Edit tour

Windows Analysis Report
5Uvn8Uyob8.exe

Overview

General Information

Sample name:	5Uvn8Uyob8.exe renamed because original name is a hash value
Original sample name:	32c91c1331de77b1cf565aff5b4c758ea851eb2e0b6dcec36990b9a282147589.exe
Analysis ID:	1502167
MD5:	db0bcc378f0895c40ad9bd5f9f7f0b11
SHA1:	70f09e0bc1ecc343ef963fc40e3371162091cee5
SHA256:	32c91c1331de77b1cf565aff5b4c758ea851eb2e0b6dcec36990b9a282147589
Tags:	119-45-147-28exe
Infos:

Detection

CobaltStrike, Metasploit

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected CobaltStrike

Yara detected Metasploit Payload

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found large amount of non-executed APIs

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

5Uvn8Uyob8.exe (PID: 7496 cmdline: "C:\Users\user\Desktop\5Uvn8Uyob8.exe" MD5: DB0BCC378F0895C40AD9BD5F9F7F0B11)

conhost.exe (PID: 7504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Cobalt Strike, CobaltStrike	Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit.The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written, stable, and highly customizable.	APT 29 APT32 APT41 AQUATIC PANDA Anunak Cobalt Codoso CopyKittens DarkHydrus FIN6 FIN7 Leviathan Mustang Panda Shell Crew Stone Panda TianWu UNC1878 UNC2452 Winnti Umbrella	http://blog.morphisec.com/new-global-attack-on-point-of-sale-systems http://blog.nsfocus.net/murenshark http://stillu.cc/assets/slides/2023-08-Unmasking%20CamoFei.pdf http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa http://www.secureworks.com/research/threat-profiles/gold-drake	https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike

Malware Configuration

Threatname: CobaltStrike

{"C2Server": "http://119.45.147.28:443/jquery-3.3.2.slim.min.js", "User Agent": "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.130 Safari/537.36\r\n"}

Threatname: Metasploit

{"Headers": "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nReferer: http://code.jquery.com/\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.130 Safari/537.36\r\n", "Type": "Metasploit Download", "URL": "http://119.45.147.28/jquery-3.3.2.slim.min.js"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2955965491.0000021DEDA70000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000000.00000002.2955965491.0000021DEDA70000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.2955965491.0000021DEDA70000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x11:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000002.2955965491.0000021DEDA70000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x7d:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
00000000.00000002.2955823037.0000002214F2C000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_MetasploitPayload_3	Yara detected Metasploit Payload	Joe Security
00000000.00000002.2955823037.0000002214F2C000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.2955823037.0000002214F2C000.00000004.00000010.00020000.00000000.sdmp	Windows_Trojan_Metasploit_7bc0f998	Identifies the API address lookup function leverage by metasploit shellcode	unknown	0x3951:$a1: 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61
00000000.00000002.2955823037.0000002214F2C000.00000004.00000010.00020000.00000000.sdmp	Windows_Trojan_Metasploit_c9773203	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.	unknown	0x39bd:$a: 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1
Click to see the 3 entries

Suricata Signatures

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 119.45.147.28

Timestamp:	2024-08-31T11:46:33.050339+0200
SID:	2028765
Severity:	3
Source Port:	49730
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 119.45.147.28

Timestamp:	2024-08-31T11:47:37.191366+0200
SID:	2028765
Severity:	3
Source Port:	49739
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 119.45.147.28

Timestamp:	2024-08-31T11:47:05.128391+0200
SID:	2028765
Severity:	3
Source Port:	49737
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.4 - Destination IP: 119.45.147.28

Timestamp:	2024-08-31T11:45:55.503206+0200
SID:	2028765
Severity:	3
Source Port:	49740
Destination Port:	443
Protocol:	TCP
Classtype:	Unknown Traffic

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.2955965491.0000021DEDA70000.00000020.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: CobaltStrike {"C2Server": "http://119.45.147.28:443/jquery-3.3.2.slim.min.js", "User Agent": "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.130 Safari/537.36\r\n"}
Source: 00000000.00000002.2955965491.0000021DEDA70000.00000020.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Metasploit {"Headers": "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nReferer: http://code.jquery.com/\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.130 Safari/537.36\r\n", "Type": "Metasploit Download", "URL": "http://119.45.147.28/jquery-3.3.2.slim.min.js"}

Multi AV Scanner detection for submitted file

Source: 5Uvn8Uyob8.exe	ReversingLabs: Detection: 31%
Source: 5Uvn8Uyob8.exe	Virustotal: Detection: 32%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.8% probability

Source: 5Uvn8Uyob8.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe	Code function: 0_2_00007FF6872ED440 FindFirstFileExW,FindNextFileW,FindClose,FindClose,		0_2_00007FF6872ED440
Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe	Code function: 0_2_00007FF6872ED2BC FindFirstFileExW,		0_2_00007FF6872ED2BC

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://119.45.147.28:443/jquery-3.3.2.slim.min.js
Source: Malware configuration extractor	URLs: http://119.45.147.28/jquery-3.3.2.slim.min.js

Source: Joe Sandbox View

ASN Name: CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa

Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49730 -> 119.45.147.28:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49737 -> 119.45.147.28:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49739 -> 119.45.147.28:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.4:49740 -> 119.45.147.28:443

Source: unknown	TCP traffic detected without corresponding DNS query: 119.45.147.28
Source: unknown	TCP traffic detected without corresponding DNS query: 119.45.147.28
Source: unknown	TCP traffic detected without corresponding DNS query: 119.45.147.28
Source: unknown	TCP traffic detected without corresponding DNS query: 119.45.147.28
Source: unknown	TCP traffic detected without corresponding DNS query: 119.45.147.28
Source: unknown	TCP traffic detected without corresponding DNS query: 119.45.147.28
Source: unknown	TCP traffic detected without corresponding DNS query: 119.45.147.28
Source: unknown	TCP traffic detected without corresponding DNS query: 119.45.147.28
Source: unknown	TCP traffic detected without corresponding DNS query: 119.45.147.28
Source: unknown	TCP traffic detected without corresponding DNS query: 119.45.147.28
Source: unknown	TCP traffic detected without corresponding DNS query: 119.45.147.28
Source: unknown	TCP traffic detected without corresponding DNS query: 119.45.147.28
Source: unknown	TCP traffic detected without corresponding DNS query: 119.45.147.28
Source: unknown	TCP traffic detected without corresponding DNS query: 119.45.147.28
Source: unknown	TCP traffic detected without corresponding DNS query: 119.45.147.28

Source: 5Uvn8Uyob8.exe, 00000000.00000002.2955965491.0000021DEDA70000.00000020.00001000.00020000.00000000.sdmp, 5Uvn8Uyob8.exe, 00000000.00000002.2955823037.0000002214F2C000.00000004.00000010.00020000.00000000.sdmp, 5Uvn8Uyob8.exe, 00000000.00000002.2955991151.0000021DEDB0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.jquery.com/
Source: 5Uvn8Uyob8.exe, 00000000.00000003.2028666595.0000021DEDB0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.jquery.com/Rs
Source: 5Uvn8Uyob8.exe, 00000000.00000002.2955991151.0000021DEDB2E000.00000004.00000020.00020000.00000000.sdmp, 5Uvn8Uyob8.exe, 00000000.00000002.2955991151.0000021DEDABB000.00000004.00000020.00020000.00000000.sdmp, 5Uvn8Uyob8.exe, 00000000.00000002.2955991151.0000021DEDB0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://119.45.147.28/
Source: 5Uvn8Uyob8.exe, 00000000.00000003.2028666595.0000021DEDB0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://119.45.147.28/F
Source: 5Uvn8Uyob8.exe, 00000000.00000002.2955991151.0000021DEDB2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://119.45.147.28/e
Source: 5Uvn8Uyob8.exe, 00000000.00000002.2955991151.0000021DEDB0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://119.45.147.28/jquery-3.3.2.slim.min.js
Source: 5Uvn8Uyob8.exe, 00000000.00000002.2955991151.0000021DEDB2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://119.45.147.28/jquery-3.3.2.slim.min.jsM
Source: 5Uvn8Uyob8.exe, 00000000.00000002.2955991151.0000021DEDB2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://119.45.147.28/jquery-3.3.2.slim.min.jsY
Source: 5Uvn8Uyob8.exe, 00000000.00000002.2955991151.0000021DEDB0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://119.45.147.28/jquery-3.3.2.slim.min.jsd4_
Source: 5Uvn8Uyob8.exe, 00000000.00000003.2028666595.0000021DEDB0C000.00000004.00000020.00020000.00000000.sdmp, 5Uvn8Uyob8.exe, 00000000.00000002.2955991151.0000021DEDB0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://119.45.147.28/jquery-3.3.2.slim.min.jsi
Source: 5Uvn8Uyob8.exe, 00000000.00000002.2955991151.0000021DEDABB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://119.45.147.28/jquery-3.3.2.slim.min.jsm:
Source: 5Uvn8Uyob8.exe, 00000000.00000003.2349419346.0000021DEDB2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://119.45.147.28/jquery-3.3.2.slim.min.jsu
Source: 5Uvn8Uyob8.exe, 00000000.00000002.2955991151.0000021DEDB0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://119.45.147.28/query-3.3.2.slim.min.js1
Source: 5Uvn8Uyob8.exe, 00000000.00000002.2955991151.0000021DEDB2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://119.45.147.28/su

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2955965491.0000021DEDA70000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000002.2955965491.0000021DEDA70000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown
Source: 00000000.00000002.2955823037.0000002214F2C000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the API address lookup function leverage by metasploit shellcode Author: unknown
Source: 00000000.00000002.2955823037.0000002214F2C000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families. Author: unknown

Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe	Code function: 0_2_00007FF6872E4F60 NtDelayExecution,		0_2_00007FF6872E4F60
Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe	Code function: 0_2_00007FF6872E549A NtAllocateVirtualMemory,NtProtectVirtualMemory,CreateFiber,		0_2_00007FF6872E549A

Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe	Code function: 0_2_00007FF6872F3F98	0_2_00007FF6872F3F98
Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe	Code function: 0_2_00007FF6872ED440	0_2_00007FF6872ED440
Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe	Code function: 0_2_00007FF6872E82B4	0_2_00007FF6872E82B4
Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe	Code function: 0_2_00007FF6872ED2BC	0_2_00007FF6872ED2BC
Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe	Code function: 0_2_0000021DEDA7010C	0_2_0000021DEDA7010C

Source: 5Uvn8Uyob8.exe

Static PE information: invalid certificate

Source: 5Uvn8Uyob8.exe	Binary or memory string: OriginalFilename vs 5Uvn8Uyob8.exe
Source: 5Uvn8Uyob8.exe, 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamemsedge.exe> vs 5Uvn8Uyob8.exe
Source: 5Uvn8Uyob8.exe	Binary or memory string: OriginalFilenamemsedge.exe> vs 5Uvn8Uyob8.exe

Source: 00000000.00000002.2955965491.0000021DEDA70000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000002.2955965491.0000021DEDA70000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23
Source: 00000000.00000002.2955823037.0000002214F2C000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_7bc0f998 os = windows, severity = x86, description = Identifies the API address lookup function leverage by metasploit shellcode, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835, id = 7bc0f998-7014-4883-8a56-d5ee00c15aed, last_modified = 2021-08-23
Source: 00000000.00000002.2955823037.0000002214F2C000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Metasploit_c9773203 os = windows, severity = x86, description = Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., creation_date = 2021-04-07, scan_context = file, memory, reference = https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm, license = Elastic License v2, threat_name = Windows.Trojan.Metasploit, fingerprint = afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36, id = c9773203-6d1e-4246-a1e0-314217e0207a, last_modified = 2021-08-23

Source: classification engine

Classification label: mal88.troj.winEXE@2/0@0/1

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7504:120:WilError_03

Source: 5Uvn8Uyob8.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 5Uvn8Uyob8.exe	ReversingLabs: Detection: 31%
Source: 5Uvn8Uyob8.exe	Virustotal: Detection: 32%

Source: unknown	Process created: C:\Users\user\Desktop\5Uvn8Uyob8.exe "C:\Users\user\Desktop\5Uvn8Uyob8.exe"
Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe	Section loaded: schannel.dll	Jump to behavior

Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: 5Uvn8Uyob8.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 5Uvn8Uyob8.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: 5Uvn8Uyob8.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 5Uvn8Uyob8.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 5Uvn8Uyob8.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 5Uvn8Uyob8.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 5Uvn8Uyob8.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: 5Uvn8Uyob8.exe	Static PE information: section name: .00cfg
Source: 5Uvn8Uyob8.exe	Static PE information: section name: .gxfg
Source: 5Uvn8Uyob8.exe	Static PE information: section name: .retplne
Source: 5Uvn8Uyob8.exe	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe	Code function: 0_2_0000021DEDA7012B push eax; ret		0_2_0000021DEDA70387
Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe	Code function: 0_2_0000021DEDA7010C push eax; ret		0_2_0000021DEDA70387

Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe

API coverage: 7.2 %

Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe TID: 7500

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe	Code function: 0_2_00007FF6872ED440 FindFirstFileExW,FindNextFileW,FindClose,FindClose,		0_2_00007FF6872ED440
Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe	Code function: 0_2_00007FF6872ED2BC FindFirstFileExW,		0_2_00007FF6872ED2BC

Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe

Code function: 0_2_00007FF6872E4BF0 GetSystemInfo,

0_2_00007FF6872E4BF0

Source: 5Uvn8Uyob8.exe, 00000000.00000002.2955991151.0000021DEDB2E000.00000004.00000020.00020000.00000000.sdmp, 5Uvn8Uyob8.exe, 00000000.00000003.2028666595.0000021DEDB2E000.00000004.00000020.00020000.00000000.sdmp, 5Uvn8Uyob8.exe, 00000000.00000003.2349419346.0000021DEDB2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 5Uvn8Uyob8.exe, 00000000.00000002.2955991151.0000021DEDAF0000.00000004.00000020.00020000.00000000.sdmp, 5Uvn8Uyob8.exe, 00000000.00000003.2028666595.0000021DEDAF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@j

Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe

Code function: 0_2_00007FF6872EAEA8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF6872EAEA8

Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe

Code function: 0_2_00007FF6872E97E4 GetProcessHeap,

0_2_00007FF6872E97E4

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe	Code function: 0_2_00007FF6872EAEA8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6872EAEA8
Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe	Code function: 0_2_00007FF6872E5F18 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6872E5F18
Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe	Code function: 0_2_00007FF6872E65A4 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6872E65A4
Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe	Code function: 0_2_00007FF6872E6594 SetUnhandledExceptionFilter,	0_2_00007FF6872E6594

Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe

Code function: 0_2_00007FF6872F3DB0 cpuid

0_2_00007FF6872F3DB0

Source: C:\Users\user\Desktop\5Uvn8Uyob8.exe

Code function: 0_2_00007FF6872E8C8C GetSystemTimeAsFileTime,

0_2_00007FF6872E8C8C

Remote Access Functionality

Yara detected CobaltStrike

Source: Yara match	File source: 00000000.00000002.2955965491.0000021DEDA70000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2955823037.0000002214F2C000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY

Yara detected Metasploit Payload

Source: Yara match	File source: 00000000.00000002.2955965491.0000021DEDA70000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2955823037.0000002214F2C000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
5Uvn8Uyob8.exe	32%	ReversingLabs	Win64.Backdoor.Cobeacon
5Uvn8Uyob8.exe	33%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://119.45.147.28/jquery-3.3.2.slim.min.jsm:	0%	Avira URL Cloud	safe
http://code.jquery.com/Rs	0%	Avira URL Cloud	safe
http://code.jquery.com/	0%	Avira URL Cloud	safe
https://119.45.147.28/F	0%	Avira URL Cloud	safe
https://119.45.147.28/jquery-3.3.2.slim.min.jsi	0%	Avira URL Cloud	safe
https://119.45.147.28/jquery-3.3.2.slim.min.js	0%	Avira URL Cloud	safe
https://119.45.147.28/su	0%	Avira URL Cloud	safe
http://code.jquery.com/	1%	Virustotal		Browse
https://119.45.147.28/F	2%	Virustotal		Browse
https://119.45.147.28/jquery-3.3.2.slim.min.jsd4_	0%	Avira URL Cloud	safe
http://119.45.147.28/jquery-3.3.2.slim.min.js	0%	Avira URL Cloud	safe
https://119.45.147.28/jquery-3.3.2.slim.min.jsM	0%	Avira URL Cloud	safe
http://119.45.147.28:443/jquery-3.3.2.slim.min.js	0%	Avira URL Cloud	safe
https://119.45.147.28/jquery-3.3.2.slim.min.js	1%	Virustotal		Browse
https://119.45.147.28/jquery-3.3.2.slim.min.jsY	0%	Avira URL Cloud	safe
https://119.45.147.28/query-3.3.2.slim.min.js1	0%	Avira URL Cloud	safe
https://119.45.147.28/	0%	Avira URL Cloud	safe
http://119.45.147.28:443/jquery-3.3.2.slim.min.js	1%	Virustotal		Browse
https://119.45.147.28/e	0%	Avira URL Cloud	safe
https://119.45.147.28/jquery-3.3.2.slim.min.jsu	0%	Avira URL Cloud	safe
https://119.45.147.28/	2%	Virustotal		Browse

Domains and IPs

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://119.45.147.28/jquery-3.3.2.slim.min.js	true	Avira URL Cloud: safe	unknown
http://119.45.147.28:443/jquery-3.3.2.slim.min.js	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://119.45.147.28/F	5Uvn8Uyob8.exe, 00000000.00000003.2028666595.0000021DEDB0C000.00000004.00000020.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://code.jquery.com/	5Uvn8Uyob8.exe, 00000000.00000002.2955965491.0000021DEDA70000.00000020.00001000.00020000.00000000.sdmp, 5Uvn8Uyob8.exe, 00000000.00000002.2955823037.0000002214F2C000.00000004.00000010.00020000.00000000.sdmp, 5Uvn8Uyob8.exe, 00000000.00000002.2955991151.0000021DEDB0C000.00000004.00000020.00020000.00000000.sdmp	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://119.45.147.28/jquery-3.3.2.slim.min.jsi	5Uvn8Uyob8.exe, 00000000.00000003.2028666595.0000021DEDB0C000.00000004.00000020.00020000.00000000.sdmp, 5Uvn8Uyob8.exe, 00000000.00000002.2955991151.0000021DEDB0C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://119.45.147.28/jquery-3.3.2.slim.min.jsm:	5Uvn8Uyob8.exe, 00000000.00000002.2955991151.0000021DEDABB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://code.jquery.com/Rs	5Uvn8Uyob8.exe, 00000000.00000003.2028666595.0000021DEDB0C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://119.45.147.28/jquery-3.3.2.slim.min.js	5Uvn8Uyob8.exe, 00000000.00000002.2955991151.0000021DEDB0C000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://119.45.147.28/su	5Uvn8Uyob8.exe, 00000000.00000002.2955991151.0000021DEDB2E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://119.45.147.28/jquery-3.3.2.slim.min.jsd4_	5Uvn8Uyob8.exe, 00000000.00000002.2955991151.0000021DEDB0C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://119.45.147.28/jquery-3.3.2.slim.min.jsM	5Uvn8Uyob8.exe, 00000000.00000002.2955991151.0000021DEDB2E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://119.45.147.28/jquery-3.3.2.slim.min.jsY	5Uvn8Uyob8.exe, 00000000.00000002.2955991151.0000021DEDB2E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://119.45.147.28/query-3.3.2.slim.min.js1	5Uvn8Uyob8.exe, 00000000.00000002.2955991151.0000021DEDB0C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://119.45.147.28/	5Uvn8Uyob8.exe, 00000000.00000002.2955991151.0000021DEDB2E000.00000004.00000020.00020000.00000000.sdmp, 5Uvn8Uyob8.exe, 00000000.00000002.2955991151.0000021DEDABB000.00000004.00000020.00020000.00000000.sdmp, 5Uvn8Uyob8.exe, 00000000.00000002.2955991151.0000021DEDB0C000.00000004.00000020.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://119.45.147.28/e	5Uvn8Uyob8.exe, 00000000.00000002.2955991151.0000021DEDB2E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://119.45.147.28/jquery-3.3.2.slim.min.jsu	5Uvn8Uyob8.exe, 00000000.00000003.2349419346.0000021DEDB2E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
119.45.147.28	unknown	China		45090	CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1502167
Start date and time:	2024-08-31 11:45:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	5Uvn8Uyob8.exe renamed because original name is a hash value
Original Sample Name:	32c91c1331de77b1cf565aff5b4c758ea851eb2e0b6dcec36990b9a282147589.exe
Detection:	MAL
Classification:	mal88.troj.winEXE@2/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 92% Number of executed functions: 10 Number of non-executed functions: 30
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
05:45:59	API Interceptor	1x Sleep call for process: 5Uvn8Uyob8.exe modified

CloseHandle, CompareStringW, ConvertThreadToFiber, CreateFiber, CreateFileA, CreateFileW, DeleteCriticalSection, DeviceIoControl, EncodePointer, EnterCriticalSection, ExitProcess, FindClose, FindFirstFileExW, FindNextFileW, FlsAlloc, FlsFree, FlsGetValue, FlsSetValue, FlushFileBuffers, FreeEnvironmentStringsW, FreeLibrary, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetFileType, GetLastError, GetModuleFileNameW, GetModuleHandleExW, GetModuleHandleW, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemInfo, GetSystemTimeAsFileTime, GetTickCount64, GlobalMemoryStatusEx, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, LCMapStringW, LeaveCriticalSection, LoadLibraryExW, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, RtlCaptureContext, RtlLookupFunctionEntry, RtlPcToFileHeader, RtlUnwindEx, RtlVirtualUnwind, SetEnvironmentVariableW, SetFilePointerEx, SetLastError, SetStdHandle, SetUnhandledExceptionFilter, SwitchToFiber, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, WideCharToMultiByte, WriteConsoleW, WriteFile

USER32.dll

GetForegroundWindow, ShowWindow

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-31T11:46:33.050339+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	49730	443	192.168.2.4	119.45.147.28
2024-08-31T11:47:37.191366+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	49739	443	192.168.2.4	119.45.147.28
2024-08-31T11:47:05.128391+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	49737	443	192.168.2.4	119.45.147.28
2024-08-31T11:45:55.503206+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	49740	443	192.168.2.4	119.45.147.28

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2024 11:46:00.942668915 CEST	49730	443	192.168.2.4	119.45.147.28
Aug 31, 2024 11:46:00.942689896 CEST	443	49730	119.45.147.28	192.168.2.4
Aug 31, 2024 11:46:00.942790031 CEST	49730	443	192.168.2.4	119.45.147.28
Aug 31, 2024 11:46:00.951280117 CEST	49730	443	192.168.2.4	119.45.147.28
Aug 31, 2024 11:46:00.951292992 CEST	443	49730	119.45.147.28	192.168.2.4
Aug 31, 2024 11:46:33.050338984 CEST	49730	443	192.168.2.4	119.45.147.28
Aug 31, 2024 11:46:33.067934036 CEST	49737	443	192.168.2.4	119.45.147.28
Aug 31, 2024 11:46:33.067975998 CEST	443	49737	119.45.147.28	192.168.2.4
Aug 31, 2024 11:46:33.068058014 CEST	49737	443	192.168.2.4	119.45.147.28
Aug 31, 2024 11:46:33.068358898 CEST	49737	443	192.168.2.4	119.45.147.28
Aug 31, 2024 11:46:33.068372965 CEST	443	49737	119.45.147.28	192.168.2.4
Aug 31, 2024 11:47:05.128391027 CEST	49737	443	192.168.2.4	119.45.147.28
Aug 31, 2024 11:47:05.136425018 CEST	49739	443	192.168.2.4	119.45.147.28
Aug 31, 2024 11:47:05.136467934 CEST	443	49739	119.45.147.28	192.168.2.4
Aug 31, 2024 11:47:05.136534929 CEST	49739	443	192.168.2.4	119.45.147.28
Aug 31, 2024 11:47:05.136831999 CEST	49739	443	192.168.2.4	119.45.147.28
Aug 31, 2024 11:47:05.136847973 CEST	443	49739	119.45.147.28	192.168.2.4
Aug 31, 2024 11:47:37.191365957 CEST	49739	443	192.168.2.4	119.45.147.28
Aug 31, 2024 11:47:37.198266983 CEST	49740	443	192.168.2.4	119.45.147.28
Aug 31, 2024 11:47:37.198333025 CEST	443	49740	119.45.147.28	192.168.2.4
Aug 31, 2024 11:47:37.198436975 CEST	49740	443	192.168.2.4	119.45.147.28
Aug 31, 2024 11:47:37.198756933 CEST	49740	443	192.168.2.4	119.45.147.28
Aug 31, 2024 11:47:37.198781013 CEST	443	49740	119.45.147.28	192.168.2.4

Target ID:	0
Start time:	05:45:59
Start date:	31/08/2024
Path:	C:\Users\user\Desktop\5Uvn8Uyob8.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\5Uvn8Uyob8.exe"
Imagebase:	0x7ff6872e0000
File size:	226'256 bytes
MD5 hash:	DB0BCC378F0895C40AD9BD5F9F7F0B11
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000000.00000002.2955965491.0000021DEDA70000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2955965491.0000021DEDA70000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000002.2955965491.0000021DEDA70000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000002.2955965491.0000021DEDA70000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_MetasploitPayload_3, Description: Yara detected Metasploit Payload, Source: 00000000.00000002.2955823037.0000002214F2C000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2955823037.0000002214F2C000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Metasploit_7bc0f998, Description: Identifies the API address lookup function leverage by metasploit shellcode, Source: 00000000.00000002.2955823037.0000002214F2C000.00000004.00000010.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Metasploit_c9773203, Description: Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families., Source: 00000000.00000002.2955823037.0000002214F2C000.00000004.00000010.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	05:45:59
Start date:	31/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3%
Dynamic/Decrypted Code Coverage:	1.1%
Signature Coverage:	5.7%
Total number of Nodes:	371
Total number of Limit Nodes:	7

Executed Functions

Function 00007FF6872E549A Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 155
nativememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL ref: 00007FF6872E55D8
NtProtectVirtualMemory.NTDLL ref: 00007FF6872E56EA
CreateFiber.KERNELBASE ref: 00007FF6872E5739

Strings

yDCKduM3, xrefs: 00007FF6872E54EF
ntdll.dll, xrefs: 00007FF6872E557B, 00007FF6872E56A2
yromeMlautriVtcetorPtN, xrefs: 00007FF6872E565E
yromeMlautriVetacollAtN, xrefs: 00007FF6872E5534

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID: MemoryVirtual$AllocateCreateFiberProtect
String ID: ntdll.dll$yDCKduM3$yromeMlautriVetacollAtN$yromeMlautriVtcetorPtN
API String ID: 3037940793-2108580085
Opcode ID: 2031e2c05c080561949802c509867ad2593e4060f4c0c3de34152a42e3e76bd8
Instruction ID: 08c3583b270d0e78646e6de0b22bceb4d74f75a8407ed4006f150a755138bec4
Opcode Fuzzy Hash: 2031e2c05c080561949802c509867ad2593e4060f4c0c3de34152a42e3e76bd8
Instruction Fuzzy Hash: 8B617BA5B48A45C3EE18DB5AEC507AA6321FF89BC4F40403ACE6D97725EE3CD155C305

Function 00007FF6872E4F60 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 85
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDelayExecution.NTDLL ref: 00007FF6872E5002

Strings

NtDelayExecution, xrefs: 00007FF6872E4FD3
ntdll.dll, xrefs: 00007FF6872E4FAC

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID: DelayExecution
String ID: NtDelayExecution$ntdll.dll
API String ID: 1249177460-521143355
Opcode ID: 409558210b666fed8c28811cee71abdbc0e23a51507d2bab28c2f06e3be5c30c
Instruction ID: 300ced974182bb1c11540edc96442fd061b9d72de7f35812b086b33b15989b43
Opcode Fuzzy Hash: 409558210b666fed8c28811cee71abdbc0e23a51507d2bab28c2f06e3be5c30c
Instruction Fuzzy Hash: 7131E3A1B54A46D9DA10DF2AEC402DA2761FF047C4F88413ADE1DA3724CE3CC549C301

Function 0000021DEDA7010C Relevance: 1.8, APIs: 1, Instructions: 250
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetConnectA.WININET(00000003,00000003,00000002,00000001), ref: 0000021DEDA70127

Part of subcall function 0000021DEDA7012B: HttpOpenRequestA.WININET(00000000,00000000,84C03200,00000000), ref: 0000021DEDA70146

Memory Dump Source

Source File: 00000000.00000002.2955965491.0000021DEDA70000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021DEDA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21deda70000_5Uvn8Uyob8.jbxd

Yara matches

Similarity

API ID: ConnectHttpInternetOpenRequest
String ID:
API String ID: 1341064763-0
Opcode ID: 873df9c4afc2546a1442a618fe62eac0c09bbb6f8c60467f1a24664f2a33bf3d
Instruction ID: aa2dcb717ec28553764361aefd092e9a858e8857b392f1a6fcfa5a962e731744
Opcode Fuzzy Hash: 873df9c4afc2546a1442a618fe62eac0c09bbb6f8c60467f1a24664f2a33bf3d
Instruction Fuzzy Hash: 7A816C32618A548EEB259B34855D3937FE5DB3630BF18019DD5808F0E3C5659A42C7AF

Function 00007FF6872E4BF0 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE ref: 00007FF6872E4C2F

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 54bab74d9da5c1d26424cc67c36e2f8160a532d74c76cf465e49ef357f147bc2
Instruction ID: 1ec59d9e17213d4b41a7fba28e17b6b17f9c5e0dbcd6384f53e75d1f76ea210a
Opcode Fuzzy Hash: 54bab74d9da5c1d26424cc67c36e2f8160a532d74c76cf465e49ef357f147bc2
Instruction Fuzzy Hash: EB11E761B1869EE2EA518F66ED4075A7770FB04B88F481122DE1E43324DD7CC556C701

Function 00007FF6872E6030 Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF6872E6044

Part of subcall function 00007FF6872E630C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6872E632E

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6872E6059
__scrt_release_startup_lock.LIBCMT ref: 00007FF6872E60C7

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 3058843127-0
Opcode ID: 9853429bb4da60e513ee4a38914f9be8eab5f557b6240c10b12d17fb9ec0640e
Instruction ID: 8dd9d4847282c14ea89036d60fd2cb7831146c65cc2f1b39d9ab1dd4a226a89c
Opcode Fuzzy Hash: 9853429bb4da60e513ee4a38914f9be8eab5f557b6240c10b12d17fb9ec0640e
Instruction Fuzzy Hash: 5A310722A8C24AC2FA15AB3596723FD1291BF86784F44503CE94DCB3D7DE2DB844C311

Function 0000021DEDA7012B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 99
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HttpOpenRequestA.WININET(00000000,00000000,84C03200,00000000), ref: 0000021DEDA70146

Strings

U.;, xrefs: 0000021DEDA70141

Memory Dump Source

Source File: 00000000.00000002.2955965491.0000021DEDA70000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000021DEDA70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21deda70000_5Uvn8Uyob8.jbxd

Yara matches

Similarity

API ID: HttpOpenRequest
String ID: U.;
API String ID: 1984915467-4213443877
Opcode ID: ab09341529980e95ac1e803047b3985bc20a26ea9b837d55d995e7e224907264
Instruction ID: e087b6582dd7641505117206ca85e76557b31635338ed0e022fef37eabc7a82f
Opcode Fuzzy Hash: ab09341529980e95ac1e803047b3985bc20a26ea9b837d55d995e7e224907264
Instruction Fuzzy Hash: 0B11906034890D1BF62C819D7C5A77621CAD3E8719F24813FB54EC73D6DC58CC82402E

Function 00007FF6872E4DA0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 00007FF6872E4DE7

Strings

@, xrefs: 00007FF6872E4DC9

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID: @
API String ID: 1890195054-2766056989
Opcode ID: 257b1fae18b893981f2c28362606997fc1754c08e9b46928f53875603ac60ae2
Instruction ID: c02c7eed59b5ed945cbf7461c5b1ab680b43f73b5a434f6ef1801984b2624461
Opcode Fuzzy Hash: 257b1fae18b893981f2c28362606997fc1754c08e9b46928f53875603ac60ae2
Instruction Fuzzy Hash: D1216AA2B14B69A2EB50CF26E84168A7B60F784B88F484125EF8E43714DF7CD547C304

Function 00007FF6872EA050 Relevance: 3.1, APIs: 2, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32 ref: 00007FF6872EA0C9
GetFileType.KERNELBASE ref: 00007FF6872EA0DF

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: b0527c7f6ce1a788535b61d80c7c4ba8f409d06ac750c36eb78f9f21eec98787
Instruction ID: 3db4e74cd8487618a372f7b78bd8894386319bae7c6c999f8b112f42d3a727e0
Opcode Fuzzy Hash: b0527c7f6ce1a788535b61d80c7c4ba8f409d06ac750c36eb78f9f21eec98787
Instruction Fuzzy Hash: E2317422958B59C2DB608B3596A01BD6A60FF45BB0F64136DDB5E873E1CF38E451E340

Function 00007FF6872EE368 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6872EE393

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8d1c89a91b2cbf7bcb4be2c56b967f6a19fa459e3375c4f3d383e19f75ea9b85
Instruction ID: a276017ebf41cb9d5ca8f88940bf21bb1068269cb62b68a0fad6fe5bbd0069b2
Opcode Fuzzy Hash: 8d1c89a91b2cbf7bcb4be2c56b967f6a19fa459e3375c4f3d383e19f75ea9b85
Instruction Fuzzy Hash: 46115833D8864AC2F210AB24A6615BDB3A5FF44B80F45043DEA8DC76A7DE7CE810CB11

Function 00007FF6872EC4D8 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FF6872E9A46,?,?,?,00007FF6872EBB0D,?,?,?,?,00007FF6872E8C40), ref: 00007FF6872EC52D

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 28eda23e1da9b668524483bb04f09af6a39cd26f9ef756103597628c970101cd
Instruction ID: 818fdedb7c182f455248b4dc71a737aba2524d95ea62f3e519f187d2e406c109
Opcode Fuzzy Hash: 28eda23e1da9b668524483bb04f09af6a39cd26f9ef756103597628c970101cd
Instruction Fuzzy Hash: B1F04942B8964AC1FE5567FA6A712F902807F88B84F48543CCC0EE6293DD2CE4D1C220

Non-executed Functions

Function 00007FF6872E65A4 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6872E65C0
RtlCaptureContext.KERNEL32 ref: 00007FF6872E65ED
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6872E6607
RtlVirtualUnwind.KERNEL32 ref: 00007FF6872E6648
IsDebuggerPresent.KERNEL32 ref: 00007FF6872E669C
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6872E66BD
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6872E66C8

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 9f5952405ada2f1ef1f081ed3776218acde1d10bcce88289bb4f44ae842eef6b
Instruction ID: 918b257f17025c330c32a8208a465c4364145302b281dbd30d84dab23bc8e040
Opcode Fuzzy Hash: 9f5952405ada2f1ef1f081ed3776218acde1d10bcce88289bb4f44ae842eef6b
Instruction Fuzzy Hash: 0C316C72658B81CAEB609F60E9603EA7360FB85744F44413EDA4E87B99EF7CD648C700

Function 00007FF6872EAEA8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6872EAF21
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6872EAF39
RtlVirtualUnwind.KERNEL32 ref: 00007FF6872EAF74
IsDebuggerPresent.KERNEL32 ref: 00007FF6872EAFAD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6872EAFB7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6872EAFC2

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 4c3534951b222c2d301418ca145ecc3f1c25be2e415c2cc7f55dc37a4a711186
Instruction ID: a54a16f87588744f5dc27d704eb9bcbe5a9145587cae3f8fe1371f9226bf68a5
Opcode Fuzzy Hash: 4c3534951b222c2d301418ca145ecc3f1c25be2e415c2cc7f55dc37a4a711186
Instruction Fuzzy Hash: DA317F32658B81C6D760CB35E9602EE73A4FF89754F54023AEA8D83B59DF38D145CB00

Function 00007FF6872ED440 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 236fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF6872ED5B0
FindNextFileW.KERNEL32 ref: 00007FF6872ED6E6
FindClose.KERNEL32 ref: 00007FF6872ED726
FindClose.KERNEL32 ref: 00007FF6872ED752

Strings

C:\Users\user\Desktop\5Uvn8Uyob8.exe, xrefs: 00007FF6872ED443

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID: C:\Users\user\Desktop\5Uvn8Uyob8.exe
API String ID: 1164774033-1647006284
Opcode ID: 1fe4684158f74cda44948dfc92cb60db8ecb20c392f3c3d8fa5fc7b83eeb46f6
Instruction ID: 4ef5d73acc20033d41afe0807f7fda382036bfaec69be8ced6dd5463cc7e87fd
Opcode Fuzzy Hash: 1fe4684158f74cda44948dfc92cb60db8ecb20c392f3c3d8fa5fc7b83eeb46f6
Instruction Fuzzy Hash: 6FA1E723B4C68AC9FB209B75A6602FD6BA0BF41794F14423DDE9DA7696DE3CE441C700

Function 00007FF6872ED2BC Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6872EC4D8: RtlAllocateHeap.NTDLL(?,?,00000000,00007FF6872E9A46,?,?,?,00007FF6872EBB0D,?,?,?,?,00007FF6872E8C40), ref: 00007FF6872EC52D

Part of subcall function 00007FF6872F1800: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6872F1833

FindFirstFileExW.KERNEL32 ref: 00007FF6872ED5B0

Part of subcall function 00007FF6872EAD28: HeapFree.KERNEL32(?,?,?,00007FF6872EC4C2,?,?,?,00007FF6872EC3C3,?,?,00000000,00007FF6872ECB21,?,?,?,00007FF6872ECA2B), ref: 00007FF6872EAD3E
Part of subcall function 00007FF6872EAD28: GetLastError.KERNEL32(?,?,?,00007FF6872EC4C2,?,?,?,00007FF6872EC3C3,?,?,00000000,00007FF6872ECB21,?,?,?,00007FF6872ECA2B), ref: 00007FF6872EAD48

Strings

C:\Users\user\Desktop\5Uvn8Uyob8.exe, xrefs: 00007FF6872ED443

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID: Heap$AllocateErrorFileFindFirstFreeLast_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\5Uvn8Uyob8.exe
API String ID: 3501618255-1647006284
Opcode ID: d3f56129abb2ea3a0148b5554a5ed10f9a72e27476d555955d9271061a735555
Instruction ID: d4c3355c99c6b70f00fd0e2c4a5466b0fb47c3b091d05190c47985881f8273df
Opcode Fuzzy Hash: d3f56129abb2ea3a0148b5554a5ed10f9a72e27476d555955d9271061a735555
Instruction Fuzzy Hash: E481E523B4C689C5EA20DB72A6602FEA7A1FF45790F544239EE9D97796DE3CE041C700

Function 00007FF6872F3F98 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF6872F41E7
RaiseException.KERNEL32 ref: 00007FF6872F41F8

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 319957773a4b6c49a8854eac7231239fa5d015cde11ab57704c72a19d288f1a7
Instruction ID: 7d31262b0bd8cdaaebee1715ea6809e4f7a9bb23babd93066b430bd87165d25f
Opcode Fuzzy Hash: 319957773a4b6c49a8854eac7231239fa5d015cde11ab57704c72a19d288f1a7
Instruction Fuzzy Hash: B1B15D73604B89CBEB25CF29C9563AC7BA0FB84B48F158929DA5D837A4CFB9D451C700

Function 00007FF6872E8C8C Relevance: 1.5, APIs: 1, Instructions: 28timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6872E8CA0

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: c85922ad66918478065214e27a300c087a3c63a3148e193683f32f0588677a36
Instruction ID: ebc671e366cc8015f2034db1acef03ac2c61c57e6ad455ecc310e3d552a91924
Opcode Fuzzy Hash: c85922ad66918478065214e27a300c087a3c63a3148e193683f32f0588677a36
Instruction Fuzzy Hash: 53F0E9D2B2968C42EE24872595203A45281AF5CBE4F007335ED7D4E7CAEE1CD1508300

Function 00007FF6872E97E4 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6872E97E8

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 25117d0311a12bd40d744b9fcaf880e2cf2b231910dbf5512aa6001f24dd187c
Instruction ID: 5a18c86cb74fd4fdc3b43d2f8a17e04cb73c22eeea807f3c774efb3fe0ab656a
Opcode Fuzzy Hash: 25117d0311a12bd40d744b9fcaf880e2cf2b231910dbf5512aa6001f24dd187c
Instruction Fuzzy Hash: 62B09224E4BA02C2EB496B256C9221922A47F88700F98003CC00C91320DE2C21F5DB41

Function 00007FF6872E82B4 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 7f2571df184d58ebb62d50973f5af77e1d9e9b47f33f48f0fbac23a951d31448
Instruction ID: 3444a71279d735ad9374960a03c318bad9eb7bafc3a4ac4644a031d3ceb0528e
Opcode Fuzzy Hash: 7f2571df184d58ebb62d50973f5af77e1d9e9b47f33f48f0fbac23a951d31448
Instruction Fuzzy Hash: BD41C272714A5982EF44CF7ADA641A973A1BB48FD0B89A13ADE4DD7B54DE3CD442C300

Function 00007FF6872F3DB0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c179c1fbef7ab172046c019bade7dfacfd4c36c3269e835407e988fe18b5ddca
Instruction ID: c28b930d0e59dfa1b1f4319f1158684a32d79add54cb61ad00352d8d8317ee35
Opcode Fuzzy Hash: c179c1fbef7ab172046c019bade7dfacfd4c36c3269e835407e988fe18b5ddca
Instruction Fuzzy Hash: 36F04F71A59295CBEBAA8F28A8426297790FB083C0B90813DD68DC3A44DA3C90A1CF04

Function 00007FF6872E6594 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73d2e78e815dc5e8534a363ce4552653f9307a60e10e6ad512d1a30309413990
Instruction ID: 9bba0ac506eea115a89d3412519e2a5e75c0e29a808133b5a69956d301412e8a
Opcode Fuzzy Hash: 73d2e78e815dc5e8534a363ce4552653f9307a60e10e6ad512d1a30309413990
Instruction Fuzzy Hash: BAA0012699C906D5EA548F11AA700A06230BF51300B400239D00D820A2DE6CA840C680

Function 00007FF6872E9570 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF6872E9540,?,?,00000000,00007FF6872EBC4B,?,?,00000003,00007FF6872E7B0D), ref: 00007FF6872E96EC
GetProcAddress.KERNEL32(?,?,?,00007FF6872E9540,?,?,00000000,00007FF6872EBC4B,?,?,00000003,00007FF6872E7B0D), ref: 00007FF6872E96F8

Strings

ext-ms-, xrefs: 00007FF6872E9649
api-ms-, xrefs: 00007FF6872E9636
MZx, xrefs: 00007FF6872E958F, 00007FF6872E9675, 00007FF6872E96D5

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: MZx$api-ms-$ext-ms-
API String ID: 3013587201-2431898299
Opcode ID: 8eda1bae14f8adc22642466ad391952a1057da3069b3b83bffa599ad567745eb
Instruction ID: 43e11285da3d13b42d448c147220226a000dbcd3a727be4baae08195031b14a8
Opcode Fuzzy Hash: 8eda1bae14f8adc22642466ad391952a1057da3069b3b83bffa599ad567745eb
Instruction Fuzzy Hash: 84411122B99A06C2EA25CB669A345F92391BF55BE0F08423FDD6DC7395EE3CE445C301

Function 00007FF6872F0B74 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMONLIBRARYCODE

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF6872F0BD1

Part of subcall function 00007FF6872EFF98: __GetUnwindTryBlock.LIBCMT ref: 00007FF6872EFFDB
Part of subcall function 00007FF6872EFF98: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF6872F0000

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6872F0CA9
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF6872F0EFE
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6872F100A

Strings

csm, xrefs: 00007FF6872F0C52
csm, xrefs: 00007FF6872F0CCC
csm, xrefs: 00007FF6872F0BEB

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: c1a3aecb3b3289eb416bdbb1e26ab85292b09fd065f402c156b3009761bb52c2
Instruction ID: 3291a212662fb05272d806840cbc605f87dc7c61c61fd8f9d446e3b2b0425c70
Opcode Fuzzy Hash: c1a3aecb3b3289eb416bdbb1e26ab85292b09fd065f402c156b3009761bb52c2
Instruction Fuzzy Hash: 8BE17D72A48785CAEB309B65D6A02ED37A0FF44798F501139EE9D97B5ACF78E180C740

Function 00007FF6872EE660 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF6872EE4F5,?,?,00000000,00007FF6872E8F24), ref: 00007FF6872EE6E5
GetLastError.KERNEL32(?,?,?,00007FF6872EE4F5,?,?,00000000,00007FF6872E8F24), ref: 00007FF6872EE6F3
LoadLibraryExW.KERNEL32(?,?,?,00007FF6872EE4F5,?,?,00000000,00007FF6872E8F24), ref: 00007FF6872EE71D
FreeLibrary.KERNEL32(?,?,?,00007FF6872EE4F5,?,?,00000000,00007FF6872E8F24), ref: 00007FF6872EE763
GetProcAddress.KERNEL32(?,?,?,00007FF6872EE4F5,?,?,00000000,00007FF6872E8F24), ref: 00007FF6872EE76F

Strings

api-ms-, xrefs: 00007FF6872EE705
MZx, xrefs: 00007FF6872EE67E, 00007FF6872EE72E, 00007FF6872EE74C

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: MZx$api-ms-
API String ID: 2559590344-259127448
Opcode ID: cd5d17ca6bcb98f021bc07e73c6cc5b27bf57e70ec9fda1240f66a7719b305e7
Instruction ID: 5acbafb87021faf088f3b8d90842564b49341c8864a6e7688e510a678e67259f
Opcode Fuzzy Hash: cd5d17ca6bcb98f021bc07e73c6cc5b27bf57e70ec9fda1240f66a7719b305e7
Instruction Fuzzy Hash: A831D232E5E646C1FF219B22AA205F52394BF58BA4F5A0639DD2D86392EF7CE441C310

Function 00007FF6872E986C Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6872E987B
FlsGetValue.KERNEL32 ref: 00007FF6872E9890
FlsSetValue.KERNEL32 ref: 00007FF6872E98B1
FlsSetValue.KERNEL32 ref: 00007FF6872E98DE
FlsSetValue.KERNEL32 ref: 00007FF6872E98EF
FlsSetValue.KERNEL32 ref: 00007FF6872E9900
SetLastError.KERNEL32 ref: 00007FF6872E991B

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: c796d71ac1c9eb43b8b4e215c8a0916cd603519f55a0d776d6edca8c277946bc
Instruction ID: 20853146e91b43fcf11e2b35927f7a21ed1a7d4cd4324ae81c9fc0383b666cda
Opcode Fuzzy Hash: c796d71ac1c9eb43b8b4e215c8a0916cd603519f55a0d776d6edca8c277946bc
Instruction Fuzzy Hash: 3E21AC22E8D24AC2FB68A3B167751BD12467F547B0F04473ED8BE867E7DE2CA440C202

Function 00007FF6872F3284 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF6872F32B5
GetLastError.KERNEL32 ref: 00007FF6872F32C1
CloseHandle.KERNEL32 ref: 00007FF6872F32D9
CreateFileW.KERNEL32 ref: 00007FF6872F3304
WriteConsoleW.KERNEL32 ref: 00007FF6872F3323

Strings

CONOUT$, xrefs: 00007FF6872F32E5

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 7cf2b1ecb743e03eda428414b294aaf79c65f1c301ed6cb0cd3cda8bd998986b
Instruction ID: cb7cc2e05fa254ed28a7e212ba37a0d614a0f5bc2e27b28b4ccc6ff81fa0041f
Opcode Fuzzy Hash: 7cf2b1ecb743e03eda428414b294aaf79c65f1c301ed6cb0cd3cda8bd998986b
Instruction Fuzzy Hash: 23119031B58A81C7E7608B12E96436962A0FF88BE4F100238EA5EC7B94CFBCD954C744

Function 00007FF6872E99E4 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6872EBB0D,?,?,?,?,00007FF6872E8C40,?,?,?,?,00007FF6872E5F68), ref: 00007FF6872E99F3
FlsSetValue.KERNEL32(?,?,?,00007FF6872EBB0D,?,?,?,?,00007FF6872E8C40,?,?,?,?,00007FF6872E5F68), ref: 00007FF6872E9A29
FlsSetValue.KERNEL32(?,?,?,00007FF6872EBB0D,?,?,?,?,00007FF6872E8C40,?,?,?,?,00007FF6872E5F68), ref: 00007FF6872E9A56
FlsSetValue.KERNEL32(?,?,?,00007FF6872EBB0D,?,?,?,?,00007FF6872E8C40,?,?,?,?,00007FF6872E5F68), ref: 00007FF6872E9A67
FlsSetValue.KERNEL32(?,?,?,00007FF6872EBB0D,?,?,?,?,00007FF6872E8C40,?,?,?,?,00007FF6872E5F68), ref: 00007FF6872E9A78
SetLastError.KERNEL32(?,?,?,00007FF6872EBB0D,?,?,?,?,00007FF6872E8C40,?,?,?,?,00007FF6872E5F68), ref: 00007FF6872E9A93

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 3fa8ad1f752b43342f51d9b5bd0934216f437454695e4e022fec278f041b9d31
Instruction ID: 257b134eb10028942f50696f116defa2813247cedc1599a7b0e2d7565bcfab95
Opcode Fuzzy Hash: 3fa8ad1f752b43342f51d9b5bd0934216f437454695e4e022fec278f041b9d31
Instruction Fuzzy Hash: C2115C22A8D24AC2FB58A3B157750BD62527F587B0F44473ED8FE867D7DE2CA441C202

Function 00007FF6872EF3A0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF6872EF41F
WriteFile.KERNEL32 ref: 00007FF6872EF6E7
WriteFile.KERNEL32 ref: 00007FF6872EF72D
GetLastError.KERNEL32 ref: 00007FF6872EF7E3

Strings

MZx, xrefs: 00007FF6872EF3F6, 00007FF6872EF477, 00007FF6872EF52C

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID: MZx
API String ID: 2718003287-2575928145
Opcode ID: c502685082263bfd7f79b411efd95184d61cdd1abc277d354517d13caa344854
Instruction ID: 0af3ca68afe5e4b22ed0edef90231c0031040cf6d598a580e0024cf558227a17
Opcode Fuzzy Hash: c502685082263bfd7f79b411efd95184d61cdd1abc277d354517d13caa344854
Instruction Fuzzy Hash: 08D1CD33B18A95CAE750CF79D6502EC3BA1FB54798B10423ADE5E97B9ADE38D506C300

Function 00007FF6872E6990 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6872E69BB
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6872E6A50
RtlUnwindEx.KERNEL32 ref: 00007FF6872E6A9F

Strings

f, xrefs: 00007FF6872E69CE
csm, xrefs: 00007FF6872E6A36

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 166b3ae7a50ef0955c775bcac24f19ce5c5692b3e500cec8d74ad421588e0b25
Instruction ID: cc58e4ecbd2d6c7aefde1e3a933486b96e87e3212c7ada5966a7b5297d15643e
Opcode Fuzzy Hash: 166b3ae7a50ef0955c775bcac24f19ce5c5692b3e500cec8d74ad421588e0b25
Instruction Fuzzy Hash: 4C51DE33A49646CADB14CF25E664AA83795FF41B98F50803CEA5E9778ADF78F841C700

Function 00007FF6872E7A94 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6872E7AB9
GetProcAddress.KERNEL32 ref: 00007FF6872E7ACF
FreeLibrary.KERNEL32 ref: 00007FF6872E7AF6

Strings

mscoree.dll, xrefs: 00007FF6872E7AB0
CorExitProcess, xrefs: 00007FF6872E7AC8

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: e963c6a543e4ccfee78c2e43468ed3092b133d64ccd72fa6b4c2660d98899525
Instruction ID: 11d1b9fb64efb5bc6ca8bf9ddf8a3c9c7223cff0b025b31fa30c49b9120452f6
Opcode Fuzzy Hash: e963c6a543e4ccfee78c2e43468ed3092b133d64ccd72fa6b4c2660d98899525
Instruction Fuzzy Hash: 0DF06262A59A06C1EB248B34E9743BA6320FF85761F54033DC96E863F4CF6CD249C700

Function 00007FF6872F3BC0 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6872F3BE8
_set_statfp.LIBCMT ref: 00007FF6872F3C03
_set_statfp.LIBCMT ref: 00007FF6872F3C1F
_set_statfp.LIBCMT ref: 00007FF6872F3C5B

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 52608bc6d143c9dc7bfa0a8c4855f078bb6d55b13afd5a83babe45fd19c9ed63
Instruction ID: 6943c861a36c5a829b5f901ee0896c465be97063dcae7854fef7ae74ad3cf880
Opcode Fuzzy Hash: 52608bc6d143c9dc7bfa0a8c4855f078bb6d55b13afd5a83babe45fd19c9ed63
Instruction Fuzzy Hash: 73116062E98A13C5F6781B68E7763F910507F54770E180A3CE57ED62D7CEEDA860C200

Function 00007FF6872E9AAC Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF6872EB187,?,?,00000000,00007FF6872EB036,?,?,?,?,?,00007FF6872EB24A), ref: 00007FF6872E9ACB
FlsSetValue.KERNEL32(?,?,?,00007FF6872EB187,?,?,00000000,00007FF6872EB036,?,?,?,?,?,00007FF6872EB24A), ref: 00007FF6872E9AEA
FlsSetValue.KERNEL32(?,?,?,00007FF6872EB187,?,?,00000000,00007FF6872EB036,?,?,?,?,?,00007FF6872EB24A), ref: 00007FF6872E9B12
FlsSetValue.KERNEL32(?,?,?,00007FF6872EB187,?,?,00000000,00007FF6872EB036,?,?,?,?,?,00007FF6872EB24A), ref: 00007FF6872E9B23
FlsSetValue.KERNEL32(?,?,?,00007FF6872EB187,?,?,00000000,00007FF6872EB036,?,?,?,?,?,00007FF6872EB24A), ref: 00007FF6872E9B34

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: c43a1d17f02fd6d809238d725c752f21079af4e0e7cbf77f0b02c1cdc299ef2f
Instruction ID: 56bda70c701a20b7051c1bd2b864352b925240b7ee6f3b3a2bd13d8ea372c9ca
Opcode Fuzzy Hash: c43a1d17f02fd6d809238d725c752f21079af4e0e7cbf77f0b02c1cdc299ef2f
Instruction Fuzzy Hash: B2116D22B8D24AC2FB5893B266615BD22467F643B0F48433ED4BD867D7DE2CA441C202

Function 00007FF6872E9940 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF6872E9951
FlsSetValue.KERNEL32 ref: 00007FF6872E9970
FlsSetValue.KERNEL32 ref: 00007FF6872E9998
FlsSetValue.KERNEL32 ref: 00007FF6872E99A9
FlsSetValue.KERNEL32 ref: 00007FF6872E99BA

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 06772123256836631eac754668c55dd1f5969a784bb1f6e52a2e9bf604fecc7c
Instruction ID: d619ab8d8de7cfc8096fabb11776145dc4172f8b69c082311510b6ea10dbf4a3
Opcode Fuzzy Hash: 06772123256836631eac754668c55dd1f5969a784bb1f6e52a2e9bf604fecc7c
Instruction Fuzzy Hash: D5111822A8920EC6FA68A3B556715FD12497F65330F08573ED8BD8A2D3ED2CB541C212

Function 00007FF6872F1120 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 158COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6872F116C
_CallSETranslator.LIBVCRUNTIME ref: 00007FF6872F11BB

Strings

RCC, xrefs: 00007FF6872F1189
MOC, xrefs: 00007FF6872F1180

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: e9d8a88209c07a61c9d1dd3debb84daeffa10c840c1233951791325237c46664
Instruction ID: 0ebfc3dfac2b39c6a16ee6e3ec23acb42ac4b07d0c5fd337a35538209be007a3
Opcode Fuzzy Hash: e9d8a88209c07a61c9d1dd3debb84daeffa10c840c1233951791325237c46664
Instruction Fuzzy Hash: CB614733A08A85CAE720CFA5D5503ED77A0FB44B88F545229EE4D93B99CF78E155C700

Function 00007FF6872F0534 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6872F0964
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF6872F0A4C

Strings

csm, xrefs: 00007FF6872F0986
csm, xrefs: 00007FF6872F0A9E

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: cb704a66e7be1a5ba522131f2496a9f209fb6fefd1e7ae97345dc8007b045222
Instruction ID: c9e140aa37563da6ed434032f12222d469f24dfcccdb44f1f8445dc9782c3aa6
Opcode Fuzzy Hash: cb704a66e7be1a5ba522131f2496a9f209fb6fefd1e7ae97345dc8007b045222
Instruction Fuzzy Hash: 5F518132948286C6EB748F25D6643B87791FF54BA8F144139DAAC87B96CF7CE590CB00

Function 00007FF6872EEF78 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF6872EF38B), ref: 00007FF6872EF094
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF6872EF38B), ref: 00007FF6872EF11F

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: c00c5e49ffc8e72db89ae86e27f22d02f60acb1b3f547771fcdf52787a963b75
Instruction ID: e38609f3cada7e192b0daf50cc04bfcca49ea8e41396490ba27ed4bba74fc3c8
Opcode Fuzzy Hash: c00c5e49ffc8e72db89ae86e27f22d02f60acb1b3f547771fcdf52787a963b75
Instruction Fuzzy Hash: 4A91C323E486AAC5F7A08B75D6602FD2BA0BF45B88F54513DDE0E97A96CF38D481C710

Function 00007FF6872F067C Relevance: 6.2, APIs: 4, Instructions: 202COMMONLIBRARYCODE

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 00007FF6872F079F
__AdjustPointer.LIBCMT ref: 00007FF6872F07EA
__AdjustPointer.LIBCMT ref: 00007FF6872F08C1

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: ad951c82f903116c12849aadc4f0baf7a869fadc68eaa4632fadd1048cacca6d
Instruction ID: 963234732c30f0de20322646ec17a374b6bcd535918c73afac996c52e76f7816
Opcode Fuzzy Hash: ad951c82f903116c12849aadc4f0baf7a869fadc68eaa4632fadd1048cacca6d
Instruction Fuzzy Hash: D371D122A8A646C1FA759B11D7A06BC6390FF44FA0F09403DDE6D87B86DEBCE481C740

Function 00007FF6872E6410 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6872E643C
GetCurrentThreadId.KERNEL32 ref: 00007FF6872E644A
GetCurrentProcessId.KERNEL32 ref: 00007FF6872E6456
QueryPerformanceCounter.KERNEL32 ref: 00007FF6872E6466

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 285e00c4d3f54fedbeb5e4d165c2997d3663a2a25e7a979b1a8c52f2ff1d236e
Instruction ID: bc729191ef3ad7e4e0b69d76480abd8ceff82bab9cbb413bf76005daef0612e0
Opcode Fuzzy Hash: 285e00c4d3f54fedbeb5e4d165c2997d3663a2a25e7a979b1a8c52f2ff1d236e
Instruction Fuzzy Hash: 15117C26B58F05CAEB50CF70E8A42B933A4FB19758F441E39DA6D827A4EF78D194C340

Function 00007FF6872ECD68 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 180COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6872ECDA0

Part of subcall function 00007FF6872EAE60: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF6872EB0D7,?,?,?,?,?,00007FF6872EB24A), ref: 00007FF6872EAE69
Part of subcall function 00007FF6872EAE60: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6872EB0D7,?,?,?,?,?,00007FF6872EB24A), ref: 00007FF6872EAE8E

Strings

*?, xrefs: 00007FF6872ECDCB
C:\Users\user\Desktop\5Uvn8Uyob8.exe, xrefs: 00007FF6872ECD76

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor_invalid_parameter_noinfo
String ID: *?$C:\Users\user\Desktop\5Uvn8Uyob8.exe
API String ID: 4036615347-4131929451
Opcode ID: a633fbf2a8584894ada7dd3ce4bf7a99a6fd6fe1b81d5eafd89ec87b4ba9ec55
Instruction ID: 6e53ccaf7ab476a76cbdf91e3f3913329fd184bbe9333d008520627b433e019a
Opcode Fuzzy Hash: a633fbf2a8584894ada7dd3ce4bf7a99a6fd6fe1b81d5eafd89ec87b4ba9ec55
Instruction Fuzzy Hash: F851B763F8869AC5EB119BB596212FC26A1BF44BE4F084539DE0D87B87DE3CE481D300

Function 00007FF6872EFA38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF6872EFB4F
GetLastError.KERNEL32 ref: 00007FF6872EFB71

Strings

U, xrefs: 00007FF6872EFAFB

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: f0cfd3164ff96798f14fc08c4734987f505c93e07409a734ac5a42f3e19d2525
Instruction ID: 91b624bb746783bc7891c2fb3e207ae689f40f045a2aa862060c6896945e84ed
Opcode Fuzzy Hash: f0cfd3164ff96798f14fc08c4734987f505c93e07409a734ac5a42f3e19d2525
Instruction Fuzzy Hash: 5E41B123A18A95C6DB60CF25E9643EA67A0FB88794F844139EE8DC7799EF3CD441C740

Function 00007FF6872F2A50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF6872F2AA0
RaiseException.KERNEL32 ref: 00007FF6872F2AE1

Strings

csm, xrefs: 00007FF6872F2ACE

Memory Dump Source

Source File: 00000000.00000002.2956185592.00007FF6872E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6872E0000, based on PE: true

Associated: 00000000.00000002.2956171676.00007FF6872E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956205933.00007FF6872F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956223363.00007FF6872FF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956247695.00007FF687300000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687302000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956260227.00007FF687305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2956288285.00007FF687308000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6872e0000_5Uvn8Uyob8.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: a272fe822553b65e5748a6350f742528e835165645c66372dbd7efeddf2a5ac6
Instruction ID: 9d23c66c6f74f99ae690115732e328209a9a7c62ff028ab4afa921eb8d07ddbc
Opcode Fuzzy Hash: a272fe822553b65e5748a6350f742528e835165645c66372dbd7efeddf2a5ac6
Instruction Fuzzy Hash: B0114932619B4182EB208B15F5502A9B7E1FF88B94F184234DA8C47759DF7CC591CB40

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.629282802894755
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	5Uvn8Uyob8.exe
File size:	226'256 bytes
MD5:	db0bcc378f0895c40ad9bd5f9f7f0b11
SHA1:	70f09e0bc1ecc343ef963fc40e3371162091cee5
SHA256:	32c91c1331de77b1cf565aff5b4c758ea851eb2e0b6dcec36990b9a282147589
SHA512:	a50740204343ecab987b187621f4bc8ff700302ab7c65e882ebe413bc2557bf3682db7985061eaf49bfc116a8bafc4becaa53b739eceb6472590ecd0bb06cded
SSDEEP:	3072:LAjRP/MfsdCZyF3M0AqW8HaCbpWKWpkFMu02VFMzFj8e5BV0rUniyimyzO:OEIw43M0G/2vW76Mzie5v0rURyi
TLSH:	37249D07B6A974FCE42AD770C4648A4697B7BD7013608BDF13A4963A2F636D48D38F60
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...^F.f.........."......:...........a.........@..........................................`........................................

Entrypoint:	0x1400061ac
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66A3465E [Fri Jul 26 06:46:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2f8c554b630188631a1d0ca244d99595

Signature Valid:	false
Signature Issuer:	CN=Microsoft Code Signing PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	16/02/2023 20:10:05 31/01/2024 20:10:05
Subject Chain	CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Version:	3
Thumbprint MD5:	1501CB08D08AB9513578ECAA0534F741
Thumbprint SHA-1:	7E9572FFDB0BE9E618862EB6463B2C0782FC2DB9
Thumbprint SHA-256:	8C32CB33A6114A9BA3B33916F4146581287BD0FC647D7773636E45E8BAE07730
Serial:	330000033C2B0A49D9D2917EAC00000000033C

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1cd50	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x29000	0x11ee8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x22000	0x10e0	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x34c00	0x27d0	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3b000	0xaf0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x15500	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1d038	0x2a8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x138c6	0x13a00	60f3629cabfe0abd874ad05a40b87577	False	0.5606215167197452	data	6.584536629813981	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x15000	0x986c	0x9a00	5d333f8442902b3a8093f8ce540365a0	False	0.43458299512987014	data	4.86337784910343	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1f000	0x2f10	0x1e00	ad7e1a9305e9ddb27b8eca8606404bf3	False	0.25755208333333335	data	5.737923723877776	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x22000	0x10e0	0x1200	a447b277bf3b1d6de9fa21a32db1ab94	False	0.4583333333333333	data	4.76952083248037	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.00cfg	0x24000	0x38	0x200	e0133a52597151a998cd929afa56b858	False	0.072265625	data	0.4362466220649174	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.gxfg	0x25000	0x1130	0x1200	4cce2d84947c5dce6432b89d096694d7	False	0.4166666666666667	PGP symmetric key encrypted data - Plaintext or unencrypted data	4.916929673040231	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.retplne	0x27000	0x8c	0x200	8c950f651287cbc1296bcb4e8cd7e990	False	0.126953125	data	1.050583247971927
_RDATA	0x28000	0x15c	0x200	e1d1d4f94013776182cbf8ff6d4994db	False	0.380859375	data	2.7683496218709203	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x29000	0x11ee8	0x12000	9e753d0f5e1af5a353b1cf45f31941da	False	0.6406114366319444	data	6.746377184180407	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x3b000	0xaf0	0xc00	d243eac38353c64c2238153010a8033c	False	0.4934895833333333	data	5.283610684883323	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa	linux_amd64.elf	Get hash	malicious	Unknown	Browse	119.29.233.208
	SecuriteInfo.com.Linux.Siggen.9999.28377.24731.elf	Get hash	malicious	Mirai	Browse	152.136.47.156
	BjdhvHE9Lu.exe	Get hash	malicious	Unknown	Browse	122.51.240.117
	SecuriteInfo.com.Trojan.DownLoader46.48074.21382.27832.exe	Get hash	malicious	Unknown	Browse	106.53.77.23
	firmware.m68k.elf	Get hash	malicious	Unknown	Browse	140.143.139.193
	KKveTTgaAAsecNNaaaa.sh4.elf	Get hash	malicious	Unknown	Browse	146.56.230.81
	KKveTTgaAAsecNNaaaa.spc.elf	Get hash	malicious	Unknown	Browse	120.53.107.161
	KKveTTgaAAsecNNaaaa.mpsl.elf	Get hash	malicious	Unknown	Browse	118.28.5.155
	kovENvYM9C.elf	Get hash	malicious	Unknown	Browse	134.175.132.160
	pzGt29I16y.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	111.229.0.18

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x295c8	0x6fd1	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9973449781659388
RT_ICON	0x305a0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.36620217288615964
RT_ICON	0x347c8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.4182572614107884
RT_ICON	0x36d70	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 6720	English	United States	0.4485207100591716
RT_ICON	0x387d8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.5117260787992496
RT_ICON	0x39880	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.5745901639344262
RT_ICON	0x3a208	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.6540697674418605
RT_ICON	0x3a8c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.7145390070921985
RT_GROUP_ICON	0x3ad28	0x76	data	English	United States	0.7542372881355932
RT_VERSION	0x29290	0x334	data	English	United States	0.43414634146341463
RT_MANIFEST	0x3ada0	0x143	XML 1.0 document, ASCII text	English	United States	0.628482972136223

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5Uvn8Uyob8.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: CobaltStrike

Threatname: Metasploit

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Statistics

CPU Usage

Memory Usage

Behavior

Windows Analysis Report
5Uvn8Uyob8.exe

Function 00007FF6872E549A Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 155
nativememoryCOMMON

Function 00007FF6872E4F60 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 85
nativeCOMMON

Function 0000021DEDA7010C Relevance: 1.8, APIs: 1, Instructions: 250
networkCOMMON

Function 00007FF6872E4BF0 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Function 00007FF6872E6030 Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Function 0000021DEDA7012B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 99
networkCOMMON

Function 00007FF6872E4DA0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 59
COMMON

Function 00007FF6872EA050 Relevance: 3.1, APIs: 2, Instructions: 71
COMMON

Function 00007FF6872EE368 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 00007FF6872EC4D8 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE