12680bf10c9f444012d88862a997d364798b96b03e4548014fb198cab54f37
Instruction ID: 0c4853fe0e3fae7351dd049c923e3f433ccb7dcbc643e918b075522cf3812124
Opcode Fuzzy Hash: fb12680bf10c9f444012d88862a997d364798b96b03e4548014fb198cab54f37
Instruction Fuzzy Hash: 7B21B5313042214BEB26662E8C6877D3697EFC9759F14403DE602CB399EB69C846DB41

Function 016F9460 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511583959.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16f0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2700953dfb5e792efa64f0b29aeba3bb5e797ff9381c439d7a6b2d32d9cac635
Instruction ID: 953d2bed48f75d276b64f455c9bb480a2b2587388d70b0cb4a26c8106746c76f
Opcode Fuzzy Hash: 2700953dfb5e792efa64f0b29aeba3bb5e797ff9381c439d7a6b2d32d9cac635
Instruction Fuzzy Hash: 3321D1313091559BEB15DE6AAC58B7B7BEAEB95314F04446EFA02C7344DB38CC42CB60

Function 016F68FF Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511583959.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16f0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cd8bc89acc182bdb625f05499bf40eec1484978bde662bb17a843e8fe47c934
Instruction ID: f02aa91f742c83e26179fc557d088fb4388b659c6f7a3269444e603db56ae5d8
Opcode Fuzzy Hash: 6cd8bc89acc182bdb625f05499bf40eec1484978bde662bb17a843e8fe47c934
Instruction Fuzzy Hash: CF21F2357016128FD7259B29C854A6AB7E2FFC9B16B08807DDA0ADB358CF34DC02CB90

Function 0A56FE40 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2538705428.000000000A560000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a560000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f38eb0f5e6655601120a5e9e0c0283627cf537546049d772e9f03664442e3e7c
Instruction ID: b30c8202737e9c75d6903275bb5b2bc81dd70fc8f97c43e349ac3ddf7dfcf0f7
Opcode Fuzzy Hash: f38eb0f5e6655601120a5e9e0c0283627cf537546049d772e9f03664442e3e7c
Instruction Fuzzy Hash: DD21C671B112268BC704BFB8F899B5EB7E5FB88210F104929E449D3344EE7C9C09D791

Function 0128D4C8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2510798273.000000000128D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0128D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_128d000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ebc1e756012be6215851f593baaeed830b2904b1a1dd6662e47d036c12e4c2e
Instruction ID: 2fda4aee60feed689f37589662c3774e35c193511a007833fcb259f993737b28
Opcode Fuzzy Hash: 2ebc1e756012be6215851f593baaeed830b2904b1a1dd6662e47d036c12e4c2e
Instruction Fuzzy Hash: 7A213871510208DFDB11EF58E5C0B16BF65FB88314F208169D9050B2D6C33AD459C6B1

Function 0A56FE50 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2538705428.000000000A560000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a560000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e333ad9358c4f620a2fa57e7faaba53c6ff2dc873c19b9c5806fbd84954cfaa9
Instruction ID: 050a58b233b98f5327b1153b0f3b1f47c3b22e23ca46f7cf1229d74c4238a458
Opcode Fuzzy Hash: e333ad9358c4f620a2fa57e7faaba53c6ff2dc873c19b9c5806fbd84954cfaa9
Instruction Fuzzy Hash: FA11D671B112168BC704BFB8F899B2EB7E9FB88210F108929E449E3344EE7C9C05D391

Function 0141D0F0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511222035.000000000141D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0141D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_141d000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78116e2be63b9063a09dc6b7c546df9b3aee8ffee4eee5b216bfd011170d2a36
Instruction ID: 083b457a51a69f88903d098663f1bbf9c4cd53a63d007fba0a6f2c7bb4b0d804
Opcode Fuzzy Hash: 78116e2be63b9063a09dc6b7c546df9b3aee8ffee4eee5b216bfd011170d2a36
Instruction Fuzzy Hash: DE2137B1904204DFDB05DF58D9C4B16BBA1FB88314F24C66ED8090B36AC336D846CA61

Function 0141D2A8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511222035.000000000141D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0141D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_141d000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd1b9b647c2d9be8213a02b41cd336fd787720497d4d6eddb623de6ffff61c7c
Instruction ID: 97a15200093c37d16a4ef9604a386b53b141e8decf7f48682b57e39681fc2964
Opcode Fuzzy Hash: fd1b9b647c2d9be8213a02b41cd336fd787720497d4d6eddb623de6ffff61c7c
Instruction Fuzzy Hash: 3D2137F1904204DFDB05DF54C5C8B16BBA5FB88314F24C66ED9094B3AAC37AD846CB61

Function 0A56BB5F Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2538705428.000000000A560000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a560000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3291221393f1f8b03588670c6f230cd4b6bbefa3d8677af35f0ab47c26c7896
Instruction ID: dbe75fe92e247f5000fdc2c80c10d5f20e2416a1c55c00b246de0b15b2e4eba1
Opcode Fuzzy Hash: f3291221393f1f8b03588670c6f230cd4b6bbefa3d8677af35f0ab47c26c7896
Instruction Fuzzy Hash: ED213431A00218EFCF14EFA8D844ADDBBB1FB49320F104069E901B7264DB319D55CF61

Function 016F5480 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511583959.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16f0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2738de1f4dc0c6d5796c586683f6effd836741d5d43fe437ff62ce9493cb1130
Instruction ID: 12a13d7e7e2135afb543aa4ee1ab2111be6a908b75bd387094b9920aeca45329
Opcode Fuzzy Hash: 2738de1f4dc0c6d5796c586683f6effd836741d5d43fe437ff62ce9493cb1130
Instruction Fuzzy Hash: 0511B9317052099FDB15EF58D818B6E7BA6FB88B15F04802DEA069B359CB38DC55CB50

Function 016F8759 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511583959.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16f0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82b3898bf1b1cb900427d052d852da00e0c017939f985db50b2460446a43fcaa
Instruction ID: fb3832617b31a4a10db8a53e9c1649d636592508d33a73ea90c7d667befa3890
Opcode Fuzzy Hash: 82b3898bf1b1cb900427d052d852da00e0c017939f985db50b2460446a43fcaa
Instruction Fuzzy Hash: E0116A75A001049FCB10DF68DC84BEDBBB6FB8C710F148169EA16A7359DB71AC11CBA0

Function 016F74F0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511583959.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16f0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07cd8445b0f365cefa786d755a1aa7c6d50276fd27050942596ee26d6b89cbb3
Instruction ID: 4d60d1cc258aa187f01f0ed30b38b7d6c49e445cdb387e719664634309ebd185
Opcode Fuzzy Hash: 07cd8445b0f365cefa786d755a1aa7c6d50276fd27050942596ee26d6b89cbb3
Instruction Fuzzy Hash: 30219771900248DFCB21CF58D848BAABBB6BB48310F44C56EE59A9B252D734A904CFA0

Function 0128D4C3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2510798273.000000000128D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0128D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_128d000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfb52f8b9dfce4186a4761286b1afaf252fc13293eafdb1bf8f112f6695a61f7
Instruction ID: 86d873604d0367c45d1a8940af17d116053dde6366c6d42acacf0fd342a65394
Opcode Fuzzy Hash: cfb52f8b9dfce4186a4761286b1afaf252fc13293eafdb1bf8f112f6695a61f7
Instruction Fuzzy Hash: EB11E176404284CFCB12DF14E5C4B16BF72FB88314F24C6AAD9090B297C33AD45ACBA1

Function 0141D2A3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511222035.000000000141D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0141D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_141d000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ccfe305154e95a536d18b49939e535c9c69fd109e9eb5688aea898868e671a0
Instruction ID: 549cd85f1100bba4948cd45bf891bbd456624253e0a9daadae4bed2f9bdb5402
Opcode Fuzzy Hash: 2ccfe305154e95a536d18b49939e535c9c69fd109e9eb5688aea898868e671a0
Instruction Fuzzy Hash: A211BEB6904284CFCB02CF54D5C4B16BBA1FB84314F28C6AAD8094B366C33AD40ACB61

Function 0141D0EB Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511222035.000000000141D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0141D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_141d000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ccfe305154e95a536d18b49939e535c9c69fd109e9eb5688aea898868e671a0
Instruction ID: 9c0c6274ae719868c380fc824bbdced416e2f2e39a18573fd9536be703059469
Opcode Fuzzy Hash: 2ccfe305154e95a536d18b49939e535c9c69fd109e9eb5688aea898868e671a0
Instruction Fuzzy Hash: D311BEB5904280CFDB06CF54D9C4B16BBB2FB84314F24C6AAD8494B36AC33AD44ACB51

Function 016FFBE0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511583959.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16f0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea0eda6bf99bf83bf9e005eb6016c590e960f1392af7e615120e05c0d5d86e74
Instruction ID: 0e9f4a2a673e72302280b14055a6fca307266cfa57b985efebef6001523cc4a0
Opcode Fuzzy Hash: ea0eda6bf99bf83bf9e005eb6016c590e960f1392af7e615120e05c0d5d86e74
Instruction Fuzzy Hash: 3501D6327001196BDB15EE59DC10AAF3BEBEBC8A90B148069FA05C7288DF75DC1297D0

Function 0128D7B1 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2510798273.000000000128D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0128D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_128d000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ba24fe4652f932aef8bb6b2acb3d3c135139367b405b0c3f4c9491c72af1a2b
Instruction ID: 040987849d44f1e0a84efd9d6c4f8717a41c4a34953f9c6cbb46c729d4e5d206
Opcode Fuzzy Hash: 6ba24fe4652f932aef8bb6b2acb3d3c135139367b405b0c3f4c9491c72af1a2b
Instruction Fuzzy Hash: 46012B31425348DBE7106B5ACD84B27FF98EF41724F18C11AEE094F1C3C6799849C6B1

Function 0A56BB52 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2538705428.000000000A560000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a560000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ab279b22a8c7ee24bbde657d528b5dafe6ea0e05cb0d2b22d0cf1c4726db0b5
Instruction ID: 13507b4179bd6bb6005982c11b6d941a764c3c474eaeebbb848734309f82ed16
Opcode Fuzzy Hash: 0ab279b22a8c7ee24bbde657d528b5dafe6ea0e05cb0d2b22d0cf1c4726db0b5
Instruction Fuzzy Hash: D1111535A00109EFCF00EFA4E9549DDBBB1FF48221F054469E906BB264DB319D51CF60

Function 0A56C430 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2538705428.000000000A560000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a560000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd1ee1d5dabba821ebd0794f87df229126aeefa3cfce790e141c753800bb2eb9
Instruction ID: 3b6bd64b79d6bd9b60dad10d4267f9ad9c705ac50b601cad8ae47681ee559c23
Opcode Fuzzy Hash: bd1ee1d5dabba821ebd0794f87df229126aeefa3cfce790e141c753800bb2eb9
Instruction Fuzzy Hash: 41F0963630111DB7CF11AF48EC10BEE3B26FB88722F108025F60997194CB76C825DB90

Function 0128D7B0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2510798273.000000000128D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0128D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_128d000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac5e27cb5b42b3cff75ab105bb0a5c17068083f929a8645a105653bd1012dd8c
Instruction ID: 2466c62e79752646ad1cd33ce03eb4a5555ab36f99ff569f6d6975e1b406ecf2
Opcode Fuzzy Hash: ac5e27cb5b42b3cff75ab105bb0a5c17068083f929a8645a105653bd1012dd8c
Instruction Fuzzy Hash: 85F0C271405348AEE7118A0AC884B62FF98EB81624F18C15AEE084B2C3C2799845CAB1

Function 016F4D97 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511583959.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16f0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d695d8d2cda3087263bba95ee2f667ea95acb4c914a298e79b82ae23ce24a80c
Instruction ID: b75f6a7c006f2469ce4f200740f8332f586764a79994c72ca21f83b3a66f61c8
Opcode Fuzzy Hash: d695d8d2cda3087263bba95ee2f667ea95acb4c914a298e79b82ae23ce24a80c
Instruction Fuzzy Hash: EAF03936A14118EFDF188A9AFC80AAEB775FF88655F00092DE3079AAC4CF304841CB51

Function 0A56FE16 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2538705428.000000000A560000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a560000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbfb3c2baef077654276b992eeaf7ab1006bb141b7672abd2ce96fc7fe9609f3
Instruction ID: ce1dacef91b288079324be18a0f360287e7de3a8927d2352478eaab1559797ed
Opcode Fuzzy Hash: bbfb3c2baef077654276b992eeaf7ab1006bb141b7672abd2ce96fc7fe9609f3
Instruction Fuzzy Hash: F5E0DFB58063A89FC752DB38EFC1A903F70F781384B050799D062CB0ABFA18680ECB55

Function 016F4DA1 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511583959.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16f0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 716431012a0ff35e2cc723cf6911dbceae8053b942c1ed41b55463402810acac
Instruction ID: e28a031bccfb47e425fe3da5f0c4d48ceb9dc41b744463337ae1b0955c4b7087
Opcode Fuzzy Hash: 716431012a0ff35e2cc723cf6911dbceae8053b942c1ed41b55463402810acac
Instruction Fuzzy Hash: 43E04636A18118EFDB288A88FC80AAEB374FB48265F01066AF307969C4CB314851CB12

Function 0A56717B Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2538705428.000000000A560000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a560000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7413e6c0f477fa6f6a4d13c29a583afc2ac393647c0e83a0e3595e688ad0ee71
Instruction ID: 439383051ba6b009097691f145b30c5154be41fddc65429406590b2e5ba45607
Opcode Fuzzy Hash: 7413e6c0f477fa6f6a4d13c29a583afc2ac393647c0e83a0e3595e688ad0ee71
Instruction Fuzzy Hash: 54E0DF7502F3828FD3032B30A9180493F31FA1616530D449BE446C2153DE3C8C06DB32

Function 0A5671B2 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2538705428.000000000A560000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a560000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2459bd2152b568660bc64cbcff4d34eec78ff161cc8f58e80d95b5987085668f
Instruction ID: f3d2fe56d8f391997d6b5eaaed71ce3c72804a4053f57727016c9df0ca91323d
Opcode Fuzzy Hash: 2459bd2152b568660bc64cbcff4d34eec78ff161cc8f58e80d95b5987085668f
Instruction Fuzzy Hash: 19E04835126216CBC3145F70F4096197F75FB09615715886CF40582151DF35DC57DF71

Function 0A5671C0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2538705428.000000000A560000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a560000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb02a07a35985eaff5f859b9611cda0c20273444fad955ea9a2894f2fedd89a2
Instruction ID: 7039d4ad869c739616ae11b9e2006807ca856b4aa5b1d64c09949205686ea163
Opcode Fuzzy Hash: cb02a07a35985eaff5f859b9611cda0c20273444fad955ea9a2894f2fedd89a2
Instruction Fuzzy Hash: 0FE0EC34226206CFC3145F71E40951A7FB9FB09616305886CF80692651DF3AD842EE71

Function 016F8815 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511583959.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16f0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c6284da19c33447fe50318601f684b3dea647fa44a2d337b4b21dd792d66178
Instruction ID: aad66264925c3d87f80d2e07f3d9e09079b976b37f3ce66c0feb5f5f080a6621
Opcode Fuzzy Hash: 6c6284da19c33447fe50318601f684b3dea647fa44a2d337b4b21dd792d66178
Instruction Fuzzy Hash: 03D0677BB401089FCF049F98EC409DDF776FB98221B148116E915A3265C6319961DB60

Function 016F6D48 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511583959.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16f0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faf6c5cd09010b8ff6490bd5a44c2468b93e91d9db68530df86999e397c3e483
Instruction ID: ef9cb5a0813396b68f8be87c7211bf4167898157e6d7b073d7d0777ea071321d
Opcode Fuzzy Hash: faf6c5cd09010b8ff6490bd5a44c2468b93e91d9db68530df86999e397c3e483
Instruction Fuzzy Hash: 76D02BB14212068FD700FB7AF8557993B26F795700B144125C8464610AEE3CC9048B41

Function 016F6D58 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511583959.00000000016F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_16f0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bff1ec4a0503278c7cefeb2c59778d28a7c4a0fe04092bf2de409f79d96ac3a
Instruction ID: fb4087db8bc127180858c07620a98e868bb2deb001b23068374809601f5c6343
Opcode Fuzzy Hash: 5bff1ec4a0503278c7cefeb2c59778d28a7c4a0fe04092bf2de409f79d96ac3a
Instruction Fuzzy Hash: 0BC0123002130B8BD604FB7BF848566376AF688B047908525990D16419EE7C5D044A95

Function 0A56E612 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2538705428.000000000A560000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a560000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 846f771f603d2af9ac115ad3027576e2e661b02a1d3e57c7d8f50dad7a7bb22c
Instruction ID: 2861051987e474b54bbf211b03f5a8bc54405f632bec9a06366b986d9d6635b5
Opcode Fuzzy Hash: 846f771f603d2af9ac115ad3027576e2e661b02a1d3e57c7d8f50dad7a7bb22c
Instruction Fuzzy Hash: E9B0123BB05008A90910008878020DCF359F1981376004163D71E52001262122300551

Non-executed Functions

Function 0A8E2B00 Relevance: .7, Instructions: 698COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2538860490.000000000A8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a8e0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 870e2a1f73a2408f1b6f3643aeea8b818209b03380a4cc3244d40cdacc03719e
Instruction ID: dd4e62c439cf6bd6dfcae72c171f34653a4eb0e44a31ae73e0c8e71c1474d104
Opcode Fuzzy Hash: 870e2a1f73a2408f1b6f3643aeea8b818209b03380a4cc3244d40cdacc03719e
Instruction Fuzzy Hash: 8842E331A01246CFDB05EF74E854A9DBBF2FF89200F1585AAD049EB265EF389C45CB91

Function 0A8E2AF0 Relevance: .6, Instructions: 597COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2538860490.000000000A8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a8e0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b046949638e004dcc0b31dc78de65251b880cfbf9b00c0e36ae03c264a5dc650
Instruction ID: 9506dfd14067710d706a4558f82120bd9dfe78cac56e1e5a178ecf00862e0ee6
Opcode Fuzzy Hash: b046949638e004dcc0b31dc78de65251b880cfbf9b00c0e36ae03c264a5dc650
Instruction Fuzzy Hash: 7B328071B0021ACFDB04EF75E855A9EBBF2FF88200F5185A9D049EB254EF389C559B90

Function 0A8EA378 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2538860490.000000000A8E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A8E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a8e0000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 257477e1c01263cb5474b5703678d9ccea792d16e1594c87bb4731a331aa2ddd
Instruction ID: 5c29fcaf6984765023366e4798893017bf4d76618c7faeba12f36425ace149e1
Opcode Fuzzy Hash: 257477e1c01263cb5474b5703678d9ccea792d16e1594c87bb4731a331aa2ddd
Instruction Fuzzy Hash: DAD1B274A00105CFDB18DF69C598AA9B7F1AF8A741F2680A9E505EB371DB31AD40CF60

Function 0A36B3B1 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2538520685.000000000A360000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a360000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2cef57f12c402ba1d3f40eed915d35f515d2650a8f6f42159a0714dd79645d1
Instruction ID: e8e617eb6ae4a394b6a7f814bceead82cb06b021fd67ca9938cdad61913f6f8b
Opcode Fuzzy Hash: f2cef57f12c402ba1d3f40eed915d35f515d2650a8f6f42159a0714dd79645d1
Instruction Fuzzy Hash: E1D1F53192074ACADB10EB75D990A9DB7B1FF95300F508B9AE4097B220FF746AC5CB91

Function 0A36B3C0 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2538520685.000000000A360000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a360000_G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd3a17a0545343e3fdf569b267023b3e2603c489f2666d0fffde17f7f538ef8b
Instruction ID: 3d2e87dca1b8bb02283dc626cf36531f258d3c28f20eec6fad758eb10f935931
Opcode Fuzzy Hash: fd3a17a0545343e3fdf569b267023b3e2603c489f2666d0fffde17f7f538ef8b
Instruction Fuzzy Hash: 97D1F43192074ACADB10EB75D890A9DB7B1FF95300F508B9AE5097B220FF746AC5CB91

Analysis Process: po.exePID: 2712, Parent PID: 1192COMMON

Execution Graph

Execution Coverage:	16%
Dynamic/Decrypted Code Coverage:	99.6%
Signature Coverage:	1.2%
Total number of Nodes:	248
Total number of Limit Nodes:	16

Executed Functions

Function 09E90011 Relevance: 5.6, Instructions: 5566
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.3330287203.0000000009E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6344586d149dc70cd9ed9f94287483bd8f9fde27371c61f3519e861a7d26ac3e
Instruction ID: cb37f33f88e11d091be27e70e9e0b5399fb5158f7d9b55292843c0080b09547b
Opcode Fuzzy Hash: 6344586d149dc70cd9ed9f94287483bd8f9fde27371c61f3519e861a7d26ac3e
Instruction Fuzzy Hash: 6BB31870E012288BCB55EF39E8946ADBBF2FF89600F0084EAD449A7354DE345E95CF56

Function 09E90040 Relevance: 5.5, Instructions: 5545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.3330287203.0000000009E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8983e4073153b15a69c4076db0ff410f56a743185f2b936681f646399fb7d2ca
Instruction ID: 47558c2e179be8d4f42c7ba454a05d9739f33b866d87bede8427b9772e106068
Opcode Fuzzy Hash: 8983e4073153b15a69c4076db0ff410f56a743185f2b936681f646399fb7d2ca
Instruction Fuzzy Hash: 84B31870E012288BCB55EF39E8946ADBBF2FF89600F0084EAD449A7354DE345E95CF56

Function 0A1CA308 Relevance: 1.7, APIs: 1, Instructions: 164
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessAsUserW.KERNELBASE(?,?,?,0000000A,?,?,?,?,?,?,?), ref: 0A1CA473

Memory Dump Source

Source File: 0000000A.00000002.3330456752.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a1c0000_po.jbxd

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: 5f1dae9f7c0eddb765db3b23d99d87bdde55e9572880b3906b2c8cc7ed8a9bbb
Instruction ID: 0593b13f9c9e39d991017ca34476edb8ba101c96e1b453970a4d2917ccf9f269
Opcode Fuzzy Hash: 5f1dae9f7c0eddb765db3b23d99d87bdde55e9572880b3906b2c8cc7ed8a9bbb
Instruction Fuzzy Hash: 0151267190026EDFDB25CF59C840BDDBBB6BF48310F0484AAE909B7250DB759A85CF50

Function 09E7ADE9 Relevance: 1.6, APIs: 1, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 09E7ADAB

Memory Dump Source

Source File: 0000000A.00000002.3330199411.0000000009E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9e70000_po.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 20400efcdcf4902a6ad1597ee36c28cb3d17572c9b7755de1e08a6080fe3ab28
Instruction ID: 9bf61af45841f3a3c8a1fa0b493b601038d3a1c19c6779441ee6c0bf8b4e58b6
Opcode Fuzzy Hash: 20400efcdcf4902a6ad1597ee36c28cb3d17572c9b7755de1e08a6080fe3ab28
Instruction Fuzzy Hash: CC410771E006488FEB18CFAA98407DEFBF7AFC8314F08C0AAD558A6265D73409458F62

Function 00E97B28 Relevance: 1.0, Instructions: 992COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3307327373.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b868523b66c93e9fed9d2927d29a1dcc78ecb29e1f61524704a4f65388b99d31
Instruction ID: 5198b25383f7dbe69a617b2910c111c75baaf1cca691895f41164dc878408e28
Opcode Fuzzy Hash: b868523b66c93e9fed9d2927d29a1dcc78ecb29e1f61524704a4f65388b99d31
Instruction Fuzzy Hash: 76924970A04205DFCF14CF69C984AAEBBF2FF89314F259599E855AB2A1DB30ED41CB50

Function 00E96ED8 Relevance: .9, Instructions: 896COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3307327373.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1839cb6de15fb2fbde71d2d0184080681cfe5dd282ba093d18b67c051511b440
Instruction ID: 5f4acf1a7516f4b7cdfa835d85db9a58b7e7def272b1bdb02125990f27b85e4e
Opcode Fuzzy Hash: 1839cb6de15fb2fbde71d2d0184080681cfe5dd282ba093d18b67c051511b440
Instruction Fuzzy Hash: E4728A70A142199FDF14DF69C884AAEBBF2FF88304F248069E445AB3A5DB34DD45CB90

Function 00E9AE98 Relevance: .7, Instructions: 692COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3307327373.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6daa5c63adc48fffff995d1620812d090a767dbf4fbf6ece5ae5c8ea03d2170a
Instruction ID: c83846cb16af85901ba29ca03c16778dc66c3db02592ac30bca286daed66d309
Opcode Fuzzy Hash: 6daa5c63adc48fffff995d1620812d090a767dbf4fbf6ece5ae5c8ea03d2170a
Instruction Fuzzy Hash: C8524F30A00218CFDF549B75D954BAEB6B2FF88300F2494AAD50ABB395DB749D81CF91

Function 00E9AE68 Relevance: .5, Instructions: 518COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3307327373.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e81251e0e992740e47b59d6a1bc9640ad0725c5593bd8a0d098bd0a950955c71
Instruction ID: a9590a52871745c130b96155484bb63eac0f64925d0f32d7f6640a46cd4b3c86
Opcode Fuzzy Hash: e81251e0e992740e47b59d6a1bc9640ad0725c5593bd8a0d098bd0a950955c71
Instruction Fuzzy Hash: 30128030A00218CFDF149B79DA54BAE77B2FF88314F2494AAD50ABB395DB748D81CB51

Function 00E95480 Relevance: 5.1, Strings: 4, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

h^, xrefs: 00E95491
h^, xrefs: 00E954AE
h^, xrefs: 00E9555C
h^, xrefs: 00E954CB

Memory Dump Source

Source File: 0000000A.00000002.3307327373.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e90000_po.jbxd

Similarity

API ID:
String ID: h^$h^$h^$h^
API String ID: 0-3481089990
Opcode ID: d383471cf843638206b1ec3feeb3daa2336b1e90796d1f6f66b1a7d4e08d6ec0
Instruction ID: fd9267dcc4827a2a6533bb033d0265eb2fcb32ecafce665d3ae91a04f5ce10a5
Opcode Fuzzy Hash: d383471cf843638206b1ec3feeb3daa2336b1e90796d1f6f66b1a7d4e08d6ec0
Instruction Fuzzy Hash: 17317C36604609AFCF06DF64E848AAE3BA2FF88325F105029F906AB355CB39DD51DB50

Function 00E968FF Relevance: 2.6, Strings: 2, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

h^, xrefs: 00E9699A
h^, xrefs: 00E969B7

Memory Dump Source

Source File: 0000000A.00000002.3307327373.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e90000_po.jbxd

Similarity

API ID:
String ID: h^$h^
API String ID: 0-3878174173
Opcode ID: 977336d42c5892cb2a829159c6fd2904c47969162d46eafbfe04102737836564
Instruction ID: 1a27fa136f036ee37e4547e2390ccdafcd6138d43b98a74c55f25466c0068665
Opcode Fuzzy Hash: 977336d42c5892cb2a829159c6fd2904c47969162d46eafbfe04102737836564
Instruction Fuzzy Hash: 4A2137357056118FCB169B35C85452EBBE2EFCA72671840BAE80AEB395CF34DC02C790

Function 087CD651 Relevance: 1.7, APIs: 1, Instructions: 151
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.3329155748.00000000087C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_87c0000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9900ccab8d756cfc54535722c780801b4d40e25f294993b38c3fe674b04aa43e
Instruction ID: 00d23c8be967c3738e872439c088eed50ee73c8293e8a7f7538c48a4bf28b27f
Opcode Fuzzy Hash: 9900ccab8d756cfc54535722c780801b4d40e25f294993b38c3fe674b04aa43e
Instruction Fuzzy Hash: 245100B5C00249AFDF12CFA9C884ADDBFB5BF49310F25816EE808AB225D771A855CF51

Function 087CD6E4 Relevance: 1.6, APIs: 1, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 087CD802

Memory Dump Source

Source File: 0000000A.00000002.3329155748.00000000087C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_87c0000_po.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 951398eb016d423e23df5b530cf6bfa94ad1f3efd0f6fabba5057d7de1485227
Instruction ID: b0a0a2010cafc140e5308c2eefcc7201b5f5659e7222c984d46f05d4ad0c122a
Opcode Fuzzy Hash: 951398eb016d423e23df5b530cf6bfa94ad1f3efd0f6fabba5057d7de1485227
Instruction Fuzzy Hash: 5A51C0B5D003499FDB14CFAAC884ADEBFB5BF48310F24812EE818AB214D774A945CF90

Function 087CD6F0 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 087CD802

Memory Dump Source

Source File: 0000000A.00000002.3329155748.00000000087C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_87c0000_po.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 19ff173c30a12a55fcb4c289bbd55e0b6aa852eda48c497ab9e4b255025c05d5
Instruction ID: cac33d54fdacf7c0d1d77529bb1ffc01172a4bab3a1e91843122541508602622
Opcode Fuzzy Hash: 19ff173c30a12a55fcb4c289bbd55e0b6aa852eda48c497ab9e4b255025c05d5
Instruction Fuzzy Hash: D34190B1D003499FDB14CF9AC884ADEBFB5BF48310F24812EE818AB214D7759845CF95

Function 04F9E9F8 Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

P, xrefs: 04F9EA3C

Memory Dump Source

Source File: 0000000A.00000002.3320071743.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4f90000_po.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-1343716551
Opcode ID: 902c87f7aff5b2c26245d0c850450e8116f80006bad23243ad4e4fabc9d1a486
Instruction ID: d66a94a026b304d5d62f6b79028815a61e114cc41246a1de90e79fd6ff3b937d
Opcode Fuzzy Hash: 902c87f7aff5b2c26245d0c850450e8116f80006bad23243ad4e4fabc9d1a486
Instruction Fuzzy Hash: B1C1F271B1020ACBD708FF78F85976E7AE6EF84254F104829E446E3398EE3C9C469791

Function 087CC5FC Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 087CFD71

Memory Dump Source

Source File: 0000000A.00000002.3329155748.00000000087C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_87c0000_po.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: ccb1cbdc2123200fbdb80a6e719826b50a5edb7d2e0984d5af3d13de980b7dbd
Instruction ID: 2408fe010bf5ffa9f436376fbf8b0e36ca41bbbb2d204a13bc2cae01cfe8b981
Opcode Fuzzy Hash: ccb1cbdc2123200fbdb80a6e719826b50a5edb7d2e0984d5af3d13de980b7dbd
Instruction Fuzzy Hash: 534169B9900309CFCB14CF89C488AAABBF6FF88310F24845CD508AB325C774A841CBA1

Function 09C97CFF Relevance: 1.6, APIs: 1, Instructions: 90fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(00000000), ref: 09C97DA8

Memory Dump Source

Source File: 0000000A.00000002.3330063494.0000000009C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9c90000_po.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 623fa72f45bedfec264a7d61192690d43f75b33c182d213353f4a2a716ca1d07
Instruction ID: 6c9eab76c5ec1072ddd0fe09e013bb1fc778bdf9aa65699db6b7ed31dba7805c
Opcode Fuzzy Hash: 623fa72f45bedfec264a7d61192690d43f75b33c182d213353f4a2a716ca1d07
Instruction Fuzzy Hash: 1031B2B2C197898FDB02CF65C8147EABFB4EF46210F198196D454EB292D3385905CBA2

Function 09E7ACEE Relevance: 1.6, APIs: 1, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 09E7ADAB

Memory Dump Source

Source File: 0000000A.00000002.3330199411.0000000009E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9e70000_po.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: e7cbc11e28194e21139f493f4a0f7d39f8575312b2a9135acc735db01f466695
Instruction ID: ad399214bc259812aa64c50d71127c9ff7bf30f62e3dd167a24c19fb6b11b2e1
Opcode Fuzzy Hash: e7cbc11e28194e21139f493f4a0f7d39f8575312b2a9135acc735db01f466695
Instruction Fuzzy Hash: 42317C718043499FEB10DFA9C945BEEFFF4EB48314F148469D458A3651E3389951CFA1

Function 0A1CCD10 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0A1CCDA0

Memory Dump Source

Source File: 0000000A.00000002.3330456752.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a1c0000_po.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 3ce92de36f94679b022c27d87d8a4fc6b1b31f6023999b452c6b48679f863e79
Instruction ID: 8e5cf8dd0ffe1c3d31e6ab12d581b162e00255c5af3d6c38a0113c2d836d9605
Opcode Fuzzy Hash: 3ce92de36f94679b022c27d87d8a4fc6b1b31f6023999b452c6b48679f863e79
Instruction Fuzzy Hash: 5B212A719003499FDB10CFAAC885BEEBBF5FF88310F10842AE918A7240D7789954CFA5

Function 0A1C3318 Relevance: 1.6, APIs: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0A1C3393

Memory Dump Source

Source File: 0000000A.00000002.3330456752.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a1c0000_po.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: e5935730630b2b8f1f0cb93b94913f58e4db652f18a02325ff1c1bc35595d21a
Instruction ID: 29a7309f13951c69fa79b8542f67d22da95be21acc47021c4d8b97bfdc8a8560
Opcode Fuzzy Hash: e5935730630b2b8f1f0cb93b94913f58e4db652f18a02325ff1c1bc35595d21a
Instruction Fuzzy Hash: D6213975D002499FDB10CF9AC444ADEFBF4EB48320F10846AE868A7610D774A545CFA5

Function 0A1CD490 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0A1CD50E

Memory Dump Source

Source File: 0000000A.00000002.3330456752.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a1c0000_po.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 3d7e5951f8b92c362f4bee3f104ad6d432552161ed7a55ee12e856d955b8927f
Instruction ID: b443f20c315b2dd53b34cd5ac1797d3081e65776196999eadc20fb14617387a5
Opcode Fuzzy Hash: 3d7e5951f8b92c362f4bee3f104ad6d432552161ed7a55ee12e856d955b8927f
Instruction Fuzzy Hash: D02109719003099FDB10DFAAC4857AEBBF4EF88314F14842DD519A7240D778A945CFA5

Function 0A1CC2C8 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64GetThreadContext.KERNEL32(?,00000000), ref: 0A1CC346

Memory Dump Source

Source File: 0000000A.00000002.3330456752.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a1c0000_po.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: e360ec9b1478f7208b142453a3f7781f4f19879cb78a8c0b5d4e394940e0e38e
Instruction ID: c9d47413732187d65ceb18f61f6f87834f449da4ac04cd4de905466356aad9ba
Opcode Fuzzy Hash: e360ec9b1478f7208b142453a3f7781f4f19879cb78a8c0b5d4e394940e0e38e
Instruction Fuzzy Hash: 13210971D003098FDB10DFAAC4857AEBBF4AF88314F14842AD519A7240D778A945CFA5

Function 087C96C2 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 087C974F

Memory Dump Source

Source File: 0000000A.00000002.3329155748.00000000087C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_87c0000_po.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 24f7d516513db846091a09ef64925f2f5e95d6735ca501811e801164de6ccc52
Instruction ID: 499a7e7e14f0c8bc1e75060131c2bf935d2ba2d1cc4ee9784d7871dc59f4a1a5
Opcode Fuzzy Hash: 24f7d516513db846091a09ef64925f2f5e95d6735ca501811e801164de6ccc52
Instruction Fuzzy Hash: 1421E5B5901248EFDB10CF9AD984ADEBFF8EB48320F14841AE918A3250D375A950CF65

Function 087C96C8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 087C974F

Memory Dump Source

Source File: 0000000A.00000002.3329155748.00000000087C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_87c0000_po.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1821fb6190ae0b9a7a2a807dcda562d7dc2b60bee68b9063ab0a43bb19aeef2c
Instruction ID: 521e59ce49ce04025497283f2f0515fad3aceb266c51630ff6842280328819b2
Opcode Fuzzy Hash: 1821fb6190ae0b9a7a2a807dcda562d7dc2b60bee68b9063ab0a43bb19aeef2c
Instruction Fuzzy Hash: 4B21C4B5901249DFDB10CF9AD984ADEBFF8EB48320F14841AE918A3350D375A954CFA5

Function 0A1CD208 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 0A1CD27F

Memory Dump Source

Source File: 0000000A.00000002.3330456752.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a1c0000_po.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 25f955439f32402b30ec8a117dab51523994c13610fadcd1f0eacba01e9a9efa
Instruction ID: a0aeaeaa7e0d5e83288e50bd7e3d9587d4dff794aa1835a8fc9aed659da23483
Opcode Fuzzy Hash: 25f955439f32402b30ec8a117dab51523994c13610fadcd1f0eacba01e9a9efa
Instruction Fuzzy Hash: CF212971C003499FDB10DFAAC844BEEBBF5EF88320F14842AD519A7250D779A945CFA5

Function 09C97D38 Relevance: 1.6, APIs: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(00000000), ref: 09C97DA8

Memory Dump Source

Source File: 0000000A.00000002.3330063494.0000000009C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9c90000_po.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 461baf3b71874754df3afecd3ef95846080a5351506eaf5f68ae18d0df906e0a
Instruction ID: dc8caa03f97ad75d9926bc68832f5e45fd769b5346400cbb3aef6df44d0b3e7c
Opcode Fuzzy Hash: 461baf3b71874754df3afecd3ef95846080a5351506eaf5f68ae18d0df906e0a
Instruction Fuzzy Hash: DF1138B2C106599FDB14CF9AD445BEEFBB4EF48720F14815AD818A7240D738A940CFA5

Function 0A1C3320 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0A1C3393

Memory Dump Source

Source File: 0000000A.00000002.3330456752.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a1c0000_po.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 83dbef0fc253b376e892b0634757c33ab9cc49ab094be719c85dae6b357a9474
Instruction ID: 29d9af587bb246f65f180fa01e4b5e360e6a7f823942023c1a3aba36e4eefb8a
Opcode Fuzzy Hash: 83dbef0fc253b376e892b0634757c33ab9cc49ab094be719c85dae6b357a9474
Instruction Fuzzy Hash: 1621D3B5D002499FDB10CF9AC985BDEFBF8EB48320F10842AE558A7250D778A945CFA5

Function 087C6CDC Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,087C73A1,00000800,00000000,00000000), ref: 087C75B2

Memory Dump Source

Source File: 0000000A.00000002.3329155748.00000000087C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_87c0000_po.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b269dadecd776992cf4ce6186ed9a06b6d0953964e1d1581479536c89f6c096e
Instruction ID: 8b84fc7520ad80f6eb23de1d7d7b6e459cd1716edab3c68678db1c686afd728e
Opcode Fuzzy Hash: b269dadecd776992cf4ce6186ed9a06b6d0953964e1d1581479536c89f6c096e
Instruction Fuzzy Hash: B51114B68002499FDB24CF9AD844AAEFBF4EB88320F14842ED519A7200C775A945CFA5

Function 087C7541 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,087C73A1,00000800,00000000,00000000), ref: 087C75B2

Memory Dump Source

Source File: 0000000A.00000002.3329155748.00000000087C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_87c0000_po.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 61f3ca949299c3907eb443bdc3ffd872b0b3d011dd06ed74a542ec8004ee90f9
Instruction ID: dc3c442229300fc38ccc8f469b0062ca855ad465aa567c130db4d190f782eeed
Opcode Fuzzy Hash: 61f3ca949299c3907eb443bdc3ffd872b0b3d011dd06ed74a542ec8004ee90f9
Instruction Fuzzy Hash: D21126B6C00249CFDB24CF9AD884AEEFBF4EB88310F14852ED519A7200C775A545CFA5

Function 09E7AD38 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 09E7ADAB

Memory Dump Source

Source File: 0000000A.00000002.3330199411.0000000009E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9e70000_po.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 83216861b8caf4486061d081700da4660f613fbd4e783c858fea446a5501ceba
Instruction ID: af4f013bf13e16c0089a3440a977afda55be810253e891f617fa64390b2ea362
Opcode Fuzzy Hash: 83216861b8caf4486061d081700da4660f613fbd4e783c858fea446a5501ceba
Instruction Fuzzy Hash: 1C21D3B59002499FDB10CF9AC885BDEFBF8EB48324F10842AE558A7250D778A945CFA5

Function 0A1CC998 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0A1CCA06

Memory Dump Source

Source File: 0000000A.00000002.3330456752.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a1c0000_po.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c47ca3a8ba8d722f3038010e8f75232b4b29325609c06bad4c2f1b60b398b8a2
Instruction ID: f8cba9b2169b4d95dee7e3e83afe2342df10c272408e82b0028e25f2b2592554
Opcode Fuzzy Hash: c47ca3a8ba8d722f3038010e8f75232b4b29325609c06bad4c2f1b60b398b8a2
Instruction Fuzzy Hash: 631156718002499FDB10DFAAC844BEEBFF5EF88724F148419D519A7250DB79A940CFA5

Function 0A1CD718 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0A1CD77A

Memory Dump Source

Source File: 0000000A.00000002.3330456752.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a1c0000_po.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 355ea49ff30a44f2ec1f52b5753856bab86e9f00a3cb689a44525dfd1a74476e
Instruction ID: 18ec434042af37dc05de36310f694292bd3175eb576fd52ff3ab99e709189ce3
Opcode Fuzzy Hash: 355ea49ff30a44f2ec1f52b5753856bab86e9f00a3cb689a44525dfd1a74476e
Instruction Fuzzy Hash: D4112871D003498BDB20DFAAC8447AEFBF4AF88724F148419C519A7250DB796944CFA5

Function 087C72BB Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 087C7326

Memory Dump Source

Source File: 0000000A.00000002.3329155748.00000000087C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_87c0000_po.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 47e534a270a98e2211f99443da63d50000c6360d32907005fb8034e79fca7695
Instruction ID: 458ba0d70a89b3c207b532ca0af6e4ddf0a957759e80e5dc54be1f8cbc330b90
Opcode Fuzzy Hash: 47e534a270a98e2211f99443da63d50000c6360d32907005fb8034e79fca7695
Instruction Fuzzy Hash: 8E1102B5C00289CEDB24CF9AD844ADEFBF4EB88311F14852EC859A7610C779A545CFA5

Function 0A1C5168 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0A1CDD2D

Memory Dump Source

Source File: 0000000A.00000002.3330456752.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_a1c0000_po.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: d11685ef23d18f64e0d2f21fd7284b42b57e243f8c23d49c970b350aeb3a8c18
Instruction ID: 93ec750cf20e018a19f0b8ebfb36c536ff8ca70d871ca6ad29be32be9e840aad
Opcode Fuzzy Hash: d11685ef23d18f64e0d2f21fd7284b42b57e243f8c23d49c970b350aeb3a8c18
Instruction Fuzzy Hash: 971103B5800349DFDB20DF9AD985BEEBBF8EB48320F108819E518A7640D375A944CFA5

Function 087C72C0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 087C7326

Memory Dump Source

Source File: 0000000A.00000002.3329155748.00000000087C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 087C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_87c0000_po.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 77d012ebf3ca0dc3b657a1a076df7d7111f85a883548e9aa12c2e3bcd6529409
Instruction ID: d7c1854632c88fa72420b40d4ee90f6e2e409339226036336ade0e5c25d2ec32
Opcode Fuzzy Hash: 77d012ebf3ca0dc3b657a1a076df7d7111f85a883548e9aa12c2e3bcd6529409
Instruction Fuzzy Hash: 081102B5C003498FCB24CF9AC844ADEFBF4AB88320F10841EC818A7210C775A545CFA5

Function 00E96AF0 Relevance: 1.5, Strings: 1, Instructions: 206COMMON

Download Yara Rule

Strings

h^, xrefs: 00E96CFE

Memory Dump Source

Source File: 0000000A.00000002.3307327373.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e90000_po.jbxd

Similarity

API ID:
String ID: h^
API String ID: 0-813783515
Opcode ID: 2657fdc5fde63d4dd91f3ce490839a5246b4a134edaf505afd950aaa38b0201b
Instruction ID: 3a594db0ecd0a02afca81f3219843bacde13752a8988aa65c386c53c02cf1da2
Opcode Fuzzy Hash: 2657fdc5fde63d4dd91f3ce490839a5246b4a134edaf505afd950aaa38b0201b
Instruction Fuzzy Hash: 41714B34A002198FCF04DF69C8949A9BBB2FF89315B25906AE445FB365EB31EC41CB51

Function 00E99547 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

h^, xrefs: 00E99562

Memory Dump Source

Source File: 0000000A.00000002.3307327373.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e90000_po.jbxd

Similarity

API ID:
String ID: h^
API String ID: 0-813783515
Opcode ID: f542fa15b53eeda1497588cbd58a0edeb84db52368f6458aad6a074b35752c46
Instruction ID: 09d16ae6a9bc4f0f9d245874c48d609495642d92ac2773c5af81c37ffb801845
Opcode Fuzzy Hash: f542fa15b53eeda1497588cbd58a0edeb84db52368f6458aad6a074b35752c46
Instruction Fuzzy Hash: 6721F1313042014BEF22577E845437E3AA79FC971AF24507ED502EB397EB6ACC429751

Function 09E9F9B8 Relevance: 1.3, Strings: 1, Instructions: 14COMMON

Download Yara Rule

Strings

')o, xrefs: 09E9F9BB

Memory Dump Source

Source File: 0000000A.00000002.3330287203.0000000009E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9e90000_po.jbxd

Similarity

API ID:
String ID: ')o
API String ID: 0-1527278165
Opcode ID: 65dfe0ee2ac3b1c0091d4b3e1104b60eade27cf1f719ffdd4ffaae4a3af894ab
Instruction ID: ffb225ba71daff0873b1f1dea1bb0ab8d63dc4b8c3cbe61b8eed7c3fcaaf606b
Opcode Fuzzy Hash: 65dfe0ee2ac3b1c0091d4b3e1104b60eade27cf1f719ffdd4ffaae4a3af894ab
Instruction Fuzzy Hash: B9D012372641085E4F40EFE5E840DA277DCBB14710300D572F508C7020E633E868D751

Function 00E99668 Relevance: .8, Instructions: 765COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3307327373.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef8eccb34517812bcc9563aa8ab85a39b13ba64a86b9472fc638c21ad3fa4a1f
Instruction ID: 7980a164974d972ed5c089dbf29c7221d4b240da42c5dba24a68fc2379cd961f
Opcode Fuzzy Hash: ef8eccb34517812bcc9563aa8ab85a39b13ba64a86b9472fc638c21ad3fa4a1f
Instruction Fuzzy Hash: DC620E70A00219CFEB14DBA5C864B9EBBB2FF84304F1480A9D6067B7A6DB349D45DF91

Function 04F9C078 Relevance: .7, Instructions: 688COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3320071743.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4f90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f82f0dde180a680ba891aae149da6742cb63137b186948ef7d58794456044d8
Instruction ID: 3b464efd1f89b8355958d1f663ecc43b54eddae56c1c0ba422ca6833c1c00a75
Opcode Fuzzy Hash: 9f82f0dde180a680ba891aae149da6742cb63137b186948ef7d58794456044d8
Instruction Fuzzy Hash: 7172283490021B8FCB59EF75E898A9DBBB2FB85301F104669D106AB359DF306E85CF91

Function 09E9B0F0 Relevance: .6, Instructions: 591COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3330287203.0000000009E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 463cc86991858fdd20e85d33573b287495983b21f8079584cf91b9942e726627
Instruction ID: 0fbe77394881e53f70c134af42a63001ed573b49c9a551d7281410588d6c9464
Opcode Fuzzy Hash: 463cc86991858fdd20e85d33573b287495983b21f8079584cf91b9942e726627
Instruction Fuzzy Hash: BE120430B052868FDB05BF79F86566E7FF1EF85200F05486AE085D7291DE38AC16C7A2

Function 09E99EA0 Relevance: .5, Instructions: 518COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3330287203.0000000009E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7021f31695272ede9b609ac854b2fc1444d903348326841ce47ae60909366dce
Instruction ID: 11f1a912b1f07476227ee2447491d455b0ffde693122b67e55ead3103ad936e9
Opcode Fuzzy Hash: 7021f31695272ede9b609ac854b2fc1444d903348326841ce47ae60909366dce
Instruction Fuzzy Hash: ACE18D70B112158FCB04FF79E9986AE7BF5EF88304B104879E445E7364EE39AC1587A2

Function 09E98805 Relevance: .5, Instructions: 515COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3330287203.0000000009E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7efedb451246dc5199f1735055f77f106ed5e26f5e5dfd188edf8cc0f60a2da
Instruction ID: b5be005663d606ae30daf3db17d8929e6e77e0a9543cffed653b79a0fcd12822
Opcode Fuzzy Hash: e7efedb451246dc5199f1735055f77f106ed5e26f5e5dfd188edf8cc0f60a2da
Instruction Fuzzy Hash: 1202C070A152598FCB05FF78E85465D7BF2FF4A204F0048AAE446E73A5DB385C16C762

Function 09E9A692 Relevance: .5, Instructions: 462COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3330287203.0000000009E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0969f293b6fceda2505c9e67aad4afe9745166fe75e3aaac875cbc905b6c6486
Instruction ID: 654811a6348dc1ed60a25d9fbdac8349679fca7f052c03bbef77cdbc0a6346c0
Opcode Fuzzy Hash: 0969f293b6fceda2505c9e67aad4afe9745166fe75e3aaac875cbc905b6c6486
Instruction Fuzzy Hash: 400247B0E00259CFCB05EF79E85829D7BB2FF88311F0149A9E44AE7354EB785C558B92

Function 09E988D1 Relevance: .5, Instructions: 453COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3330287203.0000000009E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e2a8530f4b9920f5feab7e9216d33706ab31dfda190fe7fbb1700eb8815095b
Instruction ID: b65cbaa40a35615b758110b84115a4f27be6c7c7f69231ac2081008891a56975
Opcode Fuzzy Hash: 3e2a8530f4b9920f5feab7e9216d33706ab31dfda190fe7fbb1700eb8815095b
Instruction Fuzzy Hash: E4F14C71A11219CFCB04FFB9E85865E7BF2FB89204B104969E445E7364EF38AC168B91

Function 09E988E0 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3330287203.0000000009E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b0ea117ae1ddf66576b9a0624cc120e5288dc9498959f64a79c12ee433d4483
Instruction ID: 42a153ec060ccc00fadb2f45d13c5a51d878df9a7ab0d20ea2c542160866f000
Opcode Fuzzy Hash: 6b0ea117ae1ddf66576b9a0624cc120e5288dc9498959f64a79c12ee433d4483
Instruction Fuzzy Hash: 91F15B71B11119CFCB04FFB9E85865E77F2FB89204B104969E446E7364EF38AC168B91

Function 00E963B8 Relevance: .4, Instructions: 442COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3307327373.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3a357cf5a844a727f894c360247bfe79b1d031f678159a97277dae1570fb10f
Instruction ID: 90233c9ba7920636a8ae686c9335f0c6cd34c44b88f2270f1432d8ce4ef9afbe
Opcode Fuzzy Hash: a3a357cf5a844a727f894c360247bfe79b1d031f678159a97277dae1570fb10f
Instruction Fuzzy Hash: 88E1EE307002049FDF19EF75D858B6E7BA2EB88365F14982AE506EB399DB34DC41CB90

Function 09E997FC Relevance: .4, Instructions: 400COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3330287203.0000000009E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c2fa92088121f1ba077a048bd19e0fef97c950ce57d899e484589db65cb3f9a
Instruction ID: a5f43a884e6408a8715af90726ef1914b49df42e6e5a11db9ee69a1e4183c179
Opcode Fuzzy Hash: 6c2fa92088121f1ba077a048bd19e0fef97c950ce57d899e484589db65cb3f9a
Instruction Fuzzy Hash: D4D1D271B112168FCB04FF79E99876E77E2EF48214F204869E406E7354EE78AD05C7A2

Function 09E982F8 Relevance: .4, Instructions: 376COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3330287203.0000000009E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92f0ab78fa79adb773c7693ce9d94072815b69293d43b22005b5f951dbee12fa
Instruction ID: fe7293cb1dcf18e20cf759acfa9bbab0b90cc1fbbebab81a57c9b38ec0ddc554
Opcode Fuzzy Hash: 92f0ab78fa79adb773c7693ce9d94072815b69293d43b22005b5f951dbee12fa
Instruction Fuzzy Hash: A3D1CF71B10215CFCB04FFB9E89966E7BE2EB88310F544829E445D7364DE38AC56CBA1

Function 09E95F95 Relevance: .4, Instructions: 367COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3330287203.0000000009E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc0b0951b02ab42caeb09432bc6d1c873c0d4330591e68f20f991b34a806ee6c
Instruction ID: 184d4528116365cb8e1a196bfa9b88b1a2699c02accae4b5fe8601d17e2b8c5c
Opcode Fuzzy Hash: cc0b0951b02ab42caeb09432bc6d1c873c0d4330591e68f20f991b34a806ee6c
Instruction Fuzzy Hash: 87D1F870B053858FC706EF75E86469D7FF1EF4A204B1544EAD481DB3A6DA389C0AC762

Function 00E98920 Relevance: .4, Instructions: 359COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3307327373.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa48b0b642920f8b792c2622817c3333ff4d1b94e080053b1772c57f131f6c77
Instruction ID: 285541d9fff9151adc80f946dda0fac034bcf4b21c2b8a2862f6a9dc29728360
Opcode Fuzzy Hash: aa48b0b642920f8b792c2622817c3333ff4d1b94e080053b1772c57f131f6c77
Instruction Fuzzy Hash: C1E11975A00214CFCB04DF68CA8899DBBF6FF99315B169499E505AB371CB34EC41CB64

Function 09E9981B Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3330287203.0000000009E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee6e41eb4417399afab95fc76ad3b00287d22fa9b48f358ab47ed0ace36e9888
Instruction ID: f7641bc8004296cc35028d8d44f824d98681267fecccb3445a002cbf203906e8
Opcode Fuzzy Hash: ee6e41eb4417399afab95fc76ad3b00287d22fa9b48f358ab47ed0ace36e9888
Instruction Fuzzy Hash: B6C1C070B012168FCB04FF79E99876E77E2EB48214F10486DE446E7354EE78AC05C7A2

Function 00E9F7D0 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3307327373.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94386278dc887c38dd29dd8f057373c9506fc953584ee3e145a80b38dce927c5
Instruction ID: 739c35389df2dc26f54561b5aed1ad1e01847b7e0f588691f5252971fc417d15
Opcode Fuzzy Hash: 94386278dc887c38dd29dd8f057373c9506fc953584ee3e145a80b38dce927c5
Instruction Fuzzy Hash: 83C1C131B002098FCF14DF69C494AAE7BB2AFC9315F249169E819EB355DB35DC42CB90

Function 09E982B7 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3330287203.0000000009E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79e64b968cc4e9b4fb784bad7c19acaa08b80a4afaa4fa449c4656ffd0ae8216
Instruction ID: 85e4cc21714fe4ade60a272a7ba41f4f04dabfc1078d29bf74cd2c7ad3aac3ef
Opcode Fuzzy Hash: 79e64b968cc4e9b4fb784bad7c19acaa08b80a4afaa4fa449c4656ffd0ae8216
Instruction Fuzzy Hash: 00A1E071B112058FCB04FF78E89866E7BF2EF49310B544869E441DB3A5DA3C9C4ACBA1

Function 00E949C8 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3307327373.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3626d56379e174c863717f3c3fbd67a688febfdf8896699b454c81ab9ebbb85
Instruction ID: 38e5d5becf1f710eea8f0725d1e43bbc7e81a487d93907e925f927529f06b317
Opcode Fuzzy Hash: d3626d56379e174c863717f3c3fbd67a688febfdf8896699b454c81ab9ebbb85
Instruction Fuzzy Hash: C8A1C6B4B04208DFEF189BB5D454F6E76B2FBC4315F245829E406EB3C8EA748C829795

Function 00E9498F Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3307327373.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34136c63dfe7d6a004fade12efe994df1923b4a8e39f9aeebaeebedd065b880e
Instruction ID: 7cff81e3b4a294b63dcc03c2a2b247f9b03b6ee76526d400a5ee86a60d37315c
Opcode Fuzzy Hash: 34136c63dfe7d6a004fade12efe994df1923b4a8e39f9aeebaeebedd065b880e
Instruction Fuzzy Hash: 0191B3B4B04204DFEF148BB5D854FAE77A1FB84315F24582AE406EB3C4EA748C42C795

Function 00E94AAC Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3307327373.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06fb3fd9f529f8a290c4f211bf68ce8b6ffba82dfa46aa9b8c39977e907f53e0
Instruction ID: d4d06a6e41d5194318fa626843bd8f8de82939710a2096690eb04d686da2af69
Opcode Fuzzy Hash: 06fb3fd9f529f8a290c4f211bf68ce8b6ffba82dfa46aa9b8c39977e907f53e0
Instruction Fuzzy Hash: 2381B4B4B04204CFEF189BB5D454FAE76B2FB84315F245829E006EB3C8EA748C82DB55

Function 04F98528 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3320071743.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4f90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5d207edf1df4acdabbdeac6d4f849bfdbeeb5f491e23f6db55932c64436f426
Instruction ID: 320a64076935b16fd6cc320db67935ed56f02e419ee83dd61e1853589f0b6c63
Opcode Fuzzy Hash: a5d207edf1df4acdabbdeac6d4f849bfdbeeb5f491e23f6db55932c64436f426
Instruction Fuzzy Hash: 78A18331A10605CFDB14EF69C88499DBBB2FF89314F1186A9E505AB365EB70ED85CF80

Function 00E9FC70 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3307327373.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 492a046f03c24a5ee494782804aac6923a74aa9f0cd63f634e34cf8aa1b35138
Instruction ID: a01b009ef2e2373f4df4a58bdf697e9f9120b81a091e7f2868ff40cda6a94f70
Opcode Fuzzy Hash: 492a046f03c24a5ee494782804aac6923a74aa9f0cd63f634e34cf8aa1b35138
Instruction Fuzzy Hash: 6D81A5716002489FDB15DF69C844BAEBBE6FF88314F148469E805EB3A1CB389C41CBA1

Function 09E9C080 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3330287203.0000000009E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d67ffbc86dffbed57517d42c64281bf64fcf59fe433483aa59156d23840853f6
Instruction ID: 58e8bdac8d3b8e15e0ff822a2fad9f1908ee8207ef8abbb4fc3afb15018bfd28
Opcode Fuzzy Hash: d67ffbc86dffbed57517d42c64281bf64fcf59fe433483aa59156d23840853f6
Instruction Fuzzy Hash: D8719130B10117CFCB04FFB9E895A6E77E6FB88354F608569E44AD7359EA34AC0187A1

Function 00E9B3B4 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3307327373.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b341f6331f29c04d400bd40829c90e3dbf4059c3d62c5fadd6362d7e344362f
Instruction ID: f10ea955286922673ea56e6ee2a80553bfefabafe7c71832eb959f89e35cbe98
Opcode Fuzzy Hash: 0b341f6331f29c04d400bd40829c90e3dbf4059c3d62c5fadd6362d7e344362f
Instruction Fuzzy Hash: 1B817230A00208DFEF14DB65EA55BAE7BB2FB84300F20546AD506FB395EB748D85DB51

Function 00E9B3C3 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3307327373.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfc6aaf205c3b02b7833aeb90681509b5e17dbac63bc9a47143677237983083b
Instruction ID: 8d1fe13ae91e20aeca7924095d513461a04231eee29c85e6b4bba8461b676343
Opcode Fuzzy Hash: dfc6aaf205c3b02b7833aeb90681509b5e17dbac63bc9a47143677237983083b
Instruction Fuzzy Hash: F7817130A00208DFEF14DB65EA55BAE7BB2FB84300F20546AE506FB395EB748D85DB51

Function 00E99318 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3307327373.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 854df3f4446c239ebcb551fad3c250fd0b0dbff5282fe717afb182d63ad0fc39
Instruction ID: 91cf13625dd4d0bc25e8d3a8c73ae471f3f1f18ecef9ee1de6ff6044c8bb6fdd
Opcode Fuzzy Hash: 854df3f4446c239ebcb551fad3c250fd0b0dbff5282fe717afb182d63ad0fc39
Instruction Fuzzy Hash: D75190313141518FCB16DF3EC884A6A7BE9EF4975575950BEE816DB2A3DB20EC02CB60

Function 09E9BDDD Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3330287203.0000000009E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c2727074b18c65c33fae9395d3a1ac6abc9de20c360a6c3364fa5dba716c51f
Instruction ID: 47e12b316d1fe1e59ec72dc6326b2dffcc086603f3a53c19baa9b934333a439e
Opcode Fuzzy Hash: 9c2727074b18c65c33fae9395d3a1ac6abc9de20c360a6c3364fa5dba716c51f
Instruction Fuzzy Hash: F551F471B052468FCB04FFB9E85576F7BF5EB84210F14856AE449E3354EE38AC0587A2

Function 00E9BC5F Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3307327373.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b036f7389f98c9b32650fb3c02dd73da8a3003a44b2ad0480b5126e4f170c17e
Instruction ID: a0b7dcc7c48fce9060794dd967d10305ef12c784553c5fae3017b21bcab5a0dc
Opcode Fuzzy Hash: b036f7389f98c9b32650fb3c02dd73da8a3003a44b2ad0480b5126e4f170c17e
Instruction Fuzzy Hash: 7A614930A0520CDFDF14DFA9E694BEEB7B6FB84304F215066E506AB398CB319D418B91

Function 00E9BF60 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3307327373.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28af541e4af3dbc30a22666db673e239f4c80b6a147a2d8609b45240d69347fb
Instruction ID: b0543b15de95605c97f7654c639bcc24a205d74e82eac13b6e159636c4d61cc9
Opcode Fuzzy Hash: 28af541e4af3dbc30a22666db673e239f4c80b6a147a2d8609b45240d69347fb
Instruction Fuzzy Hash: 60411731A053558FCB05EB79881419EBFF2EFCA220B24816AD504FB255EA315D06CBD1

Function 00E99118 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3307327373.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5746a883cab3726d6939106b84250d29d7bc144a00c4122461b7b2018aabfe6b
Instruction ID: 5eca6d95e5f7c34363fe8fc7faab1f6db627b1043bdb0813fe4226dafdf24688
Opcode Fuzzy Hash: 5746a883cab3726d6939106b84250d29d7bc144a00c4122461b7b2018aabfe6b
Instruction Fuzzy Hash: 384156356002069FCB05DF69D888AAA7BB5FF88315F1140A9E906EB3B2C730DD81CB51

Function 00E96328 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3307327373.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d808cd54b61af06bc25867edbacac4985e0987ffda1f8e52e3f6a40e52c40b09
Instruction ID: 2a3d7c11bae55e8593c302d47a796d938a506af0508a20f061749a56a7d712f5
Opcode Fuzzy Hash: d808cd54b61af06bc25867edbacac4985e0987ffda1f8e52e3f6a40e52c40b09
Instruction Fuzzy Hash: 46312431A092A19FDB129F38D8A46D97FB0FF86324F0540A7D151CF253E7249C4ACB96

Function 04F9E438 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3320071743.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4f90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a48813e1aee2c2284565b36717fc030b317b2aafede71efe8824382331d6d3a9
Instruction ID: fa41517ff85c70163d177c7815c0ac751a71eba0680ef92bc328523611b27745
Opcode Fuzzy Hash: a48813e1aee2c2284565b36717fc030b317b2aafede71efe8824382331d6d3a9
Instruction Fuzzy Hash: 4C31E534B041009FEB54DF29D408BAB7BF6EB8939AF158075E401EB285DB35ED46C7A1

Function 00E98768 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3307327373.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74839b2ba4e04c0a92dea73901db3d6cd1b86772e497da6e8eccf3f5925fa848
Instruction ID: bec3c074ce6c0330e4f482b10deadf9a5961f453bb8fafc24813a58be9210a8e
Opcode Fuzzy Hash: 74839b2ba4e04c0a92dea73901db3d6cd1b86772e497da6e8eccf3f5925fa848
Instruction Fuzzy Hash: DB31A1317002049FDB08AB75D858AAE7BF6FFC9721F244469E506EB395DE359C01CBA0

Function 00E98910 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3307327373.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2a140b2e9da12ef8df21ab7960cc68ee4758323225ff6eca1ae780bb8cbf110
Instruction ID: e612754266fb9d01451b46fcc5b20ccd85ee01918d17140354b16f898d96c682
Opcode Fuzzy Hash: b2a140b2e9da12ef8df21ab7960cc68ee4758323225ff6eca1ae780bb8cbf110
Instruction Fuzzy Hash: 72315470A002058FCB44DF69C98496EBBF6FF85320B15855AE515A73B5DB78AC41CBA0

Function 00E99460 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3307327373.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a3b8437def47b4eca472fbeba313edd899be2896e2969a1ad61982e99100983
Instruction ID: 4422b8735270ac995df942adfa29c3a8247896d8e0b9d97df6e8cbc708e85107
Opcode Fuzzy Hash: 4a3b8437def47b4eca472fbeba313edd899be2896e2969a1ad61982e99100983
Instruction Fuzzy Hash: 1121D0313081558BDF12DE6EEC80AAB7BAAEF85310B15542EF812D7246DB34CC42CB60

Function 04F9EF88 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3320071743.0000000004F90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4f90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 057642ee4dab1de894522a8f92314053a98ff28d7992bded7aa26dc877028cfe
Instruction ID: 68b1a7b6056ff65aabf5895e4f83f6d359a5ad27f732c22af4df91a2fbed40dd
Opcode Fuzzy Hash: 057642ee4dab1de894522a8f92314053a98ff28d7992bded7aa26dc877028cfe
Instruction Fuzzy Hash: AE31D2347006248FCB24DF19C48496AB7F6FB88715B55456EF94ACB761DB32FC828B60

Function 09E9BCDF Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3330287203.0000000009E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 762006f3d24780319c2ead0a3c901c13ce187967576b0f81de6d251881356338
Instruction ID: 1abbe2bf6916c69ab6029eb6f74ec10ac3235bccd6711cde760e9e2b7fd67142
Opcode Fuzzy Hash: 762006f3d24780319c2ead0a3c901c13ce187967576b0f81de6d251881356338
Instruction Fuzzy Hash: FA21C271B052568FD704FBB9F858B6E7BE5EB88214F148869E049D3344EE78AC058392

Function 09E9BCF0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3330287203.0000000009E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75010f7d9eb0ef65774c542cd6483f1b67463f3209853ffc4f4c36cef3a1b85f
Instruction ID: 1763c4cf94561ba5f328435790923a339e479091f940a76b840a75043b03f1ac
Opcode Fuzzy Hash: 75010f7d9eb0ef65774c542cd6483f1b67463f3209853ffc4f4c36cef3a1b85f
Instruction Fuzzy Hash: 5211AF71B111268BD704BBB9FC58B6E76E9FB88214F108829E409D3344EE78AC0587A1

Function 00E4D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3307145907.0000000000E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e4d000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 464a22acad60202ca0d8ce68639e025db1a0bbcc0ce113aee9b2f303e2c51959
Instruction ID: 027ba0034c3598b40358928c0c3cbe7069f0090d842b70e5ad2602ffb6b606f1
Opcode Fuzzy Hash: 464a22acad60202ca0d8ce68639e025db1a0bbcc0ce113aee9b2f303e2c51959
Instruction Fuzzy Hash: 0D212271608300DFDB14DF14E980B16BBA6FB88318F30C56DD80A5B282C33AD847CA61

Function 00E4D2A8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3307145907.0000000000E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e4d000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c47242be9f99f6fb90445a3c03c0ec8e2697b37e06c431a5bc9c2bce3daafd56
Instruction ID: c5493a4659af0fe5e17d9b173f8fef076feabc9874655ff4e6648ebc8fc71f3f
Opcode Fuzzy Hash: c47242be9f99f6fb90445a3c03c0ec8e2697b37e06c431a5bc9c2bce3daafd56
Instruction Fuzzy Hash: E82134B1608200DFDB00DF14E9C4B16BBA5FB88318F24C5ADE9095B256C37AD846CB62

Function 00E98759 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3307327373.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fab6c1ed58881f0fbd3b5ceda9b57199ea9342098ac0c4e6df6254a92983d7ea
Instruction ID: 1cabab73d1d354a385a5ab6c0f0e124a0f2f3cbd424b5598e1be090629fa93a7
Opcode Fuzzy Hash: fab6c1ed58881f0fbd3b5ceda9b57199ea9342098ac0c4e6df6254a92983d7ea
Instruction Fuzzy Hash: 24216A75B002049FCB14DF69C884A9EBBF6FF8C321F148069E906E7360DA75AC11CBA0

Function 00E4D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3307145907.0000000000E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e4d000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c8875ca34591a13f195fb5481101f41fa99f0b8eefa2b0d9bc27a78ea32f96e
Instruction ID: a46d9509594dd4e3f86e8b1c2438a264bf8a490668be81d67fbbe80be5beb674
Opcode Fuzzy Hash: 1c8875ca34591a13f195fb5481101f41fa99f0b8eefa2b0d9bc27a78ea32f96e
Instruction Fuzzy Hash: EE215E7550D3C08FCB16CF24D994715BF72EB46314F29C5EAD8498B6A7C33A980ACB62

Function 00E974F0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3307327373.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0c5fd77c1541b824a51746b565ad87c803f9f5011c1a24fc6882a76cba04d12
Instruction ID: 053a4a90e08edf63cef6f727a3f78ed8df17db1a53fe8d8f3aa6dfb92d5470cb
Opcode Fuzzy Hash: b0c5fd77c1541b824a51746b565ad87c803f9f5011c1a24fc6882a76cba04d12
Instruction Fuzzy Hash: 4F21AE31A04204DFCB14CF58D848BAABBF5FB48314F45C46EE49AAB251D334DD58CBA0

Function 00E4D2A3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3307145907.0000000000E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e4d000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ccfe305154e95a536d18b49939e535c9c69fd109e9eb5688aea898868e671a0
Instruction ID: 7395a0e2b325fc99dfcb55de901946c91fa1822a52c5b49e74b2d21803612748
Opcode Fuzzy Hash: 2ccfe305154e95a536d18b49939e535c9c69fd109e9eb5688aea898868e671a0
Instruction Fuzzy Hash: 6A119375504244DFCB05CF14D9C4B15BBA1FB84318F24C6ADD8494B656C33AD856CB52

Function 00E3D7B1 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3307097853.0000000000E3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e3d000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d001242987a0a9093fd8488e3702ea0e394af25f956775d20190114979951d57
Instruction ID: 2bde52015c51b2899070f6f16ccb9309c08690290fb5f45bb7f46ff7d6350f4a
Opcode Fuzzy Hash: d001242987a0a9093fd8488e3702ea0e394af25f956775d20190114979951d57
Instruction Fuzzy Hash: B801F231408344EAE7208A16ED88B66FF9CEF81324F18D15AED092B282C778A844C6B1

Function 00E9C328 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3307327373.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3327e779a49c49b3688c4f4f79a318747cb934323e3fc6870b19f94c02d2b457
Instruction ID: 57fa653249e9d9f404972f23b5a96dc00448adef15fc2c6f23944e87c32b4ef7
Opcode Fuzzy Hash: 3327e779a49c49b3688c4f4f79a318747cb934323e3fc6870b19f94c02d2b457
Instruction Fuzzy Hash: 2DF054367442045BD724EAAAB405FABBBEADBC07B1F24C4AFE15CD7244DE31A8018794

Function 00E3D7B0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3307097853.0000000000E3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e3d000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cafd7fc086980d84cb446c8f52dd1c67ebb1be56f52cd61059e39cb90470c53e
Instruction ID: 5aded8914405baad61d1086885836f03092f36c1b91021826360fc232bcfc053
Opcode Fuzzy Hash: cafd7fc086980d84cb446c8f52dd1c67ebb1be56f52cd61059e39cb90470c53e
Instruction Fuzzy Hash: D8F06272409344AAE7148E16DD88B62FF98EB91724F18C15AED485F286C379AC44CAB1

Function 09E9F909 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3330287203.0000000009E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 002a0ce7882579bd01beac681e4381b788dcf80249af3836c34d586439e0806c
Instruction ID: 1f8d8e7427563cd814d7fc85f48537d2c18a85e53a5a5305511244b68e5280a7
Opcode Fuzzy Hash: 002a0ce7882579bd01beac681e4381b788dcf80249af3836c34d586439e0806c
Instruction Fuzzy Hash: 05F037B0D1524AAFDB04DFADC441AEEBFF0AF08300F0059AAE400E7201D77089008B81

Function 09E9F918 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3330287203.0000000009E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a76cc742341a040534e786a3269b6b2a71d98204a334b62a57708630f5a14d72
Instruction ID: 6705091ec05230d53400c31c035505e1b753d05cdc2ac615b84a7e7dc3a27fc4
Opcode Fuzzy Hash: a76cc742341a040534e786a3269b6b2a71d98204a334b62a57708630f5a14d72
Instruction Fuzzy Hash: 9FF0DAB0D1420AAFDB44DFADC841ABEFFF4AF48304F1189A9E918E7240D7719A408BD0

Function 00E94D97 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3307327373.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59c83558ebcd86743f2bbd099cd5fdb77309fc35b32ac7a84afad8adcb351721
Instruction ID: 09e4427a76b03c4bb1b3945bd366cd528df76c30c7155180ca38af2df6ca1c17
Opcode Fuzzy Hash: 59c83558ebcd86743f2bbd099cd5fdb77309fc35b32ac7a84afad8adcb351721
Instruction Fuzzy Hash: 5EF030B8614118EFDF188A96F854EEC7775FB8971AF201566E207BA2C4D7304C42CB51

Function 09E9717B Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3330287203.0000000009E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59a9f06d397bf40eb7bd2f8d12f46b007ff0ea43b2dee0b3c2b8c6faac75db4f
Instruction ID: 8022c1ee272ba73c6a5e8e37080054a71ea31cf3f92589e640afde0fd91a8efe
Opcode Fuzzy Hash: 59a9f06d397bf40eb7bd2f8d12f46b007ff0ea43b2dee0b3c2b8c6faac75db4f
Instruction Fuzzy Hash: 2AE0923156E3C68FE7131770685C2A53F61DE1369930A04DFD889C90A3C62D4C0AC322

Function 09E971B1 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3330287203.0000000009E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec9457f32348c31e07928eb444e101a3912d2e9519c6d3b7ef53df606822debb
Instruction ID: 7a03447b1c272d72d12702f3d1e779dc7761c6a76c7474bb2b3e6eb17dbc3888
Opcode Fuzzy Hash: ec9457f32348c31e07928eb444e101a3912d2e9519c6d3b7ef53df606822debb
Instruction Fuzzy Hash: A9F0393021A385CFC3165B31F4580253FA5EF0660530A04DCE445CA1A2CB7A9C5ACB12

Function 00E94DA1 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3307327373.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8a2fcf17f76575d554a3aa675eb65a852a0b721acdc792899af8dc3dcfac8d2
Instruction ID: 12d9912f18c6864a0326bb130a04786cfb62e6b2b7a3dda97fef93d3dcda4d50
Opcode Fuzzy Hash: c8a2fcf17f76575d554a3aa675eb65a852a0b721acdc792899af8dc3dcfac8d2
Instruction Fuzzy Hash: 75E012B9A24114EBDF188A89F844EECB374FB4932AF212562E207BA1C0C3304842CB52

Function 00E96D48 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3307327373.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9a1da932a67db480d0bc0de3d69427b650f1dfd1eb5283d12cefd219d678f00
Instruction ID: b63ab836040ab956069e42eea83bfd4cd7892796c88f09be93e4106671aef36e
Opcode Fuzzy Hash: f9a1da932a67db480d0bc0de3d69427b650f1dfd1eb5283d12cefd219d678f00
Instruction Fuzzy Hash: E6E0C23400E3C64ED703A337A8055453F79EA4370436485DFE0498F06BFA691A0EC351

Function 09E971C0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3330287203.0000000009E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d302f5414d9509a55f64432fc2a8b74d63b184a42fc83c9a71ff5a791b81c8b9
Instruction ID: 2fbaad8a9e44967a186c29ae029cb97a1dab5212b30a3ba3c97e3a4a727f1b27
Opcode Fuzzy Hash: d302f5414d9509a55f64432fc2a8b74d63b184a42fc83c9a71ff5a791b81c8b9
Instruction Fuzzy Hash: CCE0EC30211209CFC7146F71F45C52A37A9FB0470A31504ACE80689665DB3EEC85CA51

Function 00E98815 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3307327373.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 731a70dc8e3f743a5aa1fcca63fe8578ab124b19d5ee0bf593b5d3c1448b9138
Instruction ID: 419ca4d136ef019a6107f61392a3de9a9452a433850075fcddaf279a821bed73
Opcode Fuzzy Hash: 731a70dc8e3f743a5aa1fcca63fe8578ab124b19d5ee0bf593b5d3c1448b9138
Instruction Fuzzy Hash: C6D0673AB401089FCF04DF99EC449DDF776FBD8221B148116EA15A3264C6319961DB50

Function 09E9BCB4 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3330287203.0000000009E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1614e6bff52b955e1069926ea8bdf9f3209d6faccd48a65ccf2b89b4dbd8f85d
Instruction ID: c296b1e37d782b4661fd46429e446d1ba44b8bb335785be56fb0652331c96703
Opcode Fuzzy Hash: 1614e6bff52b955e1069926ea8bdf9f3209d6faccd48a65ccf2b89b4dbd8f85d
Instruction Fuzzy Hash: F5D0929190E3C02FCB13D7B568A41647FB1AE07244B0E44CBD4C8DF0B3CA19881AC367

Function 00E96D58 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3307327373.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2ff09ccca6a740accfee3c32e67fc3c8c6e6bfb31baf4e041415a8b1c0c683f
Instruction ID: 694ad7eddfe0e984beadbf4ebc232867872c8986f6371def1266ca0c399b5b29
Opcode Fuzzy Hash: e2ff09ccca6a740accfee3c32e67fc3c8c6e6bfb31baf4e041415a8b1c0c683f
Instruction Fuzzy Hash: 86C0127401820A8BDA04F77BFC449153B9AE7843007909524A10A0605DEE786D058695

Function 09E9A4AA Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3330287203.0000000009E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_9e90000_po.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 846f771f603d2af9ac115ad3027576e2e661b02a1d3e57c7d8f50dad7a7bb22c
Instruction ID: 80a3c1b1e473e57a190e075d5033498e1d38e29fadd4afb1104392f9b9f6e59f
Opcode Fuzzy Hash: 846f771f603d2af9ac115ad3027576e2e661b02a1d3e57c7d8f50dad7a7bb22c
Instruction Fuzzy Hash: 0CB01237B04008980D10008878010D9F318D6842776008173D71F45001162122300151

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\po.lnk

C:\Users\user\AppData\Roaming\po.exe

C:\Users\user\AppData\Roaming\po.exe:Zone.Identifier

\Device\Null

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Windows Analysis Report
G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe

Function 0A560006 Relevance: 5.6, Instructions: 5571
COMMON

Function 0A560040 Relevance: 5.5, Instructions: 5545
COMMON

Function 0A360040 Relevance: 5.2, Instructions: 5226
COMMON

Function 0A8E4507 Relevance: 3.6, Instructions: 3614
COMMON

Function 0A56A4FC Relevance: 2.8, Strings: 2, Instructions: 296
COMMON

Function 0A56DF3A Relevance: 1.9, Strings: 1, Instructions: 610
COMMON

Function 0A367CFF Relevance: 1.6, APIs: 1, Instructions: 93
fileCOMMON

Function 0A367D38 Relevance: 1.6, APIs: 1, Instructions: 56
fileCOMMON

Function 0A8E88C8 Relevance: 1.5, APIs: 1, Instructions: 44
windowCOMMON

Function 0A8E88C0 Relevance: 1.5, APIs: 1, Instructions: 44
windowCOMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre