Edit tour

Windows Analysis Report
7tjt3u68PZ.exe

Overview

General Information

Sample name:	7tjt3u68PZ.exe renamed because original name is a hash value
Original sample name:	02cefbda3396f784034e71616e52d67e.exe
Analysis ID:	1509097
MD5:	02cefbda3396f784034e71616e52d67e
SHA1:	b38666d28beb902565260bf87d4f367911e94eda
SHA256:	bb128ec75526887e8ebc2c1e4c0daf7b7ec1d41f039c0fb88e927b90fce6df9e
Tags:	exenjratRAT
Infos:

Detection

Njrat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Njrat

.NET source code contains potential unpacker

AI detected suspicious sample

Contains functionality to disable the Task Manager (.Net Source)

Contains functionality to spread to USB devices (.Net source)

Creates autorun.inf (USB autostart)

Disables the Windows task manager (taskmgr)

Disables zone checking for all users

Drops PE files to the document folder of the user

Drops PE files to the startup folder

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Uses netsh to modify the Windows network and firewall settings

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the program root directory (C:\Program Files)

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

7tjt3u68PZ.exe (PID: 7108 cmdline: "C:\Users\user\Desktop\7tjt3u68PZ.exe" MD5: 02CEFBDA3396F784034E71616E52D67E)

netsh.exe (PID: 6376 cmdline: netsh firewall add allowedprogram "C:\Users\user\Desktop\7tjt3u68PZ.exe" "7tjt3u68PZ.exe" ENABLE MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 6304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Explower.exe (PID: 3064 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe" MD5: 02CEFBDA3396F784034E71616E52D67E)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
NjRAT	RedPacket Security describes NJRat as "a remote access trojan (RAT) has capabilities to log keystrokes, access the victim's camera, steal credentials stored in browsers, open a reverse shell, upload/download files, view the victim's desktop, perform process, file, and registry manipulations, and capabilities to let the attacker update, uninstall, restart, close, disconnect the RAT and rename its campaign ID. Through the Command & Control (CnC) server software, the attacker has capabilities to create and configure the malware to spread through USB drives."It is supposedly popular with actors in the Middle East. Similar to other RATs, many leaked builders may be backdoored.	AQUATIC PANDA Earth Lusca Operation C-Major The Gorgon Group	http://blog.trendmicro.com/trendlabs-security-intelligence/new-rats-emerge-from-leaked-njw0rm-source-code/ http://blogs.360.cn/post/analysis-of-apt-c-37.html http://threatgeek.typepad.com/files/fta-1009---njrat-uncovered-1.pdf https://about.fb.com/news/2021/04/taking-action-against-hackers-in-palestine/ https://asec.ahnlab.com/1369	https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat

Malware Configuration

Threatname: Njrat

{"Campaign ID": "Victim", "Version": "0.7d", "Install Name": "06b22b2a8c6c511de75528741425ba83", "Install Dir": "Adobe Update", "Registry Value": "Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Network Seprator": "|'|'|"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
7tjt3u68PZ.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
7tjt3u68PZ.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a37:$a2: SEE_MASK_NOZONECHECKS 0x156d9:$a3: Download ERROR 0x15c89:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c16:$a5: netsh firewall delete allowedprogram "
7tjt3u68PZ.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15c89:$x1: cmd.exe /c ping 0 -n 2 & del " 0x137a2:$s1: winmgmts:\\.\root\SecurityCenter2 0x156f7:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156d9:$s6: Download ERROR 0x13764:$s8: Select * From AntiVirusProduct
7tjt3u68PZ.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a37:$reg: SEE_MASK_NOZONECHECKS 0x156bd:$msg: Execute ERROR 0x15711:$msg: Execute ERROR 0x15c89:$ping: cmd.exe /c ping 0 -n 2 & del
7tjt3u68PZ.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR

Dropped Files

Source	Rule	Description	Author	Strings
C:\Program Files (x86)\Explower.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Program Files (x86)\Explower.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a37:$a2: SEE_MASK_NOZONECHECKS 0x156d9:$a3: Download ERROR 0x15c89:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c16:$a5: netsh firewall delete allowedprogram "
C:\Program Files (x86)\Explower.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15c89:$x1: cmd.exe /c ping 0 -n 2 & del " 0x137a2:$s1: winmgmts:\\.\root\SecurityCenter2 0x156f7:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156d9:$s6: Download ERROR 0x13764:$s8: Select * From AntiVirusProduct
C:\Program Files (x86)\Explower.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a37:$reg: SEE_MASK_NOZONECHECKS 0x156bd:$msg: Execute ERROR 0x15711:$msg: Execute ERROR 0x15c89:$ping: cmd.exe /c ping 0 -n 2 & del
C:\Program Files (x86)\Explower.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Program Files (x86)\Explower.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Program Files (x86)\Explower.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Program Files (x86)\Explower.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Program Files (x86)\Explower.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Program Files (x86)\Explower.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Program Files (x86)\Explower.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Program Files (x86)\Explower.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Program Files (x86)\Explower.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Program Files (x86)\Explower.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Program Files (x86)\Explower.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Notepad.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Notepad.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a37:$a2: SEE_MASK_NOZONECHECKS 0x156d9:$a3: Download ERROR 0x15c89:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c16:$a5: netsh firewall delete allowedprogram "
C:\Notepad.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15c89:$x1: cmd.exe /c ping 0 -n 2 & del " 0x137a2:$s1: winmgmts:\\.\root\SecurityCenter2 0x156f7:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156d9:$s6: Download ERROR 0x13764:$s8: Select * From AntiVirusProduct
C:\Notepad.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a37:$reg: SEE_MASK_NOZONECHECKS 0x156bd:$msg: Execute ERROR 0x15711:$msg: Execute ERROR 0x15c89:$ping: cmd.exe /c ping 0 -n 2 & del
C:\Notepad.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Notepad.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Notepad.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Notepad.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Notepad.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Notepad.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\system.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\system.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a37:$a2: SEE_MASK_NOZONECHECKS 0x156d9:$a3: Download ERROR 0x15c89:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c16:$a5: netsh firewall delete allowedprogram "
C:\system.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x13c68:$marker4: netsh firewall add allowedprogram 0x13c16:$marker25: netsh firewall delete allowedprogram " 0x15f4d:$key5: [PrintScreen] 0x15c99:$del3: /c ping 0 -n 2 & del 0x13764:$sup2: Select * From AntiVirusProduct 0x135f8:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x136aa:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x142c2:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x14346:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x14e86:$sup5: SOFTWARE\Microsoft\Windows NT\CurrentVersion 0x150d8:$sup5: SOFTWARE\Microsoft\Windows NT\CurrentVersion 0x156bd:$msg5: Execute ERROR 0x15711:$msg5: Execute ERROR 0x156d9:$msg6: Download ERROR 0x1578f:$msg7: Update ERROR 0x157c9:$msg7: Update ERROR 0x157a9:$msg8: Updating To 0x15a37:$reg1: SEE_MASK_NOZONECHECKS
C:\system.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x13c68:$marker4: netsh firewall add allowedprogram 0x13c16:$marker25: netsh firewall delete allowedprogram " 0x15f4d:$key5: [PrintScreen] 0x15c99:$del3: /c ping 0 -n 2 & del 0x13764:$sup2: Select * From AntiVirusProduct 0x135f8:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x136aa:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x142c2:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x14346:$sup3: Software\Microsoft\Windows\CurrentVersion\Run 0x14e86:$sup5: SOFTWARE\Microsoft\Windows NT\CurrentVersion 0x150d8:$sup5: SOFTWARE\Microsoft\Windows NT\CurrentVersion 0x156bd:$msg5: Execute ERROR 0x15711:$msg5: Execute ERROR 0x156d9:$msg6: Download ERROR 0x1578f:$msg7: Update ERROR 0x157c9:$msg7: Update ERROR 0x157a9:$msg8: Updating To 0x15a37:$reg1: SEE_MASK_NOZONECHECKS
C:\system.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x115d2:$a1: get_Registry 0x15a37:$a2: SEE_MASK_NOZONECHECKS 0x156d9:$a3: Download ERROR 0x15c89:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c16:$a5: netsh firewall delete allowedprogram "
C:\system.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x115d2:$a1: get_Registry 0x15a37:$a2: SEE_MASK_NOZONECHECKS 0x156d9:$a3: Download ERROR 0x15c89:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c16:$a5: netsh firewall delete allowedprogram "
C:\system.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x15c89:$x1: cmd.exe /c ping 0 -n 2 & del " 0x137a2:$s1: winmgmts:\\.\root\SecurityCenter2 0x156f7:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156d9:$s6: Download ERROR 0x13764:$s8: Select * From AntiVirusProduct
C:\system.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x15c89:$x1: cmd.exe /c ping 0 -n 2 & del " 0x137a2:$s1: winmgmts:\\.\root\SecurityCenter2 0x156f7:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156d9:$s6: Download ERROR 0x13764:$s8: Select * From AntiVirusProduct
C:\Umbrella.flv.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Umbrella.flv.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Umbrella.flv.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Umbrella.flv.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a37:$a2: SEE_MASK_NOZONECHECKS 0x156d9:$a3: Download ERROR 0x15c89:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c16:$a5: netsh firewall delete allowedprogram "
C:\Umbrella.flv.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15c89:$x1: cmd.exe /c ping 0 -n 2 & del " 0x137a2:$s1: winmgmts:\\.\root\SecurityCenter2 0x156f7:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156d9:$s6: Download ERROR 0x13764:$s8: Select * From AntiVirusProduct
C:\Umbrella.flv.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a37:$reg: SEE_MASK_NOZONECHECKS 0x156bd:$msg: Execute ERROR 0x15711:$msg: Execute ERROR 0x15c89:$ping: cmd.exe /c ping 0 -n 2 & del
C:\Umbrella.flv.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Umbrella.flv.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Umbrella.flv.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Umbrella.flv.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Umbrella.flv.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Umbrella.flv.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Umbrella.flv.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Umbrella.flv.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Umbrella.flv.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Umbrella.flv.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Umbrella.flv.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Umbrella.flv.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Umbrella.flv.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Umbrella.flv.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Umbrella.flv.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Umbrella.flv.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Umbrella.flv.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Umbrella.flv.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Umbrella.flv.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Umbrella.flv.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Umbrella.flv.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Umbrella.flv.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Umbrella.flv.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Umbrella.flv.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Umbrella.flv.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
C:\Umbrella.flv.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR
Click to see the 60 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1664656287.00000000008B2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000000.00000000.1664656287.00000000008B2000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x113d2:$a1: get_Registry 0x15837:$a2: SEE_MASK_NOZONECHECKS 0x154d9:$a3: Download ERROR 0x15a89:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13a16:$a5: netsh firewall delete allowedprogram "
00000000.00000000.1664656287.00000000008B2000.00000002.00000001.01000000.00000003.sdmp	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15837:$reg: SEE_MASK_NOZONECHECKS 0x154bd:$msg: Execute ERROR 0x15511:$msg: Execute ERROR 0x15a89:$ping: cmd.exe /c ping 0 -n 2 & del
00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: 7tjt3u68PZ.exe PID: 7108	JoeSecurity_Njrat	Yara detected Njrat	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.7tjt3u68PZ.exe.8b0000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.0.7tjt3u68PZ.exe.8b0000.0.unpack	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a37:$a2: SEE_MASK_NOZONECHECKS 0x156d9:$a3: Download ERROR 0x15c89:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c16:$a5: netsh firewall delete allowedprogram "
0.0.7tjt3u68PZ.exe.8b0000.0.unpack	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15c89:$x1: cmd.exe /c ping 0 -n 2 & del " 0x137a2:$s1: winmgmts:\\.\root\SecurityCenter2 0x156f7:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156d9:$s6: Download ERROR 0x13764:$s8: Select * From AntiVirusProduct
0.0.7tjt3u68PZ.exe.8b0000.0.unpack	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a37:$reg: SEE_MASK_NOZONECHECKS 0x156bd:$msg: Execute ERROR 0x15711:$msg: Execute ERROR 0x15c89:$ping: cmd.exe /c ping 0 -n 2 & del
0.0.7tjt3u68PZ.exe.8b0000.0.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c16:$s1: netsh firewall delete allowedprogram 0x13c68:$s2: netsh firewall add allowedprogram 0x15c89:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156bd:$s4: Execute ERROR 0x15711:$s4: Execute ERROR 0x156d9:$s5: Download ERROR

Sigma Signatures

System Summary

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\7tjt3u68PZ.exe, ProcessId: 7108, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe

Suricata Signatures

ET MALWARE Bladabindi/njRAT CnC Command (ll)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T02:02:02.603963+0200	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49730	3.125.209.94	11348	TCP
2024-09-11T02:03:06.370956+0200	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50776	3.125.209.94	11348	TCP
2024-09-11T02:04:18.274738+0200	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50777	18.192.31.165	11348	TCP
2024-09-11T02:05:23.300184+0200	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	50778	18.158.249.75	11348	TCP

ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T02:02:02.603963+0200	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49730	3.125.209.94	11348	TCP
2024-09-11T02:03:06.370956+0200	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50776	3.125.209.94	11348	TCP
2024-09-11T02:04:18.274738+0200	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50777	18.192.31.165	11348	TCP
2024-09-11T02:05:23.300184+0200	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	50778	18.158.249.75	11348	TCP

ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-11T02:02:08.278941+0200	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49730	3.125.209.94	11348	TCP
2024-09-11T02:03:11.011982+0200	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50776	3.125.209.94	11348	TCP
2024-09-11T02:04:25.276660+0200	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50777	18.192.31.165	11348	TCP
2024-09-11T02:05:26.867195+0200	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	50778	18.158.249.75	11348	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 7tjt3u68PZ.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\system.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Program Files (x86)\Explower.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Umbrella.flv.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Notepad.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Program Files (x86)\Explower.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Program Files (x86)\Explower.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Program Files (x86)\Explower.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Program Files (x86)\Explower.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Program Files (x86)\Explower.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Program Files (x86)\Explower.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Program Files (x86)\Explower.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Program Files (x86)\Explower.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Program Files (x86)\Explower.exe	Avira: detection malicious, Label: TR/Dropper.Gen

Found malware configuration

Source: 0.0.7tjt3u68PZ.exe.8b0000.0.unpack

Malware Configuration Extractor: Njrat {"Campaign ID": "Victim", "Version": "0.7d", "Install Name": "06b22b2a8c6c511de75528741425ba83", "Install Dir": "Adobe Update", "Registry Value": "Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Network Seprator": "|'|'|"}

Multi AV Scanner detection for domain / URL

Source: 0.tcp.eu.ngrok.io

Virustotal: Detection: 12%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Notepad.exe	ReversingLabs: Detection: 84%
Source: C:\Notepad.exe	Virustotal: Detection: 71%	Perma Link
Source: C:\Program Files (x86)\Explower.exe	ReversingLabs: Detection: 84%
Source: C:\Program Files (x86)\Explower.exe	Virustotal: Detection: 71%	Perma Link
Source: C:\Umbrella.flv.exe	ReversingLabs: Detection: 84%
Source: C:\Umbrella.flv.exe	Virustotal: Detection: 71%	Perma Link
Source: C:\Users\user\AppData\Local\Explower.exe	ReversingLabs: Detection: 84%
Source: C:\Users\user\AppData\Local\Explower.exe	Virustotal: Detection: 71%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\History\Explower.exe	ReversingLabs: Detection: 84%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\History\Explower.exe	Virustotal: Detection: 71%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Explower.exe	ReversingLabs: Detection: 84%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Explower.exe	Virustotal: Detection: 71%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Explower.exe	ReversingLabs: Detection: 84%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Explower.exe	Virustotal: Detection: 71%	Perma Link
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	ReversingLabs: Detection: 84%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Virustotal: Detection: 71%	Perma Link
Source: C:\Users\user\Desktop\Explower.exe	ReversingLabs: Detection: 84%
Source: C:\Users\user\Desktop\Explower.exe	Virustotal: Detection: 71%	Perma Link
Source: C:\Users\user\Documents\Explower.exe	ReversingLabs: Detection: 84%
Source: C:\Users\user\Documents\Explower.exe	Virustotal: Detection: 71%	Perma Link
Source: C:\Users\user\Favorites\Explower.exe	ReversingLabs: Detection: 84%
Source: C:\Users\user\Favorites\Explower.exe	Virustotal: Detection: 71%	Perma Link
Source: C:\Windows\SysWOW64\Explower.exe	ReversingLabs: Detection: 84%
Source: C:\Windows\SysWOW64\Explower.exe	Virustotal: Detection: 71%	Perma Link
Source: C:\system.exe	ReversingLabs: Detection: 84%
Source: C:\system.exe	Virustotal: Detection: 71%	Perma Link

Multi AV Scanner detection for submitted file

Source: 7tjt3u68PZ.exe	ReversingLabs: Detection: 84%
Source: 7tjt3u68PZ.exe	Virustotal: Detection: 71%			Perma Link

Yara detected Njrat

Source: Yara match	File source: 7tjt3u68PZ.exe, type: SAMPLE
Source: Yara match	File source: 0.0.7tjt3u68PZ.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1664656287.00000000008B2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7tjt3u68PZ.exe PID: 7108, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Notepad.exe, type: DROPPED
Source: Yara match	File source: C:\system.exe, type: DROPPED
Source: Yara match	File source: C:\Umbrella.flv.exe, type: DROPPED

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\system.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Umbrella.flv.exe	Joe Sandbox ML: detected
Source: C:\Notepad.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 7tjt3u68PZ.exe

Joe Sandbox ML: detected

Source: 7tjt3u68PZ.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: 7tjt3u68PZ.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Spreading

Contains functionality to spread to USB devices (.Net source)

Source: 7tjt3u68PZ.exe, Usb1.cs	.Net Code: infect
Source: Explower.exe.0.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe0.0.dr, Usb1.cs	.Net Code: infect
Source: system.exe.0.dr, Usb1.cs	.Net Code: infect
Source: Notepad.exe.0.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe1.0.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe2.0.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe3.0.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe4.0.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe5.0.dr, Usb1.cs	.Net Code: infect

Creates autorun.inf (USB autostart)

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe

File created: C:\autorun.inf

Jump to behavior

Source: 7tjt3u68PZ.exe, 00000000.00000000.1664656287.00000000008B2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: \autorun.inf
Source: 7tjt3u68PZ.exe, 00000000.00000000.1664656287.00000000008B2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: 7tjt3u68PZ.exe, 00000000.00000000.1664656287.00000000008B2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: autorun.inf
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \autorun.inf
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: autorun.inf$O]k
Source: 7tjt3u68PZ.exe	Binary or memory string: \autorun.inf
Source: 7tjt3u68PZ.exe	Binary or memory string: [autorun]
Source: 7tjt3u68PZ.exe	Binary or memory string: autorun.inf
Source: system.exe.0.dr	Binary or memory string: \autorun.inf
Source: system.exe.0.dr	Binary or memory string: [autorun]
Source: system.exe.0.dr	Binary or memory string: autorun.inf
Source: Explower.exe2.0.dr	Binary or memory string: \autorun.inf
Source: Explower.exe2.0.dr	Binary or memory string: [autorun]
Source: Explower.exe2.0.dr	Binary or memory string: autorun.inf
Source: Umbrella.flv.exe.0.dr	Binary or memory string: \autorun.inf
Source: Umbrella.flv.exe.0.dr	Binary or memory string: [autorun]
Source: Umbrella.flv.exe.0.dr	Binary or memory string: autorun.inf
Source: Notepad.exe.0.dr	Binary or memory string: \autorun.inf
Source: Notepad.exe.0.dr	Binary or memory string: [autorun]
Source: Notepad.exe.0.dr	Binary or memory string: autorun.inf
Source: Explower.exe8.0.dr	Binary or memory string: \autorun.inf
Source: Explower.exe8.0.dr	Binary or memory string: [autorun]
Source: Explower.exe8.0.dr	Binary or memory string: autorun.inf
Source: Explower.exe.0.dr	Binary or memory string: \autorun.inf
Source: Explower.exe.0.dr	Binary or memory string: [autorun]
Source: Explower.exe.0.dr	Binary or memory string: autorun.inf
Source: Explower.exe1.0.dr	Binary or memory string: \autorun.inf
Source: Explower.exe1.0.dr	Binary or memory string: [autorun]
Source: Explower.exe1.0.dr	Binary or memory string: autorun.inf
Source: Explower.exe4.0.dr	Binary or memory string: \autorun.inf
Source: Explower.exe4.0.dr	Binary or memory string: [autorun]
Source: Explower.exe4.0.dr	Binary or memory string: autorun.inf
Source: Explower.exe3.0.dr	Binary or memory string: \autorun.inf
Source: Explower.exe3.0.dr	Binary or memory string: [autorun]
Source: Explower.exe3.0.dr	Binary or memory string: autorun.inf
Source: Explower.exe7.0.dr	Binary or memory string: \autorun.inf
Source: Explower.exe7.0.dr	Binary or memory string: [autorun]
Source: Explower.exe7.0.dr	Binary or memory string: autorun.inf
Source: Explower.exe6.0.dr	Binary or memory string: \autorun.inf
Source: Explower.exe6.0.dr	Binary or memory string: [autorun]
Source: Explower.exe6.0.dr	Binary or memory string: autorun.inf
Source: Explower.exe0.0.dr	Binary or memory string: \autorun.inf
Source: Explower.exe0.0.dr	Binary or memory string: [autorun]
Source: Explower.exe0.0.dr	Binary or memory string: autorun.inf
Source: Explower.exe5.0.dr	Binary or memory string: \autorun.inf
Source: Explower.exe5.0.dr	Binary or memory string: [autorun]
Source: Explower.exe5.0.dr	Binary or memory string: autorun.inf
Source: autorun.inf.0.dr	Binary or memory string: [autorun]

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49730 -> 3.125.209.94:11348
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50776 -> 3.125.209.94:11348
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49730 -> 3.125.209.94:11348
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50777 -> 18.192.31.165:11348
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50776 -> 3.125.209.94:11348
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50777 -> 18.192.31.165:11348
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50776 -> 3.125.209.94:11348
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50777 -> 18.192.31.165:11348
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49730 -> 3.125.209.94:11348
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50778 -> 18.158.249.75:11348
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50778 -> 18.158.249.75:11348
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50778 -> 18.158.249.75:11348

Source: global traffic	TCP traffic: 192.168.2.4:49730 -> 3.125.209.94:11348
Source: global traffic	TCP traffic: 192.168.2.4:50777 -> 18.192.31.165:11348
Source: global traffic	TCP traffic: 192.168.2.4:50778 -> 18.158.249.75:11348

Source: Joe Sandbox View	IP Address: 3.125.209.94 3.125.209.94
Source: Joe Sandbox View	IP Address: 18.192.31.165 18.192.31.165
Source: Joe Sandbox View	IP Address: 18.158.249.75 18.158.249.75

Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: 0.tcp.eu.ngrok.io

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior

E-Banking Fraud

Yara detected Njrat

Source: Yara match	File source: 7tjt3u68PZ.exe, type: SAMPLE
Source: Yara match	File source: 0.0.7tjt3u68PZ.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1664656287.00000000008B2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7tjt3u68PZ.exe PID: 7108, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Notepad.exe, type: DROPPED
Source: Yara match	File source: C:\system.exe, type: DROPPED
Source: Yara match	File source: C:\Umbrella.flv.exe, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: 7tjt3u68PZ.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 7tjt3u68PZ.exe, type: SAMPLE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 7tjt3u68PZ.exe, type: SAMPLE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 7tjt3u68PZ.exe, type: SAMPLE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.0.7tjt3u68PZ.exe.8b0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.0.7tjt3u68PZ.exe.8b0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.0.7tjt3u68PZ.exe.8b0000.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0.0.7tjt3u68PZ.exe.8b0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 00000000.00000000.1664656287.00000000008B2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000000.1664656287.00000000008B2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Notepad.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Notepad.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Notepad.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Notepad.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Notepad.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Notepad.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Notepad.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Notepad.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Notepad.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\system.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\system.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\system.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\system.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\system.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\system.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\system.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Code function: 0_2_011CBEFE NtQuerySystemInformation,		0_2_011CBEFE
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Code function: 0_2_011CBECD NtQuerySystemInformation,		0_2_011CBECD

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	File created: C:\Windows\SysWOW64\Explower.exe			Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	File created: C:\Windows\SysWOW64\Explower.exe:Zone.Identifier:$DATA			Jump to behavior

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Code function: 0_2_05087418	0_2_05087418
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Code function: 0_2_05084290	0_2_05084290
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Code function: 0_2_05084707	0_2_05084707
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Code function: 0_2_05084628	0_2_05084628
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Code function: 0_2_0508492E	0_2_0508492E
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Code function: 0_2_05084F27	0_2_05084F27
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Code function: 0_2_0508453C	0_2_0508453C
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Code function: 0_2_05085451	0_2_05085451
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Code function: 0_2_05084B53	0_2_05084B53
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Code function: 0_2_05085055	0_2_05085055
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Code function: 0_2_05085367	0_2_05085367
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Code function: 0_2_0508427F	0_2_0508427F
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Code function: 0_2_05084C87	0_2_05084C87
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Code function: 0_2_05084995	0_2_05084995
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Code function: 0_2_05084F95	0_2_05084F95
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Code function: 0_2_050847CC	0_2_050847CC
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Code function: 0_2_050850DB	0_2_050850DB
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Code function: 0_2_050844E9	0_2_050844E9
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Code function: 0_2_05084FF8	0_2_05084FF8
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Code function: 0_2_050873FE	0_2_050873FE
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Code function: 0_2_050849F1	0_2_050849F1

Source: 7tjt3u68PZ.exe, 00000000.00000002.4122220390.0000000000EBE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenamemscorwks.dllT vs 7tjt3u68PZ.exe

Source: 7tjt3u68PZ.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 7tjt3u68PZ.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 7tjt3u68PZ.exe, type: SAMPLE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 7tjt3u68PZ.exe, type: SAMPLE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 7tjt3u68PZ.exe, type: SAMPLE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.0.7tjt3u68PZ.exe.8b0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.0.7tjt3u68PZ.exe.8b0000.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.7tjt3u68PZ.exe.8b0000.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0.0.7tjt3u68PZ.exe.8b0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 00000000.00000000.1664656287.00000000008B2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000000.00000000.1664656287.00000000008B2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Notepad.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Notepad.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Notepad.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Notepad.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Notepad.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Notepad.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Notepad.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Notepad.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Notepad.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\system.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\system.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\system.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\system.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\system.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\system.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\system.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi

Source: classification engine

Classification label: mal100.spre.phis.troj.adwa.evad.winEXE@5/30@4/3

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Code function: 0_2_011CBD82 AdjustTokenPrivileges,		0_2_011CBD82
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Code function: 0_2_011CBD4B AdjustTokenPrivileges,		0_2_011CBD4B

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe

File created: C:\Program Files (x86)\Explower.exe

Jump to behavior

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe

File created: C:\Users\user\AppData\Roaming\app

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6304:120:WilError_03
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Mutant created: \Sessions\1\BaseNamedObjects\06b22b2a8c6c511de75528741425ba83

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe

File created: C:\Users\user\AppData\Local\Temp\FransescoPast.txt

Jump to behavior

Source: 7tjt3u68PZ.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 7tjt3u68PZ.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 7tjt3u68PZ.exe	ReversingLabs: Detection: 84%
Source: 7tjt3u68PZ.exe	Virustotal: Detection: 71%

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe

File read: C:\Users\user\Desktop\7tjt3u68PZ.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\7tjt3u68PZ.exe "C:\Users\user\Desktop\7tjt3u68PZ.exe"
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\7tjt3u68PZ.exe" "7tjt3u68PZ.exe" ENABLE
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe"
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\7tjt3u68PZ.exe" "7tjt3u68PZ.exe" ENABLE	Jump to behavior

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: shfolder.dll	Jump to behavior

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: 7tjt3u68PZ.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: 7tjt3u68PZ.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: 7tjt3u68PZ.exe, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe.0.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe0.0.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: system.exe.0.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Notepad.exe.0.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe1.0.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe2.0.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe3.0.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe4.0.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe5.0.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe

Code function: 0_2_05083141 push ebx; ret

0_2_05083154

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe

File created: C:\Users\user\Documents\Explower.exe

Jump to dropped file

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	File created: C:\system.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Explower.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	File created: C:\Notepad.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	File created: C:\Windows\SysWOW64\Explower.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	File created: C:\Users\user\Desktop\Explower.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	File created: C:\Users\user\AppData\Local\Explower.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	File created: C:\Program Files (x86)\Explower.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	File created: C:\Umbrella.flv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\History\Explower.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Explower.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	File created: C:\Users\user\Documents\Explower.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	File created: C:\Users\user\Favorites\Explower.exe	Jump to dropped file

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe

File created: C:\Program Files (x86)\Explower.exe

Jump to dropped file

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe

File created: C:\Windows\SysWOW64\Explower.exe

Jump to dropped file

Boot Survival

Drops PE files to the startup folder

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe

Jump to dropped file

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe

Jump to behavior

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe			Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe\:Zone.Identifier:$DATA			Jump to behavior

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 1270000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 2F10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 1270000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 5F10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 6F10000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 7140000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 8140000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 8490000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: AD50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: BD50000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: C1E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: D1E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: E1E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: F1E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 101E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 111E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: F2E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 121E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 102E0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 131E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 141E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 151E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 161E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 171E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 181E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 191E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 1A1E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 1B1E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 1C1E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 1D1E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 1E1E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 1F1E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 201E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: C350000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 10BF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 11BF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 12BF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 13BF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 14BF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 15BF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 16BF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 211E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 221E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 231E0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 243F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 253F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 263F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 273F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 283F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 293F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 2A3F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 2B3F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 2C3F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 2D3F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 2E3F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 2F3F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 303F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 313F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 323F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 333F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: D350000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: D450000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 102E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 112E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 122E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 132E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 142E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 152E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 162E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 172E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 182E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 192E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 1A2E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 1B2E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 1C2E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 1D2E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 1E2E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 1F2E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 202E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 212E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: FA60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 10A60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 11A60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 12A60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 13A60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 14A60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 15A60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 16A60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 17A60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 18A60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 19A60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 10AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 11AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 12AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 13AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 14AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 18AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 19AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 17AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 12BE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 15AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 16AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Memory allocated: 13BE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Memory allocated: 9B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Memory allocated: 26D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Memory allocated: 9B0000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Window / User API: threadDelayed 1761	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Window / User API: threadDelayed 2863	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Window / User API: foregroundWindowGot 431	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Window / User API: foregroundWindowGot 416	Jump to behavior

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe TID: 796	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe TID: 796	Thread sleep count: 227 > 30	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe TID: 2992	Thread sleep count: 1761 > 30	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe TID: 2992	Thread sleep time: -880500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe TID: 6096	Thread sleep count: 173 > 30	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe TID: 2992	Thread sleep count: 2863 > 30	Jump to behavior
Source: C:\Users\user\Desktop\7tjt3u68PZ.exe TID: 2992	Thread sleep time: -1431500s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe TID: 5796	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior

Source: netsh.exe, 00000001.00000002.1688238328.000000000113A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll[
Source: 7tjt3u68PZ.exe, 00000000.00000002.4122220390.0000000000EBE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWngElementExten4
Source: 7tjt3u68PZ.exe, 00000000.00000002.4122220390.0000000000EBE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:02:31 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 21:59:13 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:02:44 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/11 \| 03:22:09 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:02:43 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:02:23 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:14:40 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:01:57 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/11 \| 06:06:21 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/11 \| 00:52:47 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:02:25 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:02:35 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/11 \| 04:59:23 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:37:10 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:03:41 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:03:47 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/11 \| 01:16:46 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:02:05 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:03:36 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:03:00 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 23:36:34 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:02:34 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:01:59 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:04:18 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:03:10 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:03:16 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:07:07 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:02:41 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp, Explower.exe, 00000003.00000002.1820164575.00000000026D1000.00000004.00000800.00020000.00000000.sdmp, Explower.exe, 00000003.00000002.1823617634.0000000004ACB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: 7tjt3u68PZ.exe, system.exe.0.dr, Explower.exe2.0.dr, Umbrella.flv.exe.0.dr, Notepad.exe.0.dr, Explower.exe8.0.dr, Explower.exe.0.dr, Explower.exe1.0.dr, Explower.exe4.0.dr, Explower.exe3.0.dr, Explower.exe7.0.dr, Explower.exe6.0.dr, Explower.exe0.0.dr	Binary or memory string: ProgMan
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:03:32 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/11 \| 03:49:43 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/11 \| 05:05:09 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:02:40 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 21:53:57 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:05:08 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:32:37 - Program Manager
Source: 7tjt3u68PZ.exe, system.exe.0.dr, Explower.exe2.0.dr, Umbrella.flv.exe.0.dr, Notepad.exe.0.dr, Explower.exe8.0.dr, Explower.exe.0.dr, Explower.exe1.0.dr, Explower.exe4.0.dr, Explower.exe3.0.dr, Explower.exe7.0.dr, Explower.exe6.0.dr, Explower.exe0.0.dr	Binary or memory string: Shell_traywnd+MostrarBarraDeTarefas
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:02:48 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/11 \| 09:09:59 - Program Manager
Source: Explower.exe, 00000003.00000002.1823617634.0000000004ACB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: dProgram Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:03:24 - Program Manager
Source: 7tjt3u68PZ.exe, system.exe.0.dr, Explower.exe2.0.dr, Umbrella.flv.exe.0.dr, Notepad.exe.0.dr, Explower.exe8.0.dr, Explower.exe.0.dr, Explower.exe1.0.dr, Explower.exe4.0.dr, Explower.exe3.0.dr, Explower.exe7.0.dr, Explower.exe6.0.dr, Explower.exe0.0.dr	Binary or memory string: Shell_TrayWnd
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:04:56 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:02:42 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:02:08 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:03:13 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:02:07 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:02:37 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:02:17 - Program Manager
Source: Explower.exe, 00000003.00000002.1820164575.00000000026D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ledProgram Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:02:11 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:02:21 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:03:29 - Program Manager
Source: 7tjt3u68PZ.exe, 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/10 \| 20:03:09 - Program Manager

Source: C:\Windows\SysWOW64\netsh.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Contains functionality to disable the Task Manager (.Net Source)

Source: 7tjt3u68PZ.exe, Fransesco.cs	.Net Code: INS
Source: Explower.exe.0.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe0.0.dr, Fransesco.cs	.Net Code: INS
Source: system.exe.0.dr, Fransesco.cs	.Net Code: INS
Source: Notepad.exe.0.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe1.0.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe2.0.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe3.0.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe4.0.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe5.0.dr, Fransesco.cs	.Net Code: INS

Disables the Windows task manager (taskmgr)

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr

Jump to behavior

Disables zone checking for all users

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe

Registry value created: HKEY_CURRENT_USER\Environment SEE_MASK_NOZONECHECKS

Jump to behavior

Modifies the windows firewall

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\7tjt3u68PZ.exe" "7tjt3u68PZ.exe" ENABLE

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\Desktop\7tjt3u68PZ.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\7tjt3u68PZ.exe" "7tjt3u68PZ.exe" ENABLE

Stealing of Sensitive Information

Yara detected Njrat

Source: Yara match	File source: 7tjt3u68PZ.exe, type: SAMPLE
Source: Yara match	File source: 0.0.7tjt3u68PZ.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1664656287.00000000008B2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7tjt3u68PZ.exe PID: 7108, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Notepad.exe, type: DROPPED
Source: Yara match	File source: C:\system.exe, type: DROPPED
Source: Yara match	File source: C:\Umbrella.flv.exe, type: DROPPED

Remote Access Functionality

Yara detected Njrat

Source: Yara match	File source: 7tjt3u68PZ.exe, type: SAMPLE
Source: Yara match	File source: 0.0.7tjt3u68PZ.exe.8b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1664656287.00000000008B2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7tjt3u68PZ.exe PID: 7108, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Notepad.exe, type: DROPPED
Source: Yara match	File source: C:\system.exe, type: DROPPED
Source: Yara match	File source: C:\Umbrella.flv.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	21 Replication Through Removable Media	Windows Management Instrumentation	12 Registry Run Keys / Startup Folder	1 Access Token Manipulation	32 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	2 Process Injection	51 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Clipboard Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	12 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Access Token Manipulation	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Process Injection	LSA Secrets	1 Peripheral Device Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	12 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
7tjt3u68PZ.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
7tjt3u68PZ.exe	71%	Virustotal		Browse
7tjt3u68PZ.exe	100%	Avira	TR/Dropper.Gen
7tjt3u68PZ.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\system.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Umbrella.flv.exe	100%	Avira	TR/Dropper.Gen
C:\Notepad.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\system.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Umbrella.flv.exe	100%	Joe Sandbox ML
C:\Notepad.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Notepad.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Notepad.exe	71%	Virustotal		Browse
C:\Program Files (x86)\Explower.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Program Files (x86)\Explower.exe	71%	Virustotal		Browse
C:\Umbrella.flv.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Umbrella.flv.exe	71%	Virustotal		Browse
C:\Users\user\AppData\Local\Explower.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\AppData\Local\Explower.exe	71%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\History\Explower.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\AppData\Local\Microsoft\Windows\History\Explower.exe	71%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Explower.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Explower.exe	71%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Explower.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Explower.exe	71%	Virustotal		Browse
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	71%	Virustotal		Browse
C:\Users\user\Desktop\Explower.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\Desktop\Explower.exe	71%	Virustotal		Browse
C:\Users\user\Documents\Explower.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\Documents\Explower.exe	71%	Virustotal		Browse
C:\Users\user\Favorites\Explower.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Users\user\Favorites\Explower.exe	71%	Virustotal		Browse
C:\Windows\SysWOW64\Explower.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Windows\SysWOW64\Explower.exe	71%	Virustotal		Browse
C:\system.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\system.exe	71%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
0.tcp.eu.ngrok.io	12%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
0.tcp.eu.ngrok.io	3.125.209.94	true	true	12%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
3.125.209.94	0.tcp.eu.ngrok.io	United States	16509	AMAZON-02US	true
18.192.31.165	unknown	United States	16509	AMAZON-02US	true
18.158.249.75	unknown	United States	16509	AMAZON-02US	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1509097
Start date and time:	2024-09-11 02:01:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	7tjt3u68PZ.exe renamed because original name is a hash value
Original Sample Name:	02cefbda3396f784034e71616e52d67e.exe
Detection:	MAL
Classification:	mal100.spre.phis.troj.adwa.evad.winEXE@5/30@4/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 194 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:02:01	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe
20:02:32	API Interceptor	158177x Sleep call for process: 7tjt3u68PZ.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3.125.209.94	xaa.doc.docx	Get hash	malicious	CVE-2021-40444	Browse	259f-88-231-63-13.eu.ngrok.io/exploit.html
18.192.31.165	muyq8X8qXp.exe	Get hash	malicious	Unknown	Browse	3eae-79-191-34-149.eu.ngrok.io/sysvndump/send
18.158.249.75	http://18.158.249.75	Get hash	malicious	Unknown	Browse	18.158.249.75/
18.158.249.75	xaa.doc.docx	Get hash	malicious	CVE-2021-40444	Browse	259f-88-231-63-13.eu.ngrok.io/exploit.html

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
0.tcp.eu.ngrok.io	kOBRIUczY0.exe	Get hash	malicious	Njrat	Browse	3.125.102.39
	QbkuoGa4nm.exe	Get hash	malicious	Njrat	Browse	3.125.223.134
	SecuriteInfo.com.Trojan.Siggen29.14708.13579.16480.exe	Get hash	malicious	StormKitty, XWorm	Browse	18.192.31.165
	Windows21.exe	Get hash	malicious	ZTrat	Browse	3.125.209.94
	1Md4DEEyQN.exe	Get hash	malicious	Njrat	Browse	3.125.223.134
	TiXxNKsN4C.exe	Get hash	malicious	Njrat	Browse	18.158.249.75
	tWBQ8JmsVy.exe	Get hash	malicious	Njrat	Browse	3.125.209.94
	Sd5Q0qD0YF.exe	Get hash	malicious	Njrat	Browse	3.125.223.134
	91023930344124.EXE.exe	Get hash	malicious	Unknown	Browse	3.125.209.94
	Rules.PDF.exe	Get hash	malicious	Unknown	Browse	3.125.102.39

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	http://email.friendbuy-mail.com/ls/click?upn=u001.Co2kxTMQjRboSzmQnJiNfJfDFp41sCnK1-2F4GqfdgFHosGPrCRb0CThqJNa6cWHBvgrjifDH46pR-2BbuZdJue5kg-3D-3D7XOT_Yp4ydSxZWNatis3HtI6bBrJjg57JYwT6kbyY2f89Z-2FB52Try4MOHq686O5s6LlNJnyvDqjZhIM8lr-2B5-2FhjdU-2B0FZsEpNGatFvLJAJgBa8cfPD2IaqNaoFq4pPcLdLLAsUhJfD1RQ1spHQPv41nDNuUpAchGQGhh5dYNwlLvMcMm03nfeuUrCix5Vj9aXX-2BLK0Uu7yzw9XOsBx-2BleTiIISw-3D-3D	Get hash	malicious	Unknown	Browse	13.227.219.125
	https://bnbactwyap.cloud/	Get hash	malicious	Unknown	Browse	54.199.68.233
	https://spot-speckle-gardenia.glitch.me/public/rfyiyuki4342.html	Get hash	malicious	Unknown	Browse	13.227.219.35
	https://task4-seven-omega.vercel.app/registration.html	Get hash	malicious	Unknown	Browse	76.76.21.61
	https://coenbseeprolgiin.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	52.222.232.47
	https://currentxfinitypages.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	54.69.50.186
	https://ledgerliveofficialsite.gitbook.io/	Get hash	malicious	Unknown	Browse	34.252.37.84
	https://sso--cdn-coiinbasepro-cdn-auth.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	35.166.92.226
	https://sso--coinbasepro--index.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	108.156.61.211
	https://sso-auth-get--coinbase-pro.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	52.222.232.47
AMAZON-02US	http://email.friendbuy-mail.com/ls/click?upn=u001.Co2kxTMQjRboSzmQnJiNfJfDFp41sCnK1-2F4GqfdgFHosGPrCRb0CThqJNa6cWHBvgrjifDH46pR-2BbuZdJue5kg-3D-3D7XOT_Yp4ydSxZWNatis3HtI6bBrJjg57JYwT6kbyY2f89Z-2FB52Try4MOHq686O5s6LlNJnyvDqjZhIM8lr-2B5-2FhjdU-2B0FZsEpNGatFvLJAJgBa8cfPD2IaqNaoFq4pPcLdLLAsUhJfD1RQ1spHQPv41nDNuUpAchGQGhh5dYNwlLvMcMm03nfeuUrCix5Vj9aXX-2BLK0Uu7yzw9XOsBx-2BleTiIISw-3D-3D	Get hash	malicious	Unknown	Browse	13.227.219.125
	https://bnbactwyap.cloud/	Get hash	malicious	Unknown	Browse	54.199.68.233
	https://spot-speckle-gardenia.glitch.me/public/rfyiyuki4342.html	Get hash	malicious	Unknown	Browse	13.227.219.35
	https://task4-seven-omega.vercel.app/registration.html	Get hash	malicious	Unknown	Browse	76.76.21.61
	https://coenbseeprolgiin.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	52.222.232.47
	https://currentxfinitypages.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	54.69.50.186
	https://ledgerliveofficialsite.gitbook.io/	Get hash	malicious	Unknown	Browse	34.252.37.84
	https://sso--cdn-coiinbasepro-cdn-auth.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	35.166.92.226
	https://sso--coinbasepro--index.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	108.156.61.211
	https://sso-auth-get--coinbase-pro.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	52.222.232.47
AMAZON-02US	http://email.friendbuy-mail.com/ls/click?upn=u001.Co2kxTMQjRboSzmQnJiNfJfDFp41sCnK1-2F4GqfdgFHosGPrCRb0CThqJNa6cWHBvgrjifDH46pR-2BbuZdJue5kg-3D-3D7XOT_Yp4ydSxZWNatis3HtI6bBrJjg57JYwT6kbyY2f89Z-2FB52Try4MOHq686O5s6LlNJnyvDqjZhIM8lr-2B5-2FhjdU-2B0FZsEpNGatFvLJAJgBa8cfPD2IaqNaoFq4pPcLdLLAsUhJfD1RQ1spHQPv41nDNuUpAchGQGhh5dYNwlLvMcMm03nfeuUrCix5Vj9aXX-2BLK0Uu7yzw9XOsBx-2BleTiIISw-3D-3D	Get hash	malicious	Unknown	Browse	13.227.219.125
	https://bnbactwyap.cloud/	Get hash	malicious	Unknown	Browse	54.199.68.233
	https://spot-speckle-gardenia.glitch.me/public/rfyiyuki4342.html	Get hash	malicious	Unknown	Browse	13.227.219.35
	https://task4-seven-omega.vercel.app/registration.html	Get hash	malicious	Unknown	Browse	76.76.21.61
	https://coenbseeprolgiin.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	52.222.232.47
	https://currentxfinitypages.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	54.69.50.186
	https://ledgerliveofficialsite.gitbook.io/	Get hash	malicious	Unknown	Browse	34.252.37.84
	https://sso--cdn-coiinbasepro-cdn-auth.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	35.166.92.226
	https://sso--coinbasepro--index.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	108.156.61.211
	https://sso-auth-get--coinbase-pro.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	52.222.232.47

Process:	C:\Users\user\Desktop\7tjt3u68PZ.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.561764870808992
Encrypted:	false
SSDEEP:	1536:jy+C+xhUa9urgOBPmNvM4jEwzGi1dDVD/gS:jyIUa9urgOkdGi1dhY
MD5:	02CEFBDA3396F784034E71616E52D67E
SHA1:	B38666D28BEB902565260BF87D4F367911E94EDA
SHA-256:	BB128EC75526887E8EBC2C1E4C0DAF7B7EC1D41F039C0FB88E927B90FCE6DF9E
SHA-512:	4C17201E33A1C9FC6FF5CB476FE548447CDEEEA20F494EA1A77BDE704D97DE7826B6EC880274FED2071D29499F3DF09A8737770557F27D7D3134E16A8E80B92A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Notepad.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Notepad.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Notepad.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Notepad.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Notepad.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Notepad.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Notepad.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Notepad.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Notepad.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Notepad.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84% Antivirus: Virustotal, Detection: 71%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Notepad.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\7tjt3u68PZ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Program Files (x86)\Explower.exe

Download File

Process:	C:\Users\user\Desktop\7tjt3u68PZ.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.561764870808992
Encrypted:	false
SSDEEP:	1536:jy+C+xhUa9urgOBPmNvM4jEwzGi1dDVD/gS:jyIUa9urgOkdGi1dhY
MD5:	02CEFBDA3396F784034E71616E52D67E
SHA1:	B38666D28BEB902565260BF87D4F367911E94EDA
SHA-256:	BB128EC75526887E8EBC2C1E4C0DAF7B7EC1D41F039C0FB88E927B90FCE6DF9E
SHA-512:	4C17201E33A1C9FC6FF5CB476FE548447CDEEEA20F494EA1A77BDE704D97DE7826B6EC880274FED2071D29499F3DF09A8737770557F27D7D3134E16A8E80B92A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Program Files (x86)\Explower.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Program Files (x86)\Explower.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Program Files (x86)\Explower.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Program Files (x86)\Explower.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84% Antivirus: Virustotal, Detection: 71%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Program Files (x86)\Explower.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\7tjt3u68PZ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Umbrella.flv.exe

Download File

Process:	C:\Users\user\Desktop\7tjt3u68PZ.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.561764870808992
Encrypted:	false
SSDEEP:	1536:jy+C+xhUa9urgOBPmNvM4jEwzGi1dDVD/gS:jyIUa9urgOkdGi1dhY
MD5:	02CEFBDA3396F784034E71616E52D67E
SHA1:	B38666D28BEB902565260BF87D4F367911E94EDA
SHA-256:	BB128EC75526887E8EBC2C1E4C0DAF7B7EC1D41F039C0FB88E927B90FCE6DF9E
SHA-512:	4C17201E33A1C9FC6FF5CB476FE548447CDEEEA20F494EA1A77BDE704D97DE7826B6EC880274FED2071D29499F3DF09A8737770557F27D7D3134E16A8E80B92A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Umbrella.flv.exe, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Umbrella.flv.exe, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Umbrella.flv.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Umbrella.flv.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Umbrella.flv.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Umbrella.flv.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Umbrella.flv.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Umbrella.flv.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Umbrella.flv.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Umbrella.flv.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Umbrella.flv.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Umbrella.flv.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Umbrella.flv.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Umbrella.flv.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Umbrella.flv.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Umbrella.flv.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Umbrella.flv.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Umbrella.flv.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Umbrella.flv.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Umbrella.flv.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Umbrella.flv.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Umbrella.flv.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Umbrella.flv.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Umbrella.flv.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Umbrella.flv.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Umbrella.flv.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Umbrella.flv.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Umbrella.flv.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Umbrella.flv.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Umbrella.flv.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Umbrella.flv.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Umbrella.flv.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84% Antivirus: Virustotal, Detection: 71%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Umbrella.flv.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\7tjt3u68PZ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Explower.exe

Download File

Process:	C:\Users\user\Desktop\7tjt3u68PZ.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.561764870808992
Encrypted:	false
SSDEEP:	1536:jy+C+xhUa9urgOBPmNvM4jEwzGi1dDVD/gS:jyIUa9urgOkdGi1dhY
MD5:	02CEFBDA3396F784034E71616E52D67E
SHA1:	B38666D28BEB902565260BF87D4F367911E94EDA
SHA-256:	BB128EC75526887E8EBC2C1E4C0DAF7B7EC1D41F039C0FB88E927B90FCE6DF9E
SHA-512:	4C17201E33A1C9FC6FF5CB476FE548447CDEEEA20F494EA1A77BDE704D97DE7826B6EC880274FED2071D29499F3DF09A8737770557F27D7D3134E16A8E80B92A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84% Antivirus: Virustotal, Detection: 71%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Local\Explower.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\7tjt3u68PZ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Explower.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.259753436570609
Encrypted:	false
SSDEEP:	12:Q3LaJU2C9XAn10Ug+9pfu9t0U29xtUz1B0U2uk71K6xhk7v:MLF2CpI3zffup29Iz52Ve
MD5:	260E01CC001F9C4643CA7A62F395D747
SHA1:	492AD0ACE3A9C8736909866EEA168962D418BE5A
SHA-256:	4BC52CCF866F489772A6919A0CC2C55B1432729D6BDF29E17E5853ABDFAB6030
SHA-512:	01AF7D75257E3DBD460E328F5C057D0367B83D3D9397E89CA3AE54AB9B2842D62352D8CCB4BE98ACE0C5667846759D32C199DE39ECCD0CF9CD6A83267D27E7C4
Malicious:	false
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7d443c6c007fe8696f9aa6ff1da53ef7\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\History\Explower.exe

Download File

Process:	C:\Users\user\Desktop\7tjt3u68PZ.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.561764870808992
Encrypted:	false
SSDEEP:	1536:jy+C+xhUa9urgOBPmNvM4jEwzGi1dDVD/gS:jyIUa9urgOkdGi1dhY
MD5:	02CEFBDA3396F784034E71616E52D67E
SHA1:	B38666D28BEB902565260BF87D4F367911E94EDA
SHA-256:	BB128EC75526887E8EBC2C1E4C0DAF7B7EC1D41F039C0FB88E927B90FCE6DF9E
SHA-512:	4C17201E33A1C9FC6FF5CB476FE548447CDEEEA20F494EA1A77BDE704D97DE7826B6EC880274FED2071D29499F3DF09A8737770557F27D7D3134E16A8E80B92A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84% Antivirus: Virustotal, Detection: 71%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Local\Microsoft\Windows\History\Explower.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\7tjt3u68PZ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Explower.exe

Download File

Process:	C:\Users\user\Desktop\7tjt3u68PZ.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.561764870808992
Encrypted:	false
SSDEEP:	1536:jy+C+xhUa9urgOBPmNvM4jEwzGi1dDVD/gS:jyIUa9urgOkdGi1dhY
MD5:	02CEFBDA3396F784034E71616E52D67E
SHA1:	B38666D28BEB902565260BF87D4F367911E94EDA
SHA-256:	BB128EC75526887E8EBC2C1E4C0DAF7B7EC1D41F039C0FB88E927B90FCE6DF9E
SHA-512:	4C17201E33A1C9FC6FF5CB476FE548447CDEEEA20F494EA1A77BDE704D97DE7826B6EC880274FED2071D29499F3DF09A8737770557F27D7D3134E16A8E80B92A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84% Antivirus: Virustotal, Detection: 71%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Explower.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\7tjt3u68PZ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Explower.exe

Download File

Process:	C:\Users\user\Desktop\7tjt3u68PZ.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.561764870808992
Encrypted:	false
SSDEEP:	1536:jy+C+xhUa9urgOBPmNvM4jEwzGi1dDVD/gS:jyIUa9urgOkdGi1dhY
MD5:	02CEFBDA3396F784034E71616E52D67E
SHA1:	B38666D28BEB902565260BF87D4F367911E94EDA
SHA-256:	BB128EC75526887E8EBC2C1E4C0DAF7B7EC1D41F039C0FB88E927B90FCE6DF9E
SHA-512:	4C17201E33A1C9FC6FF5CB476FE548447CDEEEA20F494EA1A77BDE704D97DE7826B6EC880274FED2071D29499F3DF09A8737770557F27D7D3134E16A8E80B92A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84% Antivirus: Virustotal, Detection: 71%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Explower.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\7tjt3u68PZ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe

Download File

Process:	C:\Users\user\Desktop\7tjt3u68PZ.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.561764870808992
Encrypted:	false
SSDEEP:	1536:jy+C+xhUa9urgOBPmNvM4jEwzGi1dDVD/gS:jyIUa9urgOkdGi1dhY
MD5:	02CEFBDA3396F784034E71616E52D67E
SHA1:	B38666D28BEB902565260BF87D4F367911E94EDA
SHA-256:	BB128EC75526887E8EBC2C1E4C0DAF7B7EC1D41F039C0FB88E927B90FCE6DF9E
SHA-512:	4C17201E33A1C9FC6FF5CB476FE548447CDEEEA20F494EA1A77BDE704D97DE7826B6EC880274FED2071D29499F3DF09A8737770557F27D7D3134E16A8E80B92A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84% Antivirus: Virustotal, Detection: 71%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\7tjt3u68PZ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\app

Download File

Process:	C:\Users\user\Desktop\7tjt3u68PZ.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:zn:z
MD5:	A65A8CC18C0FDCAC3B78ED8F032E2F98
SHA1:	9087F7AAF4EDF3B132348B1E5DFA7A678D57D40E
SHA-256:	CA1C5C735384C64968C987E3E608CB48A3CBD73E870F1BC6D60F2B24F9445E3A
SHA-512:	8E56C9AA0C90FB30B488FA72A0B9D40E69C357E32D8E6F9D5A299DFBF9DF8C896C28684D7163972019AB53DFCFE35DC75E9B305E07C81B9984A410E04B96186D
Malicious:	false
Preview:	.10

C:\Users\user\Desktop\Explower.exe

Download File

Process:	C:\Users\user\Desktop\7tjt3u68PZ.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.561764870808992
Encrypted:	false
SSDEEP:	1536:jy+C+xhUa9urgOBPmNvM4jEwzGi1dDVD/gS:jyIUa9urgOkdGi1dhY
MD5:	02CEFBDA3396F784034E71616E52D67E
SHA1:	B38666D28BEB902565260BF87D4F367911E94EDA
SHA-256:	BB128EC75526887E8EBC2C1E4C0DAF7B7EC1D41F039C0FB88E927B90FCE6DF9E
SHA-512:	4C17201E33A1C9FC6FF5CB476FE548447CDEEEA20F494EA1A77BDE704D97DE7826B6EC880274FED2071D29499F3DF09A8737770557F27D7D3134E16A8E80B92A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84% Antivirus: Virustotal, Detection: 71%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\Desktop\Explower.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\7tjt3u68PZ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\Documents\Explower.exe

Download File

Process:	C:\Users\user\Desktop\7tjt3u68PZ.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.561764870808992
Encrypted:	false
SSDEEP:	1536:jy+C+xhUa9urgOBPmNvM4jEwzGi1dDVD/gS:jyIUa9urgOkdGi1dhY
MD5:	02CEFBDA3396F784034E71616E52D67E
SHA1:	B38666D28BEB902565260BF87D4F367911E94EDA
SHA-256:	BB128EC75526887E8EBC2C1E4C0DAF7B7EC1D41F039C0FB88E927B90FCE6DF9E
SHA-512:	4C17201E33A1C9FC6FF5CB476FE548447CDEEEA20F494EA1A77BDE704D97DE7826B6EC880274FED2071D29499F3DF09A8737770557F27D7D3134E16A8E80B92A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84% Antivirus: Virustotal, Detection: 71%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\Documents\Explower.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\7tjt3u68PZ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\Favorites\Explower.exe

Download File

Process:	C:\Users\user\Desktop\7tjt3u68PZ.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.561764870808992
Encrypted:	false
SSDEEP:	1536:jy+C+xhUa9urgOBPmNvM4jEwzGi1dDVD/gS:jyIUa9urgOkdGi1dhY
MD5:	02CEFBDA3396F784034E71616E52D67E
SHA1:	B38666D28BEB902565260BF87D4F367911E94EDA
SHA-256:	BB128EC75526887E8EBC2C1E4C0DAF7B7EC1D41F039C0FB88E927B90FCE6DF9E
SHA-512:	4C17201E33A1C9FC6FF5CB476FE548447CDEEEA20F494EA1A77BDE704D97DE7826B6EC880274FED2071D29499F3DF09A8737770557F27D7D3134E16A8E80B92A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84% Antivirus: Virustotal, Detection: 71%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\Favorites\Explower.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\7tjt3u68PZ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\SysWOW64\Explower.exe

Download File

Process:	C:\Users\user\Desktop\7tjt3u68PZ.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.561764870808992
Encrypted:	false
SSDEEP:	1536:jy+C+xhUa9urgOBPmNvM4jEwzGi1dDVD/gS:jyIUa9urgOkdGi1dhY
MD5:	02CEFBDA3396F784034E71616E52D67E
SHA1:	B38666D28BEB902565260BF87D4F367911E94EDA
SHA-256:	BB128EC75526887E8EBC2C1E4C0DAF7B7EC1D41F039C0FB88E927B90FCE6DF9E
SHA-512:	4C17201E33A1C9FC6FF5CB476FE548447CDEEEA20F494EA1A77BDE704D97DE7826B6EC880274FED2071D29499F3DF09A8737770557F27D7D3134E16A8E80B92A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84% Antivirus: Virustotal, Detection: 71%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Windows\SysWOW64\Explower.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\7tjt3u68PZ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\autorun.inf

Download File

Process:	C:\Users\user\Desktop\7tjt3u68PZ.exe
File Type:	Microsoft Windows Autorun file
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.474554204780528
Encrypted:	false
SSDEEP:	3:It1KV2PHQCyK0x:e1KAwCyD
MD5:	40B1630BE21F39CB17BD1963CAE5A207
SHA1:	63C14BD151D42820DD45C033363FA5B9E1D34124
SHA-256:	F87E55F1A423B65FD639146F71F6027DBD4D6E69B65D9A17F1744774AA6589E1
SHA-512:	833112ED4A9A3C621D2FFFC78F83502B2937B82A2CF9BC692D75D907CE2AA46C2D97CFE23C402DB3292B2DD2655FF8692C3CD00D5BA4D792C3D8AF24958E1926
Malicious:	true
Preview:	[autorun]..open=C:\Umbrella.flv.exe..shellexecute=C:\..

C:\system.exe

Download File

Process:	C:\Users\user\Desktop\7tjt3u68PZ.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.561764870808992
Encrypted:	false
SSDEEP:	1536:jy+C+xhUa9urgOBPmNvM4jEwzGi1dDVD/gS:jyIUa9urgOkdGi1dhY
MD5:	02CEFBDA3396F784034E71616E52D67E
SHA1:	B38666D28BEB902565260BF87D4F367911E94EDA
SHA-256:	BB128EC75526887E8EBC2C1E4C0DAF7B7EC1D41F039C0FB88E927B90FCE6DF9E
SHA-512:	4C17201E33A1C9FC6FF5CB476FE548447CDEEEA20F494EA1A77BDE704D97DE7826B6EC880274FED2071D29499F3DF09A8737770557F27D7D3134E16A8E80B92A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\system.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\system.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\system.exe, Author: Florian Roth Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\system.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\system.exe, Author: JPCERT/CC Incident Response Group Rule: Njrat, Description: detect njRAT in memory, Source: C:\system.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\system.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\system.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84% Antivirus: Virustotal, Detection: 71%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\system.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\7tjt3u68PZ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	313
Entropy (8bit):	4.971939296804078
Encrypted:	false
SSDEEP:	6:/ojfKsUTGN8Ypox42k9L+DbGMKeQE+vigqAZs2E+AYeDPO+Yswyha:wjPIGNrkHk9iaeIM6ADDPOHyha
MD5:	689E2126A85BF55121488295EE068FA1
SHA1:	09BAAA253A49D80C18326DFBCA106551EBF22DD6
SHA-256:	D968A966EF474068E41256321F77807A042F1965744633D37A203A705662EC25
SHA-512:	C3736A8FC7E6573FA1B26FE6A901C05EE85C55A4A276F8F569D9EADC9A58BEC507D1BB90DBF9EA62AE79A6783178C69304187D6B90441D82E46F5F56172B5C5C
Malicious:	false
Preview:	..IMPORTANT: Command executed successfully...However, "netsh firewall" is deprecated;..use "netsh advfirewall firewall" instead...For more information on using "netsh advfirewall firewall" commands..instead of "netsh firewall", see KB article 947709..at https://go.microsoft.com/fwlink/?linkid=121488 .....Ok.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.561764870808992
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	7tjt3u68PZ.exe
File size:	95'232 bytes
MD5:	02cefbda3396f784034e71616e52d67e
SHA1:	b38666d28beb902565260bf87d4f367911e94eda
SHA256:	bb128ec75526887e8ebc2c1e4c0daf7b7ec1d41f039c0fb88e927b90fce6df9e
SHA512:	4c17201e33a1c9fc6ff5cb476fe548447cdeeea20f494ea1a77bde704d97de7826b6ec880274fed2071d29499f3df09a8737770557f27d7d3134e16a8e80b92a
SSDEEP:	1536:jy+C+xhUa9urgOBPmNvM4jEwzGi1dDVD/gS:jyIUa9urgOkdGi1dhY
TLSH:	DE93D74977E53524E4BF56F79472F2004E34B44B1602E39E49F259EA0A33AC44F89EEB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f.................p............... ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x418f0e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66DDA8C5 [Sun Sep 8 13:38:13 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x18eb8	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x16f14	0x17000	6d5781fda14111c1d332ca01c3044030	False	0.36819590692934784	data	5.593491839710464	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x1a000	0xc	0x200	26def8a0407cc7078ce41b7ef703298e	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-11T02:02:02.603963+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49730	3.125.209.94	11348	TCP
2024-09-11T02:02:02.603963+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49730	3.125.209.94	11348	TCP
2024-09-11T02:02:08.278941+0200	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49730	3.125.209.94	11348	TCP
2024-09-11T02:03:06.370956+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50776	3.125.209.94	11348	TCP
2024-09-11T02:03:06.370956+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50776	3.125.209.94	11348	TCP
2024-09-11T02:03:11.011982+0200	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50776	3.125.209.94	11348	TCP
2024-09-11T02:04:18.274738+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50777	18.192.31.165	11348	TCP
2024-09-11T02:04:18.274738+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50777	18.192.31.165	11348	TCP
2024-09-11T02:04:25.276660+0200	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50777	18.192.31.165	11348	TCP
2024-09-11T02:05:23.300184+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50778	18.158.249.75	11348	TCP
2024-09-11T02:05:23.300184+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50778	18.158.249.75	11348	TCP
2024-09-11T02:05:26.867195+0200	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50778	18.158.249.75	11348	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 11, 2024 02:02:02.128613949 CEST	49730	11348	192.168.2.4	3.125.209.94
Sep 11, 2024 02:02:02.134041071 CEST	11348	49730	3.125.209.94	192.168.2.4
Sep 11, 2024 02:02:02.134162903 CEST	49730	11348	192.168.2.4	3.125.209.94
Sep 11, 2024 02:02:02.603962898 CEST	49730	11348	192.168.2.4	3.125.209.94
Sep 11, 2024 02:02:02.608835936 CEST	11348	49730	3.125.209.94	192.168.2.4
Sep 11, 2024 02:02:02.608907938 CEST	49730	11348	192.168.2.4	3.125.209.94
Sep 11, 2024 02:02:02.613723040 CEST	11348	49730	3.125.209.94	192.168.2.4
Sep 11, 2024 02:02:08.278940916 CEST	49730	11348	192.168.2.4	3.125.209.94
Sep 11, 2024 02:02:08.283927917 CEST	11348	49730	3.125.209.94	192.168.2.4
Sep 11, 2024 02:03:04.221611977 CEST	11348	49730	3.125.209.94	192.168.2.4
Sep 11, 2024 02:03:04.221683025 CEST	49730	11348	192.168.2.4	3.125.209.94
Sep 11, 2024 02:03:06.328397989 CEST	49730	11348	192.168.2.4	3.125.209.94
Sep 11, 2024 02:03:06.333722115 CEST	11348	49730	3.125.209.94	192.168.2.4
Sep 11, 2024 02:03:06.365047932 CEST	50776	11348	192.168.2.4	3.125.209.94
Sep 11, 2024 02:03:06.370002985 CEST	11348	50776	3.125.209.94	192.168.2.4
Sep 11, 2024 02:03:06.370085001 CEST	50776	11348	192.168.2.4	3.125.209.94
Sep 11, 2024 02:03:06.370955944 CEST	50776	11348	192.168.2.4	3.125.209.94
Sep 11, 2024 02:03:06.375703096 CEST	11348	50776	3.125.209.94	192.168.2.4
Sep 11, 2024 02:03:06.375776052 CEST	50776	11348	192.168.2.4	3.125.209.94
Sep 11, 2024 02:03:06.380808115 CEST	11348	50776	3.125.209.94	192.168.2.4
Sep 11, 2024 02:03:11.011981964 CEST	50776	11348	192.168.2.4	3.125.209.94
Sep 11, 2024 02:03:11.016782999 CEST	11348	50776	3.125.209.94	192.168.2.4
Sep 11, 2024 02:04:08.223855972 CEST	11348	50776	3.125.209.94	192.168.2.4
Sep 11, 2024 02:04:08.223994017 CEST	50776	11348	192.168.2.4	3.125.209.94
Sep 11, 2024 02:04:10.250626087 CEST	50776	11348	192.168.2.4	3.125.209.94
Sep 11, 2024 02:04:10.255572081 CEST	11348	50776	3.125.209.94	192.168.2.4
Sep 11, 2024 02:04:18.267785072 CEST	50777	11348	192.168.2.4	18.192.31.165
Sep 11, 2024 02:04:18.273720980 CEST	11348	50777	18.192.31.165	192.168.2.4
Sep 11, 2024 02:04:18.273813963 CEST	50777	11348	192.168.2.4	18.192.31.165
Sep 11, 2024 02:04:18.274738073 CEST	50777	11348	192.168.2.4	18.192.31.165
Sep 11, 2024 02:04:18.282072067 CEST	11348	50777	18.192.31.165	192.168.2.4
Sep 11, 2024 02:04:18.282150984 CEST	50777	11348	192.168.2.4	18.192.31.165
Sep 11, 2024 02:04:18.287309885 CEST	11348	50777	18.192.31.165	192.168.2.4
Sep 11, 2024 02:04:25.276659966 CEST	50777	11348	192.168.2.4	18.192.31.165
Sep 11, 2024 02:04:25.281691074 CEST	11348	50777	18.192.31.165	192.168.2.4
Sep 11, 2024 02:05:20.231575966 CEST	11348	50777	18.192.31.165	192.168.2.4
Sep 11, 2024 02:05:20.231687069 CEST	50777	11348	192.168.2.4	18.192.31.165
Sep 11, 2024 02:05:22.275408030 CEST	50777	11348	192.168.2.4	18.192.31.165
Sep 11, 2024 02:05:22.280267000 CEST	11348	50777	18.192.31.165	192.168.2.4
Sep 11, 2024 02:05:23.294194937 CEST	50778	11348	192.168.2.4	18.158.249.75
Sep 11, 2024 02:05:23.299242973 CEST	11348	50778	18.158.249.75	192.168.2.4
Sep 11, 2024 02:05:23.299335957 CEST	50778	11348	192.168.2.4	18.158.249.75
Sep 11, 2024 02:05:23.300184011 CEST	50778	11348	192.168.2.4	18.158.249.75
Sep 11, 2024 02:05:23.304986954 CEST	11348	50778	18.158.249.75	192.168.2.4
Sep 11, 2024 02:05:23.305077076 CEST	50778	11348	192.168.2.4	18.158.249.75
Sep 11, 2024 02:05:23.309899092 CEST	11348	50778	18.158.249.75	192.168.2.4
Sep 11, 2024 02:05:26.867194891 CEST	50778	11348	192.168.2.4	18.158.249.75
Sep 11, 2024 02:05:26.872163057 CEST	11348	50778	18.158.249.75	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 11, 2024 02:02:02.109468937 CEST	63746	53	192.168.2.4	1.1.1.1
Sep 11, 2024 02:02:02.118558884 CEST	53	63746	1.1.1.1	192.168.2.4
Sep 11, 2024 02:02:18.664587975 CEST	53	64255	1.1.1.1	192.168.2.4
Sep 11, 2024 02:03:06.329502106 CEST	50995	53	192.168.2.4	1.1.1.1
Sep 11, 2024 02:03:06.338296890 CEST	53	50995	1.1.1.1	192.168.2.4
Sep 11, 2024 02:04:18.257030010 CEST	56663	53	192.168.2.4	1.1.1.1
Sep 11, 2024 02:04:18.267018080 CEST	53	56663	1.1.1.1	192.168.2.4
Sep 11, 2024 02:05:23.255028009 CEST	58741	53	192.168.2.4	1.1.1.1
Sep 11, 2024 02:05:23.263590097 CEST	53	58741	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 11, 2024 02:02:02.109468937 CEST	192.168.2.4	1.1.1.1	0xd8bc	Standard query (0)	0.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Sep 11, 2024 02:03:06.329502106 CEST	192.168.2.4	1.1.1.1	0xd90c	Standard query (0)	0.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Sep 11, 2024 02:04:18.257030010 CEST	192.168.2.4	1.1.1.1	0xa33b	Standard query (0)	0.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Sep 11, 2024 02:05:23.255028009 CEST	192.168.2.4	1.1.1.1	0xc0bd	Standard query (0)	0.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Sep 11, 2024 02:02:02.118558884 CEST	1.1.1.1	192.168.2.4	0xd8bc	No error (0)	0.tcp.eu.ngrok.io	3.125.209.94	A (IP address)	IN (0x0001)	false
Sep 11, 2024 02:03:06.338296890 CEST	1.1.1.1	192.168.2.4	0xd90c	No error (0)	0.tcp.eu.ngrok.io	3.125.209.94	A (IP address)	IN (0x0001)	false
Sep 11, 2024 02:04:18.267018080 CEST	1.1.1.1	192.168.2.4	0xa33b	No error (0)	0.tcp.eu.ngrok.io	18.192.31.165	A (IP address)	IN (0x0001)	false
Sep 11, 2024 02:05:23.263590097 CEST	1.1.1.1	192.168.2.4	0xc0bd	No error (0)	0.tcp.eu.ngrok.io	18.158.249.75	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	20:01:56
Start date:	10/09/2024
Path:	C:\Users\user\Desktop\7tjt3u68PZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\7tjt3u68PZ.exe"
Imagebase:	0x8b0000
File size:	95'232 bytes
MD5 hash:	02CEFBDA3396F784034E71616E52D67E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000000.1664656287.00000000008B2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000000.00000000.1664656287.00000000008B2000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: Njrat, Description: detect njRAT in memory, Source: 00000000.00000000.1664656287.00000000008B2000.00000002.00000001.01000000.00000003.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000002.4123213231.0000000002F11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	20:01:57
Start date:	10/09/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall add allowedprogram "C:\Users\user\Desktop\7tjt3u68PZ.exe" "7tjt3u68PZ.exe" ENABLE
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:01:57
Start date:	10/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:02:09
Start date:	10/09/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe"
Imagebase:	0x140000
File size:	95'232 bytes
MD5 hash:	02CEFBDA3396F784034E71616E52D67E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 84%, ReversingLabs Detection: 71%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	36.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.1%
Total number of Nodes:	115
Total number of Limit Nodes:	7

Executed Functions

Function 05084290 Relevance: 10.7, Strings: 7, Instructions: 1950COMMON

Download Yara Rule

Strings

:@k, xrefs: 05084CEB
:@k, xrefs: 05084E3B
:@k, xrefs: 05085539
@, xrefs: 05084C1C
:@k, xrefs: 05084D92
:@k, xrefs: 05086CED
:@k, xrefs: 0508457A

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: :@k$:@k$:@k$:@k$:@k$:@k$@
API String ID: 0-4108611281
Opcode ID: be3632a1309a8a1cfffab243ff473ae5d8980b85212889115841dc64d0bf9128
Instruction ID: 9baf6e1464910de731d1693484a2df7b5f97873aa841c27a2c4cbdf62f4dd345
Opcode Fuzzy Hash: be3632a1309a8a1cfffab243ff473ae5d8980b85212889115841dc64d0bf9128
Instruction Fuzzy Hash: 28234B74A01228CFDB65EF60E864BEDB7B2BB88304F0141E9D959A7794DB319E85CF40

Function 0508427F Relevance: 10.5, Strings: 7, Instructions: 1746COMMON

Download Yara Rule

Strings

, xrefs: 05084BBC
:@k, xrefs: 05084CEB
:@k, xrefs: 05084E3B
:@k, xrefs: 05085539
:@k, xrefs: 05084D92
:@k, xrefs: 05086CED
:@k, xrefs: 0508457A

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: $:@k$:@k$:@k$:@k$:@k$:@k
API String ID: 0-3720531893
Opcode ID: 324df51bc96bfbc592bdf1ef32be42541cc30d67fb1a4e2acc940069f65b5d4a
Instruction ID: e3a583920c0d4daf96c22403cbf1c0fc394d42fd972cb8a9892b186b939309fd
Opcode Fuzzy Hash: 324df51bc96bfbc592bdf1ef32be42541cc30d67fb1a4e2acc940069f65b5d4a
Instruction Fuzzy Hash: 9A132974A01228CFDB25EF60E864BEDB7B2BB88304F0141E9D95967798DB319E85CF50

Function 050844E9 Relevance: 10.4, Strings: 7, Instructions: 1624
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 05084BBC
:@k, xrefs: 05084CEB
:@k, xrefs: 05084E3B
:@k, xrefs: 05085539
:@k, xrefs: 05084D92
:@k, xrefs: 05086CED
:@k, xrefs: 0508457A

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: $:@k$:@k$:@k$:@k$:@k$:@k
API String ID: 0-3720531893
Opcode ID: b7dd53db76a241f8bc74e5b7ca46fbc54b6c26d0fa183bd7a3435111eb7613f6
Instruction ID: 0c43c1f32e7da10132db22eb12268d7de8350095b529a7b32b38e2d93b3ec52a
Opcode Fuzzy Hash: b7dd53db76a241f8bc74e5b7ca46fbc54b6c26d0fa183bd7a3435111eb7613f6
Instruction Fuzzy Hash: F6033974A01228CFDB25EF60E864BADB7B2FB88304F0141E9D95967798DB319E85CF50

Function 0508453C Relevance: 10.4, Strings: 7, Instructions: 1618
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 05084BBC
:@k, xrefs: 05084CEB
:@k, xrefs: 05084E3B
:@k, xrefs: 05085539
:@k, xrefs: 05084D92
:@k, xrefs: 05086CED
:@k, xrefs: 0508457A

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: $:@k$:@k$:@k$:@k$:@k$:@k
API String ID: 0-3720531893
Opcode ID: f2be60475e1aaa007f73679d6e64152733a0af06b165895f8f66d4787cad5685
Instruction ID: 8d57fbaf12772c33049fd3b1e3f77c78f2759e86d60f08ee1e456d471cad6cce
Opcode Fuzzy Hash: f2be60475e1aaa007f73679d6e64152733a0af06b165895f8f66d4787cad5685
Instruction Fuzzy Hash: D2032874A01228CFDB25EF60E864BEDB7B2BB88304F0141E9D95967798DB319E85CF50

Function 05084628 Relevance: 9.1, Strings: 6, Instructions: 1579
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 05084BBC
:@k, xrefs: 05084CEB
:@k, xrefs: 05084E3B
:@k, xrefs: 05085539
:@k, xrefs: 05086CED
:@k, xrefs: 05084D92

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: $:@k$:@k$:@k$:@k$:@k
API String ID: 0-2050216740
Opcode ID: 333083243de6bd170f1a928dbf552ff00f22bb0e8c83a8442a0fc4485b9e553a
Instruction ID: 67a49b09bb1b1d36b6ec7b7ea5231f2598db71350252c617e31d92e4affca7c5
Opcode Fuzzy Hash: 333083243de6bd170f1a928dbf552ff00f22bb0e8c83a8442a0fc4485b9e553a
Instruction Fuzzy Hash: D8032974A01228CFDB25EF60E864BEDB7B2BB88304F0141E9D95967798DB319E85CF50

Function 05084707 Relevance: 9.0, Strings: 6, Instructions: 1544
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 05084BBC
:@k, xrefs: 05084CEB
:@k, xrefs: 05084E3B
:@k, xrefs: 05085539
:@k, xrefs: 05086CED
:@k, xrefs: 05084D92

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: $:@k$:@k$:@k$:@k$:@k
API String ID: 0-2050216740
Opcode ID: ec931800b2d31342345314c096be2b775dc397a38222ad4d4f2cf250ac55f1ed
Instruction ID: de4a3ae64db6b1c9f26d914e39ca5f9bf6af15973ab58ea9f2fd6f1bd7707bf6
Opcode Fuzzy Hash: ec931800b2d31342345314c096be2b775dc397a38222ad4d4f2cf250ac55f1ed
Instruction Fuzzy Hash: A7F23974A01228CFDB25EF60E864BEDB7B2BB88304F0141E9D95967798DB319E85CF50

Function 050847CC Relevance: 9.0, Strings: 6, Instructions: 1513
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 05084BBC
:@k, xrefs: 05084CEB
:@k, xrefs: 05084E3B
:@k, xrefs: 05085539
:@k, xrefs: 05086CED
:@k, xrefs: 05084D92

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: $:@k$:@k$:@k$:@k$:@k
API String ID: 0-2050216740
Opcode ID: e97d085330fef2df7915bc39b146ccecf00985c550e26961589646a0083fab10
Instruction ID: bc399313661b47eb4055c68bba70a9bd1d8680ea1fd0920013c50d342a1656d0
Opcode Fuzzy Hash: e97d085330fef2df7915bc39b146ccecf00985c550e26961589646a0083fab10
Instruction Fuzzy Hash: 88F23974A01228CFDB25EF60E864BEDB7B2BB88304F0141E9D95967798DB319E85CF50

Function 0508492E Relevance: 9.0, Strings: 6, Instructions: 1456
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 05084BBC
:@k, xrefs: 05084CEB
:@k, xrefs: 05084E3B
:@k, xrefs: 05085539
:@k, xrefs: 05086CED
:@k, xrefs: 05084D92

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: $:@k$:@k$:@k$:@k$:@k
API String ID: 0-2050216740
Opcode ID: 9e3541df1824b58e0248c2daf2ca22700d5253ddb8e901a00b8586035642f6bd
Instruction ID: c95f31bcd63df512124504c6ea44a312667a21ff91c08681602ddc6fb6e45fc7
Opcode Fuzzy Hash: 9e3541df1824b58e0248c2daf2ca22700d5253ddb8e901a00b8586035642f6bd
Instruction Fuzzy Hash: EEF24A74A01228CFDB25EF60E864BEDB7B2BB88304F0141E9D95967798DB319E85CF50

Function 05084995 Relevance: 8.9, Strings: 6, Instructions: 1447
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 05084BBC
:@k, xrefs: 05084CEB
:@k, xrefs: 05084E3B
:@k, xrefs: 05085539
:@k, xrefs: 05086CED
:@k, xrefs: 05084D92

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: $:@k$:@k$:@k$:@k$:@k
API String ID: 0-2050216740
Opcode ID: f20d9eb65a7e809536a94325242b4eaf113e82b02295a2acf426c4a6d68e7475
Instruction ID: 7c3f6d333f9bd288023e9fbd51cd2a0e1b4c6bdf90f47bc49b6d4598d8641459
Opcode Fuzzy Hash: f20d9eb65a7e809536a94325242b4eaf113e82b02295a2acf426c4a6d68e7475
Instruction Fuzzy Hash: 99F24A74A01228CFDB25EF60E864BEDB7B2BB88304F0141E9D95967798DB319E85CF50

Function 050849F1 Relevance: 8.9, Strings: 6, Instructions: 1440
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 05084BBC
:@k, xrefs: 05084CEB
:@k, xrefs: 05084E3B
:@k, xrefs: 05085539
:@k, xrefs: 05086CED
:@k, xrefs: 05084D92

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: $:@k$:@k$:@k$:@k$:@k
API String ID: 0-2050216740
Opcode ID: 6891878084e0fe0e97c5eeb44bf91f6bcfa596d8633330921445973e96b80e58
Instruction ID: 5386a5be558bfaf5deb1cd68d65f261a3cd61ac475e21b6bfeafcce90c2cd906
Opcode Fuzzy Hash: 6891878084e0fe0e97c5eeb44bf91f6bcfa596d8633330921445973e96b80e58
Instruction Fuzzy Hash: 3EF24A74A01228CFDB25EF60E864BEDB7B2BB88304F0141E9D95967798DB319E85CF50

Function 05084B53 Relevance: 8.9, Strings: 6, Instructions: 1383
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 05084BBC
:@k, xrefs: 05084CEB
:@k, xrefs: 05084E3B
:@k, xrefs: 05085539
:@k, xrefs: 05086CED
:@k, xrefs: 05084D92

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: $:@k$:@k$:@k$:@k$:@k
API String ID: 0-2050216740
Opcode ID: 63c8e30573064738c5c5affe46dbed8ca09a5cac55eb2d447e3657bdca042105
Instruction ID: 7e56ffbee4931ed0090a9184c8d8542fa6e7426d109201a45c6187a09069cc94
Opcode Fuzzy Hash: 63c8e30573064738c5c5affe46dbed8ca09a5cac55eb2d447e3657bdca042105
Instruction Fuzzy Hash: F4E24A74A01228CFDB25EF60E864BEDB7B2BB88304F0141E9D959A7794DB319E85CF50

Function 05084C87 Relevance: 7.6, Strings: 5, Instructions: 1362
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@k, xrefs: 05084CEB
:@k, xrefs: 05084E3B
:@k, xrefs: 05085539
:@k, xrefs: 05086CED
:@k, xrefs: 05084D92

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: :@k$:@k$:@k$:@k$:@k
API String ID: 0-1600721942
Opcode ID: 444898a8a10d6169ee2cc7c94ebd13c317451f9cc29166114c81099595c06fa4
Instruction ID: af32739dc2198339cad8260da9e7ec69df421b6b3a25b7c85b4c2da3b2a567bd
Opcode Fuzzy Hash: 444898a8a10d6169ee2cc7c94ebd13c317451f9cc29166114c81099595c06fa4
Instruction Fuzzy Hash: 26E23A74A01228CFDB25EF60E864BEDB7B2BB88304F0141E9D959A7794DB319E85CF50

Function 05084F27 Relevance: 3.7, Strings: 2, Instructions: 1245
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@k, xrefs: 05085539
:@k, xrefs: 05086CED

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: :@k$:@k
API String ID: 0-4032727010
Opcode ID: de67760cd80d6e770142fc3092f9634e9ecb85c80a26ea214c0e09ac60cef1ce
Instruction ID: 89579281f89029cdb48998dc9b29d1e3b9f15fd5a9bfeaf743ee48ce43857562
Opcode Fuzzy Hash: de67760cd80d6e770142fc3092f9634e9ecb85c80a26ea214c0e09ac60cef1ce
Instruction Fuzzy Hash: EDD23A74A012288FDB65EF70E864BEDB7B2BB48304F0141E9D959A7398DB319E85DF40

Function 05084F95 Relevance: 3.7, Strings: 2, Instructions: 1236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@k, xrefs: 05085539
:@k, xrefs: 05086CED

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: :@k$:@k
API String ID: 0-4032727010
Opcode ID: 7ebafd750b6069692375810e46cf9867574b54cf3813e541553bf07757ab35ff
Instruction ID: 94948829217587a991d7e5196055b151648f8a7e71d93e51d8a3d0dce6514d7c
Opcode Fuzzy Hash: 7ebafd750b6069692375810e46cf9867574b54cf3813e541553bf07757ab35ff
Instruction Fuzzy Hash: D4D22974A012288FDB65EF70E864BEDB7B2BB48304F0141E9D959A7398DB319E85DF40

Function 05084FF8 Relevance: 3.7, Strings: 2, Instructions: 1230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@k, xrefs: 05085539
:@k, xrefs: 05086CED

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: :@k$:@k
API String ID: 0-4032727010
Opcode ID: 4ac9c825ba564c46a1f25638bfe056f4e4175ec3c9c1d7d0f67e307cd0783034
Instruction ID: 3f8dc191846f699c514bdd462db17fcb3d4292d89f4a13c7514b1d15a3844b17
Opcode Fuzzy Hash: 4ac9c825ba564c46a1f25638bfe056f4e4175ec3c9c1d7d0f67e307cd0783034
Instruction Fuzzy Hash: 61D23A74A012288FDB65EF70E864BEDB7B2BB88304F0141E9D959A7394DB319E85DF40

Function 05085055 Relevance: 3.7, Strings: 2, Instructions: 1225
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@k, xrefs: 05085539
:@k, xrefs: 05086CED

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: :@k$:@k
API String ID: 0-4032727010
Opcode ID: 4da7813448ed464e921f75a8b5eabbfb0a93f01e1b9d6471fd95f6f1d74ddfd0
Instruction ID: 744854ba00f6b17b0b30fbf504692a15e50c311cc62775578785439504529fb8
Opcode Fuzzy Hash: 4da7813448ed464e921f75a8b5eabbfb0a93f01e1b9d6471fd95f6f1d74ddfd0
Instruction Fuzzy Hash: A8D23A74A012288FDB65EF70E864BEDB7B2BB88304F0141E9D959A7394DB319E85DF40

Function 050850DB Relevance: 3.7, Strings: 2, Instructions: 1210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@k, xrefs: 05085539
:@k, xrefs: 05086CED

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: :@k$:@k
API String ID: 0-4032727010
Opcode ID: 68344641228aee1358181c66a97afd59d64fcc590d42b65e584f7ad75c9c70cb
Instruction ID: e28724e140f3a0a77e333f9d91624c6059813669a0691329e65ee1105f8eadb9
Opcode Fuzzy Hash: 68344641228aee1358181c66a97afd59d64fcc590d42b65e584f7ad75c9c70cb
Instruction Fuzzy Hash: 7BD23974A012288FDB65EF70E864BEDB7B2BB88304F0141E9D959A7394DB319E85DF40

Function 05085367 Relevance: 3.6, Strings: 2, Instructions: 1071COMMON

Download Yara Rule

Strings

:@k, xrefs: 05085539
:@k, xrefs: 05086CED

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: :@k$:@k
API String ID: 0-4032727010
Opcode ID: 1297f4a691bb3eeefc1f56614217350fe96a602c3f86c9c1b12e7e40c7b9d30c
Instruction ID: 4030d958b3798e2cdcb58f8f30b56619c7c26dfe2e70bbc863b66a9a586a4f7f
Opcode Fuzzy Hash: 1297f4a691bb3eeefc1f56614217350fe96a602c3f86c9c1b12e7e40c7b9d30c
Instruction Fuzzy Hash: B3C21874A01228CFDB65EF60E864BADB7B6FB88304F1141E9D90967794DB329E85CF40

Function 05085451 Relevance: 3.5, Strings: 2, Instructions: 1040COMMON

Download Yara Rule

Strings

:@k, xrefs: 05085539
:@k, xrefs: 05086CED

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: :@k$:@k
API String ID: 0-4032727010
Opcode ID: 3c1dddfaaef917cca7487d41900c7c538270b7df5b01d029cb88fae2e458c63d
Instruction ID: 0c5407b3e1b8e550d76872c0b1c2ee190d76bc14a34ec24b1036b8a0f6679233
Opcode Fuzzy Hash: 3c1dddfaaef917cca7487d41900c7c538270b7df5b01d029cb88fae2e458c63d
Instruction Fuzzy Hash: 04C20874A01228CFDB65EF60E864BADB7B6FB48304F1141E9D90967798DB329E85CF40

Function 011CBD4B Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 011CBDCB

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: cbc142bad7a08f6b3517a1ce85e29385b7a058e5abf0c9709ee992b6872fb5fd
Instruction ID: 19200247d8b6cca2a60dc1620089632e1799b4aadf145c843a1eec43249b0e0c
Opcode Fuzzy Hash: cbc142bad7a08f6b3517a1ce85e29385b7a058e5abf0c9709ee992b6872fb5fd
Instruction Fuzzy Hash: F321BC755093809FEB238F25DC45BA2BFB4EF06710F08849AE984CF563D330A908DB62

Function 011CBECD Relevance: 1.6, APIs: 1, Instructions: 57nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 011CBF39

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: cd2ec981b2b65a91803c10580e4549458b03259bbcd7e902557cae5367694ebb
Instruction ID: 2f3b19fa582592eb67f8ee15e366f1b67f5647682027b100e05bb69600933d76
Opcode Fuzzy Hash: cd2ec981b2b65a91803c10580e4549458b03259bbcd7e902557cae5367694ebb
Instruction Fuzzy Hash: E0118E754093849FDB228B25DC45A52FFB4EF06314F0984DAE9848B663D265A908CB62

Function 011CBD82 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 011CBDCB

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 056a6a079d0b5513a885d979dfbd559a701f3202b7ac85d99f82fc6c8164808d
Instruction ID: 1f5359fe16ac35298463291b05d90e7439a8bd231fe2ec8328972dca7bd56f03
Opcode Fuzzy Hash: 056a6a079d0b5513a885d979dfbd559a701f3202b7ac85d99f82fc6c8164808d
Instruction Fuzzy Hash: AA119E756042009FEB20CF55D985B66FBE4EF14620F08C46EDE45CB652D331E418DFA2

Function 011CBEFE Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 011CBF39

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 8d010d9fbeaa8a7bec6c47cbb70a4340fbb22e6be676fcdc6035cf7ec3889d2a
Instruction ID: c2366eb6419144b374722e486e364700602482fe926619a5f94dbaca688c9ef8
Opcode Fuzzy Hash: 8d010d9fbeaa8a7bec6c47cbb70a4340fbb22e6be676fcdc6035cf7ec3889d2a
Instruction Fuzzy Hash: 6C018F755042049FEB218F15D985B61FBE0EF24B20F08C09EED494A762C376E418CFA2

Function 05087418 Relevance: .8, Instructions: 755COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8bcfbea466d376e778d34e892440ce211b75de3027ca318b68f2c2a3c3b86ed
Instruction ID: c783c17bc423644422377d77e6a8a03b89e79b9f977cccc1ae45aef443c2d7ed
Opcode Fuzzy Hash: b8bcfbea466d376e778d34e892440ce211b75de3027ca318b68f2c2a3c3b86ed
Instruction Fuzzy Hash: 5F4205316012229BDB29FB71F450A7C73B2FB80355B668175D4A19B2D8EB3BED81C790

Function 05087EA8 Relevance: 3.7, Strings: 2, Instructions: 1239COMMON

Download Yara Rule

Strings

:@k, xrefs: 0508811E
:@k, xrefs: 0508810D

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: :@k$:@k
API String ID: 0-4032727010
Opcode ID: cea969ed68ecf000de79216011611871668db87f9efdf4fccffc1262b042b404
Instruction ID: 13ec2f692fc059ce22e55d136fddf5dc966bffd8128d44b506324f5a80e090f2
Opcode Fuzzy Hash: cea969ed68ecf000de79216011611871668db87f9efdf4fccffc1262b042b404
Instruction Fuzzy Hash: C4B25D74B0015ACBDB25AF65F820BBD77F2BB98304F12806AD99593798CB348D85DF21

Function 05087F24 Relevance: 3.6, Strings: 2, Instructions: 1079COMMON

Download Yara Rule

Strings

:@k, xrefs: 0508811E
:@k, xrefs: 0508810D

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: :@k$:@k
API String ID: 0-4032727010
Opcode ID: f34c1699609265d884ab5a41f7da97288655c8c0850c7f17e8e9e6a4ad146975
Instruction ID: f26ca0127fcd8191125a21f8b379ee5804fc7bff4ff3fde6f2ebbef8b59c64c7
Opcode Fuzzy Hash: f34c1699609265d884ab5a41f7da97288655c8c0850c7f17e8e9e6a4ad146975
Instruction Fuzzy Hash: C792A03470016A8BDF15BF65A820BBD77F7AB98304F12806BD89593B98CB74CD85DB21

Function 05087F5E Relevance: 3.6, Strings: 2, Instructions: 1076COMMON

Download Yara Rule

Strings

:@k, xrefs: 0508811E
:@k, xrefs: 0508810D

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: :@k$:@k
API String ID: 0-4032727010
Opcode ID: 054eb9cb15a13aa7b4c95df17d84ef45e740b8850f82bcb78b1b5595edbeab51
Instruction ID: f3e2168e2e2128843bada90860d57a90a402a8b813dd7feae4c191aaa96e860d
Opcode Fuzzy Hash: 054eb9cb15a13aa7b4c95df17d84ef45e740b8850f82bcb78b1b5595edbeab51
Instruction Fuzzy Hash: 3792A13470016A8BDF15BF65A820BBD77F7AB98304F12806BD89593B98CB74CD85DB21

Function 05087F8D Relevance: 3.6, Strings: 2, Instructions: 1075COMMON

Download Yara Rule

Strings

:@k, xrefs: 0508811E
:@k, xrefs: 0508810D

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: :@k$:@k
API String ID: 0-4032727010
Opcode ID: a35504da64228eba5575a6a4c4a0b83e10fbf91041c3c66d11a997ea37031808
Instruction ID: 12791cb084c52f6a485ba8a4ea3f1006e6572f5b6c1c32add04d29cf12f7aec9
Opcode Fuzzy Hash: a35504da64228eba5575a6a4c4a0b83e10fbf91041c3c66d11a997ea37031808
Instruction Fuzzy Hash: 2392A03470016A8BDF15BF65A820BBD77F7AB98304F12806BD89593B98CB74CD85DB21

Function 05085622 Relevance: 2.2, Strings: 1, Instructions: 963COMMON

Download Yara Rule

Strings

:@k, xrefs: 05086CED

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: :@k
API String ID: 0-2277858631
Opcode ID: d354c95938dde2a6dc824d133d6ef47ed5db4207615863241db3a49ff9107ca1
Instruction ID: 73ce99937c6abb7ad9e669aa49ccbb36588eeaa6f0fbf47435cd0fc459d7f4ea
Opcode Fuzzy Hash: d354c95938dde2a6dc824d133d6ef47ed5db4207615863241db3a49ff9107ca1
Instruction Fuzzy Hash: 62B21774A01228CFDB65EF60E864BADB7B6FB48304F1141E9D90967798DB329E85CF40

Function 05085799 Relevance: 2.2, Strings: 1, Instructions: 906COMMON

Download Yara Rule

Strings

:@k, xrefs: 05086CED

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: :@k
API String ID: 0-2277858631
Opcode ID: 5b6d03df030ef8e1a8ba67cbab1f15366b73a955b3c4ddf1ef6c454c9900582a
Instruction ID: 0bb3cff257573f550944984c4a4303b85d8f609d7faf52fb7632273bc7c43c37
Opcode Fuzzy Hash: 5b6d03df030ef8e1a8ba67cbab1f15366b73a955b3c4ddf1ef6c454c9900582a
Instruction Fuzzy Hash: 5CA21874A01228CFDB65EF60E864BADB7B6FB48304F0141E9D94967798DB329E85CF40

Function 05085910 Relevance: 2.1, Strings: 1, Instructions: 849COMMON

Download Yara Rule

Strings

:@k, xrefs: 05086CED

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: :@k
API String ID: 0-2277858631
Opcode ID: 38a35b10996c3b20fc4a1f0f250fee474d8189dfab92ee3fb270aa6cb760a750
Instruction ID: 1a734748333d552ac202e2173dbf53b94d5085f2641ca6bae2b538b93f191d98
Opcode Fuzzy Hash: 38a35b10996c3b20fc4a1f0f250fee474d8189dfab92ee3fb270aa6cb760a750
Instruction Fuzzy Hash: CD921874A01228CFDB65EF60E864BADB7B6FB48304F1141E9D909A7794DB329E85CF40

Function 05085A87 Relevance: 2.0, Strings: 1, Instructions: 792COMMON

Download Yara Rule

Strings

:@k, xrefs: 05086CED

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: :@k
API String ID: 0-2277858631
Opcode ID: 30f129636d7c921bc7618732fc9d6a954fefd0b5037aeaec695beb313af086c4
Instruction ID: 31a56e292a26e20e83f2373ca89b0d8d30feca3a55ce5fa7b55eb771106ec911
Opcode Fuzzy Hash: 30f129636d7c921bc7618732fc9d6a954fefd0b5037aeaec695beb313af086c4
Instruction Fuzzy Hash: 57920874A01228CFDB65EF60E864BADB7B6FB48304F1141E9D909A7794DB329E85CF40

Function 05085BFE Relevance: 2.0, Strings: 1, Instructions: 735COMMON

Download Yara Rule

Strings

:@k, xrefs: 05086CED

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: :@k
API String ID: 0-2277858631
Opcode ID: 3c28665580b7e42efa5f8bc0366c2926ae3a0120516124d0097eb7e08473d6ed
Instruction ID: c55b8bde26944b68d8a2ce65e1649c04ac481a538bc4173c1d9012aa04aef113
Opcode Fuzzy Hash: 3c28665580b7e42efa5f8bc0366c2926ae3a0120516124d0097eb7e08473d6ed
Instruction Fuzzy Hash: DC821874A01228CFDB65EF60E864BADB7B6FB48304F1141E9D949A7394DB329E85CF40

Function 05085D75 Relevance: 1.9, Strings: 1, Instructions: 678COMMON

Download Yara Rule

Strings

:@k, xrefs: 05086CED

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: :@k
API String ID: 0-2277858631
Opcode ID: 3018934412761796757370fae61be327dcb775d4f439a9193779b1964c950524
Instruction ID: c0eaa79686d3675def9905f9872437a1628c01efd0d7e3e44c3000791527878a
Opcode Fuzzy Hash: 3018934412761796757370fae61be327dcb775d4f439a9193779b1964c950524
Instruction Fuzzy Hash: 35721974A01228CFDB65EF64E864BADB7B6FB48304F1141E9D909A7394DB329E85CF40

Function 05085EEC Relevance: 1.9, Strings: 1, Instructions: 621COMMON

Download Yara Rule

Strings

:@k, xrefs: 05086CED

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: :@k
API String ID: 0-2277858631
Opcode ID: 4f40ccc281c5ef3cf9cb52953343e55828bf860a6ca4238281e64da4996263ad
Instruction ID: bffcf66c273ba08a16994f5fdabe29b2699772c316d36765ee95805cce3ade33
Opcode Fuzzy Hash: 4f40ccc281c5ef3cf9cb52953343e55828bf860a6ca4238281e64da4996263ad
Instruction Fuzzy Hash: 60621A74A01228CFDB65EF64E864BADB7B6FB48304F1141E9D909A7394DB329E85CF40

Function 05086063 Relevance: 1.8, Strings: 1, Instructions: 564COMMON

Download Yara Rule

Strings

:@k, xrefs: 05086CED

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: :@k
API String ID: 0-2277858631
Opcode ID: 1781a4ef30508222f3bf59ab2cac05b75718349d7e304a9c0102128e1ab8a9b1
Instruction ID: 2e7db922d76558ff01fcddd41e020fb9d834c22280072beae04f8f3a4919bd7f
Opcode Fuzzy Hash: 1781a4ef30508222f3bf59ab2cac05b75718349d7e304a9c0102128e1ab8a9b1
Instruction Fuzzy Hash: CE520A74A01228CFDB65EF74E864BADB7B6BB88304F1141E9D949A7394DB319E85CF00

Function 050861DA Relevance: 1.8, Strings: 1, Instructions: 507COMMON

Download Yara Rule

Strings

:@k, xrefs: 05086CED

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: :@k
API String ID: 0-2277858631
Opcode ID: a86bb177b0f3132315e55bd7a3c8b9b7fa95ae59084ec9582de2a545002a5c76
Instruction ID: 1cb0b077e13cf554c0f2a9b4e7dc080f3478482e1dea20b7519d122bad8a1552
Opcode Fuzzy Hash: a86bb177b0f3132315e55bd7a3c8b9b7fa95ae59084ec9582de2a545002a5c76
Instruction Fuzzy Hash: F4421A74A01228CFDB65EF74E864BADB7B6BB88304F1141E9D949A7394DB319E85CF00

Function 05086351 Relevance: 1.7, Strings: 1, Instructions: 450COMMON

Download Yara Rule

Strings

:@k, xrefs: 05086CED

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: :@k
API String ID: 0-2277858631
Opcode ID: c1dcad507be5a876e504c7fed3f2b023ef9e126c045d53a8299ecdad81df0b46
Instruction ID: 87f8b85173ac5efa63517fcc1ad5e473fd233c0f40b0980ca1a416f2d9db188d
Opcode Fuzzy Hash: c1dcad507be5a876e504c7fed3f2b023ef9e126c045d53a8299ecdad81df0b46
Instruction Fuzzy Hash: BB322874A01228CFDB65EF34E864BACB7B6BB88304F1141E9D959A7394DB359E84CF00

Function 0508647B Relevance: 1.7, Strings: 1, Instructions: 427COMMON

Download Yara Rule

Strings

:@k, xrefs: 05086CED

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: :@k
API String ID: 0-2277858631
Opcode ID: 2ddd1c63fbea6014925d162e4c80485152b1767cec21502b3c7d20b1101618cd
Instruction ID: 3e83fca44c5a46a1f8972f11f08b939407b74ac0b62857df12513bdaa3dcb3f8
Opcode Fuzzy Hash: 2ddd1c63fbea6014925d162e4c80485152b1767cec21502b3c7d20b1101618cd
Instruction Fuzzy Hash: EA221874A01228CFDB65EF74E864BACB7B6BB88304F1141E9D959A7394DB319E84CF00

Function 012F0A24 Relevance: 1.6, APIs: 1, Instructions: 98registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(?,00000E24), ref: 012F0ADD

Memory Dump Source

Source File: 00000000.00000002.4123109540.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12f0000_7tjt3u68PZ.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 2fd536fbf3a5466eb9407fe6c4bb3f4a08f3c95594e4ab0f073842e77321150b
Instruction ID: e6ad43700315459818adca7461ef161cd57989625d164c4d28785adccdc8ec1b
Opcode Fuzzy Hash: 2fd536fbf3a5466eb9407fe6c4bb3f4a08f3c95594e4ab0f073842e77321150b
Instruction Fuzzy Hash: AC31B0B6500344AFE7218B25CD44FA7FBFCEF09614F08455AFA85CB652E220E848CB71

Function 012F0FE3 Relevance: 1.6, APIs: 1, Instructions: 98registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,?,?), ref: 012F10AA

Memory Dump Source

Source File: 00000000.00000002.4123109540.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12f0000_7tjt3u68PZ.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 8b9e0e225550f078d1b73bfeb9d8c70a487968a86c7ffd4029aa6d9388c7a053
Instruction ID: 7327dfb159c34fbbee49564a5589b738ac9a2bffc4ecf779330833a751b4ee07
Opcode Fuzzy Hash: 8b9e0e225550f078d1b73bfeb9d8c70a487968a86c7ffd4029aa6d9388c7a053
Instruction Fuzzy Hash: E9317C6110E3C06FD3138B358C61A61BFB4EF47610F0E45CBD9848B6A3D229A959C7B2

Function 011CB1E6 Relevance: 1.6, APIs: 1, Instructions: 97registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000E24), ref: 011CB291

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: bc4cfae06c50abb2dcc7ce117755e12e5db65b58e73eaa35151076791e276f85
Instruction ID: 4ecef884bddb9293efbea7166004176e022fefb321e9a950c344b2ea5ec22184
Opcode Fuzzy Hash: bc4cfae06c50abb2dcc7ce117755e12e5db65b58e73eaa35151076791e276f85
Instruction Fuzzy Hash: F53190715093846FE7228B65DC45FAABFB8EF06610F08849AE984DB663D324E44DC762

Function 012F1D80 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,00000E24), ref: 012F1E47

Memory Dump Source

Source File: 00000000.00000002.4123109540.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12f0000_7tjt3u68PZ.jbxd

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: 628ff0dd31a07b1e62be79d752a8e24591f516f515f2c40ab8bd5edd2bf0c1fe
Instruction ID: a0404c758a605c8b881c2cacb994150ccea9b2aa6172526df218ee6570e00dec
Opcode Fuzzy Hash: 628ff0dd31a07b1e62be79d752a8e24591f516f515f2c40ab8bd5edd2bf0c1fe
Instruction Fuzzy Hash: 6F3193B1504344AFE721CB51DD84FA6FBACEF04714F04489AFA489B692D374A94DCB71

Function 050867A1 Relevance: 1.6, Strings: 1, Instructions: 343COMMON

Download Yara Rule

Strings

:@k, xrefs: 05086CED

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: :@k
API String ID: 0-2277858631
Opcode ID: 410ed48bd5639d8b1b3542a80e0450ec7b1437024425101fafe880d5ae907950
Instruction ID: da163586cc7eea54f26f0e360581cf0d9bfeddcbeadaf26d50f3d79f03e31ea4
Opcode Fuzzy Hash: 410ed48bd5639d8b1b3542a80e0450ec7b1437024425101fafe880d5ae907950
Instruction Fuzzy Hash: 78022974A01228CFDB25EF74E860BADB7B6BB88304F1141E9D959A7394DB359E81CF00

Function 012F1C00 Relevance: 1.6, APIs: 1, Instructions: 92timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNELBASE(?,00000E24,FEEAE30E,00000000,00000000,00000000,00000000), ref: 012F1C9D

Memory Dump Source

Source File: 00000000.00000002.4123109540.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12f0000_7tjt3u68PZ.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: 77df8e3007a014f19028476f4f5d603d59f45a16ef91cd41163eb58f213ad1ce
Instruction ID: a1c43f66faa374f4216387aaa11a4347a711ea38fbe017859746e8c6f29a14a1
Opcode Fuzzy Hash: 77df8e3007a014f19028476f4f5d603d59f45a16ef91cd41163eb58f213ad1ce
Instruction Fuzzy Hash: CA31F4755093809FEB228F25DD44BA6BFB8EF06320F0884EAE9848F593D2249549C772

Function 011CAA75 Relevance: 1.6, APIs: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 011CAB25

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 23b053c8abb97a471fef9b206ddcc6e0ebdbcc7513a57a5e63b472ce54b54e34
Instruction ID: ba0167475ad8850d96229c093faa2198f6effa026afc2278f5701882af5e063c
Opcode Fuzzy Hash: 23b053c8abb97a471fef9b206ddcc6e0ebdbcc7513a57a5e63b472ce54b54e34
Instruction Fuzzy Hash: F131AEB1508384AFE722CF65DC84F56BFF8EF05610F08889EE9858B652D375E848CB61

Function 012F14FC Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E24), ref: 012F1593

Memory Dump Source

Source File: 00000000.00000002.4123109540.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12f0000_7tjt3u68PZ.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: f4d8f9314e2d0e96f02bb4942160dfe5fabedb43cd7ee6d0dea4322b92b2596f
Instruction ID: abc19b7b55dd45e16434852cbf1c577fb120ca4e9a63bf41b9ee0db33aec0de9
Opcode Fuzzy Hash: f4d8f9314e2d0e96f02bb4942160dfe5fabedb43cd7ee6d0dea4322b92b2596f
Instruction Fuzzy Hash: F631C371504344AFEB22CB65DC45FA7BFF8EF05210F0884AAE945CB652D324E948CB71

Function 011CB036 Relevance: 1.6, APIs: 1, Instructions: 89synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE(?,?), ref: 011CB0DD

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: f0f39e772da73c753354a3bf5f444f858faa4e4424c30989aab4c378682709e9
Instruction ID: 7b6945b69f7d63a8ea4fba307f95f72958c5500d70cd7128c2782e8af5b6403f
Opcode Fuzzy Hash: f0f39e772da73c753354a3bf5f444f858faa4e4424c30989aab4c378682709e9
Instruction Fuzzy Hash: 5931B1B15093806FE712CB65DC85B96BFF8EF06610F08849EE984CB693D375E909C762

Function 011CB2D9 Relevance: 1.6, APIs: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,FEEAE30E,00000000,00000000,00000000,00000000), ref: 011CB394

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: bec09b431c67ac465bc85f759cdff751573d9fd1bc1c948b6a0365e9479a901f
Instruction ID: 70d8b64522a444c1bc6a097b4e262f32e1f4c6fe3f79cc4debb88686578a1692
Opcode Fuzzy Hash: bec09b431c67ac465bc85f759cdff751573d9fd1bc1c948b6a0365e9479a901f
Instruction Fuzzy Hash: CC31D1755083806FE722CB26CC45FA2BFB8EF06710F08849AE984CB253D364E84CCB65

Function 012F15F3 Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4123109540.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12f0000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 738b85e9ee4cd53242a5b39bc9ddf13670a88bbcf2bcfa43657dd06212eb33cb
Instruction ID: 24bd0bf5bfa3f1103841ced5966f245435518af4bfb2864a27ee20654d6d9f21
Opcode Fuzzy Hash: 738b85e9ee4cd53242a5b39bc9ddf13670a88bbcf2bcfa43657dd06212eb33cb
Instruction Fuzzy Hash: 7B31DC724093848FE7138B25EC45AA5FFB4EF07224F0844EED9848B663D3259A1DC7B2

Function 012F0A42 Relevance: 1.6, APIs: 1, Instructions: 86registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(?,00000E24), ref: 012F0ADD

Memory Dump Source

Source File: 00000000.00000002.4123109540.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12f0000_7tjt3u68PZ.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 0527b1dc113a94dc1a4e6497469a093c143e007c4cfcc10dbfb72ad977ec7692
Instruction ID: b244df7e8b709abe9f6e76504f2565b60f9926b7171b2aa7fc9f729ef3031981
Opcode Fuzzy Hash: 0527b1dc113a94dc1a4e6497469a093c143e007c4cfcc10dbfb72ad977ec7692
Instruction Fuzzy Hash: 0A219EB6600204AFEB21CE15CD44FA7FBECEF08614F08852AFB45D7A52E320E44C8A65

Function 050894D0 Relevance: 1.6, Strings: 1, Instructions: 335COMMON

Download Yara Rule

Strings

:@k, xrefs: 0508999B

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: :@k
API String ID: 0-2277858631
Opcode ID: 44453e03f99aed60acda1d5b83896dafbb1284c22b4d6956613b96d01eea8548
Instruction ID: 922acccac78b6892e37f1ddf7fe4fbd1e93363eca76c95c588c2424d0dc71181
Opcode Fuzzy Hash: 44453e03f99aed60acda1d5b83896dafbb1284c22b4d6956613b96d01eea8548
Instruction Fuzzy Hash: 5BD13B30A00209EFDB09FFB5F460AAD77B2BF88344B528529D416A77A8DF35AC45DB50

Function 011CA6CE Relevance: 1.6, APIs: 1, Instructions: 85comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?,00000E24,?,?), ref: 011CA77E

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 0d158fc60b0cd2adc98ac301739ab075b4698f7236622013cbb2b62d621c0fd8
Instruction ID: bfcc267e89ffcd159245e31a196942550ba2f6a00cabfd634c26e72b7fa701b5
Opcode Fuzzy Hash: 0d158fc60b0cd2adc98ac301739ab075b4698f7236622013cbb2b62d621c0fd8
Instruction Fuzzy Hash: 18316D7104D3C06FD3138B259C61B62BFB4EF87614F0A80CBE884CB6A3D2296819D772

Function 012F0B25 Relevance: 1.6, APIs: 1, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(?,00000E24,FEEAE30E,00000000,00000000,00000000,00000000), ref: 012F0BD4

Memory Dump Source

Source File: 00000000.00000002.4123109540.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12f0000_7tjt3u68PZ.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 77b4a2c1949b87c5f0355818baac98f79843dde1657444f38ee4094d51aa42fb
Instruction ID: 90e0113876daf81d1ff85a206484c0b1ee3d615caed1f06d377760d573016b0c
Opcode Fuzzy Hash: 77b4a2c1949b87c5f0355818baac98f79843dde1657444f38ee4094d51aa42fb
Instruction Fuzzy Hash: 2831F5764087C06FDB228B258C44B93FFB8EF06710F0885DEE9858B593D364E448C761

Function 012F2D6C Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNELBASE(?,00000E24,FEEAE30E,00000000,00000000,00000000,00000000), ref: 012F2E00

Memory Dump Source

Source File: 00000000.00000002.4123109540.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12f0000_7tjt3u68PZ.jbxd

Similarity

API ID: CodeExitProcess
String ID:
API String ID: 3861947596-0
Opcode ID: 1309939f77e1da33babbbc2a89607aba0e97a79b7f5c07a6d0ad98fbc33381f7
Instruction ID: 557e37e819a69c5d5ba101524645cde84c9e36b588b52dfc2b729a9b4f1dba24
Opcode Fuzzy Hash: 1309939f77e1da33babbbc2a89607aba0e97a79b7f5c07a6d0ad98fbc33381f7
Instruction Fuzzy Hash: 952104755093805FE7138B21DC54B96FFA8AF42224F1C84DAE9888F293D228A949C761

Function 012F1DA2 Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,00000E24), ref: 012F1E47

Memory Dump Source

Source File: 00000000.00000002.4123109540.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12f0000_7tjt3u68PZ.jbxd

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: a7a77d3f5684d92203e0ba3a80e4541669f270c013c60e00f46ba07108494d94
Instruction ID: 35395ae7dbd2deb01424e48c85bc1937f38df6fed7c3c219caed9e0dc1282df0
Opcode Fuzzy Hash: a7a77d3f5684d92203e0ba3a80e4541669f270c013c60e00f46ba07108494d94
Instruction Fuzzy Hash: 8821D1B2500204AEEB21DF61CD85FAAF7ACEF04714F04485AFA489A681D7B4E54D8BB1

Function 011CB4C8 Relevance: 1.6, APIs: 1, Instructions: 82windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(?,00000E24), ref: 011CB571

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: 914f0a95192c5177a43224d3bca183cd39e6a750ca69fb66197a05639125e5c3
Instruction ID: ed22df0304e06958e4c7476591d624e739e1138033cf182c3f836a177c0e74c2
Opcode Fuzzy Hash: 914f0a95192c5177a43224d3bca183cd39e6a750ca69fb66197a05639125e5c3
Instruction Fuzzy Hash: 0D21E471504340AFEB228F61DC45FA6FFB8EF46710F08849EFA848B662D375A509CB65

Function 011CBA5E Relevance: 1.6, APIs: 1, Instructions: 81COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,?), ref: 011CBAF3

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 3c78a34b303dbad0b87e29ab22db1a1c2919e827e74b71e128a165b6302b87a3
Instruction ID: 724fecd255941130e4bc91228257a81dae0e2a837ad70ccd5572813bad1ff7eb
Opcode Fuzzy Hash: 3c78a34b303dbad0b87e29ab22db1a1c2919e827e74b71e128a165b6302b87a3
Instruction Fuzzy Hash: DB31487150E3C09FD7138B259C65A52BFB4EF43210B0A84DBD985CF2A3D228A849CB72

Function 012F2C9D Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

select.WS2_32(?,?,?,?,?), ref: 012F2D2C

Memory Dump Source

Source File: 00000000.00000002.4123109540.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12f0000_7tjt3u68PZ.jbxd

Similarity

API ID: select
String ID:
API String ID: 1274211008-0
Opcode ID: e739e2e0b7fb84efbf8f05ce6e70aa8fc25d00ce1ea26bbda432800820f41a16
Instruction ID: b84e556f452eb95f272cbcb1a7350a3ddad613c04bb9810760c39f0408beebfa
Opcode Fuzzy Hash: e739e2e0b7fb84efbf8f05ce6e70aa8fc25d00ce1ea26bbda432800820f41a16
Instruction Fuzzy Hash: 4E213E755093849FEB22CF25DC44B92BFF8EF06610F09849AEA84CB162D265E949CB61

Function 011CAE77 Relevance: 1.6, APIs: 1, Instructions: 78fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000E24,FEEAE30E,00000000,00000000,00000000,00000000), ref: 011CAF0D

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 9d835aca13be72eb348ed5a2cdd4966faa74197320f0c9331bdd8935ce4e35cc
Instruction ID: 6d3a7c3a98edfeea51da1ea189833108371e754ff6fe65fce28acb4258c06510
Opcode Fuzzy Hash: 9d835aca13be72eb348ed5a2cdd4966faa74197320f0c9331bdd8935ce4e35cc
Instruction Fuzzy Hash: DD21D6B5409384AFDB22CB51DD44F96BFB8EF46714F08849AE9849F553D234A508CB71

Function 012F16B2 Relevance: 1.6, APIs: 1, Instructions: 77fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE(00000000), ref: 012F1746

Memory Dump Source

Source File: 00000000.00000002.4123109540.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12f0000_7tjt3u68PZ.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 084a86a556c9fcbecd2db8eadf8799915e8073d8f868badebf66d1c023ac52b4
Instruction ID: a186a2b3fffa77f2d4b7612783473c0a207bf225e8816f057a7fbd228fa9fa22
Opcode Fuzzy Hash: 084a86a556c9fcbecd2db8eadf8799915e8073d8f868badebf66d1c023ac52b4
Instruction Fuzzy Hash: 1D21E171404340AFE722CB56CC44F96FBF8EF09224F08849EEA858B652C375E548CB61

Function 012F10D6 Relevance: 1.6, APIs: 1, Instructions: 77networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 012F1162

Memory Dump Source

Source File: 00000000.00000002.4123109540.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12f0000_7tjt3u68PZ.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: 3458911f197c4d4090d9ec7f561ba55abe23894d769c4a7a2da0103ce271cf9b
Instruction ID: 01cf3f3abce910059822c40d3e9a235550b51c5da8af94209d543689b9aaf3fd
Opcode Fuzzy Hash: 3458911f197c4d4090d9ec7f561ba55abe23894d769c4a7a2da0103ce271cf9b
Instruction Fuzzy Hash: 31219E71505380AFE722CF55DD45B96FFB8EF05210F08889EEA858B692C375A548CB61

Function 011CA078 Relevance: 1.6, APIs: 1, Instructions: 77fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,00000E24,?,?), ref: 011CA10E

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 6173f201682d12b44ffd048147f396294dee4baa7d33dca9c7b35265554453a0
Instruction ID: 8aafb43fe8bd6920bb67732cf9a0e26817c6308ef4cafa939baafc980945ce81
Opcode Fuzzy Hash: 6173f201682d12b44ffd048147f396294dee4baa7d33dca9c7b35265554453a0
Instruction Fuzzy Hash: 4021B37150D3C06FC3128B218C55B66BFB4EF87620F1985DBD984DF693D238A909CBA2

Function 011CB3EA Relevance: 1.6, APIs: 1, Instructions: 77registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(?,00000E24,FEEAE30E,00000000,00000000,00000000,00000000), ref: 011CB480

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: b0e45def1af37f89d9c8745064e75b0f35220be33858eaf822cc0cdbd21edbc1
Instruction ID: f4959fb70ca33391432f2fd32ff5f55315c292cf61b1dcf792ef2706bee40234
Opcode Fuzzy Hash: b0e45def1af37f89d9c8745064e75b0f35220be33858eaf822cc0cdbd21edbc1
Instruction Fuzzy Hash: 7D21DE76508780AFEB228B15DC45FA3FFB8EF46610F08848AE985CB652C324E848C771

Function 012F1522 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E24), ref: 012F1593

Memory Dump Source

Source File: 00000000.00000002.4123109540.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12f0000_7tjt3u68PZ.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: f6ed031f7978655a7de8c012029e4f1ba2d6d445ce2c995fe9f2787bf8eae06f
Instruction ID: 8fbff0d9386d187507c3158425a097217a2681c65a5c251a5045ef6ab78349d1
Opcode Fuzzy Hash: f6ed031f7978655a7de8c012029e4f1ba2d6d445ce2c995fe9f2787bf8eae06f
Instruction Fuzzy Hash: 7B21D771600204AFEB20DF65DD45FAAFBECEF04214F08846AEA45CB641D374E548CB71

Function 012F140A Relevance: 1.6, APIs: 1, Instructions: 76registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,FEEAE30E,00000000,00000000,00000000,00000000), ref: 012F14A8

Memory Dump Source

Source File: 00000000.00000002.4123109540.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12f0000_7tjt3u68PZ.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: f0a01eb6e9bc79b712deed82f6e38b67e7242c022588562f478cd9afb4fb3094
Instruction ID: 58a9586243085ffd24ddff485ca4a8176bfb5901cb153c7b4b7f95da8b9db478
Opcode Fuzzy Hash: f0a01eb6e9bc79b712deed82f6e38b67e7242c022588562f478cd9afb4fb3094
Instruction Fuzzy Hash: 9721A175504384AFE722CB56DD44FA7FFF8EF45610F08849AEA859B692D324E408CB61

Function 011CAAA6 Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 011CAB25

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 2c755afad841ac81c0f9e9a138c52781fa25d3c5bddb635c243082e198d83679
Instruction ID: a859c5b0907ad4059220cb8c8c10f86b3d7f784dea45fcc3603e41576c96f40c
Opcode Fuzzy Hash: 2c755afad841ac81c0f9e9a138c52781fa25d3c5bddb635c243082e198d83679
Instruction Fuzzy Hash: F72181B1600204AFEB25CF66DD85B66FBE8EF14614F08886DEA458B652E375E408CB71

Function 011CB212 Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000E24), ref: 011CB291

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 04011f5e636dc4f83caa54fba3ef1179a8ca99368020a18c025360a8ad3bbc94
Instruction ID: d6ca475956388adb8c2067c06dd59b1e156775e0d68c557c753a802241287e89
Opcode Fuzzy Hash: 04011f5e636dc4f83caa54fba3ef1179a8ca99368020a18c025360a8ad3bbc94
Instruction Fuzzy Hash: 6C21FFB2500204AEEB208B55CD45FABFBECEF14710F04841AE944CAA42D320E44CCAB6

Function 012F2E63 Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetProcessWorkingSetSize.KERNEL32(?,00000E24,FEEAE30E,00000000,00000000,00000000,00000000), ref: 012F2EDF

Memory Dump Source

Source File: 00000000.00000002.4123109540.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12f0000_7tjt3u68PZ.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: b5c05b44ac1aabb551b83ca46275ad4d37a5cb25473afcbc01eadd9c38d570d0
Instruction ID: 9aa8523cb6e5fffb4bd3d08c5e7756b21f53f5c5bec3f2b6a36ec8a458041210
Opcode Fuzzy Hash: b5c05b44ac1aabb551b83ca46275ad4d37a5cb25473afcbc01eadd9c38d570d0
Instruction Fuzzy Hash: 7321D7755053846FDB22CB15DC44FA6FFA8EF46210F0884AEE944CB592D374E548CB71

Function 011CA9BF Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 011CAA44

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 9d88c5b9d43165b9a0c28025beedf55c481341de54a96a5aebab8e096a5abb34
Instruction ID: a531e62c403be0b180651bde06e873551c4aa71d866efcf2c28405bdcf4b5669
Opcode Fuzzy Hash: 9d88c5b9d43165b9a0c28025beedf55c481341de54a96a5aebab8e096a5abb34
Instruction Fuzzy Hash: 0E21896540E3C49FDB138B259C64A51BFB4EF53624F0E80DBD8848F6A3D268980CCB72

Function 011CAC37 Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,FEEAE30E,00000000,00000000,00000000,00000000), ref: 011CACBD

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 859d6a4d61c2aadfb2b4f82eddb5cea819965031f6a02972093e182514c57c36
Instruction ID: bbb3ad2c675dd44a84302ea1255bc8a05e6500a5a9314cceeb014b3a682dd5a6
Opcode Fuzzy Hash: 859d6a4d61c2aadfb2b4f82eddb5cea819965031f6a02972093e182514c57c36
Instruction Fuzzy Hash: 312105B54083846FE7128B11DC44BA2BFB8EF43714F0880DAE9848B693D268A90DC775

Function 012F1949 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000E24,FEEAE30E,00000000,00000000,00000000,00000000), ref: 012F19CC

Memory Dump Source

Source File: 00000000.00000002.4123109540.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12f0000_7tjt3u68PZ.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: dcd325b03fbd3c103622cc2b3950a599e4e90e6d38dea1bcd125d80cd3450781
Instruction ID: b227f4afe8869712ea1e514a3252afb275065bd70ad03b3eb8ab1a0ae0dcda9a
Opcode Fuzzy Hash: dcd325b03fbd3c103622cc2b3950a599e4e90e6d38dea1bcd125d80cd3450781
Instruction Fuzzy Hash: EB21D4B1409384AFDB12CB15DC44B96FFB8EF46620F0884DBE9849F653C368A548CB72

Function 011CA140 Relevance: 1.6, APIs: 1, Instructions: 72networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,?), ref: 011CA1C1

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 9e7d5c8bd664380ac956652c5b6d3b2f5f2f799bdb4220b6bb519403dac3df97
Instruction ID: c94a4d85fe175ce7f48e4f302e4577a70565933e14146ac4ebad0adf042897a6
Opcode Fuzzy Hash: 9e7d5c8bd664380ac956652c5b6d3b2f5f2f799bdb4220b6bb519403dac3df97
Instruction Fuzzy Hash: 5F21AC7540D3C09FDB238B259C94A52BFB4EF47220F0984DBD9848F5A3D269A809DB72

Function 011CB06A Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE(?,?), ref: 011CB0DD

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 7e4029ef37c5dabba79a764621a5cc1819debb7454eadbf6cb99f35c12a4a040
Instruction ID: 2247edd9f27869db16e4bff4f38cf9128bbb907c6d70bfaef63fce26937bdc57
Opcode Fuzzy Hash: 7e4029ef37c5dabba79a764621a5cc1819debb7454eadbf6cb99f35c12a4a040
Instruction Fuzzy Hash: B221D4B16042009FEB20DF66DD86BA6FBE8EF14620F04846DE945CB742D375E408CB76

Function 012F2BD7 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000E24,FEEAE30E,00000000,00000000,00000000,00000000), ref: 012F2C53

Memory Dump Source

Source File: 00000000.00000002.4123109540.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12f0000_7tjt3u68PZ.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 8b8066c5ac9914d450a91a2cfbb149b1b45e74d07bca7fd77693bbaf1ebe669b
Instruction ID: 14fe7a61f4d0499c60808b13aebe6cfaca2d548896e8ce8bae89086be9293320
Opcode Fuzzy Hash: 8b8066c5ac9914d450a91a2cfbb149b1b45e74d07bca7fd77693bbaf1ebe669b
Instruction Fuzzy Hash: 9B21F371409384AFDB22CF51DD44FA6FFB8EF46210F08849AEA849B652C334A508C7B1

Function 011CB31A Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,FEEAE30E,00000000,00000000,00000000,00000000), ref: 011CB394

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: f82ebd018fd8714042bfccacba492c463bce1e4be3628c109ff44add9a1c3dcd
Instruction ID: 4882e365bca19f446c54e3194a0507f85bb9b941b51f98fe4352c9f3fbe9b513
Opcode Fuzzy Hash: f82ebd018fd8714042bfccacba492c463bce1e4be3628c109ff44add9a1c3dcd
Instruction Fuzzy Hash: E921C075608200AFE720CF56DD85FA7B7ECEF14B50F08845AED45CB652D360E848CAB5

Function 011CB7B5 Relevance: 1.6, APIs: 1, Instructions: 69fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNELBASE(?,?,?), ref: 011CB82A

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 2512a9f6dd8d21015d1404734ecd133d1753da2eb0094c84e674a67606e2e56f
Instruction ID: 6b1ccdee18f871fc5b2d4ce7c92b238e299ec60004297035fcb017983933059e
Opcode Fuzzy Hash: 2512a9f6dd8d21015d1404734ecd133d1753da2eb0094c84e674a67606e2e56f
Instruction Fuzzy Hash: 0A2181716093805FEB628F29DC55B63BFE8EF46610F08849EED85CB652D225E804CB61

Function 012F1F52 Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 012F1FCE

Memory Dump Source

Source File: 00000000.00000002.4123109540.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12f0000_7tjt3u68PZ.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: 9ec6b7ae80cce5267834d4d6b521220b0b5cf18cd2aa5b486bb5413924fb83b4
Instruction ID: 28dc29a4f0377ec74dd78d6161e46458d548d3433b02cad4dc65cf1badb90021
Opcode Fuzzy Hash: 9ec6b7ae80cce5267834d4d6b521220b0b5cf18cd2aa5b486bb5413924fb83b4
Instruction Fuzzy Hash: 25217F75508380AFDB228F55DC44B62FFB4EF06710F08859EEA858B562D235A418DB61

Function 012F10F6 Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 012F1162

Memory Dump Source

Source File: 00000000.00000002.4123109540.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12f0000_7tjt3u68PZ.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: 61fb8731024baff3f4787786c1d92c774b5fd5a0f039419eef9ecb59c7003c76
Instruction ID: 4a932b599c9d7902a4e853365f7cb5d82ec0b23f8fe26748d313275222253690
Opcode Fuzzy Hash: 61fb8731024baff3f4787786c1d92c774b5fd5a0f039419eef9ecb59c7003c76
Instruction Fuzzy Hash: 0D21A171500200AFEB21CF56DD45BA6FBE8EF08324F04886EEA458AB52D375E559CB71

Function 012F16D2 Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE(00000000), ref: 012F1746

Memory Dump Source

Source File: 00000000.00000002.4123109540.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12f0000_7tjt3u68PZ.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 9de3f43e3ff41f05e8478b33a1b2cb9f49429c1419843feb1dbebcd61211f4fb
Instruction ID: 565477e355f26dcc3834452925529088f61804f05262297fdb5a2a3b20fbbb04
Opcode Fuzzy Hash: 9de3f43e3ff41f05e8478b33a1b2cb9f49429c1419843feb1dbebcd61211f4fb
Instruction Fuzzy Hash: AE21D171500200AFE721CF56DD85FA6FBE8EF08224F04846DEA498B652D371E548CBA1

Function 012F220E Relevance: 1.6, APIs: 1, Instructions: 66libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,00000E24), ref: 012F2297

Memory Dump Source

Source File: 00000000.00000002.4123109540.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12f0000_7tjt3u68PZ.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8dbdefa7f5b620f280f046c726a589b6e99a91634bee108183925d65466c31c2
Instruction ID: 9ee1b96652cbd15edddde91678aac88dc60e369e6c52ed670897d0b095d33704
Opcode Fuzzy Hash: 8dbdefa7f5b620f280f046c726a589b6e99a91634bee108183925d65466c31c2
Instruction Fuzzy Hash: 1211E475504340AFE721CB15DD85FA6FBA8DF45720F18809AFA448B692C264A948CB61

Function 011CB4F6 Relevance: 1.6, APIs: 1, Instructions: 66windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(?,00000E24), ref: 011CB571

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: 74322041b0963ffca8ac1f99e346359b0a88b85555bf5a426a0f1f9f893a01e6
Instruction ID: a51f6cd54eb31309836b51df3aa73745f7a357b3c2b367855d2d92718662cbf9
Opcode Fuzzy Hash: 74322041b0963ffca8ac1f99e346359b0a88b85555bf5a426a0f1f9f893a01e6
Instruction Fuzzy Hash: 7C212172500200AFEB318F51DC41FA6FBA8EF14710F18845EEE458AA91C371E508CBB5

Function 012F1436 Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,FEEAE30E,00000000,00000000,00000000,00000000), ref: 012F14A8

Memory Dump Source

Source File: 00000000.00000002.4123109540.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12f0000_7tjt3u68PZ.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: dfbc2663a97930880cb2d9cd9d1ca4bd746c6cfee755b1ca0f56c155920545da
Instruction ID: f0f5f24295365b2f24cfca56077b24bad94332a2f3e526e5e8b57acd2eb0c59b
Opcode Fuzzy Hash: dfbc2663a97930880cb2d9cd9d1ca4bd746c6cfee755b1ca0f56c155920545da
Instruction Fuzzy Hash: AA11E4756002049FEB21CF16CD44FA6F7ECEF44624F08806EEA458BA52D374E448CBB1

Function 011CB40E Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(?,00000E24,FEEAE30E,00000000,00000000,00000000,00000000), ref: 011CB480

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 33320e04af1b6244e5c3eb4394fbbc5ba3b97469f47d218aa030c58d11e5ff85
Instruction ID: 4041fb968a27a106a84cb5a5e0d00903b5a6d30eecd602b59a3dd1646c4471a9
Opcode Fuzzy Hash: 33320e04af1b6244e5c3eb4394fbbc5ba3b97469f47d218aa030c58d11e5ff85
Instruction Fuzzy Hash: 1C1106755046009FEB218F05DC41FA7FBECEF14610F08845AED42CA752D330E408CAB5

Function 012F1C3E Relevance: 1.6, APIs: 1, Instructions: 64timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNELBASE(?,00000E24,FEEAE30E,00000000,00000000,00000000,00000000), ref: 012F1C9D

Memory Dump Source

Source File: 00000000.00000002.4123109540.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12f0000_7tjt3u68PZ.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: 66dddb7bb0a4cf408381b1f5f6b865e225d9a7fa91bc7505a81e3952f26d8a28
Instruction ID: 127a4f0d9c5677c2ecba301d79479cbf57cde40cda15dc45ae0aabae06719974
Opcode Fuzzy Hash: 66dddb7bb0a4cf408381b1f5f6b865e225d9a7fa91bc7505a81e3952f26d8a28
Instruction Fuzzy Hash: 7C11E675500200AFEB21CF55DD45BAAFBE8EF04320F18846EEA45CB651D375E458CBB2

Function 011CBBE2 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 011CBC4A

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 21b3148216e0aa3be6ad9bf2cfcefad7b10ab1168dad8ad61ce9fa10b38a1fb3
Instruction ID: 1c2d4b28e42418c2292e62c74cb48e4765ced8f98908b98b8270da706d12d605
Opcode Fuzzy Hash: 21b3148216e0aa3be6ad9bf2cfcefad7b10ab1168dad8ad61ce9fa10b38a1fb3
Instruction Fuzzy Hash: 3511D3B16043405FEB21CF29DC45B63BFE8EF45620F0884AEED45CB252D275E804CB65

Function 012F2F47 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

SetProcessWorkingSetSize.KERNEL32(00000000,?,00000E24,FEEAE30E,00000000,00000000,00000000,00000000), ref: 012F2FC3

Memory Dump Source

Source File: 00000000.00000002.4123109540.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12f0000_7tjt3u68PZ.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 7bf7b622dab0c1e86796b455464c75df5352b5ee119b2253201594f6fd9c0785
Instruction ID: fdb9943f283e3737b2e9953e0cb31df949d4c7d65b8237ccdfdb37724ac94f00
Opcode Fuzzy Hash: 7bf7b622dab0c1e86796b455464c75df5352b5ee119b2253201594f6fd9c0785
Instruction Fuzzy Hash: 51117FB55093806FEB22CB25CD48F56BFA8AF46614F08849EF584DB592C364A848CB65

Function 012F2E86 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetProcessWorkingSetSize.KERNEL32(?,00000E24,FEEAE30E,00000000,00000000,00000000,00000000), ref: 012F2EDF

Memory Dump Source

Source File: 00000000.00000002.4123109540.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12f0000_7tjt3u68PZ.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 82d641a6e420fe274e7bcabac0725ffaec4ddf586432c882cbb98f4dae83e91e
Instruction ID: b2a5de841261d66a80e6c4fc748c34cfa1f5dcb0e149c281cbd666be384b201d
Opcode Fuzzy Hash: 82d641a6e420fe274e7bcabac0725ffaec4ddf586432c882cbb98f4dae83e91e
Instruction Fuzzy Hash: 5611C4756102009FEB21CF15DD45BA6F7E8DF45324F18846AEE45CB641D374E548CBB1

Function 012F0B6A Relevance: 1.6, APIs: 1, Instructions: 61registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(?,00000E24,FEEAE30E,00000000,00000000,00000000,00000000), ref: 012F0BD4

Memory Dump Source

Source File: 00000000.00000002.4123109540.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12f0000_7tjt3u68PZ.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 327b3a0b27391f17768af1f03a913f885dbb7396e195b1ed03c745f4ff6ebaec
Instruction ID: 57042261f9826523bb5af818ba949adc76e5c976e690c4002f017a46c426c9a3
Opcode Fuzzy Hash: 327b3a0b27391f17768af1f03a913f885dbb7396e195b1ed03c745f4ff6ebaec
Instruction Fuzzy Hash: E511C476500704AFEB218F15DD45FA6FBE8EF04714F08846AFA458B652D370E448CBB5

Function 012F2DAA Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNELBASE(?,00000E24,FEEAE30E,00000000,00000000,00000000,00000000), ref: 012F2E00

Memory Dump Source

Source File: 00000000.00000002.4123109540.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12f0000_7tjt3u68PZ.jbxd

Similarity

API ID: CodeExitProcess
String ID:
API String ID: 3861947596-0
Opcode ID: bffba17d5a4c01805d8049b6232e95cdc81f1ae37608b87420903cf871aecb3c
Instruction ID: 710203bf4a2037662ca1746ca91d20bf32d46aa7aa9002bc58f18a17caf339a9
Opcode Fuzzy Hash: bffba17d5a4c01805d8049b6232e95cdc81f1ae37608b87420903cf871aecb3c
Instruction Fuzzy Hash: D211E375600200AFEB11CF16DD85BAAF7A8DF05224F28846AEE05CF652D374E5488BB1

Function 011CA573 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 011CA5DE

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d787e922ada47f65ee78b9f2c383c4324a4a36be991d144e6e0778ba8ad529bc
Instruction ID: 8ed86dd16fcacda7ddfa10b07f3173bfe6ed8cb5977b6359a4be93b9f69706e0
Opcode Fuzzy Hash: d787e922ada47f65ee78b9f2c383c4324a4a36be991d144e6e0778ba8ad529bc
Instruction Fuzzy Hash: A311AF71408380AFDB228F55DC44B62FFF4EF4A610F08889EEE858B562D235A418DB62

Function 011CAEAE Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000E24,FEEAE30E,00000000,00000000,00000000,00000000), ref: 011CAF0D

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 624f673d06c8bc64bc11646e2b2d70ea5fb386c051ef9fd54d8db1df9389af1f
Instruction ID: 3afa1d77226f22267c8942b1fe2f3d1f70d1954f46b8aa41607a6583509c4fa9
Opcode Fuzzy Hash: 624f673d06c8bc64bc11646e2b2d70ea5fb386c051ef9fd54d8db1df9389af1f
Instruction Fuzzy Hash: D4112BB1500204AFEB21CF55DD44FAAFBE8EF14710F04845AE9458B651D334E448CBB2

Function 011CB885 Relevance: 1.6, APIs: 1, Instructions: 59fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?), ref: 011CB8E4

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: ae24426d7d0d0e23f038012976e996bf685ee1372fc113eba4ee52c9086846b4
Instruction ID: db0997fd5dd9010e9cc1104efc54d8d9154838592347d5d123745adf063326c7
Opcode Fuzzy Hash: ae24426d7d0d0e23f038012976e996bf685ee1372fc113eba4ee52c9086846b4
Instruction Fuzzy Hash: D91190B19093805FDB11CB25DC85B66BFE8EF46620F0984AEE985CB253D224E948CB61

Function 012F2BFA Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000E24,FEEAE30E,00000000,00000000,00000000,00000000), ref: 012F2C53

Memory Dump Source

Source File: 00000000.00000002.4123109540.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12f0000_7tjt3u68PZ.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 89647d587a5d3440a2f41086be10abb6c5294d667d1262756d79ce246f8529b9
Instruction ID: a8e42d22b606cc7ecd0d0f3f2cfebc2d027eff33cf8303032aac0c5e12ce0237
Opcode Fuzzy Hash: 89647d587a5d3440a2f41086be10abb6c5294d667d1262756d79ce246f8529b9
Instruction Fuzzy Hash: 4A11E0B5500204AFEB21CF55DD85BA6FBA8EF05324F18846AEA489B642C374E548CBB1

Function 012F1976 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000E24,FEEAE30E,00000000,00000000,00000000,00000000), ref: 012F19CC

Memory Dump Source

Source File: 00000000.00000002.4123109540.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12f0000_7tjt3u68PZ.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: 8fba7dbc4681e3cd773e78c7211db166695f286bc9842bdb0ac245f9290f4e41
Instruction ID: dcf68e100fadc7156d75b734342c7640123b1bab2ca1a27f3dff4576e70088af
Opcode Fuzzy Hash: 8fba7dbc4681e3cd773e78c7211db166695f286bc9842bdb0ac245f9290f4e41
Instruction Fuzzy Hash: 47110275500200AFEB21CF16DD85BA6F7E8DF04724F1884AAEE448B642D374E548CBB1

Function 012F222E Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,00000E24), ref: 012F2297

Memory Dump Source

Source File: 00000000.00000002.4123109540.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12f0000_7tjt3u68PZ.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4b39a90aa34836e51e0a1635b9a59a835f0c83fe3a8ae35fa267c28741175c2a
Instruction ID: 327991d1e2f7d359f204cd2e48c7a44e2a24e97c3e4baa97876d3f332a00b07e
Opcode Fuzzy Hash: 4b39a90aa34836e51e0a1635b9a59a835f0c83fe3a8ae35fa267c28741175c2a
Instruction Fuzzy Hash: 3E11E575510200AEEB20DB16DD85FB6F7A8DF05724F148059EE445A782D3B4E54CCAB5

Function 011CA20C Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNELBASE ref: 011CA269

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: DrivesLogical
String ID:
API String ID: 999431828-0
Opcode ID: f264b16b4840d03311245b8dc5a1b96368efc97b9785c5f69f426b0639676a0a
Instruction ID: cdafab5ff7899fc53295a80c0ae154620caf0edff2ee080197176dfe83d2fb68
Opcode Fuzzy Hash: f264b16b4840d03311245b8dc5a1b96368efc97b9785c5f69f426b0639676a0a
Instruction Fuzzy Hash: 5A1191715083809FEB128F15ED44BA2BFA8EF47620F0884DAED848F253D275A908DB71

Function 012F2CD6 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

select.WS2_32(?,?,?,?,?), ref: 012F2D2C

Memory Dump Source

Source File: 00000000.00000002.4123109540.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12f0000_7tjt3u68PZ.jbxd

Similarity

API ID: select
String ID:
API String ID: 1274211008-0
Opcode ID: 535adcf684e905331ac36795180940999d800b2cbd519bacadc5b7d84ee062aa
Instruction ID: 290481cc0fdda8562ff76b990c2dbef32b3aa00f9a951a5c0019c9cf1a1fc995
Opcode Fuzzy Hash: 535adcf684e905331ac36795180940999d800b2cbd519bacadc5b7d84ee062aa
Instruction Fuzzy Hash: 9D119475610204CFEB20CF19D985B92FBE8EF05610F08846EDE49CB6A6D370E448CBB1

Function 011CBC02 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 011CBC4A

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 8d192960744ade39079dcc4f035a5fc3ad5f38f41ccef6ee5085b02df29cec11
Instruction ID: e2f27ce4325d5dd5d41aae4bdf5c6c2343e8af3584aa6f1595979044a9ca5219
Opcode Fuzzy Hash: 8d192960744ade39079dcc4f035a5fc3ad5f38f41ccef6ee5085b02df29cec11
Instruction Fuzzy Hash: C311A5B56042008FEB54CF19D886B66FBD8EF14620F08846EDD49CB752D775E504CB6A

Function 011CB7E2 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNELBASE(?,?,?), ref: 011CB82A

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 8d192960744ade39079dcc4f035a5fc3ad5f38f41ccef6ee5085b02df29cec11
Instruction ID: 6a57f6cea0386e0408d0ae2a8b8318859b309fb1ac43763d0def5cae862f3b74
Opcode Fuzzy Hash: 8d192960744ade39079dcc4f035a5fc3ad5f38f41ccef6ee5085b02df29cec11
Instruction Fuzzy Hash: FD1182B1A042008FEB54CF19D886767FBD8EF14A60F08846EDD45CB752D374D404CA75

Function 011CB9D0 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 011CBA24

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 9a2587fa42069ec1d4c6d91044394ea90dc2f845968b23f463e1e1f01a361f51
Instruction ID: 16606286ed1d2a93fa33552f1ca29032282e949c2af80e4f1495aef044567821
Opcode Fuzzy Hash: 9a2587fa42069ec1d4c6d91044394ea90dc2f845968b23f463e1e1f01a361f51
Instruction Fuzzy Hash: 2711E5755093C09FDB128B15DC85B52FFB4DF06220F0880DEED858B263D274E908CB62

Function 011CAC6A Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,FEEAE30E,00000000,00000000,00000000,00000000), ref: 011CACBD

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: aa798094678a46abb0e898a799ebbd5635e7ca6b704db20575c9d316c219473a
Instruction ID: 498cc6346dd4e98b70b121b5c37889460dfd2557582ba55651a23334f5630849
Opcode Fuzzy Hash: aa798094678a46abb0e898a799ebbd5635e7ca6b704db20575c9d316c219473a
Instruction Fuzzy Hash: 7201D675504204AFE721CB06ED85BA6F79CDF15724F18C05AEE048B742D374E44CCAB6

Function 012F1F82 Relevance: 1.5, APIs: 1, Instructions: 49networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 012F1FCE

Memory Dump Source

Source File: 00000000.00000002.4123109540.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12f0000_7tjt3u68PZ.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: fcbafc3b33ea956ee2f0018d73fc84f4e2984d394aba819e80e09d4e85ee602e
Instruction ID: b4c7e8169d3c6b33b370793f2065138c90947d591a31a533ff7123cc8070d70a
Opcode Fuzzy Hash: fcbafc3b33ea956ee2f0018d73fc84f4e2984d394aba819e80e09d4e85ee602e
Instruction Fuzzy Hash: 3C11A072510300DFEB20CF55D844B62FBE4EF18710F08856EDE458B622D375E418CBA1

Function 011CBAB6 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,?), ref: 011CBAF3

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9e28442c749f685e7d2ab3845e767ef0e7ba6fbf0ea4bbd63ab867ea464a396f
Instruction ID: 7ee81b76eca4c924e1b4038fad602753a8330b531563015c3c6322fd547152e9
Opcode Fuzzy Hash: 9e28442c749f685e7d2ab3845e767ef0e7ba6fbf0ea4bbd63ab867ea464a396f
Instruction Fuzzy Hash: AE01B5756042408FEB64CF29D985766FBE8EF14620F08C4AEDD45CB756D374E404CBA6

Function 012F2F6A Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetProcessWorkingSetSize.KERNEL32(00000000,?,00000E24,FEEAE30E,00000000,00000000,00000000,00000000), ref: 012F2FC3

Memory Dump Source

Source File: 00000000.00000002.4123109540.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12f0000_7tjt3u68PZ.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: a8d47847c9ee059ae9b5e1eb9b366dbbd94ef628bcf883532be182da6d65441b
Instruction ID: 2473a4e92aea5f110ba020514bae0dd7c510974045067f6418d9a161d33c3702
Opcode Fuzzy Hash: a8d47847c9ee059ae9b5e1eb9b366dbbd94ef628bcf883532be182da6d65441b
Instruction Fuzzy Hash: D60180B4100200AFEB21CB15CD84F66BBECEF05714F18846DEA44DB692D374A848CB74

Function 011CA0BE Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,00000E24,?,?), ref: 011CA10E

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 98e2e24d0451bbbcf422c628b298566b8389b98b7688d1f7a8245b535185e165
Instruction ID: d32bbe1dd8ae30b3b86ee6b4ca12470038b65f2ea7449b537020604664d861b8
Opcode Fuzzy Hash: 98e2e24d0451bbbcf422c628b298566b8389b98b7688d1f7a8245b535185e165
Instruction Fuzzy Hash: 4301B171A00200ABD710DF16DD46B76FBE8EB88A20F14815AED089BB41D735F955CBE1

Function 011CB8AA Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?), ref: 011CB8E4

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 41e83e06e8db648e7e7236b490ff18d5daaef7c2b855adbf1c365aeb66b8f555
Instruction ID: d04f7f879095ea2967501f5e113d83cf645025a812c686fb3f8d491cb60d0df5
Opcode Fuzzy Hash: 41e83e06e8db648e7e7236b490ff18d5daaef7c2b855adbf1c365aeb66b8f555
Instruction Fuzzy Hash: D30192B1A042048FEB54CF29D8867A6BBD8DF14620F0884AEDD45CB756D374D404CB62

Function 011CA59A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 011CA5DE

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0d481065dbffec84307b44c589abff6542e535de3b0f44380451d310eeda09b7
Instruction ID: b5ec18c5a2df4ff24ec68dbbfb60023308573367f903f307f62ef459afaaa601
Opcode Fuzzy Hash: 0d481065dbffec84307b44c589abff6542e535de3b0f44380451d310eeda09b7
Instruction Fuzzy Hash: 4801A1715002049FDB218F55E944B56FFE4EF58720F08C89EDE854B612D335E418DFA2

Function 012F105A Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,?,?), ref: 012F10AA

Memory Dump Source

Source File: 00000000.00000002.4123109540.00000000012F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12f0000_7tjt3u68PZ.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 2639ba90981e817ce293ed560059b69e1af669ef34bfaaa36692269855a5e405
Instruction ID: 5f9b09ddb31bdc21721edcd111853bf00edb16e2ca12cea8ad6f58ced088ac84
Opcode Fuzzy Hash: 2639ba90981e817ce293ed560059b69e1af669ef34bfaaa36692269855a5e405
Instruction Fuzzy Hash: 7001A271600200ABD310DF16DD46B66FBE8FB88A20F14811AED089BB41D771F959CBE5

Function 011CA72E Relevance: 1.5, APIs: 1, Instructions: 43comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?,00000E24,?,?), ref: 011CA77E

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 2e7c1dd0fe73a46ed6256e5034a70e410b02bf875676306d6f6d44abeb5d6aca
Instruction ID: f033ca8d4699ebe1a678862cb3726eaebc5499aa27b5ab872a69ba4949a2c4e5
Opcode Fuzzy Hash: 2e7c1dd0fe73a46ed6256e5034a70e410b02bf875676306d6f6d44abeb5d6aca
Instruction Fuzzy Hash: 6B01A271600200ABD310DF16DD46B66FBE8FB88A20F148159ED089BB41D731F959CBE5

Function 011CA186 Relevance: 1.5, APIs: 1, Instructions: 42networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,?), ref: 011CA1C1

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 5c05fb5ecc8768ea63619e64598d89082f8fc335cee17612c370b56f219f1adb
Instruction ID: f51b7c44ad014542d00f7f2a396811ac6c25b309d1abc11abe7f1655e9a67a92
Opcode Fuzzy Hash: 5c05fb5ecc8768ea63619e64598d89082f8fc335cee17612c370b56f219f1adb
Instruction Fuzzy Hash: 1A019E719042449FDB21CF59E984B66FBE4EF64720F08849EDD498B612D375E448CBA2

Function 011CB9F2 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 011CBA24

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 81ea93551af246d1708e7ab590b81fb0fc08dd2aafaaf912de8df793f29e5efd
Instruction ID: c047781250332b79618d933b90fa6c1872d9a03815769a763e40221e0551ab3a
Opcode Fuzzy Hash: 81ea93551af246d1708e7ab590b81fb0fc08dd2aafaaf912de8df793f29e5efd
Instruction Fuzzy Hash: 00014475608200CFDB148F1AD886762FBE4EF10A21F08C0AEDD4A8B752C374E408CFA2

Function 011CA23A Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNELBASE ref: 011CA269

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: DrivesLogical
String ID:
API String ID: 999431828-0
Opcode ID: ec0cd487e5adf43ae78ad47502d185f5e23ac0f7fdc6a7420f9a68549a3e3f0b
Instruction ID: b0414e02b52ff306cfc08d902e46d48212c8917af3c1317b6b47e45c55d2c815
Opcode Fuzzy Hash: ec0cd487e5adf43ae78ad47502d185f5e23ac0f7fdc6a7420f9a68549a3e3f0b
Instruction Fuzzy Hash: 9C0121719042548FEB11CF15E888761FBE4DF10A20F08C4AADD088F306E379E408CBA2

Function 05086902 Relevance: 1.5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

Strings

:@k, xrefs: 05086CED

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: :@k
API String ID: 0-2277858631
Opcode ID: 4f7c4ff291bb9bcc32e65cf7fb7648bdce172698590a44667215cbab228861d4
Instruction ID: f786c5a9f511d1fdf64c2e473936b62103b0d88a80e3afa7e0a45a329d495949
Opcode Fuzzy Hash: 4f7c4ff291bb9bcc32e65cf7fb7648bdce172698590a44667215cbab228861d4
Instruction Fuzzy Hash: 4BD12B74A01228CFDB29EF74E860BADB7B6BB88304F1141E9D559A7394DB359E85CF00

Function 011CAA12 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 011CAA44

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: e2024081fa0e04bf866d5905f93a0659b470e8c4db2707e1e4d5fd37944db8ea
Instruction ID: c6c82b4080d925da9ea997e940bd656cbf01a2a83058515ab31f123889264859
Opcode Fuzzy Hash: e2024081fa0e04bf866d5905f93a0659b470e8c4db2707e1e4d5fd37944db8ea
Instruction Fuzzy Hash: 00F0FF759002488FDB218F09EA84761FBE0EF54A20F08C09ADD480B752E378E408CFA2

Function 050894C0 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

:@k, xrefs: 0508999B

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: :@k
API String ID: 0-2277858631
Opcode ID: 64de771d50572cbcf659f0b362a1a425aacc358c9a33069f00728a09e3ef46e2
Instruction ID: 92b07c3b1897ead7958b8fbc1eff554ca31698f21b6075d4d99d22b39ff67003
Opcode Fuzzy Hash: 64de771d50572cbcf659f0b362a1a425aacc358c9a33069f00728a09e3ef46e2
Instruction Fuzzy Hash: AAA13C34A00209EFCB09FFB5F460AAD77B2BB88344F528539E816977A8DB359805DB50

Function 050895D5 Relevance: 1.5, Strings: 1, Instructions: 232COMMON

Download Yara Rule

Strings

:@k, xrefs: 0508999B

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: :@k
API String ID: 0-2277858631
Opcode ID: 89a4fc7535b495c2b7f567d19b53e2e398e3b27a11e412796e455d77985683b8
Instruction ID: 33fe1670dd0d3d60c413fdd31f988f7a7786d438f972344e9b5abcf99709203a
Opcode Fuzzy Hash: 89a4fc7535b495c2b7f567d19b53e2e398e3b27a11e412796e455d77985683b8
Instruction Fuzzy Hash: CC912A34A00209EFCB09FFB5F460AAD77B2BF88348B528579E416977A8DF359805DB50

Function 05086A63 Relevance: 1.5, Strings: 1, Instructions: 231COMMON

Download Yara Rule

Strings

:@k, xrefs: 05086CED

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: :@k
API String ID: 0-2277858631
Opcode ID: ed734fdb60dec33cc382bc347b39a716b7199f1ac3c355897491eadc3cfa9b57
Instruction ID: 058f6602ffdb1458ea8d98bb318280259f8b37e26884863c5d5c8f29b48c5091
Opcode Fuzzy Hash: ed734fdb60dec33cc382bc347b39a716b7199f1ac3c355897491eadc3cfa9b57
Instruction Fuzzy Hash: 99B12970A012288FDB29EF74E860BEDB7B6BB88304F5141E9D519A7394DB359E85CF40

Function 05089633 Relevance: 1.5, Strings: 1, Instructions: 221COMMON

Download Yara Rule

Strings

:@k, xrefs: 0508999B

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: :@k
API String ID: 0-2277858631
Opcode ID: f19c12707e0d9f203eb79485dedf28cd279bd9f4fdfd18c63c7f522d93fd277e
Instruction ID: 61fafe53f7e9b319b8d2802f67e95dfa08adc59d91ee268d06ac0ad43d0ef6a7
Opcode Fuzzy Hash: f19c12707e0d9f203eb79485dedf28cd279bd9f4fdfd18c63c7f522d93fd277e
Instruction Fuzzy Hash: DC913C34A00209EFCB09FFB5F460AAD77B2BF88348B528569E416977A8DB359C05DB50

Function 05089683 Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

:@k, xrefs: 0508999B

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: :@k
API String ID: 0-2277858631
Opcode ID: 63a59d7752510c6f25ce40d056498a5a59163571df08097c629e605ea5c6e206
Instruction ID: 0d7fea022996e2c973c44223bf646aa38dbd788c73b8ddbd01334816f27f7012
Opcode Fuzzy Hash: 63a59d7752510c6f25ce40d056498a5a59163571df08097c629e605ea5c6e206
Instruction Fuzzy Hash: D4814C34A00209EFCB09FFB5F460AAD73B2BB88348B528579E416977A8DB359C05DB50

Function 05086B4D Relevance: 1.4, Strings: 1, Instructions: 198COMMON

Download Yara Rule

Strings

:@k, xrefs: 05086CED

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: :@k
API String ID: 0-2277858631
Opcode ID: 0f10b5db675d8fe2a667b4dbb23a1ac94aa6b25d2a0bfacd5d9d470c846e7bc8
Instruction ID: 8a3c3cececdf93a07dd24b2b1b3946df606979197bba66d1c00f578c456fb859
Opcode Fuzzy Hash: 0f10b5db675d8fe2a667b4dbb23a1ac94aa6b25d2a0bfacd5d9d470c846e7bc8
Instruction Fuzzy Hash: AF914B70A012288FDB29EF74E860BEDB7B6BF88304F5141E99519A7394DB359E85CF40

Function 05089705 Relevance: 1.4, Strings: 1, Instructions: 193COMMON

Download Yara Rule

Strings

:@k, xrefs: 0508999B

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: :@k
API String ID: 0-2277858631
Opcode ID: b317a3d8bb7ed0ef3198c04e7f5ca9db5d4be078378f30dae8078135ff367fd1
Instruction ID: 13b10980240ca72dc053bbcbd7223fd75de13bc3d81320ccc01f67d3bd62048a
Opcode Fuzzy Hash: b317a3d8bb7ed0ef3198c04e7f5ca9db5d4be078378f30dae8078135ff367fd1
Instruction Fuzzy Hash: F8714B34B00209DFDB09BFB5F460AAD73B2BB88348F528579D816977A8DB359C05DB50

Function 050897F5 Relevance: 1.4, Strings: 1, Instructions: 146COMMON

Download Yara Rule

Strings

:@k, xrefs: 0508999B

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: :@k
API String ID: 0-2277858631
Opcode ID: 86e0b78f3877469ba43b2647647f6b81316bade774338a0eb09964e1344fab4f
Instruction ID: e84cf78c3e2f74789c02be195e4b2dbcf41b6d8cf7bd89422607203b6aa97994
Opcode Fuzzy Hash: 86e0b78f3877469ba43b2647647f6b81316bade774338a0eb09964e1344fab4f
Instruction Fuzzy Hash: BC515D30B002199FDB19BFB5F461ABD73A6AF84348F12852AD816977A8DF359C02CB50

Function 050802C0 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

:@k, xrefs: 0508036D

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID: :@k
API String ID: 0-2277858631
Opcode ID: c7cf70a154bb99b4b9e6e12fb79a20470ca658e5c4b9290906f435d540225eca
Instruction ID: f5a51f3661438d3f25f125efc638760bc5891a52ec52cc57a8434196caeeb8f3
Opcode Fuzzy Hash: c7cf70a154bb99b4b9e6e12fb79a20470ca658e5c4b9290906f435d540225eca
Instruction Fuzzy Hash: 9031C530B002169FDB04BB74E425BFE73A6ABD8208F124439D51597798EF39DD4A87A1

Function 011CAB7C Relevance: 1.3, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 011CABF0

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 7c460c0f91aa9664a34d80b7bd87f900d4236dbabb867df002e267e06f47cb88
Instruction ID: 4a7caf7b893b00630a16b41ece18120be2add579f3de9cde507c9a36b1696ec8
Opcode Fuzzy Hash: 7c460c0f91aa9664a34d80b7bd87f900d4236dbabb867df002e267e06f47cb88
Instruction Fuzzy Hash: 3F21F6755097C05FDB038B25ED95752BFA8EF07620F0984DADD848B663D2249908CB61

Function 011CBE18 Relevance: 1.3, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 011CBE84

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 7a37a6b856ae8e039d0ae525c4e95acae69112f81b14a4f4473711d6e1aa10bb
Instruction ID: 9720c97816b9fcd52631284d711f9356156de5e485f1b5247058c2acf587729e
Opcode Fuzzy Hash: 7a37a6b856ae8e039d0ae525c4e95acae69112f81b14a4f4473711d6e1aa10bb
Instruction Fuzzy Hash: 6021DEB250D3C05FDB028B25DC95792BFB4AF07720F0984DAE9848F663D234A908CB62

Function 011CA61E Relevance: 1.3, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 011CA690

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 28a33df2d341486490e4ca511be82f6620d0e5e08d44103d2ac8a860696ace5b
Instruction ID: 93dcbfabdd50df611859382f5da22082733a1cef4ef80d86092ebb7226394966
Opcode Fuzzy Hash: 28a33df2d341486490e4ca511be82f6620d0e5e08d44103d2ac8a860696ace5b
Instruction Fuzzy Hash: C22188718093C45FDB128B259C94752BFB4EF47220F0984DAD8848F2A3D2699908CBB2

Function 011CABBE Relevance: 1.3, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 011CABF0

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 205c3d5c9d222fe0fbe341f09edae2839b532f1cf0f817432e6be7c874331354
Instruction ID: d232a8efc5d820710e260973aed43bcc2e9d46b0544397ccf0c8223cc2531e43
Opcode Fuzzy Hash: 205c3d5c9d222fe0fbe341f09edae2839b532f1cf0f817432e6be7c874331354
Instruction Fuzzy Hash: 7401D4756042048FDB158F15E985765FBD4DF15620F08C4AEDD498F752D375D408CBA2

Function 011CBE52 Relevance: 1.3, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 011CBE84

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: da32dba11c35c5079fe65f9de0c7f8c79b8dc181c734eeb1932273b131cee598
Instruction ID: c0ef694784d9b4f92f93b23e88a1e5e1b7a20005a7ea056ff65baec432ebd78a
Opcode Fuzzy Hash: da32dba11c35c5079fe65f9de0c7f8c79b8dc181c734eeb1932273b131cee598
Instruction Fuzzy Hash: B601B1756042008FDB548F19E986756BBE8DF14A20F08C0AADD49CB752C374E408CFA2

Function 011CA65E Relevance: 1.3, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 011CA690

Memory Dump Source

Source File: 00000000.00000002.4122735908.00000000011CA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ca000_7tjt3u68PZ.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 324cc435e817ce8bacbe2aa60838ad02b8bc6c95fe1080aa77fae1fb1e67ad4c
Instruction ID: b4ff5d778b2e25d88e48f0094f60a7962f70e676774f6cb059263403306c8442
Opcode Fuzzy Hash: 324cc435e817ce8bacbe2aa60838ad02b8bc6c95fe1080aa77fae1fb1e67ad4c
Instruction Fuzzy Hash: E501F2B09002048FDB11CF05E984765FBE4DF54624F08C4AACD488F312D375E408CFA2

Function 050837FA Relevance: .5, Instructions: 495COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb7eb0d6a062ad453ca4caa3175cb6dc2d02bf08277b000903d45f95018377ad
Instruction ID: c5dab42c379bc6ea037b2538371ab8dde69c6a57ada91d773c10f37fce992648
Opcode Fuzzy Hash: cb7eb0d6a062ad453ca4caa3175cb6dc2d02bf08277b000903d45f95018377ad
Instruction Fuzzy Hash: CE323C30A01218CFDB18EF74E965BEDB7B2BB88308F1145A9D509AB798DB359D85CF40

Function 05083DC4 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 988355e6a31013a300590f305d3bca6e6293272e455ec66e151f011ceeab37d4
Instruction ID: 4ef431aabc8a78cae6a8fc0c1e8612e8849b645863cc3c6104275226b6086fcf
Opcode Fuzzy Hash: 988355e6a31013a300590f305d3bca6e6293272e455ec66e151f011ceeab37d4
Instruction Fuzzy Hash: 05A1D574A01218CFDB29EF64E961BECB7B2FB48308F1141A9D909A7359DB359E84CF40

Function 050839B7 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7d6d0aa0d999d163e7b26cb71595d6a9f60d031bdd1d91b24a8257aba1207c8
Instruction ID: a6c0e58d1882e88420d896af632bbe7094b8b2f218e86bb3f6aa52e11253a8f2
Opcode Fuzzy Hash: d7d6d0aa0d999d163e7b26cb71595d6a9f60d031bdd1d91b24a8257aba1207c8
Instruction Fuzzy Hash: FF817D30A012588FDB18EFB4D850BEDB7B2BF89308F0045A9D50AAB398DB759D85CF51

Function 05087E4E Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d52c3cf4c9539ebf79d1674df7e40d48c0dde637060b6bc7a586029436e3c807
Instruction ID: 9c5b6f5b5eb47db23d39a7af244864c107cade230ea061556e9b20716c9ca5ae
Opcode Fuzzy Hash: d52c3cf4c9539ebf79d1674df7e40d48c0dde637060b6bc7a586029436e3c807
Instruction Fuzzy Hash: 1C41C0306052058BE729EF36B815BBD33E3BB84314F698169D492DB2D9DB3ADD41CB20

Function 05087173 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30f4a7f6d8258b5ce46cc2cb72485065115c08e79934a9c65ca4331f382c12ac
Instruction ID: b168c3526793e3648ff183651a136729b7b33e69e41ac05430061182d906e829
Opcode Fuzzy Hash: 30f4a7f6d8258b5ce46cc2cb72485065115c08e79934a9c65ca4331f382c12ac
Instruction Fuzzy Hash: 914182307002448FCB05EBB8D465ABE7BF2AFC9208F2A8079D405DB799DB359C45DB92

Function 05083B10 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61fee5dd0500548a9b61391655890dea4433f965d06f9600700c84288b7de46b
Instruction ID: 10b3aab3917588bc2fe22c182684e9a580243bb69e7234cf1368c3680bd55913
Opcode Fuzzy Hash: 61fee5dd0500548a9b61391655890dea4433f965d06f9600700c84288b7de46b
Instruction Fuzzy Hash: C3417C70A012588FDB18EFB4D950BECB7F2BF89308F1045AAD009AB694DB745E44CF51

Function 05089DD0 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 120464cf782dda653e6b805bae5b1abe1e660b24e811d6933d2834812dd7d2d2
Instruction ID: efca0d9f9952091b84e9820c14a76a21b512905e4d6cb11714ad5696a61bdd05
Opcode Fuzzy Hash: 120464cf782dda653e6b805bae5b1abe1e660b24e811d6933d2834812dd7d2d2
Instruction Fuzzy Hash: A831A034B002059FDB14EF79E855BBEBBE6BF88204F144439E405EB3A5DB709805CB90

Function 050800B8 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd33678719c0e1a297444ca020cb05f2484ec681aac096a2814c89cd57834691
Instruction ID: 595f2d27fe0f45886c2fe2bcf3b8a14f55533b1f8a61e21ca2c549340c7458b0
Opcode Fuzzy Hash: cd33678719c0e1a297444ca020cb05f2484ec681aac096a2814c89cd57834691
Instruction Fuzzy Hash: 2031C3317003449FD718ABB5A821BAE37E7ABD6218F09856AD001DB7C5CF79AC098792

Function 00EA07B4 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122202614.0000000000EA0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1daca05862ac7dbb95b06923c6f08748cf40de3a0be41765020cf21c3769dcb4
Instruction ID: cadac44756696e493eebc85173934c134b2be99fccddccdca3b54957c23c9eb5
Opcode Fuzzy Hash: 1daca05862ac7dbb95b06923c6f08748cf40de3a0be41765020cf21c3769dcb4
Instruction Fuzzy Hash: 6C218E315093C08FC7078B20C850B15BF71AF4B708F1996EED4855F6A3C33A9806CB52

Function 061D2194 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4128469323.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61d0000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8568e7ee5bc09eff247d172de866d69ccc3bd67186002772a89e053bf513436
Instruction ID: 1bd2eee6b071ce90d9ab0446fa408e69a79832edfb51c9b7e48e736e0c05a4b2
Opcode Fuzzy Hash: e8568e7ee5bc09eff247d172de866d69ccc3bd67186002772a89e053bf513436
Instruction Fuzzy Hash: D211EAB5908301AFD340CF19D840A5BFBE4FB88664F04895EF998D7311D231E9088FA2

Function 00EA07E4 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122202614.0000000000EA0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e72385058932245d8be6ee2a90686b9dc619a46431fb1ecbf48a9a896f24850c
Instruction ID: 8f18abdb69f204fdd82b25bb5d7c8b766a88cd5973fc31310ce1fdfd8d24f83f
Opcode Fuzzy Hash: e72385058932245d8be6ee2a90686b9dc619a46431fb1ecbf48a9a896f24850c
Instruction Fuzzy Hash: AC11D230604280DFC315CB10D580B55B795AB8E718F28C9ADE4492B642C73BE813CA85

Function 05080118 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea3853cdba1d77dd09edcc46335ed5bc323fbd55087036df7b68e84ac74569a7
Instruction ID: d1dc8f999e82ca876163b6f44f8f6902df22d95de58f5d250c6a563f2978db14
Opcode Fuzzy Hash: ea3853cdba1d77dd09edcc46335ed5bc323fbd55087036df7b68e84ac74569a7
Instruction Fuzzy Hash: 0111C4317012448FC318AB75A4217BE33DBABE6348705853ED001DBB85CF7AEC0A8792

Function 05089AF0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce1750741c027cfe060bf857b3493deaa1cedbdc2c23b9099818e9df60ee85b4
Instruction ID: fd4a4d0fd31ea2f346ca23707961ee22c7f9737eb09451aefa01e2081c2ae658
Opcode Fuzzy Hash: ce1750741c027cfe060bf857b3493deaa1cedbdc2c23b9099818e9df60ee85b4
Instruction Fuzzy Hash: A6110472F002098FCF54EB78E9555AE73F6FB89244715047AC409E3354EB319D05CBA0

Function 05087351 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a492b7c1a9e170cd7efe99a68744d873cd4d3c01a995c4848aebd0793a9afebf
Instruction ID: a157003b1377d0dcd3d4019b1ebc26d1747e2b7110f9ee00c485e16f43eb1ced
Opcode Fuzzy Hash: a492b7c1a9e170cd7efe99a68744d873cd4d3c01a995c4848aebd0793a9afebf
Instruction Fuzzy Hash: F901F7367103108BD3097A74A8517AE3766DB92347B42C5BAE5409B381DB3A88068742

Function 061D2038 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4128469323.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61d0000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61c2275b93e818abdb28a31a06d4a25bbc34dfeaaf0080a382f2ae45cbc2abf2
Instruction ID: 346a9d719f46747e757d926e8c0a2269ef1fec0eb3589966e26d8e15d7178a69
Opcode Fuzzy Hash: 61c2275b93e818abdb28a31a06d4a25bbc34dfeaaf0080a382f2ae45cbc2abf2
Instruction Fuzzy Hash: 231100B5508301AFD750CF09DC45E57FBE8EB88660F14881EF95897311D231E908CFA2

Function 011DB2F8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122798388.00000000011DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11da000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78a61c09eec78cb2fd3d739dc505bf233abbfb7cbb97208a5074b6788480a1be
Instruction ID: 1cb1d291c53a89068e0d9ee77a4e5ec484baf84d3a1b8851735a32f4e825f600
Opcode Fuzzy Hash: 78a61c09eec78cb2fd3d739dc505bf233abbfb7cbb97208a5074b6788480a1be
Instruction Fuzzy Hash: 6B110CB5A08301AFD750CF09DC41E5BFBE8EB98660F14891EF99897311D231E908CFA2

Function 00EA05E0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122202614.0000000000EA0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83194ae762ab53c93d972da8daf2a519f0015a1457f5026c7de6cfd2b854d46a
Instruction ID: e1d6676754246339b14039bb80f86d7cb7a5d4527d8bc56f79406fec8ce14273
Opcode Fuzzy Hash: 83194ae762ab53c93d972da8daf2a519f0015a1457f5026c7de6cfd2b854d46a
Instruction Fuzzy Hash: BD0186B65093846FD7118F16AD41862FFE8EB86660709C49FEC498B612D225B908CB76

Function 00EA0794 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122202614.0000000000EA0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5295eafabc236e28bf91a8a097e274b36075317ab6b172fdeed5cc82d8806274
Instruction ID: 27cfe0ffeceddb918c56fe5457892535ea44c3f0082ea2e2b2e48a2d03fd46ec
Opcode Fuzzy Hash: 5295eafabc236e28bf91a8a097e274b36075317ab6b172fdeed5cc82d8806274
Instruction Fuzzy Hash: 8B01E13550D2809FC306CB20C550B15BFB1EF9B708F2986DAD8855B6A3C33AA816DB92

Function 050801E1 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44bff6589f35c939a9908c70e1706f1837c7489c32dfaf3a98abb412a23c14d8
Instruction ID: 190a0e8b9d40f65ac044221d5d3364e1207afab7cbfd2a2160c6e0a9835f6892
Opcode Fuzzy Hash: 44bff6589f35c939a9908c70e1706f1837c7489c32dfaf3a98abb412a23c14d8
Instruction Fuzzy Hash: 3B019230612242CFC708EF78D15C55C7BE2FFA4208B40882CE55597758DB30D858CF42

Function 050800A8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff1986018cda6242c44900e9b0e9748b80d35f96990d1eeaaa1256739ccfd901
Instruction ID: a49348bfedba360609fb04d4ccb872801f90c15fb9cf195bf61f08a953887b86
Opcode Fuzzy Hash: ff1986018cda6242c44900e9b0e9748b80d35f96990d1eeaaa1256739ccfd901
Instruction Fuzzy Hash: 81F0F672B003046FEB18EBB0DC12BAE7B72DF81224F0585AE9141DF2D0DA315841C790

Function 00EA08A0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122202614.0000000000EA0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3c181a57d58872c77186dea16c7b84c2b348ca3ffffdec1f3d2b946b90fd649
Instruction ID: a9c4e13f6882b44e305cff7cd8ac8121207eb14f13989c10c35b17629809bb66
Opcode Fuzzy Hash: a3c181a57d58872c77186dea16c7b84c2b348ca3ffffdec1f3d2b946b90fd649
Instruction Fuzzy Hash: 3DF01D35548644DFC306CF00D540B15FBA2EB89718F24CAADE9491B752C737E813DB81

Function 00EA0606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122202614.0000000000EA0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ea0000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b7aeb1179dd86642e9b686d45e79827db5953daf7995523023ecdbe531f542b
Instruction ID: 592e68aee219a2293774c455924f1d3ed98080a6154d530d901b11d71f6974b9
Opcode Fuzzy Hash: 0b7aeb1179dd86642e9b686d45e79827db5953daf7995523023ecdbe531f542b
Instruction Fuzzy Hash: 69E092B66046044B9650DF0BFD42462F7D8EB88630718C07FDC0D8B711D235B548CAA5

Function 061D2087 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4128469323.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61d0000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af381fd0cac0fb28958cfd3bc552bdb9ceb84393db0da429645a70de14c399a1
Instruction ID: 61bfb2afe249edfa1b6cb8d5907d4d5476039f60173e50e2068bd0827764014e
Opcode Fuzzy Hash: af381fd0cac0fb28958cfd3bc552bdb9ceb84393db0da429645a70de14c399a1
Instruction Fuzzy Hash: A5E0D8F250020467D6509E07AD46F63FB98DB50930F14C45BED081F752D172B5048AF1

Function 061D1AAB Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4128469323.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61d0000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3cbde1f07b975ad1d62b011b1647257f0202e32874276cd1705ad3be8a86073
Instruction ID: 6b37e9d90fd03d52f766319328fd585398e969e452f0b53b59e3bd4146f53699
Opcode Fuzzy Hash: c3cbde1f07b975ad1d62b011b1647257f0202e32874276cd1705ad3be8a86073
Instruction Fuzzy Hash: 05E0DFF2A0020467D6109E07AD4AF63FB98DB90A30F18C46BEE081F706E172B518CAF1

Function 061D21FF Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4128469323.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61d0000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7547418af4bbaf16a729dca4cebd14251874103f4fd163a5fcd02c1ef583350d
Instruction ID: 2fd27f6456a51ab80247b08638090876c6b761baa104b4224359f8df18754319
Opcode Fuzzy Hash: 7547418af4bbaf16a729dca4cebd14251874103f4fd163a5fcd02c1ef583350d
Instruction Fuzzy Hash: D8E0DFF2A4020467D7109E07AD46F62FB98DB94A30F18C46BED081F742E172F5188AF1

Function 011DB347 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122798388.00000000011DA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11da000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c3f30a3a3e82f21fda316e0470db627adb292efa06bfed084f3f94915bf3384
Instruction ID: 68b5d0f0609f1f6eab25f58afbb75d2a7c7836a9817b53754dde1858126ec0bc
Opcode Fuzzy Hash: 8c3f30a3a3e82f21fda316e0470db627adb292efa06bfed084f3f94915bf3384
Instruction Fuzzy Hash: 3EE0DFF2A4020467D6509E07AD46F62FB98DB50A30F18C56BEE085F712E176B5088AF1

Function 050841F8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6798c7883ca6a0206d516e7666d98f042f0744067cf241279cc95ee06bb1106c
Instruction ID: 83426732e9f4744cbe0ebe43e28727684906034d3613cac536eafcd531d72cfc
Opcode Fuzzy Hash: 6798c7883ca6a0206d516e7666d98f042f0744067cf241279cc95ee06bb1106c
Instruction Fuzzy Hash: 7CE0C2B2D06208EBC704DFA4DC02A8A7BE4DB00205F0540B9980AD3B51EA316A008B46

Function 011C23F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122708399.00000000011C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11c2000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 377f4c677f6ecd3969afacc26b9e703780b865c16ca8766f494216cdb0b0ee6e
Instruction ID: 8aa0a16d5b10968189123656f199c02ce96667def8fcc9d9b00e21578f180cd9
Opcode Fuzzy Hash: 377f4c677f6ecd3969afacc26b9e703780b865c16ca8766f494216cdb0b0ee6e
Instruction Fuzzy Hash: 71D02E3A3006C04FE31A8B0CC2A8B863BE4AB60B04F0A00FDA800CB763C738D4C0C200

Function 05083010 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da89be5700a0ba0f64dc8e077ef5c74e7fc4bb67c264802d3eb3df42305af425
Instruction ID: 79ca2e0cbf86d3d66caf85b6aacf484c56548ef94531e9ae15a05306a2c31a19
Opcode Fuzzy Hash: da89be5700a0ba0f64dc8e077ef5c74e7fc4bb67c264802d3eb3df42305af425
Instruction Fuzzy Hash: A0E0123420A384CFDB2A2774A53C4593F31AB4620934904FEC5954A66AD63A8841CB01

Function 05089D90 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bf6f140583fd2fd1deb5d2b73af676252a5ae4c4d5d1fa11f2ed002159c9b9d
Instruction ID: 5c56cc23b4d14ad9898b3d5adeabb0e0cccedd7b026e8a878993dc4bd17e66ac
Opcode Fuzzy Hash: 5bf6f140583fd2fd1deb5d2b73af676252a5ae4c4d5d1fa11f2ed002159c9b9d
Instruction Fuzzy Hash: 1AD05EF2D41204ABCB18EBA4E94A6FC77A4AB61351F1105AA9446927A1EA350A048B41

Function 011C23BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4122708399.00000000011C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 011C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11c2000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df6e9d82fe39a753d0fa7cd4a89c31d63ca0460b56604ec60a1596b20f203f80
Instruction ID: 90a63fdc925660a8155d80e269ee962b477cb0e0d409ffbc6f706427f18da5e0
Opcode Fuzzy Hash: df6e9d82fe39a753d0fa7cd4a89c31d63ca0460b56604ec60a1596b20f203f80
Instruction Fuzzy Hash: 41D05E343046814BD719DA0CC2E4F593BD4AB54B14F0A44ECAC108B762C7B8D8C4DA00

Function 05084208 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f37d05d39a8ddae0030adc09cc5095c784dfe40030c58f00fa6b4f0cd233befd
Instruction ID: 2a82878f48005e75e4ab68b2e314033b6fbba6f8365b4c617db3cf67ec0670ee
Opcode Fuzzy Hash: f37d05d39a8ddae0030adc09cc5095c784dfe40030c58f00fa6b4f0cd233befd
Instruction Fuzzy Hash: 1ED0C971A16208EF8744DFA8D90189DB7F9EB45215B1041BAA80AD3B50EE315E04DB95

Non-executed Functions

Function 050873FE Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4127303963.0000000005080000.00000040.00000800.00020000.00000000.sdmp, Offset: 05080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5080000_7tjt3u68PZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49621d3344241866127443127e612c2c11bb5159d29b10bf68a9da817a2ebcd1
Instruction ID: 5a3d4ec0c9bcd477340791deac7b656996b93b72f50a0a3dd0eae21bae0414d7
Opcode Fuzzy Hash: 49621d3344241866127443127e612c2c11bb5159d29b10bf68a9da817a2ebcd1
Instruction Fuzzy Hash: FAB1E6716062628BD735FA73B56083DB6F2BA802523664173E4F1CB2C9EF29C981D761

Analysis Process: Explower.exePID: 3064, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	13.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	52
Total number of Limit Nodes:	4

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 049201E1 Relevance: 3.8, Strings: 3, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

HQr, xrefs: 0492023B
Pr, xrefs: 04920216
XRr, xrefs: 04920260

Memory Dump Source

Source File: 00000003.00000002.1822489600.0000000004920000.00000040.00000800.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4920000_Explower.jbxd

Similarity

API ID:
String ID: HQr$XRr$Pr
API String ID: 0-2956780941
Opcode ID: 05a73c1183474d05e04890f08c420c04dbe353f9a5b81009ba5e847ba1760546
Instruction ID: b87d2772a6041274315a2e85b0ff158c2866e1c77e06a5028e66f1ec479744cf
Opcode Fuzzy Hash: 05a73c1183474d05e04890f08c420c04dbe353f9a5b81009ba5e847ba1760546
Instruction Fuzzy Hash: B1015630606681CFC744EB78D65869D7BE1EFC8308B04892CE5568B39AEB78D865CB46

Function 049200B8 Relevance: 2.6, Strings: 2, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

5],l^, xrefs: 04920194, 04920199
E],l^, xrefs: 04920140, 04920145

Memory Dump Source

Source File: 00000003.00000002.1822489600.0000000004920000.00000040.00000800.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4920000_Explower.jbxd

Similarity

API ID:
String ID: 5],l^$E],l^
API String ID: 0-853727092
Opcode ID: 0988be3a5d91f4c38a2c17cc4c086407efcd27e102e6c94b1adc489ade88936e
Instruction ID: ddc9fc05aac1c8d42da1a48ac38a2fd5a0103490aac77b94eacaf7272fe625a7
Opcode Fuzzy Hash: 0988be3a5d91f4c38a2c17cc4c086407efcd27e102e6c94b1adc489ade88936e
Instruction Fuzzy Hash: 8131F6317043409FD715ABB59811BAE7BE7ABD6304B0485AAD0018F796CF799C068392

Function 04920118 Relevance: 2.6, Strings: 2, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

5],l^, xrefs: 04920194, 04920199
E],l^, xrefs: 04920140, 04920145

Memory Dump Source

Source File: 00000003.00000002.1822489600.0000000004920000.00000040.00000800.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4920000_Explower.jbxd

Similarity

API ID:
String ID: 5],l^$E],l^
API String ID: 0-853727092
Opcode ID: 314e7d7fdc02a03d308037c8de78c9025abcdcd886c31daf22540dbdc172e4ee
Instruction ID: 2d88b20666f5e2e0ab9f30a55a56b68b7c3d2c6e4d781bd94fa980fb0c33f63d
Opcode Fuzzy Hash: 314e7d7fdc02a03d308037c8de78c9025abcdcd886c31daf22540dbdc172e4ee
Instruction Fuzzy Hash: 8D11C6307001408FC715ABB9A410BED37DBABD7348305496ED0058FB96CF7ADC1A8792

Function 0071AA75 Relevance: 1.6, APIs: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0071AB25

Memory Dump Source

Source File: 00000003.00000002.1815224947.000000000071A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0071A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_71a000_Explower.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: be717112de3e703be189ed901c5e0d5a2a4e98b83f2406fded5edf4140aea833
Instruction ID: 0ed700d7bee4a127046af4504550fc6fe47a977bd8712156bc66205c114b1cee
Opcode Fuzzy Hash: be717112de3e703be189ed901c5e0d5a2a4e98b83f2406fded5edf4140aea833
Instruction Fuzzy Hash: 013183B1509380AFE721CF65CC85F96BBF8EF05310F08849EE9458B692D375E848CB62

Function 0071AF76 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 0071B01D

Memory Dump Source

Source File: 00000003.00000002.1815224947.000000000071A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0071A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_71a000_Explower.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 2bca91c598f65b26276a4d29b96ba413b8ee780ad0bf16cd4aded850de72ff85
Instruction ID: 1ec8f1f2ad2875eacd24a313cbfda5f517d39059cc7bebe28fb8900ebfe99e76
Opcode Fuzzy Hash: 2bca91c598f65b26276a4d29b96ba413b8ee780ad0bf16cd4aded850de72ff85
Instruction Fuzzy Hash: 4E31B1B15093806FE711CB65CC85B96BFF8EF06310F08849AE984CB293D379E949C762

Function 0071A6CE Relevance: 1.6, APIs: 1, Instructions: 85
comclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleGetClipboard.OLE32(?,00000E24,?,?), ref: 0071A77E

Memory Dump Source

Source File: 00000003.00000002.1815224947.000000000071A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0071A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_71a000_Explower.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 65b8fd18b0ed36ee8d90fbabad52c23d301a6645a9703c27ce1fb3837ab50e23
Instruction ID: 505e26fd548d3212e46d171e85117edb2ef9432f236b2380249a89558f31c59d
Opcode Fuzzy Hash: 65b8fd18b0ed36ee8d90fbabad52c23d301a6645a9703c27ce1fb3837ab50e23
Instruction Fuzzy Hash: 10317E7504D3C06FD3138B259C61B61BFB4EF87614F0A80CBE884CB6A3D2296919D772

Function 0071AAA6 Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0071AB25

Memory Dump Source

Source File: 00000003.00000002.1815224947.000000000071A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0071A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_71a000_Explower.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ba6faab8d0a9f474bee2b4f31ccb9388e58e331a3b627d83a08b7e5b7d774a8f
Instruction ID: 6e9663a856d787603ad8a5f6b398b87c90a3d18a14683f0e43ea291ca0f812ff
Opcode Fuzzy Hash: ba6faab8d0a9f474bee2b4f31ccb9388e58e331a3b627d83a08b7e5b7d774a8f
Instruction Fuzzy Hash: 5721B2B1605240AFE720CF66DD85FA6FBE8EF08310F04846DE9458B692D375E848CB72

Function 0071AC37 Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,00000E24,10FA911B,00000000,00000000,00000000,00000000), ref: 0071ACBD

Memory Dump Source

Source File: 00000003.00000002.1815224947.000000000071A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0071A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_71a000_Explower.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 7ffdd73eea18befea57933378d8afc74b5c19d70c89553300b4f34526f698dbf
Instruction ID: 941d35bf1c7d853d78177095d196af85ad08dbaddc288016c0d101eba8a2c223
Opcode Fuzzy Hash: 7ffdd73eea18befea57933378d8afc74b5c19d70c89553300b4f34526f698dbf
Instruction Fuzzy Hash: 8421EBB54093806FE7128B15DC45BE2BFB8DF47714F0880DBE9848B693D268A94DD772

Function 0071A9BF Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(?), ref: 0071AA44

Memory Dump Source

Source File: 00000003.00000002.1815224947.000000000071A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0071A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_71a000_Explower.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 15033a1e186b780e695a7479af4f2410b6e5148a537f1b70323c8e5ea634e412
Instruction ID: f1be08b36f23c5466ffbb879e6602d0ec0fa69bc961c28c14cc860afd4377f36
Opcode Fuzzy Hash: 15033a1e186b780e695a7479af4f2410b6e5148a537f1b70323c8e5ea634e412
Instruction Fuzzy Hash: 6021366540E3C0AFD7138B258C65A91BFB4EF57624B0E80DBD9848F5A3D2689849CB72

Function 0071AFAA Relevance: 1.6, APIs: 1, Instructions: 72
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 0071B01D

Memory Dump Source

Source File: 00000003.00000002.1815224947.000000000071A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0071A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_71a000_Explower.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 7fbbf57c18a9b871c70acf2dc897e71a7f1fdf627baba3a85281ee6fdb219e20
Instruction ID: edfe28cdf144cccc924450984ebbfae5259991b2fb183e9c4411356c5ed567f5
Opcode Fuzzy Hash: 7fbbf57c18a9b871c70acf2dc897e71a7f1fdf627baba3a85281ee6fdb219e20
Instruction Fuzzy Hash: 9D2195B1600200AFE720CF65DD85BA6F7E8EF08714F148469E945CB782D375E949CB71

Function 0071ADCE Relevance: 1.6, APIs: 1, Instructions: 70
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E24,10FA911B,00000000,00000000,00000000,00000000), ref: 0071AE4D

Memory Dump Source

Source File: 00000003.00000002.1815224947.000000000071A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0071A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_71a000_Explower.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 68031c2c2ec311fd8bbe9155b92e354227df32b6e0f247343f596f67dc1fa3a3
Instruction ID: dcf4999eef7816013aad44330e52446e8af778a11073b47adfeb6ebe4d20ba51
Opcode Fuzzy Hash: 68031c2c2ec311fd8bbe9155b92e354227df32b6e0f247343f596f67dc1fa3a3
Instruction Fuzzy Hash: 7721A175405380AFDB22CF55DC85F97BFB8EF45320F08849AE9449B552C334A548CBB6

Function 0071A61E Relevance: 1.6, APIs: 1, Instructions: 65
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(?), ref: 0071A690

Memory Dump Source

Source File: 00000003.00000002.1815224947.000000000071A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0071A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_71a000_Explower.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 9146d2ad490ab908b53814df9e7e04050426926b3cee0a893e2c66156ce61de1
Instruction ID: 09e99a21fed92580c102312271223d85aa0d14d3268eb5bab3565103983e0b1d
Opcode Fuzzy Hash: 9146d2ad490ab908b53814df9e7e04050426926b3cee0a893e2c66156ce61de1
Instruction Fuzzy Hash: DC21587540E3C0AFDB538B259C95692BFB4DF07220F0D84DBD8848F1A7D2699908CBB2

Function 0071A573 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0071A5DE

Memory Dump Source

Source File: 00000003.00000002.1815224947.000000000071A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0071A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_71a000_Explower.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f24e9ac90d3ff89d0ab4141830c270509b7b5c5b66129bbbbfa4f8f5cde4e8be
Instruction ID: 0d881b1125e9626b4e62d5dadf5f4a3d26feabadc0db9d52b67a2ee59d302297
Opcode Fuzzy Hash: f24e9ac90d3ff89d0ab4141830c270509b7b5c5b66129bbbbfa4f8f5cde4e8be
Instruction Fuzzy Hash: F1118475409380AFDB228F55DC44B62FFF4EF4A310F0888DEED858B562C275A918DB62

Function 0071ADEE Relevance: 1.6, APIs: 1, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E24,10FA911B,00000000,00000000,00000000,00000000), ref: 0071AE4D

Memory Dump Source

Source File: 00000003.00000002.1815224947.000000000071A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0071A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_71a000_Explower.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 0aa84e6e220af60764763b327ac8fc0d7736eb632da44ad6e20662310068f20e
Instruction ID: e6a205ac586232ecfbbfe0e4e3812443d53677efb676d26d8ba2ac0b3209cec7
Opcode Fuzzy Hash: 0aa84e6e220af60764763b327ac8fc0d7736eb632da44ad6e20662310068f20e
Instruction Fuzzy Hash: 1611B275500200AFEB21CF55DC45FE6FBA8EF14324F18845AE9458B651C374E548CBB2

Function 0071AC6A Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,00000E24,10FA911B,00000000,00000000,00000000,00000000), ref: 0071ACBD

Memory Dump Source

Source File: 00000003.00000002.1815224947.000000000071A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0071A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_71a000_Explower.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: ed226bde437f9cac5da4b8c92c0aaae3cfcf68ac5a7893d75c4aaae7692f5631
Instruction ID: 4b7e7cc53f74849cce03022829914a3ca3ba50b037c35fd37a7ddd7ba1f0a475
Opcode Fuzzy Hash: ed226bde437f9cac5da4b8c92c0aaae3cfcf68ac5a7893d75c4aaae7692f5631
Instruction Fuzzy Hash: 0C01D675505200AFE720CF06DD85BE6F798DF55724F18C056ED049B782D378E588CAB6

Function 0071A59A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0071A5DE

Memory Dump Source

Source File: 00000003.00000002.1815224947.000000000071A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0071A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_71a000_Explower.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c0a8b3924ccc02203449d28ceb4cb33e949ef0d0e382a7ca2e178f6c52ec88d1
Instruction ID: 60bf9bd40117827d0628abfa1c0953d17ffb178f7a5f57e6af2bbaab4ed8bcbb
Opcode Fuzzy Hash: c0a8b3924ccc02203449d28ceb4cb33e949ef0d0e382a7ca2e178f6c52ec88d1
Instruction Fuzzy Hash: A901AD72504200EFDB218F55D884B92FFE0EF48320F08889ADE494A656C33AE458DFA2

Function 0071A72E Relevance: 1.5, APIs: 1, Instructions: 43comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?,00000E24,?,?), ref: 0071A77E

Memory Dump Source

Source File: 00000003.00000002.1815224947.000000000071A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0071A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_71a000_Explower.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 9a871ae4581c2083c961d85f2f50f0f87fc9f6a4c710a68d6ed7035fe2f42f0e
Instruction ID: 3e42ea033b000d00589d20405d713df37935e6a3bbb82ac6b53f01b4a52a95d2
Opcode Fuzzy Hash: 9a871ae4581c2083c961d85f2f50f0f87fc9f6a4c710a68d6ed7035fe2f42f0e
Instruction Fuzzy Hash: 2401A271500200ABD310DF16CD86B66FBE8FB88A20F148159EC089BB41D731F955CBE6

Function 0071A65E Relevance: 1.5, APIs: 1, Instructions: 39comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(?), ref: 0071A690

Memory Dump Source

Source File: 00000003.00000002.1815224947.000000000071A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0071A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_71a000_Explower.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 89a27bc5e2b0bed46b424eb198f44bcf95590a643d9710f15fa9432227f83cf3
Instruction ID: fe0a0aace6b4fa11038b6e33c5f9f82a2f20db46a6fc2adce63ed0940ddf9b93
Opcode Fuzzy Hash: 89a27bc5e2b0bed46b424eb198f44bcf95590a643d9710f15fa9432227f83cf3
Instruction Fuzzy Hash: 6D018B75905240AFDB10CF19D8857A6FBA4EF15320F18C4AADD488B69AD279E448CBA2

Function 0071AA12 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0071AA44

Memory Dump Source

Source File: 00000003.00000002.1815224947.000000000071A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0071A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_71a000_Explower.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: fc7efc114584b7496d18dd0bab5cfc2437f8cd8d4da0689c8ca38aa6a631999a
Instruction ID: 85472b531841adfbeb616ab2bd40dd7623d8fa9a1cf811834b98f5eade59d3be
Opcode Fuzzy Hash: fc7efc114584b7496d18dd0bab5cfc2437f8cd8d4da0689c8ca38aa6a631999a
Instruction Fuzzy Hash: 72F0FF75900240EFDB208F09D9857A1FBE0EF14320F08C09ADD080B792D378E848CFA2

Function 049202C0 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

:@k, xrefs: 0492036D

Memory Dump Source

Source File: 00000003.00000002.1822489600.0000000004920000.00000040.00000800.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4920000_Explower.jbxd

Similarity

API ID:
String ID: :@k
API String ID: 0-2277858631
Opcode ID: 16d1ff2075726415c6bd9b1f842c2f9fe04429ca8f345556d0dd6d0e59e9d6d7
Instruction ID: 6a421a12c4cb70373e93aa7f19f65bbf5bf54f05d287f3cf350a23140ebcf867
Opcode Fuzzy Hash: 16d1ff2075726415c6bd9b1f842c2f9fe04429ca8f345556d0dd6d0e59e9d6d7
Instruction Fuzzy Hash: 1631E530B012118FE704BB74D8117AE32A69BD8208F114439D115D7BADEF789D5AC7A1

Function 0071AB7C Relevance: 1.3, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0071ABF0

Memory Dump Source

Source File: 00000003.00000002.1815224947.000000000071A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0071A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_71a000_Explower.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 35469729c7ec8f48a07595e6fa9a8986e4dbcf26770b707c50182e4111588200
Instruction ID: 7422ec872da2d4f531524a59fe54c851f3e4ea6597280a4bd8231829653e7e61
Opcode Fuzzy Hash: 35469729c7ec8f48a07595e6fa9a8986e4dbcf26770b707c50182e4111588200
Instruction Fuzzy Hash: 6E21D7755093C05FD7038F25DC95692BFB8EF07220F0984DBDC858F5A3D2645908C762

Function 0071ABBE Relevance: 1.3, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0071ABF0

Memory Dump Source

Source File: 00000003.00000002.1815224947.000000000071A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0071A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_71a000_Explower.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 3f252c2caa8cc988f9cddb27fbb6bf9beba3a1c427ff766f732f688d01cbb568
Instruction ID: c4798c12b5bc9e9350f6c2f7611577e27ac9e95cb24d6be4e0972051ffc8615e
Opcode Fuzzy Hash: 3f252c2caa8cc988f9cddb27fbb6bf9beba3a1c427ff766f732f688d01cbb568
Instruction Fuzzy Hash: D101DF75A052409FDB108F19D8857A6FBE4DF14320F08C4ABDC098B686D279E848CBA2

Function 049237FA Relevance: .5, Instructions: 497COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1822489600.0000000004920000.00000040.00000800.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4920000_Explower.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4fb137a5f364511c1920b541ea8eef3f931ada57546d8d474b6deed2e5da584
Instruction ID: 29e589f6f52f2904f1ee603c34eb7e63e986cd426dbe0d5199b850c3293903a8
Opcode Fuzzy Hash: b4fb137a5f364511c1920b541ea8eef3f931ada57546d8d474b6deed2e5da584
Instruction Fuzzy Hash: 30325830E01228CFDB24EF74D954BEDB7B2AB49304F1045A9D509AB3A9DB799E85CF40

Function 049239B7 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1822489600.0000000004920000.00000040.00000800.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4920000_Explower.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb2ea478974f2e9937a67cec0fb1fc87f07d61221b72430d87039b52a7464873
Instruction ID: efd61069a50263147af54b41ca5fafd5f884b4db3ae14e99dcba2f82ddc728d7
Opcode Fuzzy Hash: fb2ea478974f2e9937a67cec0fb1fc87f07d61221b72430d87039b52a7464873
Instruction Fuzzy Hash: E8815A30E012588FDB24EFB4C950BEDB7B2AF89308F1044A9D509AB298DB799D85CF51

Function 04923B10 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1822489600.0000000004920000.00000040.00000800.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4920000_Explower.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8519a791f1ac11fde70f1ffe0abecbe044716ce080bee9eb2762c17860e86f0
Instruction ID: 3cbeddc189ecd22a2b0371c57d180e7ed29db6f6aa89e8f62db69c11a0578dd1
Opcode Fuzzy Hash: f8519a791f1ac11fde70f1ffe0abecbe044716ce080bee9eb2762c17860e86f0
Instruction Fuzzy Hash: 5C414930E012688FDB24EFB4D954BECB7F2AF49304F1045AAD409AB299DB785E45CF61

Function 04920006 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1822489600.0000000004920000.00000040.00000800.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4920000_Explower.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a5e861ad87dde6bc0dffb9cc2c1746597735d65fd40a33184ffef7a8f8ceef5
Instruction ID: 652fa9a14e57e4988c6fc1ea7c30dd48ab61a8264cbce033a47340401f82b1b8
Opcode Fuzzy Hash: 4a5e861ad87dde6bc0dffb9cc2c1746597735d65fd40a33184ffef7a8f8ceef5
Instruction Fuzzy Hash: 7A117C6044F7D64FD313873098A8985BF70AE27204B5E85DBC090CF5A7D25C492AC7A3

Function 00A905E7 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1819122352.0000000000A90000.00000040.00000020.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a90000_Explower.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2b5f6a1404a6a4507245b089b9157e3ded5bebea49b417bc1f45a1f09d16d38
Instruction ID: 3d9ddb1c1dac045fc614b2b77089920fe86ea0a5fc745ba6fba194c5985ae9d4
Opcode Fuzzy Hash: b2b5f6a1404a6a4507245b089b9157e3ded5bebea49b417bc1f45a1f09d16d38
Instruction Fuzzy Hash: EEF0C8B65093806FD7118F16AC41863FFF8EF86630709C4AFEC498B612D225B908CB72

Function 049200A8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1822489600.0000000004920000.00000040.00000800.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4920000_Explower.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 073afcebdc5a4590331bcf8915651e7384efb6b902d026786c9ad6c529188fd7
Instruction ID: 04f498145912facb08b8a58420a06d02499c5c82bcdf970d0983b344afa57fe5
Opcode Fuzzy Hash: 073afcebdc5a4590331bcf8915651e7384efb6b902d026786c9ad6c529188fd7
Instruction Fuzzy Hash: 5AF0C872A01314ABE7149F71DC12BAE7B76EF81714F0485AAA6459B2D1DA355940C390

Function 00A90606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1819122352.0000000000A90000.00000040.00000020.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a90000_Explower.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0792e331c27426ce93dc4c28d337ba04f9e320f278eab5e12d070f6080a78332
Instruction ID: cde3d760a7153a77cc47c6bb424807513dfab3fb755b5faab563e764fb264c01
Opcode Fuzzy Hash: 0792e331c27426ce93dc4c28d337ba04f9e320f278eab5e12d070f6080a78332
Instruction Fuzzy Hash: 29E092B66046049B9650CF0AFC82452F7D8EB88630718C47FDC0D8B701D235B508CAA6

Function 04923010 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1822489600.0000000004920000.00000040.00000800.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4920000_Explower.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70b6f6966a5bce1843292049668e688424c451a2abeff539c258825e99a96ee8
Instruction ID: 9be13a7cdad39e7b9777ba6fb298b8b7ff633353a9add6c4a13e008df58593cb
Opcode Fuzzy Hash: 70b6f6966a5bce1843292049668e688424c451a2abeff539c258825e99a96ee8
Instruction Fuzzy Hash: 3BE0C2341093C08FC71A2738A42C4597F756FC720834C48FDC4854A66ACA7EC851CB40

Function 007123F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1812196041.0000000000712000.00000040.00000800.00020000.00000000.sdmp, Offset: 00712000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_712000_Explower.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9940fe08c7a6ad01a03bca77dc4e7290fb976f2226bb9905a76203c47d3c0ca
Instruction ID: d8843fcc697169c0912af83853ff8c777f7fb3d83850cb7db27e6ebb6067028c
Opcode Fuzzy Hash: f9940fe08c7a6ad01a03bca77dc4e7290fb976f2226bb9905a76203c47d3c0ca
Instruction Fuzzy Hash: C7D0C7792006C04ED3128A0CC2A8B8637D4AB40704F0A00B9AC008B7A3C72CE8C2C200

Function 007123BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1812196041.0000000000712000.00000040.00000800.00020000.00000000.sdmp, Offset: 00712000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_712000_Explower.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb3abcde2e67ac128ffc491d96e71dc93c566777b2a0c7e0bce10894c4e97790
Instruction ID: 039d07cd83986b3fe91548f92930e16eadf2da9c2fc860104a06bcc6f999dd68
Opcode Fuzzy Hash: bb3abcde2e67ac128ffc491d96e71dc93c566777b2a0c7e0bce10894c4e97790
Instruction Fuzzy Hash: 0BD05E342006814FC715DA0CC2E4F9937D4AB40714F0A44E8AC208B7A2C7ACD8D5DA00

Non-executed Functions

Function 04923047 Relevance: 5.1, Strings: 4, Instructions: 92COMMON

Download Yara Rule

Strings

Nr, xrefs: 049230C5
Nr, xrefs: 04923122
Nr, xrefs: 049230E8
Nr, xrefs: 04923081

Memory Dump Source

Source File: 00000003.00000002.1822489600.0000000004920000.00000040.00000800.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4920000_Explower.jbxd

Similarity

API ID:
String ID: Nr$Nr$Nr$Nr
API String ID: 0-3364712948
Opcode ID: 2463b1fdd03c9cf7af679aa676821dda23ac47231198d1711c0ca34c9daeb561
Instruction ID: 8234468a46d208a7df609c55fd37e7dcb2a0e6a7702b303e8a3d72790a9050b4
Opcode Fuzzy Hash: 2463b1fdd03c9cf7af679aa676821dda23ac47231198d1711c0ca34c9daeb561
Instruction Fuzzy Hash: 27318034B012599FEB20CB79C940BAA77E9FF89304F140528E902EB744EB74FC058B64

Function 04923058 Relevance: 5.1, Strings: 4, Instructions: 87COMMON

Download Yara Rule

Strings

Nr, xrefs: 049230C5
Nr, xrefs: 04923122
Nr, xrefs: 049230E8
Nr, xrefs: 04923081

Memory Dump Source

Source File: 00000003.00000002.1822489600.0000000004920000.00000040.00000800.00020000.00000000.sdmp, Offset: 04920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4920000_Explower.jbxd

Similarity

API ID:
String ID: Nr$Nr$Nr$Nr
API String ID: 0-3364712948
Opcode ID: 2fa406d1e67bb0376c8bf938e39a96c577fc589c84a80cc0f6cb7b541bcb75ae
Instruction ID: 270abedb0214f35c9fa2591775cf3522dd6c0cfc72adcd4fd33dd854883f722c
Opcode Fuzzy Hash: 2fa406d1e67bb0376c8bf938e39a96c577fc589c84a80cc0f6cb7b541bcb75ae
Instruction Fuzzy Hash: 8C216D34B012599FEB20DB79D840BAA73E9FF89704F140568E901AB758EB74FC048BA5

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 7tjt3u68PZ.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Njrat

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Notepad.exe

C:\Notepad.exe:Zone.Identifier

C:\Program Files (x86)\Explower.exe

C:\Program Files (x86)\Explower.exe:Zone.Identifier

C:\Umbrella.flv.exe

C:\Umbrella.flv.exe:Zone.Identifier

C:\Users\user\AppData\Local\Explower.exe

C:\Users\user\AppData\Local\Explower.exe:Zone.Identifier

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Explower.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\History\Explower.exe

C:\Users\user\AppData\Local\Microsoft\Windows\History\Explower.exe:Zone.Identifier

Windows Analysis Report
7tjt3u68PZ.exe

Function 050844E9 Relevance: 10.4, Strings: 7, Instructions: 1624
COMMON

Function 0508453C Relevance: 10.4, Strings: 7, Instructions: 1618
COMMON

Function 05084628 Relevance: 9.1, Strings: 6, Instructions: 1579
COMMON

Function 05084707 Relevance: 9.0, Strings: 6, Instructions: 1544
COMMON

Function 050847CC Relevance: 9.0, Strings: 6, Instructions: 1513
COMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre