Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe
Analysis ID:	1521526
MD5:	44263157176d2dce120e56ae6d3ef234
SHA1:	56a7650df487782d51c8974fa0e2686f86132c33
SHA256:	bc72cde1d16c58b721d38dae2bcaa61b3a9bc7c22eae128e0439329f32ddef05
Tags:	exe
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Contains functionality to register a low level keyboard hook

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to delete services

Contains functionality to dynamically determine API calls

Contains functionality to enumerate running services

Contains functionality to launch a control a shell (cmd.exe)

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

One or more processes crash

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe (PID: 7008 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe" MD5: 44263157176D2DCE120E56AE6D3EF234)

WerFault.exe (PID: 6172 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7008 -s 488 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe

ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.4% probability

Machine Learning detection for sample

Source: SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe

Joe Sandbox ML: detected

Source: SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe	Code function: 0_2_0041F0F0 FindFirstFileA,RemoveDirectoryA,RemoveDirectoryA,DeleteFileA,FindNextFileA,FindClose,		0_2_0041F0F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe	Code function: 0_2_0041ED60 FindClose,FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,FindNextFileA,FindNextFileA,		0_2_0041ED60

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe

Code function: 0_2_00407847 GetLogicalDriveStringsA,

0_2_00407847

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe

Code function: 4x nop then push esi

0_2_0041F4D1

Source: Amcache.hve.3.dr

String found in binary or memory: http://upx.sf.net

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe

Code function: 0_2_0040CC61 SetWindowsHookExA 0000000D,0040D0C3,?,00000000

0_2_0040CC61

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe

Code function: 0_2_0040C4BD OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_0040C4BD

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe	Code function: 0_2_0040C4BD OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		0_2_0040C4BD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe	Code function: 0_2_0040C39B GlobalAlloc,GlobalLock,RtlMoveMemory,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		0_2_0040C39B

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe

Code function: 0_2_0040DEC4 GetCurrentProcess,OpenProcess,LocalAlloc,NtQueryInformationProcess,LocalFree,CloseHandle,

0_2_0040DEC4

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe

Code function: 0_2_0041293F OpenSCManagerA,OpenServiceA,DeleteService,CloseServiceHandle,CloseServiceHandle,

0_2_0041293F

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe	Code function: 0_2_00423D60	0_2_00423D60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe	Code function: 0_2_004242E0	0_2_004242E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe	Code function: 0_2_004216A0	0_2_004216A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe	Code function: 0_2_00422F90	0_2_00422F90

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7008 -s 488

Source: SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe, 00000000.00000000.1893032318.000000000043A000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamewininit.exeD vs SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe
Source: SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe, 00000000.00000002.2033501137.000000000077E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewininit.exeD vs SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe
Source: SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe	Binary or memory string: OriginalFilenamewininit.exeD vs SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe

Source: SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal68.spyw.winEXE@2/5@0/0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe

Code function: OpenSCManagerA,CreateServiceA,CloseServiceHandle,CloseServiceHandle,

0_2_0041273E

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe

Code function: 0_2_0040C6B5 CreateToolhelp32Snapshot,Process32First,CloseHandle,Process32Next,CloseHandle,

0_2_0040C6B5

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe

Code function: 0_2_00413144 OpenSCManagerA,OpenServiceA,ChangeServiceConfigA,CloseServiceHandle,CloseServiceHandle,

0_2_00413144

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7008

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\6511a8d9-44cd-43fa-b20c-0b3db0d90bac

Jump to behavior

Source: SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe

ReversingLabs: Detection: 63%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7008 -s 488

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe	Section loaded: wtsapi32.dll			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe

Code function: 0_2_004012AD KiUserExceptionDispatcher,GetSystemMetrics,LoadLibraryA,GetProcAddress,CreateFileA,

0_2_004012AD

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe	Code function: 0_2_00424950 push eax; ret		0_2_0042497E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe	Code function: 0_2_0040BA88 push E8000001h; iretd		0_2_0040BA8D

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe

Code function: 0_2_00412AB1 OpenSCManagerA,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,

0_2_00412AB1

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe	Code function: OpenSCManagerA,EnumServicesStatusA,GetProcessHeap,HeapAlloc,EnumServicesStatusA,RtlMoveMemory,OpenServiceA,QueryServiceConfigA,GetProcessHeap,HeapAlloc,QueryServiceConfigA,RtlMoveMemory,GetProcessHeap,HeapFree,CloseServiceHandle,GetProcessHeap,HeapFree,CloseServiceHandle,	0_2_00414175
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe	Code function: OpenSCManagerA,EnumServicesStatusA,GlobalAlloc,EnumServicesStatusA,GlobalFree,CloseServiceHandle,	0_2_00415536
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe	Code function: OpenSCManagerA,EnumServicesStatusExA,GlobalAlloc,EnumServicesStatusExA,RtlMoveMemory,OpenServiceA,QueryServiceConfigA,GlobalAlloc,QueryServiceConfigA,RtlMoveMemory,GlobalFree,CloseServiceHandle,GlobalFree,CloseServiceHandle,	0_2_00415BE0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe

API coverage: 1.7 %

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe	Code function: 0_2_0041F0F0 FindFirstFileA,RemoveDirectoryA,RemoveDirectoryA,DeleteFileA,FindNextFileA,FindClose,		0_2_0041F0F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe	Code function: 0_2_0041ED60 FindClose,FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,FindNextFileA,FindNextFileA,		0_2_0041ED60

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe

Code function: 0_2_00407847 GetLogicalDriveStringsA,

0_2_00407847

Source: Amcache.hve.3.dr	Binary or memory string: VMware
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.3.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.3.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.3.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.3.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.3.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.3.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.3.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.3.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.3.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.3.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.3.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.3.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe	API call chain: ExitProcess graph end node	graph_0-14781
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe	API call chain: ExitProcess graph end node	graph_0-14972
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe	API call chain: ExitProcess graph end node	graph_0-14942
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe	API call chain: ExitProcess graph end node	graph_0-14769

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe

Code function: 0_2_004012AD KiUserExceptionDispatcher,GetSystemMetrics,LoadLibraryA,GetProcAddress,CreateFileA,

0_2_004012AD

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe

Code function: 0_2_0041D500 GetProcessHeap,RtlAllocateHeap,MessageBoxA,

0_2_0041D500

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe	Code function: 0_2_004022EE SetUnhandledExceptionFilter,		0_2_004022EE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe	Code function: 0_2_0040234C SetUnhandledExceptionFilter,		0_2_0040234C

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe

Code function: 0_2_00420290 cpuid

0_2_00420290

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe

Code function: 0_2_0041D770 GetVersionExA,

0_2_0041D770

Source: Amcache.hve.3.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe

Code function: \cmd.exe

0_2_00410A09

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Command and Scripting Interpreter	12 Windows Service	12 Windows Service	1 Virtualization/Sandbox Evasion	11 Input Capture	31 Security Software Discovery	Remote Services	11 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Service Execution	1 DLL Side-Loading	1 Process Injection	1 Process Injection	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	1 DLL Side-Loading	2 Obfuscated Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	2 Clipboard Data	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 System Service Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe	63%	ReversingLabs	Win32.Trojan.Generic
SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe	100%	Avira	TR/Spy.Gen
SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.3.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1521526
Start date and time:	2024-09-28 22:24:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe
Detection:	MAL
Classification:	mal68.spyw.winEXE@2/5@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 77% Number of executed functions: 4 Number of non-executed functions: 74
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe

Simulations

Behavior and APIs

Time	Type	Description
16:25:34	API Interceptor	1x Sleep call for process: WerFault.exe modified

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_7212a4befdb83f9e6522613afc3cc91592917d_71cefb02_7c5facf3-cc09-463c-9c66-220058371a9e\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8205709485769352
Encrypted:	false
SSDEEP:	96:bBFYglVWxwCjpFA8YstzkPtRmyf8QXIDcQvc6QcEVcw3cE/6wd+HbHg/8BRTf3ue:l1h2phYN0BU/YjeoqzuiFMZ24IO8i5J
MD5:	6995E80BACC69EB4FBFCFE68CD16FF4F
SHA1:	74D662CED532760D3B9E3B9A5D3D38D001E5EBC9
SHA-256:	2DE7605F1A8572AEF3381DAAA09E17D7004616F77A7988B586EB92CDFD67D3E0
SHA-512:	9B51DA19C7B70B654030FD7BBAED16E1C5F561F1EFF015CDB6E5C0134DD307909661500FC8CE0A0CE85601E137CA4394D7EE8D5458E26BE0136CADB8078A39A1
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.0.2.8.7.2.1.1.4.1.5.3.9.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.0.2.8.7.2.1.4.8.5.3.0.8.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.c.5.f.a.c.f.3.-.c.c.0.9.-.4.6.3.c.-.9.c.6.6.-.2.2.0.0.5.8.3.7.1.a.9.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.7.e.7.9.f.2.4.-.2.9.1.7.-.4.5.d.d.-.b.b.d.b.-.5.1.0.0.5.7.7.3.a.6.7.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...W.i.n.3.2...T.r.o.j.a.n.X.-.g.e.n...1.8.9.7.3...1.3.2.6.1...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.w.i.n.i.n.i.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.6.0.-.0.0.0.1.-.0.0.1.4.-.b.5.a.a.-.3.3.8.a.e.4.1.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.4.e.d.6.c.7.a.5.b.4.6.0.8.c.b.1.8.b.a.a.0.5.6.1.6.c.b.0.b.d.a.8.0.0.0.0.f.f.f.f.!.0.0.0.0.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF46D.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Sep 28 20:25:21 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	35888
Entropy (8bit):	1.926733532911623
Encrypted:	false
SSDEEP:	192:jrmjTsHLOH75PZLqZ0tYoYmjDHWeR16IY:+fH75By0tpDHp
MD5:	A97A0165CFCA3864453F44DF7B034A2B
SHA1:	79203B6F564CBF3F83215EEAD2D73B3CDE6CF650
SHA-256:	55910E1DF732A0ADD06AE9E60A3C38DB7F2063C3120E57B04AA38F014E2AD2E6
SHA-512:	479817AA4B47E11E6554A80D6D0FDE6E25C00DF7355EC6FE8B039D02F1CB3DF052636E08BD8F71C489BA2D8C35A5B50F8DBA23B174AC91017001A1AA327E9EB3
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......1f.f........................$...............h"..........T.......8...........T................x......................................................................................................eJ......D.......GenuineIntel............T.......`...0f.f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF4DC.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8512
Entropy (8bit):	3.702465045410482
Encrypted:	false
SSDEEP:	192:R6l7wVeJac6ig6Y9YSU9Dh7LgmffGprQ89bT5sfkKxm:R6lXJJ676YiSU9tngmff+TSfc
MD5:	7FDE7E13C524DBEEF1F5940659D7BC15
SHA1:	747AC211141FCC2321D8B9B8B4C606B63C3D2220
SHA-256:	75AAD788BD0143A86513D3CAADFBF6F8046B33DE539000DE8AF6A61F7F434747
SHA-512:	ACE12BD0CF5B2B4E663A7567DA5A7E9ED06AC30B0CC0140D9B2089453A2F12FD76E7EE7D9D20790A70217A3B9FFECC0D39E250C7E63FE2AE2C73DB2A981DAC8B
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.0.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF50C.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4893
Entropy (8bit):	4.57509558692161
Encrypted:	false
SSDEEP:	48:cvIwWl8zswtJg77aI9RCrWpW8VYpjYm8M4JDNmqFrG+q8mMSm/K2vFd:uIjf2I77Ca7Vq2J/GSi2vFd
MD5:	612ED854CD244194286F0437441F4CB6
SHA1:	74FA0C4347FC60D67B602BABD79631C750011831
SHA-256:	DEE3B36F310169BC4A6B322D1D248F02867C5508E58C1C2DD6D07B424E994BEF
SHA-512:	82B4263F876178D93FC0ADF755E80E021B6B59AFAB9DD3A7AED93C011E3FE0A989B5F0FE774344781A3EC28941BC7CE5732EAE625647E387204BB91734719A11
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="520528" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465687853453082
Encrypted:	false
SSDEEP:	6144:kIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNFdwBCswSbZ:ZXD94+WlLZMM6YFHf+Z
MD5:	CDBA5E40F98AC56ADB58B1DE4B789F28
SHA1:	9324E4C013C11B720863610E1C139C80785B58F4
SHA-256:	ED8CBAF24F2CE8B78986B35381541978255CBC5154C6F2CB5EDA8D17CCDAD8F0
SHA-512:	BEC7E641D061CADF061DD4D9F577285BBA9DC02F1DB5E3F3F1A131A7578AFF635430C5261F71AF7E06DB587142A4D91E98CEA86F82DF5226E05C406C494A11DD
Malicious:	false
Reputation:	low
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..l...................................................................................................................................................................................................................................................................................................................................................{.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.099336289847779
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe
File size:	170'496 bytes
MD5:	44263157176d2dce120e56ae6d3ef234
SHA1:	56a7650df487782d51c8974fa0e2686f86132c33
SHA256:	bc72cde1d16c58b721d38dae2bcaa61b3a9bc7c22eae128e0439329f32ddef05
SHA512:	37aca245d40e01b49c1481a19189bd52cac9fea53b33a1393ccb0be4ec97ffb79d125b89f3e626dd1c9ee93a4730b20c0c65595ba54e4cca9e5458202bf055a7
SSDEEP:	3072:RITI68njNkWEumKMQt5wFiJOVekPiyt5P0d/uR3IgfQ8m6gXe3ul0:RhIumKMQ6i8V5PiykdA3I8EhXe3ul
TLSH:	85F3F733A214C8A6D02136B622F20B38EDB447563D789177EFE4DEB1AC61562CF9794C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........*\-.K2~.K2~.K2~.W>~.K2~.W<~.K2~.T6~.K2~.m8~.K2~aT8~.K2~.K3~0K2~JDo~.K2~.m9~.K2~.K2~.K2~aT9~.K2~NM4~.K2~Rich.K2~...............

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x401000
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x64C8CD50 [Tue Aug 1 09:16:00 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	1e137beb03917c84d5c479ef47f30e98

Entrypoint Preview

Instruction
call 00007F1675073160h
call 00007F1675072E71h
xor eax, eax
ret
nop
nop
nop
push ebp
mov ebp, esp
mov eax, 00000000h
jmp 00007F1675056E45h
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0000000Ch
mov dword ptr [ebp-04h], esp
xor eax, eax
call dword ptr [0042509Ch]
nop
nop
cmp dword ptr [ebp-04h], esp
je 00007F1675056E59h
push 00000000h
push 0402FB73h
push 00000006h
call 00007F1675072E96h
add esp, 0Ch
mov dword ptr [00428345h], 00000000h
mov dword ptr [00428349h], 00000000h
push 00000000h
mov ebx, 000008D4h
call 00007F167507353Fh
add esp, 04h
mov dword ptr [ebp-08h], eax
cmp dword ptr [ebp-08h], 03h
mov eax, 00000000h
setnl al
mov dword ptr [0042834Dh], eax
call 00007F1675056E53h
mov eax, 00000000h
jmp 00007F1675056E45h
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
mov esp, ebp
pop ebp
ret
test ebx, ebx
jne 00007F1675056E45h
xor eax, eax
ret
mov ecx, ebx
test ecx, 00000003h
je 00007F1675056E51h
mov al, byte ptr [ecx]
inc ecx
test al, al
je 00007F1675056E7Dh
test ecx, 00000003h
jne 00007F1675056E33h

Rich Headers

Programming Language:

[ C ] VS98 (6.0) SP6 build 8804
[ C ] VS98 (6.0) build 8168
[C++] VS98 (6.0) SP6 build 8804
[C++] VS98 (6.0) build 8168
[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x26030	0xdc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3a000	0x3e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x25000	0x2c4	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x239d2	0x23a00	4e4a8c9bf57761c03e9543dcf78c293b	False	0.3617324561403509	data	6.123504050230424	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x25000	0x1f72	0x2000	be6f75a0e0ce694046397a15c9458685	False	0.3873291015625	OpenPGP Public Key Version 2	5.263097382925648	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x27000	0x12e05	0x3800	809f032558492b22bd7ad0d452ad939c	False	0.396484375	data	4.7946460050679045	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3a000	0x3e8	0x400	a3028926dad9a486c5651ddf0f9fdd93	False	0.5263671875	data	4.420889371032156	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x3a270	0x174	data			0.5403225806451613
RT_MANIFEST	0x3a0a0	0x1cb	XML 1.0 document, ASCII text, with CRLF line terminators			0.6318082788671024

Imports

DLL	Import
KERNEL32.dll	PeekNamedPipe, ReadFile, GetExitCodeProcess, Sleep, GlobalFree, HeapAlloc, HeapFree, lstrcatA, ReadProcessMemory, ExitProcess, HeapReAlloc, IsBadReadPtr, GetVersionExA, GetModuleFileNameA, GetTickCount, WaitForSingleObject, CreateProcessA, GetStartupInfoA, GetFileSize, FindNextFileA, FindFirstFileA, FindClose, GetCommandLineA, FreeLibrary, LCMapStringA, CreateProcessW, CreatePipe, CopyFileA, GetProcAddress, CreateFileA, SetUnhandledExceptionFilter, OpenEventA, CreateEventA, lstrlenW, GetTempPathW, WideCharToMultiByte, GetProcessHeap, MultiByteToWideChar, IsBadCodePtr, GetCommandLineW, RtlMoveMemory, LocalFree, GetCurrentProcessId, OpenProcess, CloseHandle, CreateToolhelp32Snapshot, Process32Next, SetFileAttributesA, CreateThread, LoadLibraryA, GetCurrentProcess, CreateIoCompletionPort, GetQueuedCompletionStatus, GetLogicalDriveStringsA, GetTempFileNameA, GetWindowsDirectoryA, CreateDirectoryW, LocalAlloc, lstrcpyn, RemoveDirectoryA, DeleteFileA, GetModuleHandleA, Process32First, GlobalUnlock, GlobalLock, GlobalAlloc, GetFileAttributesA, MoveFileA, CreateDirectoryA
USER32.dll	CloseClipboard, OpenClipboard, GetSystemMetrics, SetClipboardData, EmptyClipboard, PeekMessageA, TranslateMessage, DispatchMessageA, wsprintfA, MessageBoxA, SetWindowPos, SetFocus, CreateWindowExA, IsWindowEnabled, EnableWindow, MapWindowPoints, GetParent, GetWindowRect, MoveWindow, GetWindowTextA, GetWindowTextLengthA, GetInputState, WaitForInputIdle, CallWindowProcA, SetWindowLongA, CallNextHookEx, SetWindowsHookExA, UnhookWindowsHookEx, GetForegroundWindow, GetMessageA
COMCTL32.dll
SHELL32.dll	SHGetPathFromIDListA, CommandLineToArgvW, SHGetSpecialFolderLocation, SHGetSpecialFolderPathW
ADVAPI32.dll	EnumServicesStatusExA, EnumServicesStatusA, ChangeServiceConfigA, ControlService, StartServiceA, DeleteService, CreateServiceA, GetServiceKeyNameA, GetServiceDisplayNameA, ChangeServiceConfig2A, QueryServiceConfig2A, QueryServiceConfigA, RegDeleteValueA, RegDeleteKeyA, RegCreateKeyExA, RegOpenKeyExA, RegSetValueExA, RegFlushKey, RegQueryValueExA, RegEnumValueA, RegQueryInfoKeyA, RegEnumKeyA, RegOpenKeyA, RegCreateKeyA, CreateProcessWithTokenW, DuplicateTokenEx, OpenServiceA, OpenSCManagerA, CloseServiceHandle, QueryServiceStatus, LookupAccountSidA, GetTokenInformation, OpenProcessToken, RegCloseKey, RegSetValueExW, RegCreateKeyExW, RegOpenKeyExW, EnumDependentServicesA
WTSAPI32.dll	WTSEnumerateProcessesA, WTSFreeMemory
SHLWAPI.dll	PathIsDirectoryA, PathFindFileNameA, PathIsDirectoryW
ole32.dll	CoCreateGuid
MSVCRT.dll	sprintf, srand, rand, atoi, _ftol, _stricmp, free, malloc, __CxxFrameHandler, strrchr, strchr, modf, realloc, memmove, strncmp, ??3@YAXPAX@Z
WS2_32.dll	gethostname, WSACleanup, WSAStartup

Target ID:	0
Start time:	16:25:20
Start date:	28/09/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe"
Imagebase:	0x400000
File size:	170'496 bytes
MD5 hash:	44263157176D2DCE120E56AE6D3EF234
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:25:20
Start date:	28/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7008 -s 488
Imagebase:	0x310000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.1%
Total number of Nodes:	822
Total number of Limit Nodes:	7

Executed Functions

Function 004012AD Relevance: 22.0, APIs: 4, Strings: 8, Instructions: 1036libraryfileloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0040266C: OpenEventA.KERNEL32(001F0003,00000000,004012C3,?,004012C3), ref: 00402690

Part of subcall function 0041DB10: GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 0041DB22

GetSystemMetrics.USER32(00000043), ref: 00401BD9
LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00401C1F
GetProcAddress.KERNEL32(00000000), ref: 00401C54

Part of subcall function 00404B1B: IsBadCodePtr.KERNEL32(00000000), ref: 00404B2C

CreateFileA.KERNEL32(?,00000001,00000000,00000000,00000003,02000000,00000000,00000000), ref: 00401D63

Part of subcall function 0041DC30: GetTickCount.KERNEL32 ref: 0041DC38
Part of subcall function 0041DC30: srand.MSVCRT ref: 0041DC3F

Part of subcall function 0041DC60: rand.MSVCRT ref: 0041DCA7

Part of subcall function 004072DC: GetCurrentProcess.KERNEL32 ref: 004072F1
Part of subcall function 004072DC: CreateIoCompletionPort.KERNEL32(?,00000000,00000000,00000000), ref: 0040732F
Part of subcall function 004072DC: GetQueuedCompletionStatus.KERNEL32(00000000,?,?,?,?), ref: 0040738F
Part of subcall function 004072DC: CloseHandle.KERNEL32(00000000), ref: 004073BB

Strings

rB, xrefs: 004017AC
rB, xrefs: 004012FC
<sB, xrefs: 00401A04
ZrB, xrefs: 004014BE
$sB, xrefs: 0040196E
grB, xrefs: 00401554
_DECRAGE, xrefs: 004012B2, 004012F0, 00401386, 0040141C, 004014B2, 00401548, 004015DE, 00401674, 0040170A, 004017A0, 00401836, 004018CC, 00401962, 004019F8
GrB, xrefs: 00401428

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CompletionCreateFile$AddressCloseCodeCountCurrentEventHandleLibraryLoadMetricsModuleNameOpenPortProcProcessQueuedStatusSystemTickrandsrand
String ID: rB$$sB$<sB$GrB$ZrB$_DECRAGE$grB$rB
API String ID: 1433877891-2002482318
Opcode ID: e018fdfe65e899379cdec9bdbb2122edc47a5b15eff1483f466afccf8f7176ee
Instruction ID: de5532e39acbadf7d349d0af006baaac2bf1eaa9ccf12f17598a4d924a59ce7f
Opcode Fuzzy Hash: e018fdfe65e899379cdec9bdbb2122edc47a5b15eff1483f466afccf8f7176ee
Instruction Fuzzy Hash: 7B7247F1F003059BEB10DFF59C85BAF77B8AB18704F04047AF605BB291E679A9448B59

Function 0040DEC4 Relevance: 9.1, APIs: 6, Instructions: 143
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,0040DEB0,00000000,00000000,00000000), ref: 0040DEFF
OpenProcess.KERNEL32(001F0FFF,00000000,00000000,?,0040DEB0,00000000,00000000,00000000), ref: 0040DF3D
LocalAlloc.KERNEL32(00000040,00000018,?,0040DEB0,00000000,00000000,00000000), ref: 0040DF93
NtQueryInformationProcess.NTDLL(00000000,00000000,00000000,00000018,00000018), ref: 0040DFDB
LocalFree.KERNEL32(00000000,00000000,00000000,000000A8,00000000,000000A4,00000000,00000004,?,0040DEB0,00000000,00000000,00000000), ref: 0040E073
CloseHandle.KERNELBASE(00000000,?,0040DEB0,00000000,00000000,00000000), ref: 0040E09F

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Process$Local$AllocCloseCurrentFreeHandleInformationOpenQuery
String ID:
API String ID: 1303139876-0
Opcode ID: 34e63fda9af20349dcf76c9a5327e2e7779c272701567f3987ad451c9ce10896
Instruction ID: d75cd8ff585bc8fcee1375bcb69126986e861aab3cd3c2c70bffb31ce769fb9f
Opcode Fuzzy Hash: 34e63fda9af20349dcf76c9a5327e2e7779c272701567f3987ad451c9ce10896
Instruction Fuzzy Hash: 58513F70E04319EBDF10AFA1DC467AEBB70EF09715F104466F6057A2C0D7B946A4CB9A

Function 0041D500 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00420AC8,?,00000000,00000000,00000000,00420A29,00000000,00000000), ref: 0041D509
RtlAllocateHeap.NTDLL(00770000,00000000,00000000,00000000,00420AC8,?,00000000,00000000,00000000,00420A29,00000000,00000000), ref: 0041D51D
MessageBoxA.USER32(00000000,004286B8,error,00000010), ref: 0041D536

Strings

error, xrefs: 0041D52B

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Heap$AllocateMessageProcess
String ID: error
API String ID: 2992861138-1574812785
Opcode ID: 705a5dff914bf1a8ee16708b1305199e710293376f0b6d1722e6547cd1671166
Instruction ID: a7a5eb8e9180051350eba0e8ddbe24986a269b74039b11390a226e1e7cc6e7f3
Opcode Fuzzy Hash: 705a5dff914bf1a8ee16708b1305199e710293376f0b6d1722e6547cd1671166
Instruction Fuzzy Hash: FBE0D8F1F42621BFC7319760BC0EB9B36559B04755F400135F844D6250E774A8518B9E

Function 0041DE90 Relevance: 6.0, APIs: 4, Instructions: 43
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000020,00000000,00000000,00402473,00000001,?,00000000,80000004), ref: 0041DEA5
GetFileSize.KERNEL32(00000000,?,00427215,00000268), ref: 0041DEBC

Part of subcall function 0041D500: GetProcessHeap.KERNEL32(00420AC8,?,00000000,00000000,00000000,00420A29,00000000,00000000), ref: 0041D509
Part of subcall function 0041D500: RtlAllocateHeap.NTDLL(00770000,00000000,00000000,00000000,00420AC8,?,00000000,00000000,00000000,00420A29,00000000,00000000), ref: 0041D51D
Part of subcall function 0041D500: MessageBoxA.USER32(00000000,004286B8,error,00000010), ref: 0041D536

ReadFile.KERNELBASE(00000000,00000008,00000000,?,00000000), ref: 0041DEE8
CloseHandle.KERNELBASE(00000000), ref: 0041DEEF

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: File$Heap$AllocateCloseCreateHandleMessageProcessReadSize
String ID:
API String ID: 749537981-0
Opcode ID: f1e455ca97534189f8e59c1a3db510bf59d79a82e521ff7429a336f747fd733c
Instruction ID: f94fe7c6f2684ef5b05a534e8a4beb94f53d910a0c5a3b3d838e0c12281fb6d8
Opcode Fuzzy Hash: f1e455ca97534189f8e59c1a3db510bf59d79a82e521ff7429a336f747fd733c
Instruction Fuzzy Hash: A5F0C8B67007007BD3219F64EC89FAB77ACEB84B10F104A2EF602971D1E6B4A545C7A4

Non-executed Functions

Function 00414175 Relevance: 52.4, APIs: 18, Strings: 11, Instructions: 1602memoryserviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00414268
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004142BE
GetProcessHeap.KERNEL32 ref: 004142EA
HeapAlloc.KERNEL32(?,00000008,00000000), ref: 00414321
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00414369
RtlMoveMemory.KERNEL32(00000000,?,?,?,?,?,00000000,?,00000000,00000000), ref: 00414624
OpenServiceA.ADVAPI32(00000000,?,000F01FF,?,?,?,?,?,?,?,?,?,00000000), ref: 00414895
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 004148DC
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00414905
HeapAlloc.KERNEL32(00000001,00000008,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0041493C
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00414975
RtlMoveMemory.KERNEL32(?,00000000,00000024,?,?,?,?,?,?,?,?,?,?), ref: 004149B6
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00415342
HeapFree.KERNEL32(00000001,00000001,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00415379
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 004153A5
GetProcessHeap.KERNEL32(?,00000000,?,00000000,00000000), ref: 004153EC
HeapFree.KERNEL32(00000001,00000001,00000000,?,00000000,?,00000000,00000000), ref: 00415423
CloseServiceHandle.ADVAPI32(00000000,?,00000000,?,00000000,00000000), ref: 0041544F

Strings

lsB, xrefs: 004151C8
LocalSystem, xrefs: 0041518E
lsB, xrefs: 00414F9A
lsB, xrefs: 004151DC
lsB, xrefs: 00414F16
NetworkService, xrefs: 00415077
LocalService, xrefs: 00414F60
lsB, xrefs: 004150B1
lsB, xrefs: 004150C5
jxB, xrefs: 0041504D
lsB, xrefs: 00414FAE

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Heap$Service$Process$AllocCloseConfigEnumFreeHandleMemoryMoveOpenQueryServicesStatus$Manager
String ID: LocalService$LocalSystem$NetworkService$jxB$lsB$lsB$lsB$lsB$lsB$lsB$lsB
API String ID: 639198646-1831086797
Opcode ID: 6b8d0db7872ed1fd83956b0cca0d11e71b82e72b41197e932c6f8e52fb5f1c37
Instruction ID: 98f33e54627f024af630018e09ab1687fede5e3ade57d2750cb8154be3dc087f
Opcode Fuzzy Hash: 6b8d0db7872ed1fd83956b0cca0d11e71b82e72b41197e932c6f8e52fb5f1c37
Instruction Fuzzy Hash: 5DC265B1E40318ABEB00DFA5DCC2BDD7BB4FF58314F540029E608BA285E7796951CB59

Function 00415BE0 Relevance: 45.4, APIs: 14, Strings: 11, Instructions: 1609servicememoryCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 00415CD3
EnumServicesStatusExA.ADVAPI32(00000000,00000000,00000030,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00415D52
GlobalAlloc.KERNEL32(00000040,00000000), ref: 00415D93
EnumServicesStatusExA.ADVAPI32(00000000,00000000,00000030,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00415E04
RtlMoveMemory.KERNEL32(00000000,?,?,?,?,?,00000000,?,00000000,00000000), ref: 004160DF
OpenServiceA.ADVAPI32(00000000,00000001,000F01FF), ref: 004163A2
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 004163F5
GlobalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00416429
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 00416462
RtlMoveMemory.KERNEL32(?,00000000,00000024), ref: 004164A3
GlobalFree.KERNEL32(00000000), ref: 00416E2B
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00416E57
GlobalFree.KERNEL32(00000000), ref: 00416E8F
CloseServiceHandle.ADVAPI32(00000000), ref: 00416EBB

Strings

lsB, xrefs: 00416A94
LocalSystem, xrefs: 00416C74
lsB, xrefs: 004169FC
lsB, xrefs: 00416A80
lsB, xrefs: 00416BAB
NetworkService, xrefs: 00416B5D
lsB, xrefs: 00416CC2
LocalService, xrefs: 00416A46
lsB, xrefs: 00416B97
jxB, xrefs: 00416B33
lsB, xrefs: 00416CAE

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Service$Global$AllocCloseConfigEnumFreeHandleMemoryMoveOpenQueryServicesStatus$Manager
String ID: LocalService$LocalSystem$NetworkService$jxB$lsB$lsB$lsB$lsB$lsB$lsB$lsB
API String ID: 749800324-1831086797
Opcode ID: 6fa02d790720f43c01bebd8cbf64691de85f564c0f919bc3d7a60c6ea79ef680
Instruction ID: 9ecd4d6c96cd11dc63db353ec3ba48419734f737a6b7490546908938defcf832
Opcode Fuzzy Hash: 6fa02d790720f43c01bebd8cbf64691de85f564c0f919bc3d7a60c6ea79ef680
Instruction Fuzzy Hash: EDC265F1E40318ABEB00DFA5DCC2B9D7BB4FF18314F540029E605BA386E679A955CB19

Function 00410A09 Relevance: 30.6, APIs: 13, Strings: 4, Instructions: 886
pipesleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNEL32(00000000,00000000,00000000,00000000), ref: 00410B10
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000025,00000000,00000000), ref: 00410C32
CreateProcessW.KERNEL32(00000000,00000000,?,00000000,00000001,00000000,00000000,00000000,00000000), ref: 00410F61
CloseHandle.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,00000001,00000001), ref: 00411061
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00000001,00000001), ref: 00411097
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00000001,00000001), ref: 004110D8
WaitForInputIdle.USER32(00000000,000003E8), ref: 00411111
PeekNamedPipe.KERNEL32(00000000,00000000,00000000,00000000,000000FF,00000000), ref: 0041115F
ReadFile.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 004111E3
GetExitCodeProcess.KERNEL32(00000000,?), ref: 00411322

Part of subcall function 00403FD9: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,FFFFFFFF,00000000,00000000,00000000), ref: 004040B5

Sleep.KERNEL32(00000001,?,?,?,?,?,?,?,?,?,?,00000001,00000001), ref: 00411362
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00000001,00000001), ref: 0041139B
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00000001,00000001), ref: 004113C7

Strings

[A, xrefs: 00410E5F
\command.com, xrefs: 00410C7A
/c , xrefs: 00410D36
\cmd.exe, xrefs: 00410C70

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CloseHandle$CreatePipeProcess$ByteCharCodeExitFileFolderIdleInputMultiNamedPathPeekReadSleepSpecialWaitWide
String ID: /c $[A$\cmd.exe$\command.com
API String ID: 4223885641-1881789782
Opcode ID: 09426194bcebca9c65a55874e4f6ac6c4ad04b093cf7b347c963c368def8f260
Instruction ID: cdfa67f950413d8aba35a529d406481f4311bdcad35f854d5f16005b5db9d459
Opcode Fuzzy Hash: 09426194bcebca9c65a55874e4f6ac6c4ad04b093cf7b347c963c368def8f260
Instruction Fuzzy Hash: C66209B1E40309ABEF10DFA5ECC5B9EBBB4AF18314F140026E605BB381E779A591CB55

Function 0040C39B Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 143clipboardmemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000002,00000000), ref: 0040C41C
GlobalLock.KERNEL32(00000000), ref: 0040C44B
RtlMoveMemory.KERNEL32(00000000,00000002,00000000), ref: 0040C482
GlobalUnlock.KERNEL32(00000000), ref: 0040C4AE
OpenClipboard.USER32(00000000), ref: 0040C4E2
EmptyClipboard.USER32 ref: 0040C50B
SetClipboardData.USER32(00000001,00000000), ref: 0040C53C
CloseClipboard.USER32 ref: 0040C565

Strings

lsB, xrefs: 0040C3D7

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Clipboard$Global$AllocCloseDataEmptyLockMemoryMoveOpenUnlock
String ID: lsB
API String ID: 2903773834-575463903
Opcode ID: 04f946a2c85cca730725b16f39b3320f5d47223364587b8be726b73d1e467f87
Instruction ID: 3d2fca06fadcd5da2c6968f07cbc19a4199a8a93edfa2883944f9547740e88bc
Opcode Fuzzy Hash: 04f946a2c85cca730725b16f39b3320f5d47223364587b8be726b73d1e467f87
Instruction Fuzzy Hash: 944131B4E40308FBEB10AFA0DD87BAEBFB1AB09715F504565F5047A180D77A4690CBDA

Function 0040C6B5 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 433processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,?,?,0040C5E9), ref: 0040C720
Process32First.KERNEL32(000000FF,00000000), ref: 0040C7FD
CloseHandle.KERNEL32(000000FF), ref: 0040C979
Process32Next.KERNEL32(000000FF,00000000), ref: 0040CA43
CloseHandle.KERNEL32(000000FF,?,?,?,?,?,?,?,0040C5E9), ref: 0040CB2D

Strings

lsB, xrefs: 0040C926
lsB, xrefs: 0040C93C

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CloseHandleProcess32$CreateFirstNextSnapshotToolhelp32
String ID: lsB$lsB
API String ID: 1789362936-2359463181
Opcode ID: 5bfea29c0391b9bf33e31ee1042cf2f080800d5184bcd658dc431e4d1efa4047
Instruction ID: 936ea92a57d697f22349cd11dd2fd27080672a001d8c158f425babb76bf45983
Opcode Fuzzy Hash: 5bfea29c0391b9bf33e31ee1042cf2f080800d5184bcd658dc431e4d1efa4047
Instruction Fuzzy Hash: F3E14DF1A402569BFB00DFA8DCC1B9A77A0EF59324F280435E50AAF340D379B961DB56

Function 00415536 Relevance: 9.1, APIs: 6, Instructions: 127servicememoryCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 004155A1
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004155F7
GlobalAlloc.KERNEL32(00000040,00000000), ref: 00415628
EnumServicesStatusA.ADVAPI32(00000000,00000030,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00415670
GlobalFree.KERNEL32(00000000), ref: 0041569F
CloseServiceHandle.ADVAPI32(00000000), ref: 004156CB

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: EnumGlobalServicesStatus$AllocCloseFreeHandleManagerOpenService
String ID:
API String ID: 2081471158-0
Opcode ID: d75f427d4269b4074a095e20b6992aee8a9c50a44a8838642211eed12f7f1006
Instruction ID: d966f5431f58b1e8e8a1040ed51d6d36c6386fa4cb8a5a6d1a691bcd37b23b80
Opcode Fuzzy Hash: d75f427d4269b4074a095e20b6992aee8a9c50a44a8838642211eed12f7f1006
Instruction Fuzzy Hash: FD412BB4E40309FBEB109FA1DD06BEEBBB5EB09714F504026F1187A180D27A5691CFDA

Function 0041ED60 Relevance: 9.1, APIs: 6, Instructions: 123fileCOMMON

Download Yara Rule

APIs

FindClose.KERNEL32(00427215,00000000), ref: 0041ED98
FindFirstFileA.KERNEL32(?,?,00000000), ref: 0041EDA4
FindNextFileA.KERNEL32(00427215,00000000,00000000,00427215,?,00000000), ref: 0041EE04
FindNextFileA.KERNEL32(00427215,?,?,00000000), ref: 0041EE1C
FindNextFileA.KERNEL32(00427215,00000000,00000000,00427215,?,00000000), ref: 0041EE2F
FindNextFileA.KERNEL32(00427215,?,?,00000000), ref: 0041EE48

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Find$File$Next$CloseFirst
String ID:
API String ID: 1884811643-0
Opcode ID: 917ded024f04a1d20b2547bcf4210bdae42c3ad749adaede7467fe65e373c450
Instruction ID: ad96e4fcb63cd82dd3558789ff3d09b27a196235f5bed2761d9ebd65c8ca7190
Opcode Fuzzy Hash: 917ded024f04a1d20b2547bcf4210bdae42c3ad749adaede7467fe65e373c450
Instruction Fuzzy Hash: 7031D9367007164BD730DA2AEC44BFB7394BFC4720F450A2AED6587380EB39DC898699

Function 0041F0F0 Relevance: 7.7, APIs: 5, Instructions: 213fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(?,?,00000238), ref: 0041F1CA
DeleteFileA.KERNEL32(?), ref: 0041F2EF
FindNextFileA.KERNEL32(00000000,?), ref: 0041F304
FindClose.KERNEL32(00000000), ref: 0041F313

Part of subcall function 0041F0F0: RemoveDirectoryA.KERNEL32(?), ref: 0041F2E6

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: FileFind$CloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 196174304-0
Opcode ID: 711391d98003b812d42eed3d0e1ddec31a6dd5ad9813caf543f561d3a930b72e
Instruction ID: 1acee1032b002fdb52bbb03fad87674d77a744dbe4151ab61f8aa1ae480c758c
Opcode Fuzzy Hash: 711391d98003b812d42eed3d0e1ddec31a6dd5ad9813caf543f561d3a930b72e
Instruction Fuzzy Hash: 4D51D5366046480BC7288A7898615EB77C6ABD4330F594B3EE96BC73D0EE79DD0EC244

Function 00413144 Relevance: 7.7, APIs: 5, Instructions: 184serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00413176
OpenServiceA.ADVAPI32(00000000,00000000,000F01FF), ref: 004131B9
ChangeServiceConfigA.ADVAPI32(00000000,FFFFFFFF,?,FFFFFFFF,?,?,00000000,?,?,?,?), ref: 004132DC
CloseServiceHandle.ADVAPI32(00000000), ref: 00413371
CloseServiceHandle.ADVAPI32(00000000), ref: 0041339D

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Service$CloseHandleOpen$ChangeConfigManager
String ID:
API String ID: 3054356760-0
Opcode ID: db644377e79abdd9be9e918e927d7efc3ff182ec465c3c1f43d80fd5a47fe5d8
Instruction ID: 5d138ccca7dc5e2fed9accbefca25afb24964360a2f3747d37cd2f52cb43fc07
Opcode Fuzzy Hash: db644377e79abdd9be9e918e927d7efc3ff182ec465c3c1f43d80fd5a47fe5d8
Instruction Fuzzy Hash: C55113B1F40308BBEB109FE1DC47BEE7A71AB08715F140429FB147E2C1E6BA56908B59

Function 0041293F Relevance: 7.6, APIs: 5, Instructions: 102serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00412971
OpenServiceA.ADVAPI32(00000000,00000000,?), ref: 004129EB
DeleteService.ADVAPI32(00000000), ref: 00412A24
CloseServiceHandle.ADVAPI32(00000000), ref: 00412A53
CloseServiceHandle.ADVAPI32(00000000), ref: 00412A7F

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Service$CloseHandleOpen$DeleteManager
String ID:
API String ID: 204194956-0
Opcode ID: 3ea295d18d61a2ae5ee8447a247e97d4fee846a86e5c2c975e898092f5b9e91a
Instruction ID: 039d98c5e845ccd5e404b0e5009faa0377f095f6505ee90f409a7febca9b08d5
Opcode Fuzzy Hash: 3ea295d18d61a2ae5ee8447a247e97d4fee846a86e5c2c975e898092f5b9e91a
Instruction Fuzzy Hash: 793164B0E50318BBEB10AFA0DD07BAEBA70AF09755F504525F1087A1C0D7F65690CB9A

Function 00412AB1 Relevance: 7.6, APIs: 5, Instructions: 90serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00412AE3
OpenServiceA.ADVAPI32(00000000,00000000,00000010), ref: 00412B26
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00412B69
CloseServiceHandle.ADVAPI32(00000000), ref: 00412B98
CloseServiceHandle.ADVAPI32(00000000), ref: 00412BC4

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Service$CloseHandleOpen$ManagerStart
String ID:
API String ID: 1485051382-0
Opcode ID: 164bce5bd3f2ab7e2ab7344646ea41feef0e83033111e0f51b5f123f3b186197
Instruction ID: c419527cc32dc670f81d4b3eabbe502063bcccf4ab688d524b2e5d9bc5a81641
Opcode Fuzzy Hash: 164bce5bd3f2ab7e2ab7344646ea41feef0e83033111e0f51b5f123f3b186197
Instruction Fuzzy Hash: A23154B0E44318FBDB10AFA0DE06BAEBB70BB15711F404565F1087A180D3F55690DB8A

Function 0041273E Relevance: 6.1, APIs: 4, Instructions: 144serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 004127B1
CreateServiceA.ADVAPI32(00000000,?,?,000F01FF,?,?,00000001,?,?,00000000,?,?,?), ref: 00412876
CloseServiceHandle.ADVAPI32(00000000), ref: 004128D8
CloseServiceHandle.ADVAPI32(00000000), ref: 00412904

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Service$CloseHandle$CreateManagerOpen
String ID:
API String ID: 2424488607-0
Opcode ID: c868a48e8b212fb6cb22ebf6af8e257dae8eae602bff4664bf60759b469feb62
Instruction ID: d37e1ec0abe70d318c0b3283ed2463257440cc5871af0e23dfa59697d30af1d2
Opcode Fuzzy Hash: c868a48e8b212fb6cb22ebf6af8e257dae8eae602bff4664bf60759b469feb62
Instruction Fuzzy Hash: 87515E74A40308FBEF01AFA0CD46BDD7BB0EB08314F004165FA04AA291D3B996A0DF5A

Function 0040C4BD Relevance: 6.1, APIs: 4, Instructions: 63clipboardCOMMON

Download Yara Rule

APIs

Part of subcall function 0040C58F: GetForegroundWindow.USER32(?,0040C4D7), ref: 0040C59D

OpenClipboard.USER32(00000000), ref: 0040C4E2
EmptyClipboard.USER32 ref: 0040C50B
SetClipboardData.USER32(00000001,00000000), ref: 0040C53C
CloseClipboard.USER32 ref: 0040C565

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Clipboard$CloseDataEmptyForegroundOpenWindow
String ID:
API String ID: 966817184-0
Opcode ID: 400ae1d6691e17c590632a2f7301a88ddc79b70a7320605893bfa61937bf2811
Instruction ID: 04ae6674d39151ea3cf62d6cc84d2764affccc56d5f6ef855ccad9c4cbf4885e
Opcode Fuzzy Hash: 400ae1d6691e17c590632a2f7301a88ddc79b70a7320605893bfa61937bf2811
Instruction Fuzzy Hash: 221160B4F44305FBD710AFB09D877AEBB709B0A711F140566F1047A1C0E67A4691CAEB

Function 00407847 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 349COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsA.KERNEL32(000000FF,00000000), ref: 004078D5

Strings

lsB, xrefs: 00407AE0
Tu@, xrefs: 00407BCB, 004079E1, 00407A2A, 00407A4F, 004079E4, 00407A0C, 00407A57, 00407BCE, 00407BF6

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: DriveLogicalStrings
String ID: Tu@$lsB
API String ID: 2022863570-3149387333
Opcode ID: f3db82a1468e89b369cd0fbac6f4ab6015ff97eee58a91c44ae64b94107eefba
Instruction ID: 3657416d358bebbe956b90e73c44ddc075ec5669e343080fac8f69a10030e6b8
Opcode Fuzzy Hash: f3db82a1468e89b369cd0fbac6f4ab6015ff97eee58a91c44ae64b94107eefba
Instruction Fuzzy Hash: A3B177F1F442059BFB10DAA5DCC2BAF77A4AB18314F14007AFA05FB381E679B9418766

Function 0040CC61 Relevance: 4.6, APIs: 3, Instructions: 54COMMON

Download Yara Rule

APIs

UnhookWindowsHookEx.USER32(00000001), ref: 0040CC82
GetModuleHandleA.KERNEL32(00000000,00000001,00428369,00000000,00000001,?,?,?,?,?,?,?,004074F2), ref: 0040CCB8
SetWindowsHookExA.USER32(0000000D,0040D0C3,?,00000000), ref: 0040CCF6

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: HookWindows$HandleModuleUnhook
String ID:
API String ID: 2342532310-0
Opcode ID: 34bef85b858209d2df508877841a6b0ca48c12d33b7d6e47fa45a94c2fe87ce8
Instruction ID: 6b9dcc124f61c24f57be2f8160a3bf868d36f1be011d844814069cf48eaf98a5
Opcode Fuzzy Hash: 34bef85b858209d2df508877841a6b0ca48c12d33b7d6e47fa45a94c2fe87ce8
Instruction Fuzzy Hash: 77113070F41304FBDB20AFA1DD47B5D7F60AB05752F408076B5087A2C0E67556558B5E

Function 0041D770 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 0041D794

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 1e853dcc142a15417ed2cd3a366cffb36dc4392bc6ff73f515553900f4d36c4c
Instruction ID: b7a4a6691a933674b88ca7f1c71783d1db5be2b6e7a82cfd0e8015f97230eea8
Opcode Fuzzy Hash: 1e853dcc142a15417ed2cd3a366cffb36dc4392bc6ff73f515553900f4d36c4c
Instruction Fuzzy Hash: 4CF09A72B0021513E730962CEC44BEBF6D8AB84764F840477E668C63A1E4BCC98B41C9

Function 004022EE Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

Part of subcall function 0041DDB0: atoi.MSVCRT(00000000,?,?,?,?,?,?,?,?,0040129B), ref: 0041DE0E

SetUnhandledExceptionFilter.KERNEL32(0040129B,?,?,?,?,?,0040129B), ref: 00402320

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterUnhandledatoi
String ID:
API String ID: 933777754-0
Opcode ID: 230f3f92d9c43d47110aa254d022de2ea088d1a7619c68ccd226d4e073199041
Instruction ID: 04ae530a847475eff96767bc9a1e2dd5d8b20e6ef1a8c8163a74b9ab1aa2a258
Opcode Fuzzy Hash: 230f3f92d9c43d47110aa254d022de2ea088d1a7619c68ccd226d4e073199041
Instruction Fuzzy Hash: 2CE0D170F4030877E7207BB05D0775D7570D709704F5040B6FD08761C2F5BA15705686

Function 0040234C Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040237A

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f677855d1097d3613b21265ecf61b2c28aedaee6bcc8536797688086a6588716
Instruction ID: df066e8cd697ec556d6108b01e61d2e1ff00c8a05c6ea3c05dcc0923910c508d
Opcode Fuzzy Hash: f677855d1097d3613b21265ecf61b2c28aedaee6bcc8536797688086a6588716
Instruction Fuzzy Hash: 57F0A730E00308EBC700DF64C54AB5DBBB0AB09314F5081B5E9083B2D1D7755A549B46

Function 0041F4D1 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT ref: 0041F4F6

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 303f045bfc0c2ae6b86ad52fbbb755a0cd18b7bfbd1532dd55bc2328e09c1aa0
Instruction ID: 2b6d51ac89fbd29d0fc9763b6739cc7864ae4cdb6912552dceabd16ac0ac9e90
Opcode Fuzzy Hash: 303f045bfc0c2ae6b86ad52fbbb755a0cd18b7bfbd1532dd55bc2328e09c1aa0
Instruction Fuzzy Hash: A4D095F2A4013111D2141D187C062D791F44F53314F04C12FFC4593303D6BCCC8641AE

Function 004216A0 Relevance: .9, Instructions: 903COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7588268db9ad160e2392b48f534035be178d540a008719f74208fe9ed0531eb1
Instruction ID: 54362848167c92106cd00076080ec324b07bc3959eb0f6e1c4a065c9153a5406
Opcode Fuzzy Hash: 7588268db9ad160e2392b48f534035be178d540a008719f74208fe9ed0531eb1
Instruction Fuzzy Hash: 9E52BA767447095BD308CE9ACC9195AF3D3ABC8304F488A3CE955C3346EEB8ED0AC655

Function 00423D60 Relevance: .4, Instructions: 379COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4bfdb248b3fb90f8076a3fe4a1e75f7bd1b50aa5aafde52d762773f77742459
Instruction ID: 4b568d269aab9b0e76e9530bc0a1acc43a46e1789187a42d234e6212c70c24db
Opcode Fuzzy Hash: d4bfdb248b3fb90f8076a3fe4a1e75f7bd1b50aa5aafde52d762773f77742459
Instruction Fuzzy Hash: 0DF1AD7260C2508FC3098F18E5989E27BE2FFA8754B1F42FAD4499B363D7369841CB95

Function 004242E0 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87f601182351ec405340d45de598d1bcb3d2e6f5ef99c7e9ad81858a078b48d8
Instruction ID: 8fcc366b03b2536323ed915c9daf8bb1b8b96d6c955aad2d3cef2826cc15a6a5
Opcode Fuzzy Hash: 87f601182351ec405340d45de598d1bcb3d2e6f5ef99c7e9ad81858a078b48d8
Instruction Fuzzy Hash: 7CD189752082518FC319CF18E5D88E67BE1FFA8740B4E42F9C98A9B323D7369841CB55

Function 00422F90 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b4f27dd10139f30faea009d98bf7d04ad43b169fe1efa635cf320682f8d45aa
Instruction ID: d39377a01c0441ebbdc4ce8508775ee24cbcf2fc997e1980600f0b2fd97afc4c
Opcode Fuzzy Hash: 0b4f27dd10139f30faea009d98bf7d04ad43b169fe1efa635cf320682f8d45aa
Instruction Fuzzy Hash: 2B314D3374559203F71DCE2F9CA12BAEAD34FC522872ED57E99C58731AECBA84164144

Function 00420290 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38ad12cb99c612f196e1196b4ea8d84d44f96c79e3dc8fddb13796f1c251f6a1
Instruction ID: 12a374f1bc605c3aed030f542aaab06e71a69c542a5848dcb82fe218c4589d0c
Opcode Fuzzy Hash: 38ad12cb99c612f196e1196b4ea8d84d44f96c79e3dc8fddb13796f1c251f6a1
Instruction Fuzzy Hash: 5DE04F71B052089BD730CF49FA41755B7E8EB08304F9081A9FC0CD3B50E77A9D20D659

Function 0041F960 Relevance: 37.2, APIs: 18, Strings: 3, Instructions: 426
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,0042A7A8,00000104), ref: 0041F9DE
strrchr.MSVCRT ref: 0041F9EF
_ftol.MSVCRT ref: 0041FB2E
GetCommandLineA.KERNEL32 ref: 0041FB54
PeekMessageA.USER32(00000000,00000000,00000000,00000000,00000000), ref: 0041FBC1
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0041FBF3
TranslateMessage.USER32(?), ref: 0041FBFA
DispatchMessageA.USER32(?), ref: 0041FC01
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 0041FC10
wsprintfA.USER32 ref: 0041FE53
MessageBoxA.USER32(00000000,?,__DECRAGE,00000010), ref: 0041FE6A

Strings

ERROR, xrefs: 0041FDF0
__DECRAGE, xrefs: 0041FE62
__DECRAGE RunTime Error:%s, xrefs: 0041FDD8

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Message$Peek$CommandDispatchFileLineModuleNameTranslate_ftolstrrchrwsprintf
String ID: ERROR$__DECRAGE$__DECRAGE RunTime Error:%s
API String ID: 3335176381-317446693
Opcode ID: cbe8d85ad00e6cf5e0541d13967d598fff44645ca9c62754c845d3fd3f8db211
Instruction ID: b9a0292a464c7728a53c27a18fc02aacd0e3cc7baf5afde0424a36f5e687e662
Opcode Fuzzy Hash: cbe8d85ad00e6cf5e0541d13967d598fff44645ca9c62754c845d3fd3f8db211
Instruction Fuzzy Hash: 78C1087778060457D3349268FC45BFBB780D7D0332F54013BEA05CA2E1D96F959E8AAA

Function 00413C55 Relevance: 35.4, APIs: 9, Strings: 11, Instructions: 396
servicememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 00413CC0
OpenServiceA.ADVAPI32(00000000,00000000,00000001), ref: 00413D03
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 00413D4A
GlobalAlloc.KERNEL32(00000040,00000000), ref: 00413D7B
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 00413DB4
RtlMoveMemory.KERNEL32(?,00000000,00000024), ref: 00413DF5
GlobalFree.KERNEL32(00000000), ref: 004140A4
CloseServiceHandle.ADVAPI32(00000000), ref: 004140D0
CloseServiceHandle.ADVAPI32(00000000), ref: 004140FC

Strings

lsB, xrefs: 00414027
lsB, xrefs: 00413EE9
lsB, xrefs: 00413F7E
jxB, xrefs: 00413F1E
lsB, xrefs: 0041403B
localservice, xrefs: 00413E9B
Networkservice, xrefs: 00413F44
localsystem, xrefs: 00413FED
lsB, xrefs: 00413F92
lsB, xrefs: 00413E51
lsB, xrefs: 00413ED5

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Service$CloseConfigGlobalHandleOpenQuery$AllocFreeManagerMemoryMove
String ID: Networkservice$jxB$localservice$localsystem$lsB$lsB$lsB$lsB$lsB$lsB$lsB
API String ID: 4257998133-2882072413
Opcode ID: 33f328f9c2c589488ef73c572b1a7f40f5a5743660b9a337727a65d3d12e68e4
Instruction ID: 45e3e4d6d669a4013059d0d1e65790fbf0c8567184e8898e449864238793c891
Opcode Fuzzy Hash: 33f328f9c2c589488ef73c572b1a7f40f5a5743660b9a337727a65d3d12e68e4
Instruction Fuzzy Hash: 96D167F0F40304ABEB10DFA59D46BEE7AB4AB1C715F14003AF704BA281E67A5991C76D

Function 0040E413 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 287
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyA.ADVAPI32(80000005,?,00000000), ref: 0040E6B7
RegOpenKeyA.ADVAPI32(80000005,?,00000000), ref: 0040E783

Strings

lsB, xrefs: 0040E46D
HKEY_LOCAL_MACHINE, xrefs: 0040E578
lsB, xrefs: 0040E68D
lsB, xrefs: 0040E4FB
lsB, xrefs: 0040E709
lsB, xrefs: 0040E4BA
HKEY_USERS, xrefs: 0040E59D
HKEY_CLASSES_ROOT, xrefs: 0040E52E
lsB, xrefs: 0040E63D
HKEY_CURRENT_CONFIG, xrefs: 0040E5D5
lsB, xrefs: 0040E5E8
lsB, xrefs: 0040E759
HKEY_CURRENT_USER, xrefs: 0040E553

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CreateOpen
String ID: HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$lsB$lsB$lsB$lsB$lsB$lsB$lsB$lsB
API String ID: 436179556-2860883009
Opcode ID: fc43cd86f5aede989fb7e793da94cd99c752d4e05d626225fd8241ccf6ce965d
Instruction ID: 710e141eb6f700b791122f7aeb0678feab987eb516f0bd57223bebcb1a15418d
Opcode Fuzzy Hash: fc43cd86f5aede989fb7e793da94cd99c752d4e05d626225fd8241ccf6ce965d
Instruction Fuzzy Hash: E3A165B0E00208FBEB109F96EC85B9E7B74EB18304F54487AFA05BA2C1D7795A60C759

Function 00413715 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 218
servicememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 00413779
OpenServiceA.ADVAPI32(00000000,00000000,00000001), ref: 004137BC
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 00413803
GlobalAlloc.KERNEL32(00000040,00000000), ref: 00413834
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0041386D
RtlMoveMemory.KERNEL32(?,00000000,00000024), ref: 004138AE
GlobalFree.KERNEL32(00000000), ref: 0041391C
CloseServiceHandle.ADVAPI32(00000000), ref: 00413948
CloseServiceHandle.ADVAPI32(00000000), ref: 00413974

Strings

lsB, xrefs: 004139C3

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Service$CloseConfigGlobalHandleOpenQuery$AllocFreeManagerMemoryMove
String ID: lsB
API String ID: 4257998133-575463903
Opcode ID: baa9a81697714a33ee472185fa78fb6e8f4b42d193b51c4d5ac6a7a52bdb40d5
Instruction ID: 9cd4fc2219f058a6807319d604df2ad7e8c37ebc0782109f5b0907d093eb507f
Opcode Fuzzy Hash: baa9a81697714a33ee472185fa78fb6e8f4b42d193b51c4d5ac6a7a52bdb40d5
Instruction Fuzzy Hash: 3C7157F0E50318ABEF10AFA1DC46BDEBBB4BB0D715F044125F108BA281E77A5650CB59

Function 0041FEF0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 136
librarywindowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?), ref: 0041FF02
LoadLibraryA.KERNEL32(?), ref: 0041FF17
wsprintfA.USER32 ref: 0041FF2E
MessageBoxA.USER32(00000000,?,DLL ERROR,00000010), ref: 0041FF5E
atoi.MSVCRT(?), ref: 0041FF9F
strchr.MSVCRT ref: 0041FFD9
GetProcAddress.KERNEL32(00000000,?), ref: 0041FFF7
wsprintfA.USER32 ref: 0042000F
MessageBoxA.USER32(00000000,?,DLL ERROR,00000010), ref: 00420043

Strings

DLL ERROR, xrefs: 0041FF56, 0042003B

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Messagewsprintf$AddressHandleLibraryLoadModuleProcatoistrchr
String ID: DLL ERROR
API String ID: 4054768979-4092134112
Opcode ID: 45cb0141e4792c6b2a5f9bfb8f7f53b538d3cb579e5bca1d447e80fbf86dd5d3
Instruction ID: 7e09291dcee4e6feee0f2c124e430f23e8709d101480c73ccbf591e3d81e24e4
Opcode Fuzzy Hash: 45cb0141e4792c6b2a5f9bfb8f7f53b538d3cb579e5bca1d447e80fbf86dd5d3
Instruction Fuzzy Hash: 5241C3B17043055BD320DF64AC45B9B77D8AB99710F40053AFA05C7291EBB8D94AC7AA

Function 00411F9B Relevance: 16.7, APIs: 11, Instructions: 249memoryserviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 00411FF3
OpenServiceA.ADVAPI32(00000000,00000000,00000001), ref: 00412036
QueryServiceConfig2A.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00412082
GetProcessHeap.KERNEL32 ref: 004120AB
HeapAlloc.KERNEL32(?,00000008,00000000), ref: 004120E2
QueryServiceConfig2A.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00412120
RtlMoveMemory.KERNEL32(?,00000000,00000004), ref: 0041215C
CloseServiceHandle.ADVAPI32(00000000), ref: 004121C1
GetProcessHeap.KERNEL32 ref: 004121EA
HeapFree.KERNEL32(?,00000001,00000000), ref: 00412221
CloseServiceHandle.ADVAPI32(00000000), ref: 0041224D

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Service$Heap$CloseConfig2HandleOpenProcessQuery$AllocFreeManagerMemoryMove
String ID:
API String ID: 4186248289-0
Opcode ID: d930be343fc1d2352145f4088b378296fa1fd3da912b024d67c00fd58ccc063f
Instruction ID: 8fea60fde15ca56f9dfd3a87eed5b99bdd4a033c0173b8d67cb42fad26520502
Opcode Fuzzy Hash: d930be343fc1d2352145f4088b378296fa1fd3da912b024d67c00fd58ccc063f
Instruction Fuzzy Hash: FF8189B0E40305ABEB109FB1DD47BEE7BB4AF1D715F144026F508BA180E6B94691CF99

Function 0040503F Relevance: 15.5, APIs: 10, Instructions: 474COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000400,00000000,00000000), ref: 004050A0
OpenProcessToken.ADVAPI32(00000000,00000008,00000000), ref: 0040510B
CloseHandle.KERNEL32(00000000), ref: 00405144
CloseHandle.KERNEL32(00000000), ref: 00405199
GetTokenInformation.ADVAPI32(00000000,00000001(TokenIntegrityLevel),00427215,00000000,00000000), ref: 004051E0
GetTokenInformation.ADVAPI32(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?), ref: 00405262
CloseHandle.KERNEL32(00000000), ref: 00405342
LookupAccountSidA.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?), ref: 00405421
CloseHandle.KERNEL32(00000000), ref: 00405487
LookupAccountSidA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00405588

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CloseHandle$Token$AccountInformationLookupOpenProcess
String ID:
API String ID: 3246857531-0
Opcode ID: 4826e97bec8ee2add6e74a2c8d568950118bc7a2ec02ae84824c336c32dcfa5e
Instruction ID: 70bd23ef6376a538e876860c57da62c3c1691bb19944a3be35e0a10edf687bc0
Opcode Fuzzy Hash: 4826e97bec8ee2add6e74a2c8d568950118bc7a2ec02ae84824c336c32dcfa5e
Instruction Fuzzy Hash: D3F154B1E40304BBEB109FB5DC46BEE7BB5EB08704F54442AFA04BA2C1E6BA55508F59

Function 004133CF Relevance: 13.7, APIs: 9, Instructions: 229servicememoryCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 00413433
OpenServiceA.ADVAPI32(00000000,00000000,00000001), ref: 00413476
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 004134BD
GlobalAlloc.KERNEL32(00000040,00000000), ref: 004134EE
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 00413527
RtlMoveMemory.KERNEL32(?,00000000,00000024), ref: 00413568
CloseServiceHandle.ADVAPI32(00000000), ref: 0041367D
CloseServiceHandle.ADVAPI32(00000000), ref: 004136A9
GlobalFree.KERNEL32(00000000), ref: 004136D5

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Service$CloseConfigGlobalHandleOpenQuery$AllocFreeManagerMemoryMove
String ID:
API String ID: 4257998133-0
Opcode ID: 5c46755abc53f0f6937ef81c5c0f8b88f575be1504e6d1a9e5816f1dc84591b6
Instruction ID: 57253c06b1829d0cac89d406ba40070f8e8db2bb950447ab4f3a6dbdefaa1626
Opcode Fuzzy Hash: 5c46755abc53f0f6937ef81c5c0f8b88f575be1504e6d1a9e5816f1dc84591b6
Instruction Fuzzy Hash: B88122B0E40318EBEF109FA1DC46BEEBBB1FB0D715F500126E6057A281D3795691CB9A

Function 0041009D Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 297registryCOMMON

Download Yara Rule

APIs

RegDeleteKeyA.ADVAPI32(00000000,?), ref: 00410368
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000001), ref: 004103AD

Strings

lsB, xrefs: 004100F9
lsB, xrefs: 00410342
lsB, xrefs: 004102F2
lsB, xrefs: 00410184
lsB, xrefs: 004101B9

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CloseDelete
String ID: lsB$lsB$lsB$lsB$lsB
API String ID: 453069226-3033684243
Opcode ID: 4cd1792f3af635ae6688ab1c27d5f07e59483d94f83c667ef2f2a2109d21c44b
Instruction ID: f53bd7fd5e91dcafea311144008862dcbeb99aa26837f20a0542f41e6fb9ea31
Opcode Fuzzy Hash: 4cd1792f3af635ae6688ab1c27d5f07e59483d94f83c667ef2f2a2109d21c44b
Instruction Fuzzy Hash: 4CA156B5E00204AFEB10DFA5DCC6BDE77B4EB08314F14406AFA05BB391D6799990CB59

Function 00411CB1 Relevance: 12.2, APIs: 8, Instructions: 210servicememoryCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 00411CF8
OpenServiceA.ADVAPI32(00000000,00000000,80000000), ref: 00411D3B
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 00411D82
GlobalAlloc.KERNEL32(00000040,00000000), ref: 00411DB3
QueryServiceConfigA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 00411DEC
GlobalFree.KERNEL32(00000000), ref: 00411F11
CloseServiceHandle.ADVAPI32(00000000), ref: 00411F3D
CloseServiceHandle.ADVAPI32(00000000), ref: 00411F69

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Service$CloseConfigGlobalHandleOpenQuery$AllocFreeManager
String ID:
API String ID: 1798664345-0
Opcode ID: 006de4605fcc4d9958f663af474fcaabec066cc3d20e923478c7da387a876653
Instruction ID: da7bc4fa81ba3ec4ae31789ca146e3a96fe79c0fb158ba368fb455aa88b753f5
Opcode Fuzzy Hash: 006de4605fcc4d9958f663af474fcaabec066cc3d20e923478c7da387a876653
Instruction Fuzzy Hash: DF7178B0E40309EBEB109FA1DD46BFEBAB5AF08714F10442AF6047A2D1D3795691CF99

Function 004087C5 Relevance: 10.9, APIs: 2, Strings: 5, Instructions: 406stringCOMMON

Download Yara Rule

APIs

lstrcpyn.KERNEL32(00000000,00000000,00000000), ref: 00408A7D
lstrcpyn.KERNEL32(00000000,00000000,00000000), ref: 00408AB4

Strings

lsB, xrefs: 004088FE
tB, xrefs: 004088C8
lsB, xrefs: 00408884
*.*, xrefs: 00408B55
lsB, xrefs: 004088A9

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: lstrcpyn
String ID: tB$*.*$lsB$lsB$lsB
API String ID: 97706510-3314701417
Opcode ID: b1e8de21e48bba5f0c2dd57b9478aa0ee3292e5c3db20aca176f212171ffdc1d
Instruction ID: 5a754f420145a6fd81577788ae37f5b11e9646b2a0a27a507e9b19c6d2e9a950
Opcode Fuzzy Hash: b1e8de21e48bba5f0c2dd57b9478aa0ee3292e5c3db20aca176f212171ffdc1d
Instruction Fuzzy Hash: 6CE18BB1E00305ABEF10EFA5DD82B9F7B74AB18304F14043AFA05BA3C1D6795A54CB69

Function 0041DCC0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65processsynchronizationCOMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32 ref: 0041DCD2
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,?,?), ref: 0041DD51
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0041DD6A
CloseHandle.KERNEL32(?), ref: 0041DD7B
CloseHandle.KERNEL32(?), ref: 0041DD82

Strings

D, xrefs: 0041DCCA

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CloseHandle$CreateInfoObjectProcessSingleStartupWait
String ID: D
API String ID: 2246201701-2746444292
Opcode ID: 15a13d45cebc142761f0b679e0b458df93087cfe8cf199ad142d7cc45c3d1aa2
Instruction ID: f39a994570697b277b2dea15f6fbd69238444c1e3cb0c6dd0bfa36cd58dbff02
Opcode Fuzzy Hash: 15a13d45cebc142761f0b679e0b458df93087cfe8cf199ad142d7cc45c3d1aa2
Instruction Fuzzy Hash: 692133B4908340AAC320DB19D9549ABFBF9EFC5754F60491EF15583220D779C886CB5B

Function 004122C7 Relevance: 9.1, APIs: 6, Instructions: 110servicestringCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,20000000), ref: 00412300
OpenServiceA.ADVAPI32(00000000,00000000,00000002), ref: 00412343
lstrcpyn.KERNEL32(00000000,00000000,00000000), ref: 00412388
ChangeServiceConfig2A.ADVAPI32(00000000,00000001,00000000), ref: 004123C0
CloseServiceHandle.ADVAPI32(00000000), ref: 004123EF
CloseServiceHandle.ADVAPI32(00000000), ref: 0041241B

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Service$CloseHandleOpen$ChangeConfig2Managerlstrcpyn
String ID:
API String ID: 409095021-0
Opcode ID: 9d777e54dd795d3b7530e5156c1baa2e9c6d4d66a69eec6834f9b2e48088fca7
Instruction ID: 31be62ef89ee705e37e74a1117f2f166fd7b635fb67674cc0a5839d16a7d0cbb
Opcode Fuzzy Hash: 9d777e54dd795d3b7530e5156c1baa2e9c6d4d66a69eec6834f9b2e48088fca7
Instruction Fuzzy Hash: FE4133B0E41308EBEB10DFA0DE46BAEBBB0EB09715F500065F108BA180D3B64794CBD6

Function 0040B217 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 342COMMON

Download Yara Rule

Strings

~tB, xrefs: 0040B324
lsB, xrefs: 0040B497
\Temp, xrefs: 0040B2DB

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: \Temp$lsB$~tB
API String ID: 0-1779499026
Opcode ID: 17a7e1158442f09d146097b1562e7287125354a7e0e16c91df715735c4751d1a
Instruction ID: ec8e8d675d910d9056c75b11e381e8839bc71006d1dd7cdfbbee301beabad261
Opcode Fuzzy Hash: 17a7e1158442f09d146097b1562e7287125354a7e0e16c91df715735c4751d1a
Instruction Fuzzy Hash: 32C199F1E00305ABEB10DFA5DC81B9F77B4EB18314F14407AEA05BB381E779AA458B59

Function 0040D8F8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000000,00000000), ref: 0040D995
CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000000,-00000002,0000005C,00000000,00000000,?,00000000), ref: 0040DA2E
LocalFree.KERNEL32(00000000,00000000,?,00000000), ref: 0040DAC9

Strings

\, xrefs: 0040DA5C

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Local$AllocCreateDirectoryFree
String ID: \
API String ID: 1918405509-2967466578
Opcode ID: f7eb94f50969822adbabbab712764a50521d0615248f04d9a39c33e83302fcfd
Instruction ID: f2d04f8f8c0e0eef29889bec3387c98b97d36490cf334a12081d5e47f910ac4d
Opcode Fuzzy Hash: f7eb94f50969822adbabbab712764a50521d0615248f04d9a39c33e83302fcfd
Instruction Fuzzy Hash: CF512870E04618EBEF10AFE1D94ABEEBB74FF08715F10406AE50079181DB790669CF9A

Function 004125AB Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 124serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 004125E4
GetServiceKeyNameA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 00412629
GetServiceKeyNameA.ADVAPI32(00000000,00000000,00000000,00000000), ref: 00412698
CloseServiceHandle.ADVAPI32(00000000), ref: 004126C7

Strings

lsB, xrefs: 00412716

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Service$Name$CloseHandleManagerOpen
String ID: lsB
API String ID: 36220719-575463903
Opcode ID: ba0b665d0cf7ecba8be424d9aeee8334188d356285aecd4c130a9be1de58b9db
Instruction ID: 2f04bd873d50febb61cade8d8ae62cf1554ff60371fca872734000af08fb662b
Opcode Fuzzy Hash: ba0b665d0cf7ecba8be424d9aeee8334188d356285aecd4c130a9be1de58b9db
Instruction Fuzzy Hash: 704125B1E00305ABDB10DFA0DD46BEFBBB4AB08314F14446AF504BA281E7755B50DB9A

Function 00410738 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105librarystringloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00410767
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 0041079B
lstrcpyn.KERNEL32(00000000,00000000,00000000), ref: 0041081F

Strings

GetSystemWow64DirectoryA, xrefs: 00410791
kernel32.dll, xrefs: 00410760

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: AddressHandleModuleProclstrcpyn
String ID: GetSystemWow64DirectoryA$kernel32.dll
API String ID: 2801827026-4063490227
Opcode ID: 704d4a3f04d5bdef38290923aa2c52c3d797fbd242dbf732e803af96c823ba51
Instruction ID: 96ff23f04b955fbd5adda1bc60871f7e21eb93e494b727395a1fd0730f0cde7b
Opcode Fuzzy Hash: 704d4a3f04d5bdef38290923aa2c52c3d797fbd242dbf732e803af96c823ba51
Instruction Fuzzy Hash: BC313570E41309BBEB109FE1DD46BEEBAB1AB08704F204465F5047A2C1D7FA56948B9A

Function 0041D3D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 70windowCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0041D436
wsprintfA.USER32 ref: 0041D44D
MessageBoxA.USER32(00000000,?,error,00000010), ref: 0041D497

Strings

error, xrefs: 0041D48F
program internal error number is %d. %s, xrefs: 0041D447

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: wsprintf$Message
String ID: error$program internal error number is %d. %s
API String ID: 386942524-1911117719
Opcode ID: 6b485466e68c1c31431fc4e11c01e33484ec8790351a1080e336b74f933842a7
Instruction ID: 648a536df43ba85aacb80ca773a8a97b315871d8974c80b8de164206995dd208
Opcode Fuzzy Hash: 6b485466e68c1c31431fc4e11c01e33484ec8790351a1080e336b74f933842a7
Instruction Fuzzy Hash: 8021C6B1B052109FE7349B14DC41FEB33A8EB84700F84452AF88597280D778E9848BAB

Function 0041D550 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35memorywindowCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0041D559
HeapReAlloc.KERNEL32(00770000,00000000,?,?), ref: 0041D576
HeapAlloc.KERNEL32(00770000,00000008,?), ref: 0041D586
MessageBoxA.USER32(00000000,004286B8,error,00000010), ref: 0041D59F

Strings

error, xrefs: 0041D594

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Heap$Alloc$MessageProcess
String ID: error
API String ID: 2690588855-1574812785
Opcode ID: 29edad864b118e7195ea524e5629a0942666dd6500d41d7aecc4227fabd524db
Instruction ID: ed0e98808165461b65e589532a98cc97f462e965a62b402a8d59d838da79495c
Opcode Fuzzy Hash: 29edad864b118e7195ea524e5629a0942666dd6500d41d7aecc4227fabd524db
Instruction Fuzzy Hash: C7F0F0F0B42311BFD6249B60AC09F6B336AAB40711F404029B84597250D674D8418BAE

Function 004186FB Relevance: 7.8, APIs: 5, Instructions: 282serviceCOMMON

Download Yara Rule

APIs

Part of subcall function 0041EEC0: PeekMessageA.USER32(00000000,00000000,00000000,00000000,00000000), ref: 0041EEDA
Part of subcall function 0041EEC0: GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0041EF04
Part of subcall function 0041EEC0: TranslateMessage.USER32(?), ref: 0041EF0B
Part of subcall function 0041EEC0: DispatchMessageA.USER32(?), ref: 0041EF12
Part of subcall function 0041EEC0: PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 0041EF21

CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041876B

Part of subcall function 0041F920: Sleep.KERNEL32(00000000,004186AF,00000001,?,00000000,80000301), ref: 0041F929

QueryServiceStatus.ADVAPI32(00000000,?), ref: 004186BD
GlobalFree.KERNEL32(00000000), ref: 004187A3
CloseServiceHandle.ADVAPI32(00000000), ref: 004187CF
CloseServiceHandle.ADVAPI32(00000000), ref: 004187FB

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Message$Service$CloseHandle$Peek$DispatchFreeGlobalQuerySleepStatusTranslate
String ID:
API String ID: 1939688605-0
Opcode ID: 6caaa84808d0a506d022e437a584a38f6d52c0294502b1d7a7bda84248c55ecd
Instruction ID: ca73dfe2c1b538866e0074e7452d12f25170d98dbad63869116b3933d2186997
Opcode Fuzzy Hash: 6caaa84808d0a506d022e437a584a38f6d52c0294502b1d7a7bda84248c55ecd
Instruction Fuzzy Hash: D3A1EAB1E80345ABEF00DF95ECC1B9DBBB5EF19324F280065F505AB341E679A8A1CB15

Function 0041D860 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 193COMMON

Download Yara Rule

Strings

%I64d, xrefs: 0041DA3C
%lf, xrefs: 0041DA79

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: %I64d$%lf
API String ID: 0-1545097854
Opcode ID: 3a971a702a77d6bc6ef28fb87aa63a09f46f117dda7049957c25f616c23c1f91
Instruction ID: 81e10eea4b6367879a1e497e77f4de6d87d8c1eddd76e1889a297438783ab35c
Opcode Fuzzy Hash: 3a971a702a77d6bc6ef28fb87aa63a09f46f117dda7049957c25f616c23c1f91
Instruction Fuzzy Hash: 6A51C4F1B082108BD738D7A89886AFF73959F80350F64492FFA56C2291D97DD8C6C25B

Function 004139F7 Relevance: 7.7, APIs: 5, Instructions: 171serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00413A29
OpenServiceA.ADVAPI32(00000000,00000000,000F01FF), ref: 00413A6C
ChangeServiceConfigA.ADVAPI32(00000000,FFFFFFFF,FFFFFFFF,FFFFFFFF,?,?,00000000,?,?,?,?), ref: 00413B72
CloseServiceHandle.ADVAPI32(00000000), ref: 00413BF7
CloseServiceHandle.ADVAPI32(00000000), ref: 00413C23

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Service$CloseHandleOpen$ChangeConfigManager
String ID:
API String ID: 3054356760-0
Opcode ID: ae2a958d911fb6910f8d66621cd5c19757aa819501e416f4406b3cd034f864a3
Instruction ID: 0d73acb18939f419d0de7bca10a6c753efef182e5d4f1cb2188558e5a5f4bf33
Opcode Fuzzy Hash: ae2a958d911fb6910f8d66621cd5c19757aa819501e416f4406b3cd034f864a3
Instruction Fuzzy Hash: 485158B1E40305BBEB109FA1CC47FEE7A70AB08715F140529F6147E2C2E7BA56908B99

Function 0040F8CA Relevance: 7.6, APIs: 5, Instructions: 147registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,0042736C,00000000,?,?), ref: 0040F940
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,?,?), ref: 0040F9D2
RegSetValueExA.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0040FA53
RegCloseKey.ADVAPI32(?), ref: 0040FA93
RegCloseKey.ADVAPI32(?), ref: 0040FABF

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Close$CreateOpenValue
String ID:
API String ID: 678895439-0
Opcode ID: 1bf095a2b83bb2f696e4b096cd46df36e1c8eeeead08ae1b19105774df87ebb6
Instruction ID: d0eb9f4e2faffdfab12440a585a56125f7fa7f28a1db1523c5fcfc38c919904a
Opcode Fuzzy Hash: 1bf095a2b83bb2f696e4b096cd46df36e1c8eeeead08ae1b19105774df87ebb6
Instruction Fuzzy Hash: C0512171F40319BBEF109FA0DD47BAEBA75EB09704F500036F604BA2C1D7B956548BAA

Function 0040F8D4 Relevance: 7.6, APIs: 5, Instructions: 147registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,0042736C,00000000,?,?), ref: 0040F940
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,?,?), ref: 0040F9D2
RegSetValueExA.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0040FA53
RegCloseKey.ADVAPI32(?), ref: 0040FA93
RegCloseKey.ADVAPI32(?), ref: 0040FABF

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Close$CreateOpenValue
String ID:
API String ID: 678895439-0
Opcode ID: 269fbc8aec5621ebb150b3df707e714dbce7c46f05eb1b571180c86849d7a24b
Instruction ID: 646324d4934c2635100bec865a6a3881a35f850cb5ddb1700e14bfaedbacd4ed
Opcode Fuzzy Hash: 269fbc8aec5621ebb150b3df707e714dbce7c46f05eb1b571180c86849d7a24b
Instruction Fuzzy Hash: 36513070F40319BBEB109FA0DD47BAEBA70AB09704F100036F604BA2C1D2B956548BAA

Function 0040F8DE Relevance: 7.6, APIs: 5, Instructions: 147registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,0042736C,00000000,?,?), ref: 0040F940
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,?,?), ref: 0040F9D2
RegSetValueExA.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0040FA53
RegCloseKey.ADVAPI32(?), ref: 0040FA93
RegCloseKey.ADVAPI32(?), ref: 0040FABF

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Close$CreateOpenValue
String ID:
API String ID: 678895439-0
Opcode ID: 6e557a926a73413502710d3031efd9e18c7d179b8dd052c2c3acae7e85e2f8e6
Instruction ID: 3f5158941ffe5f2423f0eaa4896d357b26fd118d3d0f80c1c892e855e7877ee2
Opcode Fuzzy Hash: 6e557a926a73413502710d3031efd9e18c7d179b8dd052c2c3acae7e85e2f8e6
Instruction Fuzzy Hash: 6E512171F40319BBEF109FA0DD47BAEBA75EB09704F500036F604BA2C1D7B956548BAA

Function 0040F8E8 Relevance: 7.6, APIs: 5, Instructions: 147registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,0042736C,00000000,?,?), ref: 0040F940
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,?,?), ref: 0040F9D2
RegSetValueExA.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0040FA53
RegCloseKey.ADVAPI32(?), ref: 0040FA93
RegCloseKey.ADVAPI32(?), ref: 0040FABF

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Close$CreateOpenValue
String ID:
API String ID: 678895439-0
Opcode ID: c9db2a3babedca06af5062497221a706c99fa6a7cfea411e848110fc344560c0
Instruction ID: 8f78e268fb974d5321c9cbb9e13ae0207ee5f58913c34f6029326ec3ff0cbf3d
Opcode Fuzzy Hash: c9db2a3babedca06af5062497221a706c99fa6a7cfea411e848110fc344560c0
Instruction Fuzzy Hash: E6512171F40319BBEF109FA0DD47BAEBA75EB09704F500036F604BA2C1D7B956548BAA

Function 0040F8F2 Relevance: 7.6, APIs: 5, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,0042736C,00000000,?,?), ref: 0040F940
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,?,?), ref: 0040F9D2
RegSetValueExA.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0040FA53
RegCloseKey.ADVAPI32(?), ref: 0040FA93
RegCloseKey.ADVAPI32(?), ref: 0040FABF

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Close$CreateOpenValue
String ID:
API String ID: 678895439-0
Opcode ID: 057f20f6d6c201fc2d89a57894e58dd9152a98078a69896bfcddce6f90137d26
Instruction ID: 53353d584d65fb0f1a6353128fb28f5b7868167c468068f77fed1fe345181964
Opcode Fuzzy Hash: 057f20f6d6c201fc2d89a57894e58dd9152a98078a69896bfcddce6f90137d26
Instruction Fuzzy Hash: A4510071F40319BBEF109FA0DD47BAEBA75EB09704F500036F604BA2C1D6B95A548BA9

Function 00411B32 Relevance: 7.6, APIs: 5, Instructions: 111serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 00411B81
OpenServiceA.ADVAPI32(00000000,?,80000000), ref: 00411BC4
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411C00
CloseServiceHandle.ADVAPI32(00000000), ref: 00411C45
CloseServiceHandle.ADVAPI32(00000000), ref: 00411C71

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Service$CloseHandleOpen$ManagerQueryStatus
String ID:
API String ID: 2623946379-0
Opcode ID: 5ef4fd2ca5d7921638ad9d1d0ec238af2e254111a1832d1aa53e1090cee47b51
Instruction ID: fa3e4b6cf9f418752d8c85b436096e59abe3a2af06749a719dbbb70c62cd1f81
Opcode Fuzzy Hash: 5ef4fd2ca5d7921638ad9d1d0ec238af2e254111a1832d1aa53e1090cee47b51
Instruction Fuzzy Hash: 00316AB0E40308EBDB10EFA1DE46BEEBBB0AB09315F500065F1087A290E3755750CB96

Function 00412D64 Relevance: 7.6, APIs: 5, Instructions: 105serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00412DB3
OpenServiceA.ADVAPI32(00000000,00000000,000F01FF), ref: 00412DF6
ControlService.ADVAPI32(00000000,00000002,?), ref: 00412E37
CloseServiceHandle.ADVAPI32(00000000), ref: 00412E66
CloseServiceHandle.ADVAPI32(00000000), ref: 00412E92

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Service$CloseHandleOpen$ControlManager
String ID:
API String ID: 2705437689-0
Opcode ID: 6e992b1ff6c578b9849eb012ed72067ff3faa0a46adf6b86f0aa85abb9a80a2b
Instruction ID: 3e5cf29cc7b7ffc56edb174b2bb782768967ad5f38be94f3ef437054126918eb
Opcode Fuzzy Hash: 6e992b1ff6c578b9849eb012ed72067ff3faa0a46adf6b86f0aa85abb9a80a2b
Instruction Fuzzy Hash: B23158B0E40308EBDB10DFA1DD06BEEBBB0AB09715F544025F104BA281E6B65754CB9A

Function 00412ED2 Relevance: 7.6, APIs: 5, Instructions: 105serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00412F21
OpenServiceA.ADVAPI32(00000000,00000000,000F01FF), ref: 00412F64
ControlService.ADVAPI32(00000000,00000003,?), ref: 00412FA5
CloseServiceHandle.ADVAPI32(00000000), ref: 00412FD4
CloseServiceHandle.ADVAPI32(00000000), ref: 00413000

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Service$CloseHandleOpen$ControlManager
String ID:
API String ID: 2705437689-0
Opcode ID: f8d55d3b780a3b6239360acbaf44f4e5782805e430ea95a91016e4b79906b6c5
Instruction ID: 230e3ebe1dec3a3712defd8f6d79e14248aa23317c2b83da941c068c596bc69a
Opcode Fuzzy Hash: f8d55d3b780a3b6239360acbaf44f4e5782805e430ea95a91016e4b79906b6c5
Instruction Fuzzy Hash: EF3156B0E40308EBDF10EFB1DD46BAEBBB1AB0D715F540025F108BA280E6B64755DB96

Function 00412BF6 Relevance: 7.6, APIs: 5, Instructions: 105serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,00000001), ref: 00412C45
OpenServiceA.ADVAPI32(00000000,00000000,00000020), ref: 00412C88
ControlService.ADVAPI32(00000000,00000001,?), ref: 00412CC9
CloseServiceHandle.ADVAPI32(00000000), ref: 00412CF8
CloseServiceHandle.ADVAPI32(00000000), ref: 00412D24

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Service$CloseHandleOpen$ControlManager
String ID:
API String ID: 2705437689-0
Opcode ID: f31fb0f5c9d6e38541cf473a3a199fc1bb1fd37cf5b33103085c8e7895104e08
Instruction ID: c804d830310df2eb7525c10f65053febca7c7e56bd80e3585a7881df419b08eb
Opcode Fuzzy Hash: f31fb0f5c9d6e38541cf473a3a199fc1bb1fd37cf5b33103085c8e7895104e08
Instruction Fuzzy Hash: 7A3158B0E41304FBEB10EFB0DE06BEEBAB0AB09715F544025F108BA180E6B55755CB96

Function 0041EEC0 Relevance: 7.5, APIs: 5, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(00000000,00000000,00000000,00000000,00000000), ref: 0041EEDA
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0041EF04
TranslateMessage.USER32(?), ref: 0041EF0B
DispatchMessageA.USER32(?), ref: 0041EF12
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 0041EF21

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Message$Peek$DispatchTranslate
String ID:
API String ID: 1795658109-0
Opcode ID: 2e60e13271cb28fb52f4422e45d2fbf32f24b92e8ec2961e527cb2d4e681aad0
Instruction ID: df9e9a7742128004fe1217001b003d9dd65b5148cdc7da8e54c9383c6b48d807
Opcode Fuzzy Hash: 2e60e13271cb28fb52f4422e45d2fbf32f24b92e8ec2961e527cb2d4e681aad0
Instruction Fuzzy Hash: 12018176340305B6E230DB55AC42FA77758EB84B50F940859FB00AA1D0D7B4F949CB7E

Function 00404590 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 411libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 004045BF
GetProcAddress.KERNEL32(?), ref: 004045F4

Part of subcall function 00405004: GetCurrentProcessId.KERNEL32(?,004049A4,?,?,00000000,00000000), ref: 00405012

Part of subcall function 0040503F: OpenProcess.KERNEL32(00000400,00000000,00000000), ref: 004050A0

Part of subcall function 0040266C: OpenEventA.KERNEL32(001F0003,00000000,004012C3,?,004012C3), ref: 00402690

Part of subcall function 00405AB1: CloseHandle.KERNEL32(?,00000000), ref: 00405AC2

Part of subcall function 0041DB10: GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 0041DB22

Part of subcall function 0041DBA0: GetModuleFileNameA.KERNEL32(00000000,00000000,00000104,00000000,00427215), ref: 0041DBB8

Strings

/_, xrefs: 0040487D, 00404A7A
_DECRAGE, xrefs: 004048DB

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: FileModuleNameOpenProcess$AddressCloseCurrentEventHandleLibraryLoadProc
String ID: /_$_DECRAGE
API String ID: 207943232-886320553
Opcode ID: 68a85c76b623431e2eb920f985d00bebbcacad90e5c6ae0139dfd9bc019b5cbf
Instruction ID: fbda0af1fb73edac255e97afbd74dfd3a109a528f02437e51a89ac438be340f2
Opcode Fuzzy Hash: 68a85c76b623431e2eb920f985d00bebbcacad90e5c6ae0139dfd9bc019b5cbf
Instruction Fuzzy Hash: 4BE157F1E40205ABEF10DFE5DC86B9E76B4AB48304F14003AF605BA2D1E77E9A54CB59

Function 0041244D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 0041247F
GetServiceDisplayNameA.ADVAPI32(00000000,00000000,00000000,?), ref: 00412505
CloseServiceHandle.ADVAPI32(00000000), ref: 00412534

Strings

lsB, xrefs: 00412583

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Service$CloseDisplayHandleManagerNameOpen
String ID: lsB
API String ID: 2066901978-575463903
Opcode ID: e2d2f0e3330092bce66ec5e53fd09d1382f175141e7713ed22fe1d2d21b21ee4
Instruction ID: 6eb7a9b0a31ed17860fbbbbe8981b14f03aa2c6c69103397c6523548cc881aaf
Opcode Fuzzy Hash: e2d2f0e3330092bce66ec5e53fd09d1382f175141e7713ed22fe1d2d21b21ee4
Instruction Fuzzy Hash: 893187B0E40305BBEB10DFA5DD86BEE7BB5AB08304F14442AB504FA281E7B956909B95

Function 00407D9F Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

GetTempFileNameA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00407D27,00000000), ref: 00407E20

Strings

lsB, xrefs: 00407E61
lsB, xrefs: 00407EB8

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: FileNameTemp
String ID: lsB$lsB
API String ID: 745986568-2359463181
Opcode ID: 840abbd33ab442680bd9a5ffa0eaf8b5fbe51ce441632e1bbc48a26e5dbcdb70
Instruction ID: 3e6ac1e7b1449a20cb5b1353218be54249fd34c2b3bda9f25f32ec11d1e4b275
Opcode Fuzzy Hash: 840abbd33ab442680bd9a5ffa0eaf8b5fbe51ce441632e1bbc48a26e5dbcdb70
Instruction Fuzzy Hash: 8B318971E05304BBDB10EBB5DC82B9E7AB4AB08704F1044B7F604BA2C1E7796E51979B

Function 0041D4B0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25memorywindowCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(0041DF96,00000009,00427380,00402849,00000001,00000001,00000000,80000301), ref: 0041D4B9
HeapAlloc.KERNEL32(00770000,00000008,80000301,00000001,0041DF96,00000009,00427380,00402849,00000001,00000001,00000000,80000301), ref: 0041D4CD
MessageBoxA.USER32(00000000,004286B8,error,00000010), ref: 0041D4E6

Strings

error, xrefs: 0041D4DB

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Heap$AllocMessageProcess
String ID: error
API String ID: 445856604-1574812785
Opcode ID: 737695422d5f27857d6fbbd75782ed6959f042faddec39610d2186c9edb7dfbb
Instruction ID: 40104aaf607790664e3319b82313945d75a267dfa5a28ba82e2e6397f323c779
Opcode Fuzzy Hash: 737695422d5f27857d6fbbd75782ed6959f042faddec39610d2186c9edb7dfbb
Instruction Fuzzy Hash: D8E0D8F1F42621BBC7319B64BC0EB8B36549B14751F400125FC48D6290EA74B8518B9E

Function 0040EA0C Relevance: 6.5, APIs: 4, Instructions: 497registryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyA.ADVAPI32(00000000,00000000,?,00000000,?,?,?,00000000,?,?,?,?), ref: 0040EBFD
RegEnumValueA.ADVAPI32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 0040ECF2
RegEnumValueA.ADVAPI32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 0040ED97
RegCloseKey.ADVAPI32(00000000), ref: 0040EF63

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: EnumValue$CloseInfoQuery
String ID:
API String ID: 224134890-0
Opcode ID: b83207134ca14e74ff92c32bca48c519340684260298d857a002d84f023e7483
Instruction ID: 491efff5f5bc72e0bc503df9bfc9940f632accf3de78d68c4fd59f9487483a2f
Opcode Fuzzy Hash: b83207134ca14e74ff92c32bca48c519340684260298d857a002d84f023e7483
Instruction Fuzzy Hash: EB021CB1E00209ABEB10DFA5DC81BDEBBB4EF1C314F14442AF905FB381E67999518B65

Function 0040638C Relevance: 6.4, APIs: 4, Instructions: 418processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004063FE
Process32Next.KERNEL32(000000FF,00000000), ref: 004064D1
Process32Next.KERNEL32(000000FF,00000000), ref: 004066A9
CloseHandle.KERNEL32(000000FF), ref: 00406793

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: NextProcess32$CloseCreateHandleSnapshotToolhelp32
String ID:
API String ID: 1175704045-0
Opcode ID: f9d755127ff500c180dee6e73056acb34731a3536204ff9d8cd9dbbf11dd24f1
Instruction ID: 422f10df47fcb628e5dfd326baa38512c8b29815af5738e5010f05facaa8e461
Opcode Fuzzy Hash: f9d755127ff500c180dee6e73056acb34731a3536204ff9d8cd9dbbf11dd24f1
Instruction Fuzzy Hash: 8BD130F1A412429BEB00CFA8DCC179977E1EF59328F290475E50AAB344D379B961CB62

Function 0041BC7C Relevance: 6.3, APIs: 4, Instructions: 308COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0041BFFB
ReadProcessMemory.KERNEL32(?,0041A65D,00000000,00000000), ref: 0041C09D
GetCurrentProcess.KERNEL32(?,00000000), ref: 0041C1FD
ReadProcessMemory.KERNEL32(?,00000000,00000000,?,00000000), ref: 0041C29F

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Process$CurrentMemoryRead
String ID:
API String ID: 267060218-0
Opcode ID: 05cfc3698fe057f348d9ef71ba50c8a66f0e7524ab12dd3d990a348de33ae3dd
Instruction ID: ad37ff29608794651f4f61ea742610cc2a33874278e38a75aa1e7cecb4d3956e
Opcode Fuzzy Hash: 05cfc3698fe057f348d9ef71ba50c8a66f0e7524ab12dd3d990a348de33ae3dd
Instruction Fuzzy Hash: 25B14EF1A802569BEF00CFA9DCC1B99B7B0EF19324F280475E509AB341D378B951DB66

Function 0041BD59 Relevance: 6.3, APIs: 4, Instructions: 308COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0041BFFB
ReadProcessMemory.KERNEL32(?,0041A65D,00000000,00000000), ref: 0041C09D
GetCurrentProcess.KERNEL32(?,00000000), ref: 0041C1FD
ReadProcessMemory.KERNEL32(?,00000000,00000000,?,00000000), ref: 0041C29F

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Process$CurrentMemoryRead
String ID:
API String ID: 267060218-0
Opcode ID: 265d04004f5d25bdf573eb173e32726ecf7da5b77d6b630963886ceb210896a8
Instruction ID: ad37ff29608794651f4f61ea742610cc2a33874278e38a75aa1e7cecb4d3956e
Opcode Fuzzy Hash: 265d04004f5d25bdf573eb173e32726ecf7da5b77d6b630963886ceb210896a8
Instruction Fuzzy Hash: 25B14EF1A802569BEF00CFA9DCC1B99B7B0EF19324F280475E509AB341D378B951DB66

Function 0041BE36 Relevance: 6.3, APIs: 4, Instructions: 308COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0041BFFB
ReadProcessMemory.KERNEL32(?,0041A65D,00000000,00000000), ref: 0041C09D
GetCurrentProcess.KERNEL32(?,00000000), ref: 0041C1FD
ReadProcessMemory.KERNEL32(?,00000000,00000000,?,00000000), ref: 0041C29F

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Process$CurrentMemoryRead
String ID:
API String ID: 267060218-0
Opcode ID: 315a26820c56f28bf4b2268d0a630baad76602b963ff17a5bd4afb9885dae097
Instruction ID: ad37ff29608794651f4f61ea742610cc2a33874278e38a75aa1e7cecb4d3956e
Opcode Fuzzy Hash: 315a26820c56f28bf4b2268d0a630baad76602b963ff17a5bd4afb9885dae097
Instruction Fuzzy Hash: 25B14EF1A802569BEF00CFA9DCC1B99B7B0EF19324F280475E509AB341D378B951DB66

Function 0041BF16 Relevance: 6.3, APIs: 4, Instructions: 308COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0041BFFB
ReadProcessMemory.KERNEL32(?,0041A65D,00000000,00000000), ref: 0041C09D
GetCurrentProcess.KERNEL32(?,00000000), ref: 0041C1FD
ReadProcessMemory.KERNEL32(?,00000000,00000000,?,00000000), ref: 0041C29F

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Process$CurrentMemoryRead
String ID:
API String ID: 267060218-0
Opcode ID: 28078a498a47341dd9318380c77145f92fd3c335cb5db8b0f0b6f99762003c72
Instruction ID: ad37ff29608794651f4f61ea742610cc2a33874278e38a75aa1e7cecb4d3956e
Opcode Fuzzy Hash: 28078a498a47341dd9318380c77145f92fd3c335cb5db8b0f0b6f99762003c72
Instruction Fuzzy Hash: 25B14EF1A802569BEF00CFA9DCC1B99B7B0EF19324F280475E509AB341D378B951DB66

Function 0041BB9F Relevance: 6.3, APIs: 4, Instructions: 308COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0041BFFB
ReadProcessMemory.KERNEL32(?,0041A65D,00000000,00000000), ref: 0041C09D
GetCurrentProcess.KERNEL32(?,00000000), ref: 0041C1FD
ReadProcessMemory.KERNEL32(?,00000000,00000000,?,00000000), ref: 0041C29F

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Process$CurrentMemoryRead
String ID:
API String ID: 267060218-0
Opcode ID: e20760fa600bc6fb462b48d55136f0bf98047d50d0540a0f2df811f4ef6de151
Instruction ID: ad37ff29608794651f4f61ea742610cc2a33874278e38a75aa1e7cecb4d3956e
Opcode Fuzzy Hash: e20760fa600bc6fb462b48d55136f0bf98047d50d0540a0f2df811f4ef6de151
Instruction Fuzzy Hash: 25B14EF1A802569BEF00CFA9DCC1B99B7B0EF19324F280475E509AB341D378B951DB66

Function 0040D646 Relevance: 6.2, APIs: 4, Instructions: 155libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0040D65F
GetProcAddress.KERNEL32(?), ref: 0040D694
LoadLibraryA.KERNEL32(?,00000013,00000001,00000001,00000001,00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040D773
GetProcAddress.KERNEL32(?), ref: 0040D7A8

Part of subcall function 00404B1B: IsBadCodePtr.KERNEL32(00000000), ref: 00404B2C

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: AddressLibraryLoadProc$Code
String ID:
API String ID: 3251064535-0
Opcode ID: 584a99becaa769af7753d35085d7f8927d921500dfa81f3fa53440b0cab8bfaf
Instruction ID: 23022ddeeb7f54d09aab1668498806af0ab9741bd49eef725d6af1dd8eef1c5c
Opcode Fuzzy Hash: 584a99becaa769af7753d35085d7f8927d921500dfa81f3fa53440b0cab8bfaf
Instruction Fuzzy Hash: F95194B4E41308BBEF219F90DD46BDDBEB1BB08B14F604059F6043A2E0C3BA25559F59

Function 00404392 Relevance: 6.1, APIs: 4, Instructions: 145registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000), ref: 0040442C
RegCreateKeyExW.ADVAPI32(00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00404492

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CreateOpen
String ID:
API String ID: 436179556-0
Opcode ID: 99dc5a138dbeb3e56d316a0118553b8359c471d4353ee3e014bc5f71151856e1
Instruction ID: a820d938e3ceb1813da909b43a739ef35b03fc955e93d9588feafc7ac8b2f1cc
Opcode Fuzzy Hash: 99dc5a138dbeb3e56d316a0118553b8359c471d4353ee3e014bc5f71151856e1
Instruction Fuzzy Hash: 315165B4E40308FBEF109F90DC46BAE7BB4EB45715F144466FA04BA2C1D3B99A50CB95

Function 004072DC Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 004072F1
CreateIoCompletionPort.KERNEL32(?,00000000,00000000,00000000), ref: 0040732F
GetQueuedCompletionStatus.KERNEL32(00000000,?,?,?,?), ref: 0040738F
CloseHandle.KERNEL32(00000000), ref: 004073BB

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Completion$CloseCreateCurrentHandlePortProcessQueuedStatus
String ID:
API String ID: 345563290-0
Opcode ID: 06a3baee19f52e27edd5011469fefa0f183d07c4b307431e84b0c1855a847ce0
Instruction ID: dcd28198e68ad4238ffcf64221127fecb3f101b567b2f3aad2bbbdbce24bb8e3
Opcode Fuzzy Hash: 06a3baee19f52e27edd5011469fefa0f183d07c4b307431e84b0c1855a847ce0
Instruction Fuzzy Hash: CF213070E44308ABEB10AFA4DD067AEBB75EB09710F104476B904BA2C0E7795650DF9A

Function 00420970 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 004209D0
LCMapStringA.KERNEL32(00000804,00400000,?,?,00000000,00000001), ref: 00420A04
free.MSVCRT ref: 00420A13
free.MSVCRT ref: 00420A2C

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: free$Stringmalloc
String ID:
API String ID: 3576809655-0
Opcode ID: 7349006d07cb3dcae48f1f3ce1cc57c630e216b3cd826b13ca2648b0de6d3310
Instruction ID: 0cad1afd77b23511b22d69e86288af611add931931e56c7f5532adab5a02c5d7
Opcode Fuzzy Hash: 7349006d07cb3dcae48f1f3ce1cc57c630e216b3cd826b13ca2648b0de6d3310
Instruction Fuzzy Hash: 211102F23023242FD2149B65AC42E7B72DCDBD8604F90452EF60292202DE78E94587AE

Function 00413040 Relevance: 6.1, APIs: 4, Instructions: 73serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 0041306B
OpenServiceA.ADVAPI32(00000000,?,80000000), ref: 004130AE
CloseServiceHandle.ADVAPI32(00000000), ref: 004130DD
CloseServiceHandle.ADVAPI32(00000000), ref: 00413109

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: Service$CloseHandleOpen$Manager
String ID:
API String ID: 4196757001-0
Opcode ID: 1affe47ea5f99f24aff9d34ebd1f2a07e6b8da3d37af71b740a03b2035711547
Instruction ID: 88196c9a1115e9ce17f529d00f6a557e972ccb59d6d057f70dc0d653b8b6ecd5
Opcode Fuzzy Hash: 1affe47ea5f99f24aff9d34ebd1f2a07e6b8da3d37af71b740a03b2035711547
Instruction Fuzzy Hash: C32175B0E40308FBDB10AFA2DD07B9DBBB1EB09715F508066F5047A180D67A4794DF9A

Function 0040EFCA Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 257registryCOMMON

Download Yara Rule

APIs

RegEnumValueA.ADVAPI32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 0040F087

Strings

lsB, xrefs: 0040F341

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: EnumValue
String ID: lsB
API String ID: 2814608202-575463903
Opcode ID: 8185f3e648eeda7f3077b383fbee750bd06f755cb76c290e49a95d14f1982ffd
Instruction ID: c9e2782bbae2b25368c71bf82a72d0867452c9fa26ab8eccf89328121d26640c
Opcode Fuzzy Hash: 8185f3e648eeda7f3077b383fbee750bd06f755cb76c290e49a95d14f1982ffd
Instruction Fuzzy Hash: 089184B1E00219DBEF10DFE1CC82BAFB674AB18304F14043AEA157A2C2E77E59558B59

Function 00411581 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

CallWindowProcA.USER32(00000000,00000000,00000000,00000000,?), ref: 00411601

Strings

:xB, xrefs: 00411591
[A, xrefs: 00411581

Memory Dump Source

Source File: 00000000.00000002.2033139735.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2033118194.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033178996.0000000000425000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033211388.0000000000427000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033226885.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033242238.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033289665.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033309325.000000000043A000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Similarity

API ID: CallProcWindow
String ID: :xB$[A
API String ID: 2714655100-3416101520
Opcode ID: a0b2edfdb1dddd2a88cb0bdcf1334f6df203742a8fdbd2cb3d9656bbf97b34a8
Instruction ID: 96d206800348fdd84272337406c6bfbf5d73ae028419c0739b8d27b0c6cc631a
Opcode Fuzzy Hash: a0b2edfdb1dddd2a88cb0bdcf1334f6df203742a8fdbd2cb3d9656bbf97b34a8
Instruction Fuzzy Hash: 7811B9B1E00208BFDB10EFE59C45BDF7BB9DB08314F04446BFA08A6151E67A96509B59

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_7212a4befdb83f9e6522613afc3cc91592917d_71cefb02_7c5facf3-cc09-463c-9c66-220058371a9e\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF46D.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF4DC.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF50C.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

Windows Analysis Report
SecuriteInfo.com.Win32.TrojanX-gen.18973.13261.exe

Function 0040DEC4 Relevance: 9.1, APIs: 6, Instructions: 143
memorynativeCOMMON

Function 0041D500 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25
memorywindowCOMMON

Function 0041DE90 Relevance: 6.0, APIs: 4, Instructions: 43
fileCOMMON

Function 00410A09 Relevance: 30.6, APIs: 13, Strings: 4, Instructions: 886
pipesleepprocessCOMMON

Function 0041F960 Relevance: 37.2, APIs: 18, Strings: 3, Instructions: 426
windowstringCOMMON

Function 00413C55 Relevance: 35.4, APIs: 9, Strings: 11, Instructions: 396
servicememoryCOMMON

Function 0040E413 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 287
registryCOMMON

Function 00413715 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 218
servicememoryCOMMON

Function 0041FEF0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 136
librarywindowstringCOMMON