Edit tour

Windows Analysis Report
01koiHnedL.exe

Overview

General Information

Sample name:	01koiHnedL.exe renamed because original name is a hash value
Original sample name:	1f41f02970cfdce69e628299a96d754d.exe
Analysis ID:	1511706
MD5:	1f41f02970cfdce69e628299a96d754d
SHA1:	fb04fa7cbe25caccd197dac9af74496e3b513866
SHA256:	6d48ccbf40f5f43149cb69f1659d683fc7eaf5cee527f724a1761e548c1a5fe2
Tags:	exenjratRAT
Infos:

Detection

Njrat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Njrat

.NET source code contains potential unpacker

AI detected suspicious sample

Contains functionality to disable the Task Manager (.Net Source)

Contains functionality to spread to USB devices (.Net source)

Disables zone checking for all users

Machine Learning detection for sample

Modifies the windows firewall

Uses netsh to modify the Windows network and firewall settings

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Yara signature match

Classification

Process Tree

System is w10x64

01koiHnedL.exe (PID: 3420 cmdline: "C:\Users\user\Desktop\01koiHnedL.exe" MD5: 1F41F02970CFDCE69E628299A96D754D)

netsh.exe (PID: 6756 cmdline: netsh firewall add allowedprogram "C:\Users\user\Desktop\01koiHnedL.exe" "01koiHnedL.exe" ENABLE MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 7092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
NjRAT	RedPacket Security describes NJRat as "a remote access trojan (RAT) has capabilities to log keystrokes, access the victim's camera, steal credentials stored in browsers, open a reverse shell, upload/download files, view the victim's desktop, perform process, file, and registry manipulations, and capabilities to let the attacker update, uninstall, restart, close, disconnect the RAT and rename its campaign ID. Through the Command & Control (CnC) server software, the attacker has capabilities to create and configure the malware to spread through USB drives."It is supposedly popular with actors in the Middle East. Similar to other RATs, many leaked builders may be backdoored.	AQUATIC PANDA Earth Lusca Operation C-Major The Gorgon Group	http://blog.trendmicro.com/trendlabs-security-intelligence/new-rats-emerge-from-leaked-njw0rm-source-code/ http://blogs.360.cn/post/analysis-of-apt-c-37.html http://threatgeek.typepad.com/files/fta-1009---njrat-uncovered-1.pdf https://about.fb.com/news/2021/04/taking-action-against-hackers-in-palestine/ https://asec.ahnlab.com/1369	https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat

Malware Configuration

Threatname: Njrat

{"Campaign ID": "clien", "Version": "0.7d", "Install Name": "f7e6d24b4a113d9753558dfbb032c2ac", "Install Dir": "Adobe Update", "Registry Value": "Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Network Seprator": "|'|'|"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
01koiHnedL.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
01koiHnedL.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a4f:$a2: SEE_MASK_NOZONECHECKS 0x156f1:$a3: Download ERROR 0x15ca1:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c2e:$a5: netsh firewall delete allowedprogram "
01koiHnedL.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15ca1:$x1: cmd.exe /c ping 0 -n 2 & del " 0x137ba:$s1: winmgmts:\\.\root\SecurityCenter2 0x1570f:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156f1:$s6: Download ERROR 0x1377c:$s8: Select * From AntiVirusProduct
01koiHnedL.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a4f:$reg: SEE_MASK_NOZONECHECKS 0x156d5:$msg: Execute ERROR 0x15729:$msg: Execute ERROR 0x15ca1:$ping: cmd.exe /c ping 0 -n 2 & del
01koiHnedL.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c2e:$s1: netsh firewall delete allowedprogram 0x13c80:$s2: netsh firewall add allowedprogram 0x15ca1:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156d5:$s4: Execute ERROR 0x15729:$s4: Execute ERROR 0x156f1:$s5: Download ERROR

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.2117088678.0000000000352000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000000.00000000.2117088678.0000000000352000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x113d2:$a1: get_Registry 0x1584f:$a2: SEE_MASK_NOZONECHECKS 0x154f1:$a3: Download ERROR 0x15aa1:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13a2e:$a5: netsh firewall delete allowedprogram "
00000000.00000000.2117088678.0000000000352000.00000002.00000001.01000000.00000003.sdmp	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x1584f:$reg: SEE_MASK_NOZONECHECKS 0x154d5:$msg: Execute ERROR 0x15529:$msg: Execute ERROR 0x15aa1:$ping: cmd.exe /c ping 0 -n 2 & del
00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: 01koiHnedL.exe PID: 3420	JoeSecurity_Njrat	Yara detected Njrat	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.01koiHnedL.exe.350000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.0.01koiHnedL.exe.350000.0.unpack	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a4f:$a2: SEE_MASK_NOZONECHECKS 0x156f1:$a3: Download ERROR 0x15ca1:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c2e:$a5: netsh firewall delete allowedprogram "
0.0.01koiHnedL.exe.350000.0.unpack	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15ca1:$x1: cmd.exe /c ping 0 -n 2 & del " 0x137ba:$s1: winmgmts:\\.\root\SecurityCenter2 0x1570f:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156f1:$s6: Download ERROR 0x1377c:$s8: Select * From AntiVirusProduct
0.0.01koiHnedL.exe.350000.0.unpack	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a4f:$reg: SEE_MASK_NOZONECHECKS 0x156d5:$msg: Execute ERROR 0x15729:$msg: Execute ERROR 0x15ca1:$ping: cmd.exe /c ping 0 -n 2 & del
0.0.01koiHnedL.exe.350000.0.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c2e:$s1: netsh firewall delete allowedprogram 0x13c80:$s2: netsh firewall add allowedprogram 0x15ca1:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156d5:$s4: Execute ERROR 0x15729:$s4: Execute ERROR 0x156f1:$s5: Download ERROR

Suricata Signatures

ET MALWARE Bladabindi/njRAT CnC Command (ll)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-16T08:32:03.708470+0200	2021176	1	Malware Command and Control Activity Detected	192.168.2.6	49711	147.185.221.18	61276	TCP
2024-09-16T08:32:50.098627+0200	2021176	1	Malware Command and Control Activity Detected	192.168.2.6	49718	147.185.221.18	61276	TCP

ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-16T08:32:03.708470+0200	2033132	1	Malware Command and Control Activity Detected	192.168.2.6	49711	147.185.221.18	61276	TCP
2024-09-16T08:32:50.098627+0200	2033132	1	Malware Command and Control Activity Detected	192.168.2.6	49718	147.185.221.18	61276	TCP

ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-16T08:32:09.137258+0200	2825564	1	Malware Command and Control Activity Detected	192.168.2.6	49711	147.185.221.18	61276	TCP
2024-09-16T08:32:55.280177+0200	2825564	1	Malware Command and Control Activity Detected	192.168.2.6	49718	147.185.221.18	61276	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 01koiHnedL.exe

Avira: detected

Found malware configuration

Source: 0.0.01koiHnedL.exe.350000.0.unpack

Malware Configuration Extractor: Njrat {"Campaign ID": "clien", "Version": "0.7d", "Install Name": "f7e6d24b4a113d9753558dfbb032c2ac", "Install Dir": "Adobe Update", "Registry Value": "Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Network Seprator": "|'|'|"}

Multi AV Scanner detection for submitted file

Source: 01koiHnedL.exe	ReversingLabs: Detection: 86%
Source: 01koiHnedL.exe	Virustotal: Detection: 75%			Perma Link

Yara detected Njrat

Source: Yara match	File source: 01koiHnedL.exe, type: SAMPLE
Source: Yara match	File source: 0.0.01koiHnedL.exe.350000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2117088678.0000000000352000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 01koiHnedL.exe PID: 3420, type: MEMORYSTR

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 01koiHnedL.exe

Joe Sandbox ML: detected

Source: 01koiHnedL.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\01koiHnedL.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: 01koiHnedL.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Spreading

Contains functionality to spread to USB devices (.Net source)

Source: 01koiHnedL.exe, Usb1.cs

.Net Code: infect

Source: 01koiHnedL.exe, 00000000.00000000.2117088678.0000000000352000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: \autorun.inf
Source: 01koiHnedL.exe, 00000000.00000000.2117088678.0000000000352000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: 01koiHnedL.exe, 00000000.00000000.2117088678.0000000000352000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: autorun.inf
Source: 01koiHnedL.exe	Binary or memory string: \autorun.inf
Source: 01koiHnedL.exe	Binary or memory string: [autorun]
Source: 01koiHnedL.exe	Binary or memory string: autorun.inf

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.6:49718 -> 147.185.221.18:61276
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.6:49711 -> 147.185.221.18:61276
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.6:49711 -> 147.185.221.18:61276
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.6:49711 -> 147.185.221.18:61276
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.6:49718 -> 147.185.221.18:61276
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.6:49718 -> 147.185.221.18:61276

Source: global traffic

TCP traffic: 192.168.2.6:49711 -> 147.185.221.18:61276

Source: Joe Sandbox View

IP Address: 147.185.221.18 147.185.221.18

Source: Joe Sandbox View

ASN Name: SALSGIVERUS SALSGIVERUS

Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.18

Source: C:\Users\user\Desktop\01koiHnedL.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

E-Banking Fraud

Yara detected Njrat

Source: Yara match	File source: 01koiHnedL.exe, type: SAMPLE
Source: Yara match	File source: 0.0.01koiHnedL.exe.350000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2117088678.0000000000352000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 01koiHnedL.exe PID: 3420, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 01koiHnedL.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 01koiHnedL.exe, type: SAMPLE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 01koiHnedL.exe, type: SAMPLE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 01koiHnedL.exe, type: SAMPLE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.0.01koiHnedL.exe.350000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.0.01koiHnedL.exe.350000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.0.01koiHnedL.exe.350000.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0.0.01koiHnedL.exe.350000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 00000000.00000000.2117088678.0000000000352000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000000.2117088678.0000000000352000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group

Source: C:\Users\user\Desktop\01koiHnedL.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\01koiHnedL.exe	Code function: 0_2_0092BC36 NtQuerySystemInformation,		0_2_0092BC36
Source: C:\Users\user\Desktop\01koiHnedL.exe	Code function: 0_2_0092BC05 NtQuerySystemInformation,		0_2_0092BC05

Source: C:\Users\user\Desktop\01koiHnedL.exe	Code function: 0_2_00D78CE8	0_2_00D78CE8
Source: C:\Users\user\Desktop\01koiHnedL.exe	Code function: 0_2_00D74298	0_2_00D74298
Source: C:\Users\user\Desktop\01koiHnedL.exe	Code function: 0_2_00D747D4	0_2_00D747D4
Source: C:\Users\user\Desktop\01koiHnedL.exe	Code function: 0_2_00D78CD9	0_2_00D78CD9
Source: C:\Users\user\Desktop\01koiHnedL.exe	Code function: 0_2_00D744F1	0_2_00D744F1
Source: C:\Users\user\Desktop\01koiHnedL.exe	Code function: 0_2_00D749F9	0_2_00D749F9
Source: C:\Users\user\Desktop\01koiHnedL.exe	Code function: 0_2_00D750E3	0_2_00D750E3
Source: C:\Users\user\Desktop\01koiHnedL.exe	Code function: 0_2_00D74F9D	0_2_00D74F9D
Source: C:\Users\user\Desktop\01koiHnedL.exe	Code function: 0_2_00D7499D	0_2_00D7499D
Source: C:\Users\user\Desktop\01koiHnedL.exe	Code function: 0_2_00D74C8F	0_2_00D74C8F
Source: C:\Users\user\Desktop\01koiHnedL.exe	Code function: 0_2_00D7505D	0_2_00D7505D
Source: C:\Users\user\Desktop\01koiHnedL.exe	Code function: 0_2_00D74B5B	0_2_00D74B5B
Source: C:\Users\user\Desktop\01koiHnedL.exe	Code function: 0_2_00D75459	0_2_00D75459
Source: C:\Users\user\Desktop\01koiHnedL.exe	Code function: 0_2_00D74544	0_2_00D74544
Source: C:\Users\user\Desktop\01koiHnedL.exe	Code function: 0_2_00D7536F	0_2_00D7536F
Source: C:\Users\user\Desktop\01koiHnedL.exe	Code function: 0_2_00D74269	0_2_00D74269
Source: C:\Users\user\Desktop\01koiHnedL.exe	Code function: 0_2_00D75000	0_2_00D75000
Source: C:\Users\user\Desktop\01koiHnedL.exe	Code function: 0_2_00D7470F	0_2_00D7470F
Source: C:\Users\user\Desktop\01koiHnedL.exe	Code function: 0_2_00D74936	0_2_00D74936
Source: C:\Users\user\Desktop\01koiHnedL.exe	Code function: 0_2_00D74630	0_2_00D74630
Source: C:\Users\user\Desktop\01koiHnedL.exe	Code function: 0_2_00D74F2F	0_2_00D74F2F

Source: 01koiHnedL.exe, 00000000.00000002.4570462609.000000000096E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenamemscorwks.dllT vs 01koiHnedL.exe

Source: 01koiHnedL.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 01koiHnedL.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 01koiHnedL.exe, type: SAMPLE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 01koiHnedL.exe, type: SAMPLE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 01koiHnedL.exe, type: SAMPLE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.0.01koiHnedL.exe.350000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.0.01koiHnedL.exe.350000.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.01koiHnedL.exe.350000.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0.0.01koiHnedL.exe.350000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 00000000.00000000.2117088678.0000000000352000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000000.00000000.2117088678.0000000000352000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan

Source: classification engine

Classification label: mal100.spre.phis.troj.evad.winEXE@4/2@0/1

Source: C:\Users\user\Desktop\01koiHnedL.exe	Code function: 0_2_0092BABA AdjustTokenPrivileges,		0_2_0092BABA
Source: C:\Users\user\Desktop\01koiHnedL.exe	Code function: 0_2_0092BA83 AdjustTokenPrivileges,		0_2_0092BA83

Source: C:\Users\user\Desktop\01koiHnedL.exe

File created: C:\Users\user\AppData\Roaming\app

Jump to behavior

Source: C:\Users\user\Desktop\01koiHnedL.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\01koiHnedL.exe	Mutant created: \Sessions\1\BaseNamedObjects\f7e6d24b4a113d9753558dfbb032c2ac
Source: C:\Users\user\Desktop\01koiHnedL.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7092:120:WilError_03

Source: C:\Users\user\Desktop\01koiHnedL.exe

File created: C:\Users\user\AppData\Local\Temp\FransescoPast.txt

Jump to behavior

Source: 01koiHnedL.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 01koiHnedL.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\01koiHnedL.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 01koiHnedL.exe	ReversingLabs: Detection: 86%
Source: 01koiHnedL.exe	Virustotal: Detection: 75%

Source: unknown	Process created: C:\Users\user\Desktop\01koiHnedL.exe "C:\Users\user\Desktop\01koiHnedL.exe"
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\01koiHnedL.exe" "01koiHnedL.exe" ENABLE
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\01koiHnedL.exe" "01koiHnedL.exe" ENABLE	Jump to behavior

Source: C:\Users\user\Desktop\01koiHnedL.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\01koiHnedL.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\01koiHnedL.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: 01koiHnedL.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Desktop\01koiHnedL.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: 01koiHnedL.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: 01koiHnedL.exe, Fransesco.cs

.Net Code: Plugin System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: BC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 2AD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: D90000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 5920000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 6920000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 6E90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 7E90000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 82E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 92E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: A2E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: B2E0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: B770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: A2E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: C770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: D770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: E770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: F770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 10770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 11770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 12770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 13770000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 14080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 15080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 16080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 17080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 18080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 19080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 1A080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 1B080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 1C080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 1D080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 1E080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 1F080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 20080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 21080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 22080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 23080000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 24290000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 25290000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 26290000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 27290000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 28290000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 29290000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 2A290000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 2B290000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 2C290000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 2D290000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 2E290000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 2F290000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 30290000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 31290000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 32290000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: B2E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: C2E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: D2E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: E2E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: F2E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 102E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: C3E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: D3E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: E3E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: F3E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 103E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 113E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 123E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: E160000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: F160000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 10160000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: F260000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 11260000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Memory allocated: 12260000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\01koiHnedL.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\01koiHnedL.exe	Window / User API: threadDelayed 3293	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Window / User API: threadDelayed 978	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Window / User API: foregroundWindowGot 470	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe	Window / User API: foregroundWindowGot 473	Jump to behavior

Source: C:\Users\user\Desktop\01koiHnedL.exe TID: 5316	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe TID: 5316	Thread sleep count: 273 > 30	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe TID: 6524	Thread sleep count: 3293 > 30	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe TID: 6524	Thread sleep time: -1646500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe TID: 6104	Thread sleep count: 40 > 30	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe TID: 6524	Thread sleep count: 978 > 30	Jump to behavior
Source: C:\Users\user\Desktop\01koiHnedL.exe TID: 6524	Thread sleep time: -489000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\01koiHnedL.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: 01koiHnedL.exe, 00000000.00000002.4570462609.00000000009E5000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000002.00000003.2144662641.0000000002CF1000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\01koiHnedL.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\01koiHnedL.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\01koiHnedL.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:34:35 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 13:05:55 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:32:24 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:38:03 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 13:32:36 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:32:31 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:34:28 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:32:11 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:32:09 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:33:28 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 03:25:36 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:39:34 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:32:57 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:35:26 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:31:58 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 03:05:44 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 18:36:43 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 09:32:13 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 03:51:45 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:32:20 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:32:10 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:33:58 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 03:21:37 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:32:46 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:33:21 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:33:51 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:35:34 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:32:55 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 06:37:55 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:32:25 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 17:48:42 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:32:14 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 19:40:23 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:35:57 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:32:34 - Program Manager
Source: 01koiHnedL.exe	Binary or memory string: ProgMan
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:32:27 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:32:21 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 08:02:45 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:33:06 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:32:06 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:32:19 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:35:49 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 03:05:07 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 22:54:08 - Program Manager
Source: 01koiHnedL.exe	Binary or memory string: Shell_traywnd+MostrarBarraDeTarefas
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:31:57 - Program Manager
Source: 01koiHnedL.exe	Binary or memory string: Shell_TrayWnd
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 07:24:06 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 03:15:36 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:34:10 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:32:13 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:34:20 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 18:50:24 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:32:29 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 08:57:50 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:33:44 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:32:48 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 03:27:32 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 03:02:36 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 20:02:25 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:35:11 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:55:40 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:32:08 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:36:23 - Program Manager
Source: 01koiHnedL.exe, 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/09/16 \| 02:32:32 - Program Manager

Source: C:\Windows\SysWOW64\netsh.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\01koiHnedL.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Contains functionality to disable the Task Manager (.Net Source)

Source: 01koiHnedL.exe, Fransesco.cs

.Net Code: INS

Disables zone checking for all users

Source: C:\Users\user\Desktop\01koiHnedL.exe

Registry value created: HKEY_CURRENT_USER\Environment SEE_MASK_NOZONECHECKS

Jump to behavior

Modifies the windows firewall

Source: C:\Users\user\Desktop\01koiHnedL.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\01koiHnedL.exe" "01koiHnedL.exe" ENABLE

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\Desktop\01koiHnedL.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\01koiHnedL.exe" "01koiHnedL.exe" ENABLE

Stealing of Sensitive Information

Yara detected Njrat

Source: Yara match	File source: 01koiHnedL.exe, type: SAMPLE
Source: Yara match	File source: 0.0.01koiHnedL.exe.350000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2117088678.0000000000352000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 01koiHnedL.exe PID: 3420, type: MEMORYSTR

Remote Access Functionality

Yara detected Njrat

Source: Yara match	File source: 01koiHnedL.exe, type: SAMPLE
Source: Yara match	File source: 0.0.01koiHnedL.exe.350000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2117088678.0000000000352000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 01koiHnedL.exe PID: 3420, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	11 Replication Through Removable Media	Windows Management Instrumentation	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	2 Process Injection	41 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Clipboard Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Process Injection	LSA Secrets	1 Peripheral Device Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
01koiHnedL.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
01koiHnedL.exe	75%	Virustotal		Browse
01koiHnedL.exe	100%	Avira	TR/Dropper.Gen
01koiHnedL.exe	100%	Joe Sandbox ML

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
147.185.221.18	unknown	United States		12087	SALSGIVERUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1511706
Start date and time:	2024-09-16 08:31:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	01koiHnedL.exe renamed because original name is a hash value
Original Sample Name:	1f41f02970cfdce69e628299a96d754d.exe
Detection:	MAL
Classification:	mal100.spre.phis.troj.evad.winEXE@4/2@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 142 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, cdn.onenote.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:32:32	API Interceptor	147899x Sleep call for process: 01koiHnedL.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
147.185.221.18	i231IEP3oh.exe	Get hash	malicious	AsyncRAT	Browse
	killer.exe	Get hash	malicious	XWorm	Browse
	system47.exe	Get hash	malicious	XWorm	Browse
	javaupdate.jar	Get hash	malicious	Dynamic Stealer	Browse
	javaupdate.jar	Get hash	malicious	Dynamic Stealer	Browse
	LisectAVT_2403002C_149.exe	Get hash	malicious	AsyncRAT	Browse
	LisectAVT_2403002C_28.exe	Get hash	malicious	Remcos	Browse
	sqjxHtZQi8.jpg.ps1	Get hash	malicious	ArrowRAT	Browse
	listafamilia_caipira.doc	Get hash	malicious	ArrowRAT	Browse
	1.exe	Get hash	malicious	AsyncRAT, PureLog Stealer, zgRAT	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SALSGIVERUS	nPIv2AODg2.exe	Get hash	malicious	XWorm	Browse	147.185.221.19
	WLO9Pkkle0.exe	Get hash	malicious	XWorm	Browse	147.185.221.22
	uUY8turU3x.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	147.185.221.22
	wB5Gc9RKzG.exe	Get hash	malicious	XWorm	Browse	147.185.221.22
	Uhj9qfwbYG.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	147.185.221.21
	PjkFCWhi.exe	Get hash	malicious	XWorm	Browse	147.185.221.22
	BootstrapperV3.0.exe	Get hash	malicious	XWorm	Browse	147.185.221.22
	TRXLoader.exe	Get hash	malicious	XWorm	Browse	147.185.221.22
	Bootstrapper.exe	Get hash	malicious	XWorm	Browse	147.185.221.22
	Fixer.exe	Get hash	malicious	Unknown	Browse	147.185.221.22

Process:	C:\Users\user\Desktop\01koiHnedL.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:1n:1
MD5:	02B81B0CBE1FAAA1FA62D5FC876AB443
SHA1:	D473CFE21FB1F188689415B0BDD239688F8FDDD9
SHA-256:	E7E9E2C247BC872BACCE77661C78F001A17D70EE3130A9016A5818DA9DA00CDB
SHA-512:	592AB5B200D4C560951CB70288DC1B7A562F0CBFAEE01CE03076B6934D537B88575C2E1E0FEDCC05DB95E6C224CA739923E7D74F9165E683F3FBAD7BBF641784
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.16

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	313
Entropy (8bit):	4.971939296804078
Encrypted:	false
SSDEEP:	6:/ojfKsUTGN8Ypox42k9L+DbGMKeQE+vigqAZs2E+AYeDPO+Yswyha:wjPIGNrkHk9iaeIM6ADDPOHyha
MD5:	689E2126A85BF55121488295EE068FA1
SHA1:	09BAAA253A49D80C18326DFBCA106551EBF22DD6
SHA-256:	D968A966EF474068E41256321F77807A042F1965744633D37A203A705662EC25
SHA-512:	C3736A8FC7E6573FA1B26FE6A901C05EE85C55A4A276F8F569D9EADC9A58BEC507D1BB90DBF9EA62AE79A6783178C69304187D6B90441D82E46F5F56172B5C5C
Malicious:	false
Reputation:	high, very likely benign file
Preview:	..IMPORTANT: Command executed successfully...However, "netsh firewall" is deprecated;..use "netsh advfirewall firewall" instead...For more information on using "netsh advfirewall firewall" commands..instead of "netsh firewall", see KB article 947709..at https://go.microsoft.com/fwlink/?linkid=121488 .....Ok.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.565068645805422
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	01koiHnedL.exe
File size:	95'232 bytes
MD5:	1f41f02970cfdce69e628299a96d754d
SHA1:	fb04fa7cbe25caccd197dac9af74496e3b513866
SHA256:	6d48ccbf40f5f43149cb69f1659d683fc7eaf5cee527f724a1761e548c1a5fe2
SHA512:	aeec12de9fdffa33fa7123809c2e67b1a6fa786d7c8db210d622b76ddeb40ae631a1cc370644836618670e976dde42367818ce53097b1760493e63c73fa6ba29
SSDEEP:	1536:QxNJD/HBZbszKu9AZp77r1jEwzGi1dDrD7gS:QxUzK4AZtHCi1dr0
TLSH:	E893E94977E52524E0BF56F75471F2004E34B48B1612E39D58F219AA0B33AC48F8AFEB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f.................p............... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x418f1e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66D896E0 [Wed Sep 4 17:20:32 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x18ed0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x16f24	0x17000	1789bfe8f7287f81e478a81a39b266ae	False	0.36824898097826086	data	5.596737171251843	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x1a000	0xc	0x200	9dc49a004fa3bd643fadc899ad4fdf5d	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-16T08:32:03.708470+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.6	49711	147.185.221.18	61276	TCP
2024-09-16T08:32:03.708470+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.6	49711	147.185.221.18	61276	TCP
2024-09-16T08:32:09.137258+0200	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.6	49711	147.185.221.18	61276	TCP
2024-09-16T08:32:50.098627+0200	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.6	49718	147.185.221.18	61276	TCP
2024-09-16T08:32:50.098627+0200	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.6	49718	147.185.221.18	61276	TCP
2024-09-16T08:32:55.280177+0200	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.6	49718	147.185.221.18	61276	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 16, 2024 08:32:02.092541933 CEST	49711	61276	192.168.2.6	147.185.221.18
Sep 16, 2024 08:32:02.097557068 CEST	61276	49711	147.185.221.18	192.168.2.6
Sep 16, 2024 08:32:02.097639084 CEST	49711	61276	192.168.2.6	147.185.221.18
Sep 16, 2024 08:32:03.708470106 CEST	49711	61276	192.168.2.6	147.185.221.18
Sep 16, 2024 08:32:03.724071980 CEST	61276	49711	147.185.221.18	192.168.2.6
Sep 16, 2024 08:32:03.724145889 CEST	49711	61276	192.168.2.6	147.185.221.18
Sep 16, 2024 08:32:03.729034901 CEST	61276	49711	147.185.221.18	192.168.2.6
Sep 16, 2024 08:32:09.137258053 CEST	49711	61276	192.168.2.6	147.185.221.18
Sep 16, 2024 08:32:09.142111063 CEST	61276	49711	147.185.221.18	192.168.2.6
Sep 16, 2024 08:32:48.055018902 CEST	61276	49711	147.185.221.18	192.168.2.6
Sep 16, 2024 08:32:48.055119991 CEST	49711	61276	192.168.2.6	147.185.221.18
Sep 16, 2024 08:32:50.062112093 CEST	49711	61276	192.168.2.6	147.185.221.18
Sep 16, 2024 08:32:50.062730074 CEST	49718	61276	192.168.2.6	147.185.221.18
Sep 16, 2024 08:32:50.067166090 CEST	61276	49711	147.185.221.18	192.168.2.6
Sep 16, 2024 08:32:50.067553043 CEST	61276	49718	147.185.221.18	192.168.2.6
Sep 16, 2024 08:32:50.067640066 CEST	49718	61276	192.168.2.6	147.185.221.18
Sep 16, 2024 08:32:50.098627090 CEST	49718	61276	192.168.2.6	147.185.221.18
Sep 16, 2024 08:32:50.103585958 CEST	61276	49718	147.185.221.18	192.168.2.6
Sep 16, 2024 08:32:50.103789091 CEST	49718	61276	192.168.2.6	147.185.221.18
Sep 16, 2024 08:32:50.108700037 CEST	61276	49718	147.185.221.18	192.168.2.6
Sep 16, 2024 08:32:55.280177116 CEST	49718	61276	192.168.2.6	147.185.221.18
Sep 16, 2024 08:32:55.285093069 CEST	61276	49718	147.185.221.18	192.168.2.6

Target ID:	0
Start time:	02:31:55
Start date:	16/09/2024
Path:	C:\Users\user\Desktop\01koiHnedL.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\01koiHnedL.exe"
Imagebase:	0x350000
File size:	95'232 bytes
MD5 hash:	1F41F02970CFDCE69E628299A96D754D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000000.2117088678.0000000000352000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000000.00000000.2117088678.0000000000352000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: Njrat, Description: detect njRAT in memory, Source: 00000000.00000000.2117088678.0000000000352000.00000002.00000001.01000000.00000003.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000002.4571318480.0000000002AD1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	02:31:57
Start date:	16/09/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall add allowedprogram "C:\Users\user\Desktop\01koiHnedL.exe" "01koiHnedL.exe" ENABLE
Imagebase:	0xa60000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:31:57
Start date:	16/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	21.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	7.7%
Total number of Nodes:	91
Total number of Limit Nodes:	5

Executed Functions

Function 00D74298 Relevance: 13.2, Strings: 9, Instructions: 1950
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@2l, xrefs: 00D74E43
:@2l, xrefs: 00D74582
2Yl, xrefs: 00D7541D
:@2l, xrefs: 00D75541
:@2l, xrefs: 00D74CF3
@, xrefs: 00D74C24
:@2l, xrefs: 00D74D9A
\OYl, xrefs: 00D76AF9
:@2l, xrefs: 00D76CF5

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: :@2l$:@2l$:@2l$:@2l$:@2l$:@2l$@$\OYl$2Yl
API String ID: 0-2587338529
Opcode ID: d847b1592cf33cf6826237c21e1cf9418ab6fd163a8bb385b0c4d2a44bd875fc
Instruction ID: 46c5e51942a54e500824984cecbf7d5d387be065e243fab2adba3bf6269bbf42
Opcode Fuzzy Hash: d847b1592cf33cf6826237c21e1cf9418ab6fd163a8bb385b0c4d2a44bd875fc
Instruction Fuzzy Hash: 5C235A74A02228CFDB64EF74D954BA9B7B2FB48304F1081EAD40AA7794DB359E85CF50

Function 00D74269 Relevance: 13.0, Strings: 9, Instructions: 1763
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@2l, xrefs: 00D74E43
:@2l, xrefs: 00D74582
2Yl, xrefs: 00D7541D
:@2l, xrefs: 00D75541
:@2l, xrefs: 00D74CF3
:@2l, xrefs: 00D74D9A
\OYl, xrefs: 00D76AF9
:@2l, xrefs: 00D76CF5
, xrefs: 00D74BC4

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: $:@2l$:@2l$:@2l$:@2l$:@2l$:@2l$\OYl$2Yl
API String ID: 0-2458924787
Opcode ID: 95bb37ee5f637459823e416ddb046915378aebfef03787e86dadfbe9685d9d7a
Instruction ID: 1f388042a5405f4b393b43cb2180ac76a711dc7c20d406370bd00ac93e79c58e
Opcode Fuzzy Hash: 95bb37ee5f637459823e416ddb046915378aebfef03787e86dadfbe9685d9d7a
Instruction Fuzzy Hash: 0B134B74A02228CFDB25EF34D954BA9B7B2FB48304F1081EAD90A67794DB359E85CF50

Function 00D744F1 Relevance: 12.9, Strings: 9, Instructions: 1624
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@2l, xrefs: 00D74E43
:@2l, xrefs: 00D74582
2Yl, xrefs: 00D7541D
:@2l, xrefs: 00D75541
:@2l, xrefs: 00D74CF3
:@2l, xrefs: 00D74D9A
\OYl, xrefs: 00D76AF9
:@2l, xrefs: 00D76CF5
, xrefs: 00D74BC4

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: $:@2l$:@2l$:@2l$:@2l$:@2l$:@2l$\OYl$2Yl
API String ID: 0-2458924787
Opcode ID: b48f1e6b5877b083944596e7bc57288c513d7b8c9e5010b724f6d96788147c80
Instruction ID: 54d58d3fe16d42f0063d5ae7f9e47a330b988c7f7d7c049f27c362375feaf711
Opcode Fuzzy Hash: b48f1e6b5877b083944596e7bc57288c513d7b8c9e5010b724f6d96788147c80
Instruction Fuzzy Hash: B2034974A02228CFDB25EF34D954BA9B7B2FB48304F1081EAD90A67794DB359E85CF50

Function 00D74544 Relevance: 12.9, Strings: 9, Instructions: 1618
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@2l, xrefs: 00D74E43
:@2l, xrefs: 00D74582
2Yl, xrefs: 00D7541D
:@2l, xrefs: 00D75541
:@2l, xrefs: 00D74CF3
:@2l, xrefs: 00D74D9A
\OYl, xrefs: 00D76AF9
:@2l, xrefs: 00D76CF5
, xrefs: 00D74BC4

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: $:@2l$:@2l$:@2l$:@2l$:@2l$:@2l$\OYl$2Yl
API String ID: 0-2458924787
Opcode ID: 51cc89a3769b2d54c80e9edb22cd5ac876a7a1885d8abbadad940d80b6cbdffe
Instruction ID: 19ce4efca1faa3630bccdca1be957030f84241345613b23abd86f55df0da3b47
Opcode Fuzzy Hash: 51cc89a3769b2d54c80e9edb22cd5ac876a7a1885d8abbadad940d80b6cbdffe
Instruction Fuzzy Hash: E3034974A02228CFDB25EF34D954BA9B7B2FB48304F1081EAD90A67794DB359E85CF50

Function 00D74630 Relevance: 11.6, Strings: 8, Instructions: 1579
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@2l, xrefs: 00D74E43
2Yl, xrefs: 00D7541D
:@2l, xrefs: 00D75541
:@2l, xrefs: 00D74CF3
:@2l, xrefs: 00D74D9A
\OYl, xrefs: 00D76AF9
:@2l, xrefs: 00D76CF5
, xrefs: 00D74BC4

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: $:@2l$:@2l$:@2l$:@2l$:@2l$\OYl$2Yl
API String ID: 0-2159143268
Opcode ID: 26004bb35f59722cbd7ddc05a1630a9c59f670f43c1bc1130b6c9a0f8c32b5e0
Instruction ID: ada628c0ea573191104332d6008f71686926fba606d1a65ca8f914f1667b1577
Opcode Fuzzy Hash: 26004bb35f59722cbd7ddc05a1630a9c59f670f43c1bc1130b6c9a0f8c32b5e0
Instruction Fuzzy Hash: 99033974A02228CFDB25EF34D954BA9B7B2FB48304F1081EAD90A67794DB359E85CF50

Function 00D7470F Relevance: 11.5, Strings: 8, Instructions: 1544
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@2l, xrefs: 00D74E43
2Yl, xrefs: 00D7541D
:@2l, xrefs: 00D75541
:@2l, xrefs: 00D74CF3
:@2l, xrefs: 00D74D9A
\OYl, xrefs: 00D76AF9
:@2l, xrefs: 00D76CF5
, xrefs: 00D74BC4

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: $:@2l$:@2l$:@2l$:@2l$:@2l$\OYl$2Yl
API String ID: 0-2159143268
Opcode ID: 59e7e96cd9ef7aa8692560c82799bb92b57acf9e2fb632b505e54c71f0b0d34f
Instruction ID: c1e860d10c880b5c018ca2c4e93048b564ce13c8ab277b5c52e1d70df0ce0840
Opcode Fuzzy Hash: 59e7e96cd9ef7aa8692560c82799bb92b57acf9e2fb632b505e54c71f0b0d34f
Instruction Fuzzy Hash: D2F24974A02228CFDB25EF24DD54BA9B7B2FB48304F1081EAD90A67794DB359E85CF50

Function 00D747D4 Relevance: 11.5, Strings: 8, Instructions: 1513
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@2l, xrefs: 00D74E43
2Yl, xrefs: 00D7541D
:@2l, xrefs: 00D75541
:@2l, xrefs: 00D74CF3
:@2l, xrefs: 00D74D9A
\OYl, xrefs: 00D76AF9
:@2l, xrefs: 00D76CF5
, xrefs: 00D74BC4

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: $:@2l$:@2l$:@2l$:@2l$:@2l$\OYl$2Yl
API String ID: 0-2159143268
Opcode ID: 4dcdc43dd55633e74eb5ecb7b018edd4196029e1d924118e7ded0261bc057e28
Instruction ID: e7e619b7438aa0935ae8e9186c002db32511c3fc99120623e6634fbbcf83df10
Opcode Fuzzy Hash: 4dcdc43dd55633e74eb5ecb7b018edd4196029e1d924118e7ded0261bc057e28
Instruction Fuzzy Hash: 09F24974A02228CFDB25EF24DD54BA9B7B2FB48304F1081EAD90A67794DB319E85CF50

Function 00D74936 Relevance: 11.5, Strings: 8, Instructions: 1456
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@2l, xrefs: 00D74E43
2Yl, xrefs: 00D7541D
:@2l, xrefs: 00D75541
:@2l, xrefs: 00D74CF3
:@2l, xrefs: 00D74D9A
\OYl, xrefs: 00D76AF9
:@2l, xrefs: 00D76CF5
, xrefs: 00D74BC4

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: $:@2l$:@2l$:@2l$:@2l$:@2l$\OYl$2Yl
API String ID: 0-2159143268
Opcode ID: b448f89d0f65324b88839cade39ac2fbfc12900bdea71863216e1b2b86d15d2b
Instruction ID: 2aa80e348477b0207e215e664fcecfb7507c382200cb27624e8d7b99687e40a5
Opcode Fuzzy Hash: b448f89d0f65324b88839cade39ac2fbfc12900bdea71863216e1b2b86d15d2b
Instruction Fuzzy Hash: 75F24974A06228CFDB25EF24DD54BA9B7B2FB48304F1081EAD90A67794DB319E85CF50

Function 00D7499D Relevance: 11.4, Strings: 8, Instructions: 1447
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@2l, xrefs: 00D74E43
2Yl, xrefs: 00D7541D
:@2l, xrefs: 00D75541
:@2l, xrefs: 00D74CF3
:@2l, xrefs: 00D74D9A
\OYl, xrefs: 00D76AF9
:@2l, xrefs: 00D76CF5
, xrefs: 00D74BC4

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: $:@2l$:@2l$:@2l$:@2l$:@2l$\OYl$2Yl
API String ID: 0-2159143268
Opcode ID: bb7651017ddeb25ada44ef39b7b4e8343a5cfb3f8b0b76bcb287afedc51094b5
Instruction ID: d8078fe909421d3556eef58052393b8ab9b251f5eda3d6766380d8fc403eaa52
Opcode Fuzzy Hash: bb7651017ddeb25ada44ef39b7b4e8343a5cfb3f8b0b76bcb287afedc51094b5
Instruction Fuzzy Hash: 88F24974A06228CFDB25EF24DD54BA9B7B2FB48304F1081EAD90A67794DB319E85CF50

Function 00D749F9 Relevance: 11.4, Strings: 8, Instructions: 1440
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@2l, xrefs: 00D74E43
2Yl, xrefs: 00D7541D
:@2l, xrefs: 00D75541
:@2l, xrefs: 00D74CF3
:@2l, xrefs: 00D74D9A
\OYl, xrefs: 00D76AF9
:@2l, xrefs: 00D76CF5
, xrefs: 00D74BC4

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: $:@2l$:@2l$:@2l$:@2l$:@2l$\OYl$2Yl
API String ID: 0-2159143268
Opcode ID: 5547b311a7bce4943db20a3c16393e221978362acceca99238e6860b9aae8e83
Instruction ID: 6df07876a2058a59145631d8be3aa2b01e822c203a6b2e208ef0ebe5ab464e9d
Opcode Fuzzy Hash: 5547b311a7bce4943db20a3c16393e221978362acceca99238e6860b9aae8e83
Instruction Fuzzy Hash: FCF24874A06228CFDB25EF24DD54BA9B7B2FB48304F1081EAD90A67794DB319E85CF50

Function 00D74B5B Relevance: 11.4, Strings: 8, Instructions: 1383
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@2l, xrefs: 00D74E43
2Yl, xrefs: 00D7541D
:@2l, xrefs: 00D75541
:@2l, xrefs: 00D74CF3
:@2l, xrefs: 00D74D9A
\OYl, xrefs: 00D76AF9
:@2l, xrefs: 00D76CF5
, xrefs: 00D74BC4

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: $:@2l$:@2l$:@2l$:@2l$:@2l$\OYl$2Yl
API String ID: 0-2159143268
Opcode ID: b2a998132bdc9fc934c6a5e184ae93ca3e629bebbc66f6d7cf1c70ae1facc747
Instruction ID: a298ad96510489fde1cb2423e398ffa6dad8316ede3f901fd9f3e351546aca35
Opcode Fuzzy Hash: b2a998132bdc9fc934c6a5e184ae93ca3e629bebbc66f6d7cf1c70ae1facc747
Instruction Fuzzy Hash: 25E24974A06228CFDB25EF34D954BA9B7B2FB48304F1081EAD90A67794DB319E85CF50

Function 00D74C8F Relevance: 10.1, Strings: 7, Instructions: 1362
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:@2l, xrefs: 00D74E43
2Yl, xrefs: 00D7541D
:@2l, xrefs: 00D75541
:@2l, xrefs: 00D74CF3
:@2l, xrefs: 00D74D9A
\OYl, xrefs: 00D76AF9
:@2l, xrefs: 00D76CF5

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: :@2l$:@2l$:@2l$:@2l$:@2l$\OYl$2Yl
API String ID: 0-1757531996
Opcode ID: 9d6c1b0524bd2a685808533063382efc0b5d62d8bf0f5940b2c49f15fe268b3a
Instruction ID: 0a95b87d5d11a3124e2c97c0c83deda2a3b08184b5e45b247184f81fb99d5b04
Opcode Fuzzy Hash: 9d6c1b0524bd2a685808533063382efc0b5d62d8bf0f5940b2c49f15fe268b3a
Instruction Fuzzy Hash: B8E24974A06228CFDB25EF34D954BA9B7B2FB48304F1081EAD90A67794DB319E85CF50

Function 00D74F2F Relevance: 6.2, Strings: 4, Instructions: 1245
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2Yl, xrefs: 00D7541D
:@2l, xrefs: 00D75541
\OYl, xrefs: 00D76AF9
:@2l, xrefs: 00D76CF5

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: :@2l$:@2l$\OYl$2Yl
API String ID: 0-1774593142
Opcode ID: 3ffd1bf82433d793cecedc35a2d8d1f170e30af60673e1039f548aaa4a4e6a51
Instruction ID: 53c025cee5c281b8bcb4ae7197a493a6f2bddb12a14b5199fd127a13dee2708f
Opcode Fuzzy Hash: 3ffd1bf82433d793cecedc35a2d8d1f170e30af60673e1039f548aaa4a4e6a51
Instruction Fuzzy Hash: A6D23A74A06228CFDB65EF34D954BA9B7B2FB48304F1081EAD80A67794DB319E85CF50

Function 00D74F9D Relevance: 6.2, Strings: 4, Instructions: 1236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2Yl, xrefs: 00D7541D
:@2l, xrefs: 00D75541
\OYl, xrefs: 00D76AF9
:@2l, xrefs: 00D76CF5

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: :@2l$:@2l$\OYl$2Yl
API String ID: 0-1774593142
Opcode ID: 3ef3aa16b0c5fe1acf4a7401a02618b38a4147a613b7756635ae86572775bbbe
Instruction ID: 8836d9bade58c07b128d60120d7085fdcd51e3865acb47c89c5b6b3d1e2577ad
Opcode Fuzzy Hash: 3ef3aa16b0c5fe1acf4a7401a02618b38a4147a613b7756635ae86572775bbbe
Instruction Fuzzy Hash: A5D23A74A06228CFDB65EF34D954BA9B7B2FB48304F1081EAD80A67794DB319E85CF50

Function 00D75000 Relevance: 6.2, Strings: 4, Instructions: 1230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2Yl, xrefs: 00D7541D
:@2l, xrefs: 00D75541
\OYl, xrefs: 00D76AF9
:@2l, xrefs: 00D76CF5

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: :@2l$:@2l$\OYl$2Yl
API String ID: 0-1774593142
Opcode ID: 689fec55add43ea59021484b888f9dd938484ff50ddd8da8397b674a8f32e860
Instruction ID: 17973e455937a9b4e75d651452b63d28f2cadef76d3393c83029f1968c396b76
Opcode Fuzzy Hash: 689fec55add43ea59021484b888f9dd938484ff50ddd8da8397b674a8f32e860
Instruction Fuzzy Hash: 47D23A74A06228CFDB65EF34D954BA9B7B2FB48304F1081EAD80A67794DB319E85CF50

Function 00D7505D Relevance: 6.2, Strings: 4, Instructions: 1225COMMON

Download Yara Rule

Strings

2Yl, xrefs: 00D7541D
:@2l, xrefs: 00D75541
\OYl, xrefs: 00D76AF9
:@2l, xrefs: 00D76CF5

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: :@2l$:@2l$\OYl$2Yl
API String ID: 0-1774593142
Opcode ID: a5945f9ef40fd847a6671bb068588cd3f138a1b4d3eb526b3e30ab0f2e169f91
Instruction ID: 86975bc64520ca021a8ab39fb5a882ec0d807b58e68fa4ecc7ef12b4afb51e83
Opcode Fuzzy Hash: a5945f9ef40fd847a6671bb068588cd3f138a1b4d3eb526b3e30ab0f2e169f91
Instruction Fuzzy Hash: 55D24A74A02228CFDB65EF34D954BA9B7B2FB48304F1081EAD80A67794DB319E85CF50

Function 00D750E3 Relevance: 6.2, Strings: 4, Instructions: 1210COMMON

Download Yara Rule

Strings

2Yl, xrefs: 00D7541D
:@2l, xrefs: 00D75541
\OYl, xrefs: 00D76AF9
:@2l, xrefs: 00D76CF5

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: :@2l$:@2l$\OYl$2Yl
API String ID: 0-1774593142
Opcode ID: f9f7d202c61abc919c6c547b8c4876d2782f327241e3ff9958aa5989fb35b82f
Instruction ID: 4d0724114ebe26b3b05c0736db842895c9f7d8e70c4d498cf7208b01e169c6c6
Opcode Fuzzy Hash: f9f7d202c61abc919c6c547b8c4876d2782f327241e3ff9958aa5989fb35b82f
Instruction Fuzzy Hash: 71D23A74A02228CFDB65EF34D954BA9B7B2FB48304F1081EAD80A67794DB319E95CF50

Function 00D7536F Relevance: 6.1, Strings: 4, Instructions: 1071COMMON

Download Yara Rule

Strings

2Yl, xrefs: 00D7541D
:@2l, xrefs: 00D75541
\OYl, xrefs: 00D76AF9
:@2l, xrefs: 00D76CF5

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: :@2l$:@2l$\OYl$2Yl
API String ID: 0-1774593142
Opcode ID: 14916180fe5ea7e04ed54af1ef6c3446a97a6bb3cc7a335a540c11f61277e466
Instruction ID: 97fc1f6d3f668c4e550ef5497f77a0b0d2417d8383d95a94a6c4e6149af1ea75
Opcode Fuzzy Hash: 14916180fe5ea7e04ed54af1ef6c3446a97a6bb3cc7a335a540c11f61277e466
Instruction Fuzzy Hash: B1C24C74A02228CFDB65EF24DD54BA9B7B2FB48304F1081EAD40A6B794DB319E95CF50

Function 00D75459 Relevance: 4.8, Strings: 3, Instructions: 1040COMMON

Download Yara Rule

Strings

:@2l, xrefs: 00D75541
\OYl, xrefs: 00D76AF9
:@2l, xrefs: 00D76CF5

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: :@2l$:@2l$\OYl
API String ID: 0-3268719163
Opcode ID: b0c4673da204da7ea781c6f2c3b161368210ad55e59de6665df844d362d10c72
Instruction ID: d5eeb8715f696340581e26c89cf716192966d8b76b13abe231d3a77fa3cf6139
Opcode Fuzzy Hash: b0c4673da204da7ea781c6f2c3b161368210ad55e59de6665df844d362d10c72
Instruction Fuzzy Hash: 0AC23C74A02228CFDB65EF24DD54BA9B7B2FB48304F1081EAD40A6B794DB319E95CF50

Function 00D78CE8 Relevance: 2.1, Strings: 1, Instructions: 805COMMON

Download Yara Rule

Strings

:@2l, xrefs: 00D7980B

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: :@2l
API String ID: 0-1731998491
Opcode ID: e96083d81132ffbef4991b2e5731cf678e519c4163d91e4938261c8ebfb4959b
Instruction ID: 377fce8b487c131ce11504cde621d137ec91453123b320c8b888a041e09e63f7
Opcode Fuzzy Hash: e96083d81132ffbef4991b2e5731cf678e519c4163d91e4938261c8ebfb4959b
Instruction Fuzzy Hash: 13520132A012119BCB18EB75E46066DB3B2FF88344755C02AE45A9B394EF35ED52DBA0

Function 0092BA83 Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 0092BB03

Memory Dump Source

Source File: 00000000.00000002.4570281581.000000000092A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92a000_01koiHnedL.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 8d33ed9da95ffefe406fd163e4000cb385491daa1a7d5c0aa27b3ef0cf762545
Instruction ID: 7fb037f92399c7e7ca4505526829326388aea43eb6add64e048b4bb4466b6dde
Opcode Fuzzy Hash: 8d33ed9da95ffefe406fd163e4000cb385491daa1a7d5c0aa27b3ef0cf762545
Instruction Fuzzy Hash: C5219F75509780AFDB228F25DC44B52BFF8EF06310F0985DAE9858B563D371D908DB62

Function 0092BC05 Relevance: 1.6, APIs: 1, Instructions: 57nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 0092BC71

Memory Dump Source

Source File: 00000000.00000002.4570281581.000000000092A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92a000_01koiHnedL.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 1a01f404fb40b69b9036f6acee4b8d87520661e99bcb9c438b72560c909781ad
Instruction ID: 6e9009e3f0de67461d305bc883f2106a15a3685be78f3cfb38639100aecfafb7
Opcode Fuzzy Hash: 1a01f404fb40b69b9036f6acee4b8d87520661e99bcb9c438b72560c909781ad
Instruction Fuzzy Hash: 161190714097C09FDB22CF15DC45A92FFF4EF07324F0984DAE9844B263D265A918DB62

Function 0092BABA Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 0092BB03

Memory Dump Source

Source File: 00000000.00000002.4570281581.000000000092A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92a000_01koiHnedL.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 0a37e06049ce94cde189b7afe27d9fca3d4574fe36788f0a56e788f066e9aea5
Instruction ID: 200f698ce181868aed4dcc0d53b2b4da5bdbd8b4e393d438f872e4f7feb4f137
Opcode Fuzzy Hash: 0a37e06049ce94cde189b7afe27d9fca3d4574fe36788f0a56e788f066e9aea5
Instruction Fuzzy Hash: 3611A0315007009FDB20CF55E944B52FBE8EF04320F08C4AADD458B656D375E818DF61

Function 0092BC36 Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 0092BC71

Memory Dump Source

Source File: 00000000.00000002.4570281581.000000000092A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92a000_01koiHnedL.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 5db8459cf3d74b73c560c8fc38b0f8d1024ba84c8c3897b99dc633507070741a
Instruction ID: 534472ab3c32e19f8b48a171c3c18dab128622b8ab5f7b7119410217485ad9a0
Opcode Fuzzy Hash: 5db8459cf3d74b73c560c8fc38b0f8d1024ba84c8c3897b99dc633507070741a
Instruction Fuzzy Hash: F0018F31500A449FEB20CF49E984B61FBE4EF45720F18C49ADD890A655D375E818DFA2

Function 00D700B8 Relevance: 5.1, Strings: 4, Instructions: 98COMMON

Download Yara Rule

Strings

2Yl, xrefs: 00D70154
E]Xl^, xrefs: 00D70140, 00D70145
2Yl, xrefs: 00D701A8
5]Xl^, xrefs: 00D70194, 00D70199

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: 2Yl$2Yl$5]Xl^$E]Xl^
API String ID: 0-4174921172
Opcode ID: 260300c37047ae016b2ce9620b97d272db944bb06242084bfac2b00ce4fa02e9
Instruction ID: fcdef9a0de9830e87ccb0374515587c19fadf2a7b5e8cdd17506edad3d6b0de6
Opcode Fuzzy Hash: 260300c37047ae016b2ce9620b97d272db944bb06242084bfac2b00ce4fa02e9
Instruction Fuzzy Hash: 8B31E4317083909FCB19E7749C51BAE3BA79BC2308F04856ED005CF792DB769C0A87A2

Function 00D70118 Relevance: 5.1, Strings: 4, Instructions: 61COMMON

Download Yara Rule

Strings

2Yl, xrefs: 00D70154
E]Xl^, xrefs: 00D70140, 00D70145
2Yl, xrefs: 00D701A8
5]Xl^, xrefs: 00D70194, 00D70199

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: 2Yl$2Yl$5]Xl^$E]Xl^
API String ID: 0-4174921172
Opcode ID: 1ca9430083aace28fda22ca15174dd837acc26098f142a0074960e09c1294bea
Instruction ID: 9ff84c890ab08b96caa456c84513806f354aacaf1467cf43f782c85a5e972bf0
Opcode Fuzzy Hash: 1ca9430083aace28fda22ca15174dd837acc26098f142a0074960e09c1294bea
Instruction Fuzzy Hash: F311023170C2908FC72AA7B868516ED2BA78BC6308314556FD006CF786CF769C0D87A3

Function 00D776C0 Relevance: 3.7, Strings: 2, Instructions: 1242COMMON

Download Yara Rule

Strings

:@2l, xrefs: 00D77925
:@2l, xrefs: 00D77936

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: :@2l$:@2l
API String ID: 0-1182302870
Opcode ID: 6427b9073f828360aefa421474d39f1c0217f8d829be00eee027b35fbf2ad309
Instruction ID: aaeb37194322bd2f07a61bee30babdac084c16f73ba59300658ab6160e67a74a
Opcode Fuzzy Hash: 6427b9073f828360aefa421474d39f1c0217f8d829be00eee027b35fbf2ad309
Instruction Fuzzy Hash: 7BC2AB34B05164DBDB15AB35E9007B97BF2EB4C309F24C0AB985A93784DB348D5AEF21

Function 00D7773C Relevance: 3.6, Strings: 2, Instructions: 1079COMMON

Download Yara Rule

Strings

:@2l, xrefs: 00D77925
:@2l, xrefs: 00D77936

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: :@2l$:@2l
API String ID: 0-1182302870
Opcode ID: 77ff7c579df779ee4ca6cb7a080cbdbd61e180807bd7fa76c11b1cef00bcee8c
Instruction ID: 6672ba6d03c07cfc25899016fc56a3bc14787728d93baac0a54be393b292e176
Opcode Fuzzy Hash: 77ff7c579df779ee4ca6cb7a080cbdbd61e180807bd7fa76c11b1cef00bcee8c
Instruction Fuzzy Hash: 0192AC347041609BDF056B35E9107B97BF6EB88309F24C06B945AA3B94DF348D5AEF22

Function 00D77776 Relevance: 3.6, Strings: 2, Instructions: 1076COMMON

Download Yara Rule

Strings

:@2l, xrefs: 00D77925
:@2l, xrefs: 00D77936

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: :@2l$:@2l
API String ID: 0-1182302870
Opcode ID: 011b262ef0cddbcc5503c78821ca81716859d497b7fc2d9639dbc36fc6f90e37
Instruction ID: 0d7586bf78988eb4afe3b6c62d44048c751f92905aa2784e65fe1008e0b3fc14
Opcode Fuzzy Hash: 011b262ef0cddbcc5503c78821ca81716859d497b7fc2d9639dbc36fc6f90e37
Instruction Fuzzy Hash: DE92BC347041609BDF056B35E9107B97BF6EB88309F24C06B945AA3B94DF348D5AEF22

Function 00D777A5 Relevance: 3.6, Strings: 2, Instructions: 1075COMMON

Download Yara Rule

Strings

:@2l, xrefs: 00D77925
:@2l, xrefs: 00D77936

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: :@2l$:@2l
API String ID: 0-1182302870
Opcode ID: a039c66bc9ee1ee3f3b5e8ae77aa84fe24f07309c3a661ae707ab42984b70e61
Instruction ID: f06b51d72404cbb7a4a55e514b7011354052ef1e69769fc29d29b8a3c8742120
Opcode Fuzzy Hash: a039c66bc9ee1ee3f3b5e8ae77aa84fe24f07309c3a661ae707ab42984b70e61
Instruction Fuzzy Hash: 4192BC347041609BDF056B35E9107B97BF6EB88309F24C06B945AA3B94DF348D5AEF22

Function 0092A140 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,?), ref: 0092A1C1

Strings

X<l, xrefs: 0092A1DD

Memory Dump Source

Source File: 00000000.00000002.4570281581.000000000092A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92a000_01koiHnedL.jbxd

Similarity

API ID: send
String ID: X<l
API String ID: 2809346765-1623157627
Opcode ID: 9925057fb99fe60a4b871eaa5df33aecdbe0e5a756644a68c0ae2bf246cd0157
Instruction ID: 2c5516be6bea9bd5004843b530b8b70c269379aa1e1ed8283806d0cef1a98af3
Opcode Fuzzy Hash: 9925057fb99fe60a4b871eaa5df33aecdbe0e5a756644a68c0ae2bf246cd0157
Instruction Fuzzy Hash: A9216D7140D7C09FD7238B219C94A52BFB4EF07220F0985DBD9848F5A3D269A819DB72

Function 0092A186 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,?), ref: 0092A1C1

Strings

X<l, xrefs: 0092A1DD

Memory Dump Source

Source File: 00000000.00000002.4570281581.000000000092A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92a000_01koiHnedL.jbxd

Similarity

API ID: send
String ID: X<l
API String ID: 2809346765-1623157627
Opcode ID: dde1763a153e7944f9cbf4a3a9475feb7f2862244b2a0f8106c6cc9389feb86e
Instruction ID: 4c8ecc6a10aafb0d16ca2fc2bff3ca10d6a9d3ab49121723366ce61fdfaf7c9b
Opcode Fuzzy Hash: dde1763a153e7944f9cbf4a3a9475feb7f2862244b2a0f8106c6cc9389feb86e
Instruction Fuzzy Hash: B301B1328047409FDB20CF55E944B52FBE4EF04320F18C8AADD498B656C375E468DFA2

Function 00D7562A Relevance: 3.5, Strings: 2, Instructions: 963COMMON

Download Yara Rule

Strings

\OYl, xrefs: 00D76AF9
:@2l, xrefs: 00D76CF5

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: :@2l$\OYl
API String ID: 0-3579895576
Opcode ID: 916e36cfa9aca418e3d616c386de6d089893e4faa89a8a2d601c631bdb0d39d6
Instruction ID: 6af3262a497cbaab4954d0269a428d02c03605bedcd3e940407d02d6e765ed8c
Opcode Fuzzy Hash: 916e36cfa9aca418e3d616c386de6d089893e4faa89a8a2d601c631bdb0d39d6
Instruction Fuzzy Hash: 03B23C74A02228CFDB65EF24DD54BA9B7B2FB48304F1081EAD40A6B794DB319E95CF50

Function 00D757A1 Relevance: 3.4, Strings: 2, Instructions: 906COMMON

Download Yara Rule

Strings

\OYl, xrefs: 00D76AF9
:@2l, xrefs: 00D76CF5

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: :@2l$\OYl
API String ID: 0-3579895576
Opcode ID: 1a958194d095b0581364d81a6aaa74dd3a9d5487f04554775f811496fcbbd808
Instruction ID: 89a77d8385fa2bb93dc558685f5bbdee92656868f0737d06fb8dfa48f7eb55c4
Opcode Fuzzy Hash: 1a958194d095b0581364d81a6aaa74dd3a9d5487f04554775f811496fcbbd808
Instruction Fuzzy Hash: 7CA22C74A02228CFDB65EF24DD54BA9B7B2FB48304F1081EAD40A6B794DB319E95CF50

Function 00D75918 Relevance: 3.3, Strings: 2, Instructions: 849COMMON

Download Yara Rule

Strings

\OYl, xrefs: 00D76AF9
:@2l, xrefs: 00D76CF5

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: :@2l$\OYl
API String ID: 0-3579895576
Opcode ID: 35b0bbfdefaa2639ed25879862233903c2e42490a463e91cb29beb9f56a6f29c
Instruction ID: cfa1b0270d58e4f3f581f275d23ec666e410f8e657dbe0f665f4d1662438595b
Opcode Fuzzy Hash: 35b0bbfdefaa2639ed25879862233903c2e42490a463e91cb29beb9f56a6f29c
Instruction Fuzzy Hash: B8922D74A02228CFDB65EF24DD54BA9B7B2FB48304F1081EAD40A6B794DB319E95CF50

Function 00D75A8F Relevance: 3.3, Strings: 2, Instructions: 792COMMON

Download Yara Rule

Strings

\OYl, xrefs: 00D76AF9
:@2l, xrefs: 00D76CF5

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: :@2l$\OYl
API String ID: 0-3579895576
Opcode ID: 53ff72f11dabbd300c9b9f191b6da801a837df30c5c5fe903cb36ede1cdf650c
Instruction ID: b28fdbc1983bbd01f8f2fab2fd60314a4b967e937721aa696f778dd631a29a08
Opcode Fuzzy Hash: 53ff72f11dabbd300c9b9f191b6da801a837df30c5c5fe903cb36ede1cdf650c
Instruction Fuzzy Hash: 02922C74A02228CFDB65EF24DD54BA9B7B2FB48304F1081EAD40A6B794DB319E95CF50

Function 00D75C06 Relevance: 3.2, Strings: 2, Instructions: 735COMMON

Download Yara Rule

Strings

\OYl, xrefs: 00D76AF9
:@2l, xrefs: 00D76CF5

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: :@2l$\OYl
API String ID: 0-3579895576
Opcode ID: 96f718c7b605f0ef5731a37576a38da743b2f6fb4617990660903784b61420f1
Instruction ID: 11d57e3ab865544b1db9fce6688fd265a99268551a5abcbc877edc8ebf792ede
Opcode Fuzzy Hash: 96f718c7b605f0ef5731a37576a38da743b2f6fb4617990660903784b61420f1
Instruction Fuzzy Hash: 3A822D74A02228CFDB65EF24DD54BA9B7B2FB48304F1081EAD80A67794DB319E95CF50

Function 00D75D7D Relevance: 3.2, Strings: 2, Instructions: 678COMMON

Download Yara Rule

Strings

\OYl, xrefs: 00D76AF9
:@2l, xrefs: 00D76CF5

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: :@2l$\OYl
API String ID: 0-3579895576
Opcode ID: 4821daeaa88e074f72b8ae2ab0f9b39703b1699f5bf983ee7bee672d96fa3f0b
Instruction ID: 4f4967935a4f36e62353f51fd0b2bef160138f9f193df67875bacbf73d8fe4d8
Opcode Fuzzy Hash: 4821daeaa88e074f72b8ae2ab0f9b39703b1699f5bf983ee7bee672d96fa3f0b
Instruction Fuzzy Hash: 9A721D74A02228CFDB65EF24DD54BA9B7B2FB48304F1081EAD80A67794DB319E95CF50

Function 00D75EF4 Relevance: 3.1, Strings: 2, Instructions: 621COMMON

Download Yara Rule

Strings

\OYl, xrefs: 00D76AF9
:@2l, xrefs: 00D76CF5

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: :@2l$\OYl
API String ID: 0-3579895576
Opcode ID: cb1c06465aebaef7898b7fa04769cb422a83fe9d400cd93ec49817dfc3b6684e
Instruction ID: e9eb5da96bfdb0d16399ef723c80f274fa95777ec72710c6ba3d7f4a1a4ee7fb
Opcode Fuzzy Hash: cb1c06465aebaef7898b7fa04769cb422a83fe9d400cd93ec49817dfc3b6684e
Instruction Fuzzy Hash: EA622E74A01228CFDB65EF24D954BA8B7B2FB49304F1081EAD80AA7794DB319E95CF50

Function 00D7606B Relevance: 3.1, Strings: 2, Instructions: 564COMMON

Download Yara Rule

Strings

\OYl, xrefs: 00D76AF9
:@2l, xrefs: 00D76CF5

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: :@2l$\OYl
API String ID: 0-3579895576
Opcode ID: 930c3eba81d8dc68e328b91cce79170cd2fd021111d3f52597f5a865b11a3e64
Instruction ID: 4d5d0c647eabf68a64edf8ca07a228c3416c7bf61d8507f9791a1f8371dc8f1b
Opcode Fuzzy Hash: 930c3eba81d8dc68e328b91cce79170cd2fd021111d3f52597f5a865b11a3e64
Instruction Fuzzy Hash: 32522F74A05228CFDB65EF34D954BA8B7B6FB49304F1081EAD80AA7394DB319E95CF40

Function 00D737E1 Relevance: 3.0, Strings: 2, Instructions: 514COMMON

Download Yara Rule

Strings

2Yl, xrefs: 00D73C2E
\OYl, xrefs: 00D73885

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: \OYl$2Yl
API String ID: 0-2262476593
Opcode ID: fdf994dda9b7dd74cced46b5f4ae5accd0e294e634d55bf043709dfe63fe0011
Instruction ID: a7c2260bc697080e748b061b28b4c8e22338609b6f4bca1fc3eac96d0b06b572
Opcode Fuzzy Hash: fdf994dda9b7dd74cced46b5f4ae5accd0e294e634d55bf043709dfe63fe0011
Instruction Fuzzy Hash: E1322830A01218CFDB18EF74D954BEDB7B2EB49308F1045AAD40AAB794DB359E86CF50

Function 00D761E2 Relevance: 3.0, Strings: 2, Instructions: 507COMMON

Download Yara Rule

Strings

\OYl, xrefs: 00D76AF9
:@2l, xrefs: 00D76CF5

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: :@2l$\OYl
API String ID: 0-3579895576
Opcode ID: 0c50a5a378814b629b05826d6cdd49c2705bbe523ca3ec097f840ed650f093f0
Instruction ID: 9716d471729ce08dfee3850cceab5a29a5291d2f386e177067bab024eeed7462
Opcode Fuzzy Hash: 0c50a5a378814b629b05826d6cdd49c2705bbe523ca3ec097f840ed650f093f0
Instruction Fuzzy Hash: 0B422E74A05228CFDB65EF34D954BA8B7B6FB49304F1081EAD80AA7394DB319E95CF40

Function 00D76359 Relevance: 3.0, Strings: 2, Instructions: 450COMMON

Download Yara Rule

Strings

\OYl, xrefs: 00D76AF9
:@2l, xrefs: 00D76CF5

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: :@2l$\OYl
API String ID: 0-3579895576
Opcode ID: ca12642befed309396fe89cd74772f77565fde782920d637011cc1f01972c6c5
Instruction ID: 76ec8f2a695cc572121a66c9032edc11a5c0966ed25159d11133f647a03f9c16
Opcode Fuzzy Hash: ca12642befed309396fe89cd74772f77565fde782920d637011cc1f01972c6c5
Instruction Fuzzy Hash: 48321C74A05228CFDB65EF34D954BA8B7B6FB49304F1081EAD80AA7394DB319E95CF40

Function 00D76483 Relevance: 2.9, Strings: 2, Instructions: 427COMMON

Download Yara Rule

Strings

\OYl, xrefs: 00D76AF9
:@2l, xrefs: 00D76CF5

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: :@2l$\OYl
API String ID: 0-3579895576
Opcode ID: 9f6b458217154101a09aedf5a8f37ffac1baa1da568089db34f52100a70d89ac
Instruction ID: 4a3634ad5d2acebabec757a1fa95bb0bc26cdfe5e6e53cbae747292f244eae41
Opcode Fuzzy Hash: 9f6b458217154101a09aedf5a8f37ffac1baa1da568089db34f52100a70d89ac
Instruction Fuzzy Hash: 58221D74A05228CFDB65EF34D954BA8B7B6FB49304F1081EAD80AA7394DB319E95CF40

Function 00D767A9 Relevance: 2.8, Strings: 2, Instructions: 343COMMON

Download Yara Rule

Strings

\OYl, xrefs: 00D76AF9
:@2l, xrefs: 00D76CF5

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: :@2l$\OYl
API String ID: 0-3579895576
Opcode ID: 1df991d502b25165866ff6759544dbb60b2d744bb6cebb600302f266e4235327
Instruction ID: 341edf682cc0ecc3150ee7f0b3de5521fc75c586a4870ca9ba2339479d322609
Opcode Fuzzy Hash: 1df991d502b25165866ff6759544dbb60b2d744bb6cebb600302f266e4235327
Instruction Fuzzy Hash: 38021B74A01228CFDB65EF34D954BA9B7B2FB49304F1081EAD90AA7794DB319E91CF40

Function 00D7690A Relevance: 2.8, Strings: 2, Instructions: 287COMMON

Download Yara Rule

Strings

\OYl, xrefs: 00D76AF9
:@2l, xrefs: 00D76CF5

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: :@2l$\OYl
API String ID: 0-3579895576
Opcode ID: 6dfbcf29882977a5ffe8c3f2bfdc546a6507ad605e1536c10285d5ded4c3fb24
Instruction ID: bb75b881e897160eba09d4b1835a45013b188b4f1b12ea6eddf0d6702b7893d0
Opcode Fuzzy Hash: 6dfbcf29882977a5ffe8c3f2bfdc546a6507ad605e1536c10285d5ded4c3fb24
Instruction Fuzzy Hash: C1D13974A01228CFDB25EF34D990BA9B7B2FB49304F5081EAD50AA7794DB359E81CF50

Function 00D76A6B Relevance: 2.7, Strings: 2, Instructions: 231COMMON

Download Yara Rule

Strings

\OYl, xrefs: 00D76AF9
:@2l, xrefs: 00D76CF5

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: :@2l$\OYl
API String ID: 0-3579895576
Opcode ID: c7710f66eb1cf541279cb803746e6726b979c0a3e5033fd036aab2a432a3cdb6
Instruction ID: 39bdbfe1214922397917e9e58b57bf049d6abbc2fc8e1a0ab96cf5071646170c
Opcode Fuzzy Hash: c7710f66eb1cf541279cb803746e6726b979c0a3e5033fd036aab2a432a3cdb6
Instruction Fuzzy Hash: B2B12B70A012288FDB25EB74D950BADB7B2FF88304F5081EAD50AA7794DB359E85CF50

Function 00E124EA Relevance: 1.6, APIs: 1, Instructions: 131registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(?,00000E24), ref: 00E125E5

Memory Dump Source

Source File: 00000000.00000002.4571132731.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_01koiHnedL.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 947f2704f53dfacc711b8becdb242a3bd3aa83cd9c4723cf25b90bcfb61ef80c
Instruction ID: 1b12bfec51697bbbba1c1319f5d92210a4f1377ae40bc7490d3e9ce64e63783d
Opcode Fuzzy Hash: 947f2704f53dfacc711b8becdb242a3bd3aa83cd9c4723cf25b90bcfb61ef80c
Instruction Fuzzy Hash: D8418D711093C06FE7238B218C50FA2BFB8EF47614F0945DAE985DB5A3D264E859CB72

Function 00E10AD7 Relevance: 1.6, APIs: 1, Instructions: 98registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,?,?), ref: 00E10B9E

Memory Dump Source

Source File: 00000000.00000002.4571132731.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_01koiHnedL.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: a05fd3aed4d6c8d2780bf7a0d79d612261fabe17184c71a33a73294961274142
Instruction ID: 620b94ae200e68464f8c65107349dd144cb8f0ad59e9325ead93aef6adc0cea0
Opcode Fuzzy Hash: a05fd3aed4d6c8d2780bf7a0d79d612261fabe17184c71a33a73294961274142
Instruction Fuzzy Hash: 6A319E7110E3C06FD3138B218C61A61BFB4EF47614B1E45CBE8C49F6A3D269A909C7B2

Function 0092B1E6 Relevance: 1.6, APIs: 1, Instructions: 97registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000E24), ref: 0092B291

Memory Dump Source

Source File: 00000000.00000002.4570281581.000000000092A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92a000_01koiHnedL.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 2ce45f712bf77c6a57e5a4d964c5bb3f0980c34caf7f2fdae614143dc16160c6
Instruction ID: a51ca0f29cebf01d19189d599f6318773f5b6b5c4a51e4ef8aa33686c937595c
Opcode Fuzzy Hash: 2ce45f712bf77c6a57e5a4d964c5bb3f0980c34caf7f2fdae614143dc16160c6
Instruction Fuzzy Hash: BF319071509394AFD7228B61DC44FA6BFFCEF06210F08849BE9848B693D364E809C771

Function 0092AA75 Relevance: 1.6, APIs: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0092AB25

Memory Dump Source

Source File: 00000000.00000002.4570281581.000000000092A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92a000_01koiHnedL.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d52855aceb8464a46f2c5aed96182ae1c330d6a981124f760b29a287d3d71ad5
Instruction ID: b64e052ffbd935e9be7aa66c3af6dacc7d5e0e18606e6ef5b66101d606fec9df
Opcode Fuzzy Hash: d52855aceb8464a46f2c5aed96182ae1c330d6a981124f760b29a287d3d71ad5
Instruction Fuzzy Hash: 7A318171505380AFE721CF65DC85F96BBF8EF05314F08849EE9858B652D365E808CB61

Function 0092B036 Relevance: 1.6, APIs: 1, Instructions: 89synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE(?,?), ref: 0092B0DD

Memory Dump Source

Source File: 00000000.00000002.4570281581.000000000092A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92a000_01koiHnedL.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: e4f5382ae58d482a2b6fa398054167b654e77656ba8b01336c4bebebf5bc1211
Instruction ID: ce244046363e2a0c17c5b4065041107999fe0129f3a83727a81b5ee0cf78b63a
Opcode Fuzzy Hash: e4f5382ae58d482a2b6fa398054167b654e77656ba8b01336c4bebebf5bc1211
Instruction Fuzzy Hash: EE31A1B15093806FE712CB25DC95B96BFF8EF06314F08849AE9848F292D365E908C762

Function 0092B2D9 Relevance: 1.6, APIs: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,465146A2,00000000,00000000,00000000,00000000), ref: 0092B394

Memory Dump Source

Source File: 00000000.00000002.4570281581.000000000092A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92a000_01koiHnedL.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 6c84ae65ebdadc9758cbbe006d07794d404c0a86a9cd084a1b6aef58a9482f69
Instruction ID: c43a23ce2a4f366f5ae11e0af7a49dcf522aae5ed33e2c9168aae6cb6fc570c8
Opcode Fuzzy Hash: 6c84ae65ebdadc9758cbbe006d07794d404c0a86a9cd084a1b6aef58a9482f69
Instruction Fuzzy Hash: 9C3193765057846FD722CB61DC44F92BFFCEF46314F08849AE9858B293D364E948CBA1

Function 00E10FF0 Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E24), ref: 00E11087

Memory Dump Source

Source File: 00000000.00000002.4571132731.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_01koiHnedL.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: ddc66b035d5d88152c5406b71f67f1962d0dbb7a4ce07de99490617513e5b1be
Instruction ID: 17498b075882bfc39cec041806d94fce5c05bae3ea8d4322908d61a740bffa8f
Opcode Fuzzy Hash: ddc66b035d5d88152c5406b71f67f1962d0dbb7a4ce07de99490617513e5b1be
Instruction Fuzzy Hash: D231C372504384AFEB21CB65DC45FA7BFF8EF05314F08849AE984DB652D364E948CB61

Function 00E1254A Relevance: 1.6, APIs: 1, Instructions: 86registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(?,00000E24), ref: 00E125E5

Memory Dump Source

Source File: 00000000.00000002.4571132731.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_01koiHnedL.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 83f9fb5bcaac5dcdf2ce4c96e7d4d1c37a0939883674a4fea9097389fefd5659
Instruction ID: 6961d7476413524995dbcaf9083f6547f5f9516b66c5d2b56c1eb8618dd8787f
Opcode Fuzzy Hash: 83f9fb5bcaac5dcdf2ce4c96e7d4d1c37a0939883674a4fea9097389fefd5659
Instruction Fuzzy Hash: E7218D72600704AFEB219E55CC84FA7FBECEF08714F14845EEA45D7651D720E9588AB2

Function 0092A6CE Relevance: 1.6, APIs: 1, Instructions: 85comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?,00000E24,?,?), ref: 0092A779

Memory Dump Source

Source File: 00000000.00000002.4570281581.000000000092A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92a000_01koiHnedL.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 889db6653cdad3071605a7c006a1c350f472a2c0f41f56f0a3dd85a328a14f13
Instruction ID: 6cfb4ef12f1d01dd6127596f723ef3e4ce972c10781ed36e82dc184fd4f4880b
Opcode Fuzzy Hash: 889db6653cdad3071605a7c006a1c350f472a2c0f41f56f0a3dd85a328a14f13
Instruction Fuzzy Hash: A931717104D3C06FD3138B259C61BA1BFB4EF47614F1A40CBE884CB6A3D2256919D7B2

Function 00E1288C Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNELBASE(?,00000E24,465146A2,00000000,00000000,00000000,00000000), ref: 00E12920

Memory Dump Source

Source File: 00000000.00000002.4571132731.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_01koiHnedL.jbxd

Similarity

API ID: CodeExitProcess
String ID:
API String ID: 3861947596-0
Opcode ID: 14d2d8da09e250ca174ec53a44e75357d743fc7eb531277552de171050705328
Instruction ID: 92d8fabfa25faf5dde2c4b468aca522d38c9455be85d692b6edc361c9f007e77
Opcode Fuzzy Hash: 14d2d8da09e250ca174ec53a44e75357d743fc7eb531277552de171050705328
Instruction Fuzzy Hash: B721F6715093806FE712CB20CC54B96BFB8AF42324F0884DBE9889F293D264A949C7B1

Function 00E11700 Relevance: 1.6, APIs: 1, Instructions: 83timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNELBASE(?,00000E24,465146A2,00000000,00000000,00000000,00000000), ref: 00E11791

Memory Dump Source

Source File: 00000000.00000002.4571132731.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_01koiHnedL.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: 517f0d02d12d5b0fc53f420bd31a7f54691df47e6d581a329c20b8da86f43cdf
Instruction ID: 27ce6f51e585921096f2f7b6b2f0b268addc53c4982ba4868ea15cac0822def4
Opcode Fuzzy Hash: 517f0d02d12d5b0fc53f420bd31a7f54691df47e6d581a329c20b8da86f43cdf
Instruction Fuzzy Hash: B321D6715093806FDB228F21CD44F96BFB8EF46314F0884DBE9849F292D365A948CBB1

Function 0092B4C8 Relevance: 1.6, APIs: 1, Instructions: 82windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(?,00000E24), ref: 0092B571

Memory Dump Source

Source File: 00000000.00000002.4570281581.000000000092A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92a000_01koiHnedL.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: 012e0393fcd1c4f6d3c6e8551bd3a98017b083cb7a179ffba653134f66302176
Instruction ID: 9e894d71190fa1ebd2c799e7c2021196334cfd5613e1fac74654f3dd3b953e2d
Opcode Fuzzy Hash: 012e0393fcd1c4f6d3c6e8551bd3a98017b083cb7a179ffba653134f66302176
Instruction Fuzzy Hash: 1521F671104740AFEB228F11DC44FA2FFB8EF46310F18849AF9845F6A2D375A509CB61

Function 00E127BD Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

select.WS2_32(?,?,?,?,?), ref: 00E1284C

Memory Dump Source

Source File: 00000000.00000002.4571132731.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_01koiHnedL.jbxd

Similarity

API ID: select
String ID:
API String ID: 1274211008-0
Opcode ID: 53be1ad8d97d2dcf3f87ca6355667402203ad1a34c8d9ba7163bcdbbcb67046f
Instruction ID: 77627018c446001b40344cad9a5208604abfbdb2322f14b035fa2ca902ead4ef
Opcode Fuzzy Hash: 53be1ad8d97d2dcf3f87ca6355667402203ad1a34c8d9ba7163bcdbbcb67046f
Instruction Fuzzy Hash: 34217C715093849FEB22CF25DC44B92BFF8EF06314F0984DAE984DB262D324E959DB61

Function 0092AE77 Relevance: 1.6, APIs: 1, Instructions: 78fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000E24,465146A2,00000000,00000000,00000000,00000000), ref: 0092AF0D

Memory Dump Source

Source File: 00000000.00000002.4570281581.000000000092A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92a000_01koiHnedL.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 7446c30ca8a1fad9f7d033acffaea6c647e0854d772967ff7c4b4c661b168653
Instruction ID: 4d79a4840bfc69a81fdfcf8596fdc6604e96904e25621ec00a986c74f6bc2bae
Opcode Fuzzy Hash: 7446c30ca8a1fad9f7d033acffaea6c647e0854d772967ff7c4b4c661b168653
Instruction Fuzzy Hash: D921B7B2409380AFD722CF51DD44F96BFB8EF46314F0984DAE9849F162D365A509CBB1

Function 0092B3EA Relevance: 1.6, APIs: 1, Instructions: 77registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(?,00000E24,465146A2,00000000,00000000,00000000,00000000), ref: 0092B480

Memory Dump Source

Source File: 00000000.00000002.4570281581.000000000092A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92a000_01koiHnedL.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 305e3ef7e86f0fdaf94ef10292bc2caeb68ee2494961639aa8e9ca651b25f442
Instruction ID: c8c4d3e12723dbfae8d2e263cf325a316e7d5e0bc54630e4b0f70f16b97645fc
Opcode Fuzzy Hash: 305e3ef7e86f0fdaf94ef10292bc2caeb68ee2494961639aa8e9ca651b25f442
Instruction Fuzzy Hash: D9217F765047946FD7228B11DC84BA2BBBCDF46314F08849AE9858B262D364E848C7B1

Function 00E10BCA Relevance: 1.6, APIs: 1, Instructions: 77networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 00E10C56

Memory Dump Source

Source File: 00000000.00000002.4571132731.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_01koiHnedL.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: 08c86db9b017408453b2f4ec572188f4181c02c57b79677e5bc741a5036fcc50
Instruction ID: 1f39cb53cbf2a8d5f5d24d6f19c5a20bdb11cbfc617198e614eb139eea6936e5
Opcode Fuzzy Hash: 08c86db9b017408453b2f4ec572188f4181c02c57b79677e5bc741a5036fcc50
Instruction Fuzzy Hash: 9E21A071405380AFE721CF51CC45F96FFB8EF45324F08889EE9858B692D375A848CBA1

Function 00E111A6 Relevance: 1.6, APIs: 1, Instructions: 77fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE ref: 00E1123A

Memory Dump Source

Source File: 00000000.00000002.4571132731.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_01koiHnedL.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: f4da2eecbcbeaca5e62868a262d8ff9c2a5c877f3152118366ba67b6d8d25666
Instruction ID: 1d9d24d324e814d989bab3bb68966cea92d7b14d954112d7e9cad787d5c0c7d6
Opcode Fuzzy Hash: f4da2eecbcbeaca5e62868a262d8ff9c2a5c877f3152118366ba67b6d8d25666
Instruction Fuzzy Hash: CC21BF71405384AFE722CF55CC44F96FBF8EF09224F04849EE9888B252D375E948CBA1

Function 0092AAA6 Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0092AB25

Memory Dump Source

Source File: 00000000.00000002.4570281581.000000000092A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92a000_01koiHnedL.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 7832e3d705a290adcb79be46be6cb2ca7755c4e4481e58e62de7e48a63287058
Instruction ID: 9322b5c68e1419c78b07e586d303d0b5149bad3a9aeef354f3cc7791893cd431
Opcode Fuzzy Hash: 7832e3d705a290adcb79be46be6cb2ca7755c4e4481e58e62de7e48a63287058
Instruction Fuzzy Hash: 3E217C72500640AFEB21CF65DD45BA6FBE8EF08724F14886AE9498B651D375E808CB62

Function 00E10EFE Relevance: 1.6, APIs: 1, Instructions: 76registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,465146A2,00000000,00000000,00000000,00000000), ref: 00E10F9C

Memory Dump Source

Source File: 00000000.00000002.4571132731.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_01koiHnedL.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 32564687a09ab7cde3124e3c75b4f22a46033e71103d7fadf1fb5c16c22d0766
Instruction ID: a9cd6273fc7bb8b233db7b7aa74946d94d6ad9d9eb691ae0631353c4ae5667b3
Opcode Fuzzy Hash: 32564687a09ab7cde3124e3c75b4f22a46033e71103d7fadf1fb5c16c22d0766
Instruction Fuzzy Hash: D321D172505740AFE722CB11CC45F93BBF8AF49314F08849AE9459B692D364E848CBB1

Function 00E11016 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E24), ref: 00E11087

Memory Dump Source

Source File: 00000000.00000002.4571132731.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_01koiHnedL.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: 3514b6517c8401d3245cd477745ec0bd984087c4b48d71a854dd179e525cbae1
Instruction ID: 32693b605c13633c707498a221f4efdb54464db1c862dd83d20a88a48f2f8879
Opcode Fuzzy Hash: 3514b6517c8401d3245cd477745ec0bd984087c4b48d71a854dd179e525cbae1
Instruction Fuzzy Hash: 8621D771900244AFEB20DF65DC45FEAFBECEF04714F14845AE944DB641D774E9488AB1

Function 0092B212 Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000E24), ref: 0092B291

Memory Dump Source

Source File: 00000000.00000002.4570281581.000000000092A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92a000_01koiHnedL.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: d619459e14243471e438d395b04932e485878e2adb73bc0b712c40429aa6e916
Instruction ID: 87a10cc0e96033ce4447dcbb94d157c3da81011bb32fe652f5c92f5fec4cd150
Opcode Fuzzy Hash: d619459e14243471e438d395b04932e485878e2adb73bc0b712c40429aa6e916
Instruction Fuzzy Hash: 7521F072500314EEEB20DF51DC44FABFBFCEF18324F14885AE9458B645D364E9088AB2

Function 0092AC37 Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,465146A2,00000000,00000000,00000000,00000000), ref: 0092ACBD

Memory Dump Source

Source File: 00000000.00000002.4570281581.000000000092A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92a000_01koiHnedL.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 7ac14424ac4c7cd211622edea8ddde8d5c8e7c21972ef977ecde96f4daef79cd
Instruction ID: 9411152998d865e29ff9c848b498e4842f2e786533404b281350e3ecec42f240
Opcode Fuzzy Hash: 7ac14424ac4c7cd211622edea8ddde8d5c8e7c21972ef977ecde96f4daef79cd
Instruction Fuzzy Hash: B221C6B54097806FE7128B11DC40BE2BFB8DF46314F1880DAE9848B293D264A909C772

Function 0092A9BF Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0092AA44

Memory Dump Source

Source File: 00000000.00000002.4570281581.000000000092A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92a000_01koiHnedL.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 44b9c29e286cfb01c13c61277cc07a289f1e4b88e204764fe455653e0d9624dd
Instruction ID: d039920158048ec8af7d257b7a68afeb104ac2ef1ba5611687d55b42c4ffab87
Opcode Fuzzy Hash: 44b9c29e286cfb01c13c61277cc07a289f1e4b88e204764fe455653e0d9624dd
Instruction Fuzzy Hash: 3C21486540E7C09FDB138B259C64A51BFB4AF57624F0E80DBD9848F6A3C2689C48CB72

Function 00E12983 Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetProcessWorkingSetSize.KERNEL32(?,00000E24,465146A2,00000000,00000000,00000000,00000000), ref: 00E129FF

Memory Dump Source

Source File: 00000000.00000002.4571132731.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_01koiHnedL.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: dfb1bbbe0f67003ea88a1d8a18bb6464b7916c64a05ff167f1d3c3f37f96e870
Instruction ID: 05b33eec408839610cc51a7401710aedf32dd0f313c8cd767b9c32b545791200
Opcode Fuzzy Hash: dfb1bbbe0f67003ea88a1d8a18bb6464b7916c64a05ff167f1d3c3f37f96e870
Instruction Fuzzy Hash: 3C2192715053846FDB21CB11DC45F96BFB8EF46324F0884AAE9449B292D374E948CBA5

Function 00E12A67 Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetProcessWorkingSetSize.KERNEL32(?,00000E24,465146A2,00000000,00000000,00000000,00000000), ref: 00E12AE3

Memory Dump Source

Source File: 00000000.00000002.4571132731.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_01koiHnedL.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: dfb1bbbe0f67003ea88a1d8a18bb6464b7916c64a05ff167f1d3c3f37f96e870
Instruction ID: 1f526d03f3417d03281ab2e54605b1f3f07626e64f20a480635a85b9fce5503e
Opcode Fuzzy Hash: dfb1bbbe0f67003ea88a1d8a18bb6464b7916c64a05ff167f1d3c3f37f96e870
Instruction Fuzzy Hash: 9321A4715093846FD722CF11DC45FA6BFB8EF46324F0884AEE944DB292D364A948CBB5

Function 0092B06A Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE(?,?), ref: 0092B0DD

Memory Dump Source

Source File: 00000000.00000002.4570281581.000000000092A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92a000_01koiHnedL.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 344b2265cb5a23a9e195ad0c769fabcecce03a73f7c1c11c082cd2d956395332
Instruction ID: 20c0ab3ce7071adca9e6d4d79357bd9297094a6df37e55e1f5af95ee30b6942d
Opcode Fuzzy Hash: 344b2265cb5a23a9e195ad0c769fabcecce03a73f7c1c11c082cd2d956395332
Instruction Fuzzy Hash: 2221C271500210AFE720DF65DD45BA6FBE8EF04324F14846AED488B745D775E808CBB2

Function 00E1143D Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000E24,465146A2,00000000,00000000,00000000,00000000), ref: 00E114C0

Memory Dump Source

Source File: 00000000.00000002.4571132731.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_01koiHnedL.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: 5d887759694e2da50c19b98e04795aa879999b3f7ad30a704f007970316de72e
Instruction ID: aa871aad85c1a7c3a66d1b64c70ed2de9186e09815eedb3a0a65404f4f064587
Opcode Fuzzy Hash: 5d887759694e2da50c19b98e04795aa879999b3f7ad30a704f007970316de72e
Instruction Fuzzy Hash: 162195B14093846FD7128B55CC44B96BFB8EF46324F1884DAE9849F252C368A948C7A2

Function 0092B31A Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,465146A2,00000000,00000000,00000000,00000000), ref: 0092B394

Memory Dump Source

Source File: 00000000.00000002.4570281581.000000000092A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92a000_01koiHnedL.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 087eb505348d1aa02f9eef16f8873fadac74c04e2fba89a772825cf5043c984d
Instruction ID: 8c88849b3999565e0d5cb35d7a58872f32eefce024795578418451fa36dea15e
Opcode Fuzzy Hash: 087eb505348d1aa02f9eef16f8873fadac74c04e2fba89a772825cf5043c984d
Instruction Fuzzy Hash: 9721CD72600210AFE720CF51DC80FA6B7ECEF04724F18845AE949CB655D360E808CAB1

Function 00E126F7 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000E24,465146A2,00000000,00000000,00000000,00000000), ref: 00E12773

Memory Dump Source

Source File: 00000000.00000002.4571132731.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_01koiHnedL.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 393827ff91f0284f2f578399682dad32fdb61af4816a758bc98716b13ccda1b9
Instruction ID: 1c631a1b35e0de59c9e6063510db1781803669a3fdbcffebfddfe4cb8c829af3
Opcode Fuzzy Hash: 393827ff91f0284f2f578399682dad32fdb61af4816a758bc98716b13ccda1b9
Instruction Fuzzy Hash: 2021A1714093846FD722CF11CC84F96BFB8EF45324F08849BE9489B292C365A908C7A2

Function 00E11947 Relevance: 1.6, APIs: 1, Instructions: 68networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 00E119C6

Memory Dump Source

Source File: 00000000.00000002.4571132731.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_01koiHnedL.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: 2410e266b932f1e24a6a5388a52fea1a088e512c9283c8c33dc8cef36625647a
Instruction ID: bbd89a7d0ec5b0e12fa99149dcd64897b9346ed91502662506e2b00c3e14e6ee
Opcode Fuzzy Hash: 2410e266b932f1e24a6a5388a52fea1a088e512c9283c8c33dc8cef36625647a
Instruction Fuzzy Hash: B021B071409780AFDB228F61CC84B92BFF4EF46310F0985DAE9858F262D375E849DB61

Function 00E10BEA Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 00E10C56

Memory Dump Source

Source File: 00000000.00000002.4571132731.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_01koiHnedL.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: d9166061a72f166177c14b083ecc3ec6fead23cc714a09d02814a6b885093401
Instruction ID: 634cce32a9c2ba3117649d9d3a2faf564cf1b530a42fff4262a9c54f8b395688
Opcode Fuzzy Hash: d9166061a72f166177c14b083ecc3ec6fead23cc714a09d02814a6b885093401
Instruction Fuzzy Hash: 2B21D171500200AFEB21CF51CD45F96FBE4EF08324F14885EE9859B651D3B1E458CBB2

Function 00E111C6 Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE ref: 00E1123A

Memory Dump Source

Source File: 00000000.00000002.4571132731.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_01koiHnedL.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 1704d96f1e3d6df76d31039da3d02915f88fd1e53bf0952a13e4449444ffb799
Instruction ID: e740929a40353d4cfbf890dba419c73b3888e0b5aa1d17f1069b4c402802a2f4
Opcode Fuzzy Hash: 1704d96f1e3d6df76d31039da3d02915f88fd1e53bf0952a13e4449444ffb799
Instruction Fuzzy Hash: 2E21DE71500204AFEB21CF55CD44FDAFBE8EF08328F14849DEA898B651D375E848CBA2

Function 0092B4F6 Relevance: 1.6, APIs: 1, Instructions: 66windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(?,00000E24), ref: 0092B571

Memory Dump Source

Source File: 00000000.00000002.4570281581.000000000092A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92a000_01koiHnedL.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: 62a2a7c3aa1db34778633bfa7fb166a93f5513573facb87be072b5aace3c5919
Instruction ID: dbf7e4615e48be43f701c5044d2b736af87ff02e20c076162eebe8caa7cdfcd5
Opcode Fuzzy Hash: 62a2a7c3aa1db34778633bfa7fb166a93f5513573facb87be072b5aace3c5919
Instruction Fuzzy Hash: 4421CD72500600AFEB218F50DD41FA6FBF8EF44714F14885AFE859A691D375E5188BA2

Function 00E11C06 Relevance: 1.6, APIs: 1, Instructions: 66libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,00000E24), ref: 00E11C8F

Memory Dump Source

Source File: 00000000.00000002.4571132731.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_01koiHnedL.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: da04069c03dec823ed1e016be8d372b5b0d8bc4ac7c407e206a1296b97d0b690
Instruction ID: e7e0bb9309ccc0faf67c94df83d2e7be8da37d7e07e55be6afef0e6b28073948
Opcode Fuzzy Hash: da04069c03dec823ed1e016be8d372b5b0d8bc4ac7c407e206a1296b97d0b690
Instruction Fuzzy Hash: B011E4715043406FE721CB11DC85FE6FBB8DF45324F18809AF9489B292C364A948CBA6

Function 0092B40E Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(?,00000E24,465146A2,00000000,00000000,00000000,00000000), ref: 0092B480

Memory Dump Source

Source File: 00000000.00000002.4570281581.000000000092A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92a000_01koiHnedL.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 7a8ee36a6314f95ba7f9fd6cc4caff0b4e01d990472e003c02966a50d5b0e2b9
Instruction ID: 0fafc90334b837700b970225a19ba80551cd09d306a7e716a0f2ce5b49c5445a
Opcode Fuzzy Hash: 7a8ee36a6314f95ba7f9fd6cc4caff0b4e01d990472e003c02966a50d5b0e2b9
Instruction Fuzzy Hash: CB119076600614AFEB219F11DC80FA7FBECEF44724F14855AED458A766D374E808CAB1

Function 00E10F2A Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,465146A2,00000000,00000000,00000000,00000000), ref: 00E10F9C

Memory Dump Source

Source File: 00000000.00000002.4571132731.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_01koiHnedL.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 446af90ab6db0cda3deacce561ddf60e6e7ee566b26ec5d4fe277291f3569935
Instruction ID: 7141b53590d572ffc78606a5d2738c235dfca0a0ef52c35754deb9f4f08e3f7c
Opcode Fuzzy Hash: 446af90ab6db0cda3deacce561ddf60e6e7ee566b26ec5d4fe277291f3569935
Instruction Fuzzy Hash: 1611B176600604AFE731CF11CC41FE6F7F8EF48724F18845AE9459B651D360E889CAB2

Function 0092B91A Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 0092B982

Memory Dump Source

Source File: 00000000.00000002.4570281581.000000000092A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92a000_01koiHnedL.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 3bc0c97fad133d2202f75c942c496f397b302fd5c0ca2d3ab1e391f48773dc5b
Instruction ID: 5fa24b466e0410656aaa029cc5971ad1ceddb1c121bbd70cca988fe7f3e9e5e2
Opcode Fuzzy Hash: 3bc0c97fad133d2202f75c942c496f397b302fd5c0ca2d3ab1e391f48773dc5b
Instruction Fuzzy Hash: E91190B6604380AFDB21CF25DC84B52BFE8EF46324F0884AAED45DB256D374E844CB61

Function 00E11732 Relevance: 1.6, APIs: 1, Instructions: 64timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNELBASE(?,00000E24,465146A2,00000000,00000000,00000000,00000000), ref: 00E11791

Memory Dump Source

Source File: 00000000.00000002.4571132731.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_01koiHnedL.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: 8ec832d14047dc2f7f4f89894260ef838363930856035e442cd0ac84451a6782
Instruction ID: cec710be082bc8da38fa023d50ec9de186a85701ae4522635ea0a1cf955b3d65
Opcode Fuzzy Hash: 8ec832d14047dc2f7f4f89894260ef838363930856035e442cd0ac84451a6782
Instruction Fuzzy Hash: 9E11E272500204AFEB218F51DD44FEAFBF8EF45324F1484AAEA459B791D370E8488BB1

Function 00E129A6 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetProcessWorkingSetSize.KERNEL32(?,00000E24,465146A2,00000000,00000000,00000000,00000000), ref: 00E129FF

Memory Dump Source

Source File: 00000000.00000002.4571132731.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_01koiHnedL.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: efbdd230ff6be32f5838085812e3cbbf50271ec70a051eaca3dd1deea90aade2
Instruction ID: 5960225d35f0201755f1bb40a7696772a429d271d9da41172afba31204c98120
Opcode Fuzzy Hash: efbdd230ff6be32f5838085812e3cbbf50271ec70a051eaca3dd1deea90aade2
Instruction Fuzzy Hash: 36110171600200AFEB20CF55CC44BE6BBA8EF44324F18C86EEE089B651D370E8588AB5

Function 00E12A8A Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

SetProcessWorkingSetSize.KERNEL32(?,00000E24,465146A2,00000000,00000000,00000000,00000000), ref: 00E12AE3

Memory Dump Source

Source File: 00000000.00000002.4571132731.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_01koiHnedL.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: efbdd230ff6be32f5838085812e3cbbf50271ec70a051eaca3dd1deea90aade2
Instruction ID: a471ca0edc9c621522e31670c82e18a3443e4d4baa033adfa6874b90f7df7402
Opcode Fuzzy Hash: efbdd230ff6be32f5838085812e3cbbf50271ec70a051eaca3dd1deea90aade2
Instruction Fuzzy Hash: CB110172600200AFEB21CF51DC44FEAB7A8EF44324F14846EEE08DB641D374E9588BB5

Function 0092A573 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0092A5DE

Memory Dump Source

Source File: 00000000.00000002.4570281581.000000000092A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92a000_01koiHnedL.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 25816617b12fd1ef344b7cd8a6da4bcd071b9eb7303e943cd0bb78bec3c5e50e
Instruction ID: 374d0fa4fd7d3d3b0deacf9370d853a194e62777b21a41e04fcb698d32e0ee24
Opcode Fuzzy Hash: 25816617b12fd1ef344b7cd8a6da4bcd071b9eb7303e943cd0bb78bec3c5e50e
Instruction Fuzzy Hash: 51117571405780AFDB228F51DC44B52FFF4EF46310F0888DAED858B562C375A818DB62

Function 00E128CA Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNELBASE(?,00000E24,465146A2,00000000,00000000,00000000,00000000), ref: 00E12920

Memory Dump Source

Source File: 00000000.00000002.4571132731.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_01koiHnedL.jbxd

Similarity

API ID: CodeExitProcess
String ID:
API String ID: 3861947596-0
Opcode ID: e9d8397b050ba14bbdd75ae3e5bd51c298d3ccc6f73533821736a99b3d935da7
Instruction ID: a087de83cc73d79fccae9e68bba8c0915d8841374f9b03a623db2b2afe14e0ca
Opcode Fuzzy Hash: e9d8397b050ba14bbdd75ae3e5bd51c298d3ccc6f73533821736a99b3d935da7
Instruction Fuzzy Hash: 2211E371600200AFEB108F15DC85BEAB7E8DF84724F14846AEE48DB641D774E9488AB1

Function 0092AEAE Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000E24,465146A2,00000000,00000000,00000000,00000000), ref: 0092AF0D

Memory Dump Source

Source File: 00000000.00000002.4570281581.000000000092A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92a000_01koiHnedL.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 0d65a9878118086ff3b24f88137a5b7202113776fc206aa40f8eee04135585fa
Instruction ID: d55ccb09faf3033fb91674e220700ea9e1acb870703bdd43c86f3f24327f5173
Opcode Fuzzy Hash: 0d65a9878118086ff3b24f88137a5b7202113776fc206aa40f8eee04135585fa
Instruction Fuzzy Hash: D3110472500200AFEB21CF51DD40FA6FBF8EF44324F14845AEE489B655C334E4088BB2

Function 00E1271A Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000E24,465146A2,00000000,00000000,00000000,00000000), ref: 00E12773

Memory Dump Source

Source File: 00000000.00000002.4571132731.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_01koiHnedL.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: db27b0d5ab5c323b5090567370f50061ddf5abd4ac055bb3a660775b79b9f524
Instruction ID: 61b3e84fb079c477d85bda4d7392716fea4ae8df2c4136a3335c7e40fe0ff5c8
Opcode Fuzzy Hash: db27b0d5ab5c323b5090567370f50061ddf5abd4ac055bb3a660775b79b9f524
Instruction Fuzzy Hash: 0A11E371500200AFEB20CF51CD44BE6F7E8EF44324F14846AEE489B681C375A5588AB2

Function 00E1146A Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000E24,465146A2,00000000,00000000,00000000,00000000), ref: 00E114C0

Memory Dump Source

Source File: 00000000.00000002.4571132731.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_01koiHnedL.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: 58004b31ea9b933af66e0f1279611d7dad879495c3f8168aa3729c975f90b25e
Instruction ID: fd6950c021d07a13bb74cd4cb08b27b10427ccca8d2e4faf1c6e755d314aff93
Opcode Fuzzy Hash: 58004b31ea9b933af66e0f1279611d7dad879495c3f8168aa3729c975f90b25e
Instruction Fuzzy Hash: 8E11C271500204AEEB20CF55DD84BE6B7A8EF44724F2484AAEE499B741D374E9488AB6

Function 00E11C26 Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,00000E24), ref: 00E11C8F

Memory Dump Source

Source File: 00000000.00000002.4571132731.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_01koiHnedL.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ac834564fb56b36c5ef56a73d57eb7dd56aebfcbc19f0755eafc0e226ca66e16
Instruction ID: 03713838b535219bfd0b6ad20bac1c1b328c23fd97be8363ef0cfeeb59e9a855
Opcode Fuzzy Hash: ac834564fb56b36c5ef56a73d57eb7dd56aebfcbc19f0755eafc0e226ca66e16
Instruction Fuzzy Hash: FD110871640204AEE720DB11DD81FF6F7A8DF44724F248099FE495A781D3B5E948CAF6

Function 00E127F6 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

select.WS2_32(?,?,?,?,?), ref: 00E1284C

Memory Dump Source

Source File: 00000000.00000002.4571132731.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_01koiHnedL.jbxd

Similarity

API ID: select
String ID:
API String ID: 1274211008-0
Opcode ID: b67cf0b69ea52dd199d3e8cb89fccaffd5ed28a4f6173089c51a38fc927d77ad
Instruction ID: 19d85816092be411adb0187dfd6760b5b64f1760a151dad88f286751121187ed
Opcode Fuzzy Hash: b67cf0b69ea52dd199d3e8cb89fccaffd5ed28a4f6173089c51a38fc927d77ad
Instruction Fuzzy Hash: 53118C716002049FEB20CF55DC84B92FBE8EF04724F0884AEDE49DB262D330E898CB61

Function 0092B93A Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 0092B982

Memory Dump Source

Source File: 00000000.00000002.4570281581.000000000092A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92a000_01koiHnedL.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: ec84ed22516a9b12063eb0b4c27d4680545d0603492b6d56b6c612ef9357941d
Instruction ID: a602abf92bbfe6977100b05763167df6fd569aea9e49deadf8fc292636e1f23c
Opcode Fuzzy Hash: ec84ed22516a9b12063eb0b4c27d4680545d0603492b6d56b6c612ef9357941d
Instruction Fuzzy Hash: A711A5766006009FDB10CF15ED85B56FBE8EF04324F18C46ADD49DB756D334D844CA61

Function 0092AC6A Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,465146A2,00000000,00000000,00000000,00000000), ref: 0092ACBD

Memory Dump Source

Source File: 00000000.00000002.4570281581.000000000092A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92a000_01koiHnedL.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: b0fc7d9037c956acca2e35bc7cd6b88bc2a779346dfdb2ef55db14859e2b05c0
Instruction ID: 493ed564e6a6944255197a72e01083e6792e70341c7aa33a69fe4a2d56c9460d
Opcode Fuzzy Hash: b0fc7d9037c956acca2e35bc7cd6b88bc2a779346dfdb2ef55db14859e2b05c0
Instruction Fuzzy Hash: 6901D272500214AFE720CB01ED84BA6F7ACDF44724F14C49AEE488B745D378E9488AB6

Function 00E1197A Relevance: 1.5, APIs: 1, Instructions: 49networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 00E119C6

Memory Dump Source

Source File: 00000000.00000002.4571132731.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_01koiHnedL.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: 23f5808cbe166e91a815b07091ab122296e1b97afa357af7d08fbbf65cb37905
Instruction ID: c4d95e7d262dea7c0b9cd69d9dca1df237cf9244d8d85caa7f6fd86e0adc82aa
Opcode Fuzzy Hash: 23f5808cbe166e91a815b07091ab122296e1b97afa357af7d08fbbf65cb37905
Instruction Fuzzy Hash: DF118E31500644AFDB20CF55D944B92FBF4EF48324F18C9AADE959B622D331E898DF62

Function 0092A59A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0092A5DE

Memory Dump Source

Source File: 00000000.00000002.4570281581.000000000092A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92a000_01koiHnedL.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 89a2969dfbfc1130486733d985553d57c8911621ee8ce5c88977092ab2ffbdaf
Instruction ID: 6844ab53dc97cc2fd3d67b83e50929857aed867f3eac1861c2e7c4dd6ef32c8f
Opcode Fuzzy Hash: 89a2969dfbfc1130486733d985553d57c8911621ee8ce5c88977092ab2ffbdaf
Instruction Fuzzy Hash: F3016D724007009FDB218F55D944B56FFE4EF48720F18C89EEE494A665C376E418DF62

Function 0092A72E Relevance: 1.5, APIs: 1, Instructions: 43comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?,00000E24,?,?), ref: 0092A779

Memory Dump Source

Source File: 00000000.00000002.4570281581.000000000092A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92a000_01koiHnedL.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 122e50e22982c0f20ef9b209d54590ea7462f4b4e01bd07c5bb3f6bfe4e8b53b
Instruction ID: c3e4aa8a82ebb45b515fdee65135ab16e8ca34426130cf938fcb6c1c2f2c9d8c
Opcode Fuzzy Hash: 122e50e22982c0f20ef9b209d54590ea7462f4b4e01bd07c5bb3f6bfe4e8b53b
Instruction Fuzzy Hash: DC01D671500600ABD310DF16CC46B66FBE8FB88B20F248159ED089BB41D771F915CBE5

Function 00E10B4E Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,?,?), ref: 00E10B9E

Memory Dump Source

Source File: 00000000.00000002.4571132731.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_01koiHnedL.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: db00d29af6725fffa548190c08b070b744a723a186ef61b32a88bc49092ecee1
Instruction ID: 866137a612235540b38737d96c0828d5650b9de89aff3e67cc56b5c2e3d5bd36
Opcode Fuzzy Hash: db00d29af6725fffa548190c08b070b744a723a186ef61b32a88bc49092ecee1
Instruction Fuzzy Hash: DE01D671500600ABD310DF16CC46B66FBE8FB88B20F24815AED089BB41D771F915CBE5

Function 00D77288 Relevance: 1.5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

Strings

2Yl, xrefs: 00D77590

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: 2Yl
API String ID: 0-600701926
Opcode ID: fbd066532d2fc194167e63efc00cc27b3a74728964d9340e68bb44d3c4f6ea78
Instruction ID: 13b2311e52b17f8ccd7dd159155d6121a69f3516127f57cee5f132d6e935b57d
Opcode Fuzzy Hash: fbd066532d2fc194167e63efc00cc27b3a74728964d9340e68bb44d3c4f6ea78
Instruction Fuzzy Hash: CFA1E1317082018BD714EB39D945BAD33E2EB88318F188A29D81ADB3D5EB34DD46CB60

Function 0092AA12 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0092AA44

Memory Dump Source

Source File: 00000000.00000002.4570281581.000000000092A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92a000_01koiHnedL.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: cd882821c96b27eecf4e1cde623ae82f2fa7b41647ebd696926ee2d4ebcf7924
Instruction ID: 3fae8915004046fd3e7d877580bba8bf4622c3521313f960b2a09280b4b4cef1
Opcode Fuzzy Hash: cd882821c96b27eecf4e1cde623ae82f2fa7b41647ebd696926ee2d4ebcf7924
Instruction Fuzzy Hash: 05F0AF369006449FDB208F05EA84761FBE4EF44724F18C09ADD494B756D379E948CEA3

Function 00D79445 Relevance: 1.5, Strings: 1, Instructions: 232COMMON

Download Yara Rule

Strings

:@2l, xrefs: 00D7980B

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: :@2l
API String ID: 0-1731998491
Opcode ID: d730c053db9ff340fe9b67a3515459b6b4656f486bb1be5381618275a105a579
Instruction ID: 73b2e745b09dac8fed57ca83257b58cc423731acdf722874166d240bc5d2390c
Opcode Fuzzy Hash: d730c053db9ff340fe9b67a3515459b6b4656f486bb1be5381618275a105a579
Instruction Fuzzy Hash: 75910B34A01204DFCB09EFB5E850A9D77B2FF88348B51852AE416977A8DF359C26DF90

Function 00D794A3 Relevance: 1.5, Strings: 1, Instructions: 221COMMON

Download Yara Rule

Strings

:@2l, xrefs: 00D7980B

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: :@2l
API String ID: 0-1731998491
Opcode ID: b2b59bf0c4d5ce1949b46c6b9d2315c10447ebd304fa1380c1462ac1fe3379f5
Instruction ID: b0d9ac1351939850af2e3f6d523be244a892ab09e83341f550a89538050bc362
Opcode Fuzzy Hash: b2b59bf0c4d5ce1949b46c6b9d2315c10447ebd304fa1380c1462ac1fe3379f5
Instruction Fuzzy Hash: AD910B34A01204DFCB19EFB5E850A9D73B2FF88348B51852AE416977A8DF359C26DF90

Function 00D794F3 Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

:@2l, xrefs: 00D7980B

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: :@2l
API String ID: 0-1731998491
Opcode ID: bdde6eb742329f608e384b362361cf593d5de5cf591b6f75f1a0cbd8a776111d
Instruction ID: 4bd4d2ab8fd763f6b1c8c41dc9cae63d5f21da1865aef455c525b9f0fb3007ef
Opcode Fuzzy Hash: bdde6eb742329f608e384b362361cf593d5de5cf591b6f75f1a0cbd8a776111d
Instruction Fuzzy Hash: 60811B34A01204DFCB19EFB5E850A9D73B2FF88348B51852AE416977A8DF359C26DF90

Function 00D76B55 Relevance: 1.4, Strings: 1, Instructions: 198COMMON

Download Yara Rule

Strings

:@2l, xrefs: 00D76CF5

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: :@2l
API String ID: 0-1731998491
Opcode ID: 7a659896d5af933baacc78126e32779452d290d757d36ec04dce7269b292cfe0
Instruction ID: f9802bbde0a24196474ce7870b45590fa9a6c9d51f77f2cdb74d33bb6115772c
Opcode Fuzzy Hash: 7a659896d5af933baacc78126e32779452d290d757d36ec04dce7269b292cfe0
Instruction Fuzzy Hash: B7912C70A012288FDB25EF34D951BAD77B2EF88304F5081A9950A6B794DF359E86CF50

Function 00D79575 Relevance: 1.4, Strings: 1, Instructions: 193COMMON

Download Yara Rule

Strings

:@2l, xrefs: 00D7980B

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: :@2l
API String ID: 0-1731998491
Opcode ID: 95f0418d52194834229d0b069111d270c5f2cf97a1156fc8976a1fbf1e2fc627
Instruction ID: 8e97808a821b95515ef467ee7ad299c25dc258d8762cf51b41ac1540335af0ea
Opcode Fuzzy Hash: 95f0418d52194834229d0b069111d270c5f2cf97a1156fc8976a1fbf1e2fc627
Instruction Fuzzy Hash: 60711B34B012009FCB19AF79E450A9D73B2FF88348B61852ED416977A8DF359C62DB91

Function 00D739BF Relevance: 1.4, Strings: 1, Instructions: 182COMMON

Download Yara Rule

Strings

2Yl, xrefs: 00D73C2E

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: 2Yl
API String ID: 0-600701926
Opcode ID: 1799796a82369252ca5fbe269b469150b072e7dada545d0c653bd7fceb960988
Instruction ID: 5d816344928d1e9ffb78e065875b783a181db3f21d64d50e9b75fec88b206975
Opcode Fuzzy Hash: 1799796a82369252ca5fbe269b469150b072e7dada545d0c653bd7fceb960988
Instruction Fuzzy Hash: B6816D30A01218CFDB14EBB4C951BECB7B2EF49308F1085A9D40AAB394DB759E85CF51

Function 00D79665 Relevance: 1.4, Strings: 1, Instructions: 146COMMON

Download Yara Rule

Strings

:@2l, xrefs: 00D7980B

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: :@2l
API String ID: 0-1731998491
Opcode ID: 28d46d118b05311632fccf42bbf9adc715d090f7c345feef8b0bfd21c17852a0
Instruction ID: 77f15a57104c1045a210e88e5d91ec87714b157ca30fabc233319589b8885db1
Opcode Fuzzy Hash: 28d46d118b05311632fccf42bbf9adc715d090f7c345feef8b0bfd21c17852a0
Instruction Fuzzy Hash: D3515F35B012149FDB18EFB5E860AADB3A2FF88748F11812AD41697798DF349C16CB91

Function 00D73B18 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

2Yl, xrefs: 00D73C2E

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: 2Yl
API String ID: 0-600701926
Opcode ID: 7e169673aa4a305a592523372a448d1b2d28a9441ecf55bc3dc5145e856819be
Instruction ID: ac4fd1100bb26b3315120deb7c82a8caa4a0aceeae95b5db8fe8101f7d4e4480
Opcode Fuzzy Hash: 7e169673aa4a305a592523372a448d1b2d28a9441ecf55bc3dc5145e856819be
Instruction Fuzzy Hash: 90416D30A012588FDB14EBB4C855BECB7F1FF89308F1041AAD00AAB695DB759E49CF61

Function 00D70958 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

:@2l, xrefs: 00D70A05

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID: :@2l
API String ID: 0-1731998491
Opcode ID: ef6e54bc5fafe549bb2311abd595ed433147554f5fe60ffa98bd067a4d454a67
Instruction ID: f919bb9b6f85be8874e253217ee350cf1aa23541f1ca3c0c24aa8e8e62acf0d7
Opcode Fuzzy Hash: ef6e54bc5fafe549bb2311abd595ed433147554f5fe60ffa98bd067a4d454a67
Instruction Fuzzy Hash: CC31E6307012118FDB04BB75D9117BE37A6EB88308F14843ED416D7799EF388D1A8BA2

Function 0092AB7C Relevance: 1.3, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0092ABF0

Memory Dump Source

Source File: 00000000.00000002.4570281581.000000000092A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92a000_01koiHnedL.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 0fd55c05687081ddc4d90295713c716e7c7da0d86858d79edbe4e811ac7e8b2e
Instruction ID: 68b4c05d6b0fb584c09e02c660a5dfabd23b1fafdd09067d270fa48ca53630dc
Opcode Fuzzy Hash: 0fd55c05687081ddc4d90295713c716e7c7da0d86858d79edbe4e811ac7e8b2e
Instruction Fuzzy Hash: 7B21F6755097C05FD7128F25DC91792BFB8EF07320F0984DADD848F263D2249909C762

Function 0092BB50 Relevance: 1.3, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0092BBBC

Memory Dump Source

Source File: 00000000.00000002.4570281581.000000000092A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92a000_01koiHnedL.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 5c05a1bc17ef595f0e639b0413c3f0c2033da3a772d35e2d349e8d74322227c4
Instruction ID: 4cc19f9b5e4f9fde9835cf5408e74ab1de20a8f6e4a733588154a5b0655d4988
Opcode Fuzzy Hash: 5c05a1bc17ef595f0e639b0413c3f0c2033da3a772d35e2d349e8d74322227c4
Instruction Fuzzy Hash: 7A21C0725093C05FDB128B25DC95B92BFF4AF07324F0984DAED858F663D264A908CB62

Function 0092A61E Relevance: 1.3, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0092A690

Memory Dump Source

Source File: 00000000.00000002.4570281581.000000000092A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92a000_01koiHnedL.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 1f12f2babc968a4f08cf6e6b908b2ffe193e891bea080a72b18e7793dc264719
Instruction ID: b8c6bfde4873f251e51f1410e10d64a50ed4b34815445121c4de8fcf0e3acbc9
Opcode Fuzzy Hash: 1f12f2babc968a4f08cf6e6b908b2ffe193e891bea080a72b18e7793dc264719
Instruction Fuzzy Hash: 5F214A714093C49FDB128B25DD95B92BFB4DF07220F0984DBDD849F2A3D2699908DBB2

Function 0092BB8A Relevance: 1.3, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0092BBBC

Memory Dump Source

Source File: 00000000.00000002.4570281581.000000000092A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92a000_01koiHnedL.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: b7f832f60b866d5fa4c7d305046504d34f4312fe0220d70ed93c4f424e2442a3
Instruction ID: 0f4687c54530625dcb5c71683d62afbf13e50f8a24ac062a89055db36cb998b0
Opcode Fuzzy Hash: b7f832f60b866d5fa4c7d305046504d34f4312fe0220d70ed93c4f424e2442a3
Instruction Fuzzy Hash: 4F01DF719002408FDB10CF1AE985B92FBE4EF00720F18C4AADD498F75AC375E808CB62

Function 0092ABBE Relevance: 1.3, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0092ABF0

Memory Dump Source

Source File: 00000000.00000002.4570281581.000000000092A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92a000_01koiHnedL.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 559edbaa62834aed39ad6e6d9fd1b23fbe70bc861aedd0e16c07840f5fe172bd
Instruction ID: 940806da2386f7033f18be4ea4b11383fff245934da981dbf1c63a52572704b1
Opcode Fuzzy Hash: 559edbaa62834aed39ad6e6d9fd1b23fbe70bc861aedd0e16c07840f5fe172bd
Instruction Fuzzy Hash: A601DF729042009FDB10CF16E9857A6FBE8DF00320F18C4AADD498F756D279E808CA62

Function 0092A65E Relevance: 1.3, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 0092A690

Memory Dump Source

Source File: 00000000.00000002.4570281581.000000000092A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92a000_01koiHnedL.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 566507aaf095c9a994cfae326b0209cb0b8d35ebbe96353236815fffc9847e9d
Instruction ID: 842142300a9a740377dd1dd58b35affa65edfdfeb55ed7848248e989aeb1daf7
Opcode Fuzzy Hash: 566507aaf095c9a994cfae326b0209cb0b8d35ebbe96353236815fffc9847e9d
Instruction Fuzzy Hash: 4001A2719002409FDB10CF55E984755FBE4DF04324F18C4AADD488F356D37AE808CEA2

Function 00D73DCC Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcf15ca1d4d6317d7861caffd98670a1408340cc95011ac0872d790d86b23c95
Instruction ID: 09e18b147f1e8b5851a13f0671295f64edb1b8b5e232ac16805a1914c18e834e
Opcode Fuzzy Hash: fcf15ca1d4d6317d7861caffd98670a1408340cc95011ac0872d790d86b23c95
Instruction Fuzzy Hash: 0BA1E674A01218CFCB65EF74D950AECB7B2FB48308F1041AAD80AAB755DB359E96CF40

Function 00D7726E Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fca98698d5b7423d95f068ce72a6e53bf6b65a2202651bdf0a11ab374963565
Instruction ID: 566c111ce169b22b25e5a15d42499a911c894b8135fc7cc86ef9d02709e1a9a4
Opcode Fuzzy Hash: 5fca98698d5b7423d95f068ce72a6e53bf6b65a2202651bdf0a11ab374963565
Instruction Fuzzy Hash: AE5104306093018FD715DF36A8047A93BE2EB45354F18CA66D85ADB2E6FB34DA46DB30

Function 00D77666 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6350766241d3e68045b8c4187379c3354031bb0c102150683b69152876f2f85
Instruction ID: 0726d957ce6b8f10888b2f491955a0d91e0f03e6b8a32721d3f560fd6e57655e
Opcode Fuzzy Hash: f6350766241d3e68045b8c4187379c3354031bb0c102150683b69152876f2f85
Instruction Fuzzy Hash: C641C0307092018BDB14DF36A9057A936E3AB44354F18C966D45ADB2E5EF38DA46DB30

Function 00D79C40 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35ed66d4c6202b5b77895b5895664708d3ad460d5249d7fd98d498544fa6924b
Instruction ID: 305ee02cde03ef031000d9262586f0f032508055efa811cf15840184e20e8538
Opcode Fuzzy Hash: 35ed66d4c6202b5b77895b5895664708d3ad460d5249d7fd98d498544fa6924b
Instruction Fuzzy Hash: 1D31A631B002059FDB14DB75D955BAEBBF6AF88344F248129E409EB3A4DB749D05CB90

Function 00D70006 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af857b208dfc9d517b7e9d0ca17bf4843df0f70aeff059ae842203345f5b60d4
Instruction ID: da5e61c4f7a40a31b9dd06466578aaff5bc57efa7e9be06638aa44078bd23cb7
Opcode Fuzzy Hash: af857b208dfc9d517b7e9d0ca17bf4843df0f70aeff059ae842203345f5b60d4
Instruction Fuzzy Hash: 3311282419F3C14FD70397709CA56817F70AE1710975E85EBC480CF1A7C659591EE762

Function 05932194 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4574240802.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_01koiHnedL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed8f42c5a7f29fa00350a6a19e11e5d6fb93b684314c789110ae88c63911984d
Instruction ID: ede1d4d5dfdbc63b9b007f4668d84040983b16bc4d67dbc13cc3c2f9589418a8
Opcode Fuzzy Hash: ed8f42c5a7f29fa00350a6a19e11e5d6fb93b684314c789110ae88c63911984d
Instruction Fuzzy Hash: 1C11B8B5A08341AFD350CF19D940A5BFBE4FB88664F14896EF99897311D231E9048FA2

Function 00D80814 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4571080890.0000000000D80000.00000040.00000020.00020000.00000000.sdmp, Offset: 00D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_01koiHnedL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f315885fcaa86fe457a0324738f355f7d095d92ecd881df0ae45585db04a77ec
Instruction ID: 271f5839a03741ef092b65e1b01f2bbf655570c3ee5bcab8a9fe8cee2af6752e
Opcode Fuzzy Hash: f315885fcaa86fe457a0324738f355f7d095d92ecd881df0ae45585db04a77ec
Instruction Fuzzy Hash: D811E430208240DFD751EB10C940B25BFB5AB88708F28C9ADE8490B683C777D896DBA1

Function 00D771C1 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b571b8882c627a87785bcb8c4c76be99e0008e5b6bdb29f228a38e021e9af7c
Instruction ID: e6463be2ed3d8ff88b78af8e1751cbec7fe3b0428444a5e2627db6f71d693694
Opcode Fuzzy Hash: 1b571b8882c627a87785bcb8c4c76be99e0008e5b6bdb29f228a38e021e9af7c
Instruction Fuzzy Hash: 48019E3964D7904FC3226A3868215693B72EB8620572605BFD841EB393DB295C0EC3A6

Function 00D79960 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2a070abaff03de51c0daf9942aee4deee5a164b6c6a827c03dcf7455030114e
Instruction ID: b9faa3630d1856acac00e7a8850c0e63320c514706b9980f025719c2942a55d2
Opcode Fuzzy Hash: e2a070abaff03de51c0daf9942aee4deee5a164b6c6a827c03dcf7455030114e
Instruction Fuzzy Hash: 8E11A071F011059FCB54EFB898108EE7BFAEB8924472045BEC406E7746EB359E06CB90

Function 0093B2F8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4570361325.000000000093A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_93a000_01koiHnedL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83e4724086ae21102c478042a4ddaf0f22a0446fca27c7c777c6c2ae5eb5764d
Instruction ID: bf6c8b80be2f97763bbfadd13a37b51b45508ffc70ddf91f49c70c0d3798f341
Opcode Fuzzy Hash: 83e4724086ae21102c478042a4ddaf0f22a0446fca27c7c777c6c2ae5eb5764d
Instruction Fuzzy Hash: FE11FAB5A08301AFD350CF09DD40E57FBE8EB88760F14896EF95997311D231E9088FA2

Function 05932038 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4574240802.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_01koiHnedL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 491c8b470c022ffc8a4b99dc4d8910c8c801abed5e235d7709141387b1386b41
Instruction ID: 7d090bff01a938febd3c58edc199d2cf7050152c485ae1d4d0f597e0bf0016d9
Opcode Fuzzy Hash: 491c8b470c022ffc8a4b99dc4d8910c8c801abed5e235d7709141387b1386b41
Instruction Fuzzy Hash: 9111FAB5A08301AFD350CF09DC80E57FBE8EB88760F14886EF95897311D231E9088FA2

Function 00D70878 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1eaefe3d7977380e48cd985d3e92cb637129a4bdc69fcff1611736ba7d289663
Instruction ID: 84518e961e96047314c6bbb365a4984a7b8d80c9d51335dc7d78a0f3ee5a4eb0
Opcode Fuzzy Hash: 1eaefe3d7977380e48cd985d3e92cb637129a4bdc69fcff1611736ba7d289663
Instruction Fuzzy Hash: 53118E3420A7829FC700EB74D55454D7BE1EFC9208B15882DA9858B35ADF3498099F82

Function 00D700A8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5660ef4c4fd7e770bc37f8dcb07869887ccfe0ca30840c10d99ca5c607914aea
Instruction ID: f6966d0c3f45ebaa544bb12566252b9b937f7f615739de0d101a85d97a670a42
Opcode Fuzzy Hash: 5660ef4c4fd7e770bc37f8dcb07869887ccfe0ca30840c10d99ca5c607914aea
Instruction Fuzzy Hash: 9DF09676A01344DBEB18DBB08852BAE7B73EBC1714F00C5AED5459B1D5DA315D41C750

Function 00D79C00 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f33640a4e8ce928feda614c0a5ffb95878dbf24d7914324d4d25fdc98e5ad5eb
Instruction ID: 2713daff85e717cf7265346ae5b45f464a558c40ec6f5a9ce0e6353ef89c6b0b
Opcode Fuzzy Hash: f33640a4e8ce928feda614c0a5ffb95878dbf24d7914324d4d25fdc98e5ad5eb
Instruction Fuzzy Hash: A3F0E932D4D2898ECB12CFB8A8554ECFF30EA02320B1443EAD899D71A2D7310519C762

Function 00D808D0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4571080890.0000000000D80000.00000040.00000020.00020000.00000000.sdmp, Offset: 00D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_01koiHnedL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e688d466f81438e4200f8fd76d8625fe577cca3db3c4452d967b0a8c1c81d4f3
Instruction ID: abbe068a6b40764a2bd0314f31c825815ec5eeedb3698c7e2033b73228cf4fb6
Opcode Fuzzy Hash: e688d466f81438e4200f8fd76d8625fe577cca3db3c4452d967b0a8c1c81d4f3
Instruction Fuzzy Hash: 48F06D35108640DFC701DF00C580B15FBA2EB88718F24CAADE84807752C337D813DB91

Function 00D80606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4571080890.0000000000D80000.00000040.00000020.00020000.00000000.sdmp, Offset: 00D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d80000_01koiHnedL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2280332f42adec14a818625bc383a775eab17daaae94a6c8ba198ba5cd9f0aad
Instruction ID: 616db7fa194cb0750b56e9b9a3d6913c0915a22ec08f70cdbf3a6a2fc811a41d
Opcode Fuzzy Hash: 2280332f42adec14a818625bc383a775eab17daaae94a6c8ba198ba5cd9f0aad
Instruction Fuzzy Hash: 09E092B6A006044F9650CF0BEC41452F7E8EB84630718C07FDC0D8B701D235F909CAA5

Function 0093B347 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4570361325.000000000093A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_93a000_01koiHnedL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4767b0be697001c8c5e4c3aec42bd719e314a793f168c2b7e6e8f6413fede87
Instruction ID: ce4d25039af98b3d0536451246969f7a5b5205e9c4e0982e393dde9676415262
Opcode Fuzzy Hash: c4767b0be697001c8c5e4c3aec42bd719e314a793f168c2b7e6e8f6413fede87
Instruction Fuzzy Hash: 60E0D8B294020467D2108F069D45F52FBA8DB50A31F14C56BEE191B701D171B50489F6

Function 05932087 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4574240802.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_01koiHnedL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dc1471dbb97626c0d89b39bda97873dc1bb1c039501013b7009443cf32cbe9f
Instruction ID: a8487f7cd0b5d0d193a5a9e259358cb94033516e0511785be4ecda1b649552b8
Opcode Fuzzy Hash: 6dc1471dbb97626c0d89b39bda97873dc1bb1c039501013b7009443cf32cbe9f
Instruction Fuzzy Hash: 4CE0D8B294030467D2509F069C45F53FBA8DB40A30F14C46BEE081B702D172B50489F5

Function 05931AAB Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4574240802.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_01koiHnedL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14fbce75f9738a3c41f484ec6ed0af27060f105f120e7473d88fbfcead5ba905
Instruction ID: 64f4c2e647582e91f88d772aa1df05c6927a0a6e67b49dcc96f65f916e5fe71c
Opcode Fuzzy Hash: 14fbce75f9738a3c41f484ec6ed0af27060f105f120e7473d88fbfcead5ba905
Instruction Fuzzy Hash: 08E0D8B294060467D2109F06AC45F53FB98DB80A30F18C46BEE081B701D172B514C9E5

Function 059321FF Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4574240802.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5930000_01koiHnedL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74e5e0cdfb285af554437ae5c4e0e880cf3978f5eeed39157f2f41bd19348b7b
Instruction ID: 41aec992c06614df6ebe207ed0214d75a45ccf01526abe85a1d97dd5019d7b98
Opcode Fuzzy Hash: 74e5e0cdfb285af554437ae5c4e0e880cf3978f5eeed39157f2f41bd19348b7b
Instruction Fuzzy Hash: 5DE0D8B294030467D2108F069C45F52FB9CDB94A31F14C46BEE181B741D171B51489E5

Function 00D736A8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b40a7801378ce3729bec6da1397edfa1967ea70b20340c0249a4b61752e4ab6
Instruction ID: ef7eb9c22df8fe5d8d1088025376d2d812da6eff6f62001344018e905fb3b20b
Opcode Fuzzy Hash: 3b40a7801378ce3729bec6da1397edfa1967ea70b20340c0249a4b61752e4ab6
Instruction Fuzzy Hash: 0AE08C316EB7808FCB2A6B78645846C3B30EF4220834504FEC4468BBA3DA3B9487CB00

Function 00D74200 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaabd8b48292475e2a6c467b1fbf1eae841a8976c828aaa624c77893667829b2
Instruction ID: 3e0712a4ad6245553ad61de0e782a8eb56c402697cc4843615477c624bab6711
Opcode Fuzzy Hash: eaabd8b48292475e2a6c467b1fbf1eae841a8976c828aaa624c77893667829b2
Instruction Fuzzy Hash: 22E08671A5E2C49FCB01DF789D1189C7FB09A0220470202EAD845D71A2DA315E09DB62

Function 009223F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4570257917.0000000000922000.00000040.00000800.00020000.00000000.sdmp, Offset: 00922000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_922000_01koiHnedL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a3204b096298af9bf63e42bcc1eed66bda890977a303d653a6dda397a3b6eaf
Instruction ID: 6d73a02326f12ef7634adc9acf53a9ae2ec6bc5a2656c72830e301deedb6ba0e
Opcode Fuzzy Hash: 0a3204b096298af9bf63e42bcc1eed66bda890977a303d653a6dda397a3b6eaf
Instruction Fuzzy Hash: A2D02E792086D04FD312AB0CD1A4B8537E8AB40704F0A00FEAC008B777C76CD881C600

Function 009223BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4570257917.0000000000922000.00000040.00000800.00020000.00000000.sdmp, Offset: 00922000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_922000_01koiHnedL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d92cbced25e7a18ebc10cd46168386cbd194cb69f2e0050bb576d56d84f871
Instruction ID: 1619d8e2563fc8f29fe004f86c2a9b34084e3e33133042f30d680842339314db
Opcode Fuzzy Hash: 72d92cbced25e7a18ebc10cd46168386cbd194cb69f2e0050bb576d56d84f871
Instruction Fuzzy Hash: 98D05E342002814BC719EB0CE2D4F5937E8AF40B14F1A44ECAC108B766C7A8D9C1CA00

Function 00D74210 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e97ebd4732f80f7f6c2a028c6bb985b52e5174d70641d840d567eecfd006bb0
Instruction ID: f3d4a4f417eafde1b45a3b72c3254f69f2851c38ddbcbf8e01b2de5c63276ba2
Opcode Fuzzy Hash: 0e97ebd4732f80f7f6c2a028c6bb985b52e5174d70641d840d567eecfd006bb0
Instruction Fuzzy Hash: 59D0C971A19208EF8B44DFA8DD0189DB7F9EB46219B1141A9A809D3250EE716E10EB91

Non-executed Functions

Function 00D78CD9 Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4571064680.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d70000_01koiHnedL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3306ab8f843cd9590f160e574be5f3816a53e71b2df57707e0141b44a9aee25c
Instruction ID: a9e1163539d08abe83921761ea4528cba25e8acbd59254a59ceb12e973115dd4
Opcode Fuzzy Hash: 3306ab8f843cd9590f160e574be5f3816a53e71b2df57707e0141b44a9aee25c
Instruction Fuzzy Hash: 45C15A3354A3229BDB35AB72E951279F6A2BA04351349C072F495DB1D0FF28CD92EB70

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 01koiHnedL.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Njrat

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\app

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
01koiHnedL.exe

Function 00D74298 Relevance: 13.2, Strings: 9, Instructions: 1950
COMMON

Function 00D74269 Relevance: 13.0, Strings: 9, Instructions: 1763
COMMON

Function 00D744F1 Relevance: 12.9, Strings: 9, Instructions: 1624
COMMON

Function 00D74544 Relevance: 12.9, Strings: 9, Instructions: 1618
COMMON

Function 00D74630 Relevance: 11.6, Strings: 8, Instructions: 1579
COMMON

Function 00D7470F Relevance: 11.5, Strings: 8, Instructions: 1544
COMMON

Function 00D747D4 Relevance: 11.5, Strings: 8, Instructions: 1513
COMMON

Function 00D74936 Relevance: 11.5, Strings: 8, Instructions: 1456
COMMON

Function 00D7499D Relevance: 11.4, Strings: 8, Instructions: 1447
COMMON

Function 00D749F9 Relevance: 11.4, Strings: 8, Instructions: 1440
COMMON

Function 00D74B5B Relevance: 11.4, Strings: 8, Instructions: 1383
COMMON

Function 00D74C8F Relevance: 10.1, Strings: 7, Instructions: 1362
COMMON

Function 00D74F2F Relevance: 6.2, Strings: 4, Instructions: 1245
COMMON

Function 00D74F9D Relevance: 6.2, Strings: 4, Instructions: 1236
COMMON

Function 00D75000 Relevance: 6.2, Strings: 4, Instructions: 1230
COMMON