Edit tour

Windows Analysis Report
Qe73sKzGgb.dll

Overview

General Information

Sample name:	Qe73sKzGgb.dll (renamed file extension from exe to dll, renamed because original name is a hash value)
Original sample name:	17561b8a9ca5b29c23d27dd75f9d5aea43bc77625f1203a015e3d17ee33a6a61.exe
Analysis ID:	1522596
MD5:	91d4990ea1a6cf19d40cc96f32202b63
SHA1:	6a03998802559f88b5236c8372d3683f081227bb
SHA256:	17561b8a9ca5b29c23d27dd75f9d5aea43bc77625f1203a015e3d17ee33a6a61
Tags:	exeRavinAcademyuser-JAMESWT_MHT
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Creates a thread in another existing process (thread injection)

Found direct / indirect Syscall (likely to bypass EDR)

Maps a DLL or memory area into another process

Uses known network protocols on non-standard ports

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 1308 cmdline: loaddll64.exe "C:\Users\user\Desktop\Qe73sKzGgb.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)

conhost.exe (PID: 576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3852 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Qe73sKzGgb.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

rundll32.exe (PID: 1868 cmdline: rundll32.exe "C:\Users\user\Desktop\Qe73sKzGgb.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)

sihost.exe (PID: 3388 cmdline: sihost.exe MD5: A21E7719D73D0322E2E7D61802CB8F80)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Qe73sKzGgb.dll	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x2b23:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
Qe73sKzGgb.dll	Windows_Trojan_Donutloader_5c38878d	unknown	unknown	0x327a:$a: 24 48 03 C2 48 89 44 24 28 41 8A 00 84 C0 74 14 33 D2 FF C1

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.2139912895.000001BDF7DF0000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x2723:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000003.00000002.2139912895.000001BDF7DF0000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Donutloader_5c38878d	unknown	unknown	0x2e7a:$a: 24 48 03 C2 48 89 44 24 28 41 8A 00 84 C0 74 14 33 D2 FF C1
00000004.00000000.2092567006.0000024EB5E20000.00000020.80000000.00040000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x2723:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000004.00000000.2092567006.0000024EB5E20000.00000020.80000000.00040000.00000000.sdmp	Windows_Trojan_Donutloader_5c38878d	unknown	unknown	0x2e7a:$a: 24 48 03 C2 48 89 44 24 28 41 8A 00 84 C0 74 14 33 D2 FF C1
00000004.00000002.3329850570.0000024EB5E10000.00000020.00000001.00040000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x2723:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000004.00000002.3329850570.0000024EB5E10000.00000020.00000001.00040000.00000000.sdmp	Windows_Trojan_Donutloader_5c38878d	unknown	unknown	0x2e7a:$a: 24 48 03 C2 48 89 44 24 28 41 8A 00 84 C0 74 14 33 D2 FF C1
00000004.00000002.3329877059.0000024EB5E20000.00000020.80000000.00040000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x2723:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000004.00000002.3329877059.0000024EB5E20000.00000020.80000000.00040000.00000000.sdmp	Windows_Trojan_Donutloader_5c38878d	unknown	unknown	0x2e7a:$a: 24 48 03 C2 48 89 44 24 28 41 8A 00 84 C0 74 14 33 D2 FF C1
00000000.00000002.2098220710.000001FA21A10000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x2723:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
00000000.00000002.2098220710.000001FA21A10000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Donutloader_5c38878d	unknown	unknown	0x2e7a:$a: 24 48 03 C2 48 89 44 24 28 41 8A 00 84 C0 74 14 33 D2 FF C1
Click to see the 5 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Qe73sKzGgb.dll	ReversingLabs: Detection: 34%
Source: Qe73sKzGgb.dll	Virustotal: Detection: 45%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.4% probability

Source: Qe73sKzGgb.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: C:\Users\NEO\Desktop\RavinAcademy\RedTeam-01\10\HTTPMalware\Persist\x64\Release\DLL.pdb source: Qe73sKzGgb.dll
Source:	Binary string: C:\Users\NEO\Desktop\RavinAcademy\RedTeam-01\10\HTTPMalware\HTTPMalw\HTTPMalw\obj\Release\HTTPMalw.pdb source: sihost.exe, 00000004.00000002.3330089530.0000024EB5ED0000.00000004.10000000.00040000.00000000.sdmp, sihost.exe, 00000004.00000000.2092725357.0000024EB5E50000.00000004.00000001.00020000.00000000.sdmp, sihost.exe, 00000004.00000002.3331065779.0000024EB64E6000.00000004.00000001.00020000.00000000.sdmp, sihost.exe, 00000004.00000002.3331065779.0000024EB6421000.00000004.00000001.00020000.00000000.sdmp

Networking

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 81
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 81
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 81
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 81
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 81
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 81
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 81
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 81
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 81
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 81
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 81
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 81

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246Host: 192.168.1.140:81Content-Length: 133Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246Host: 192.168.1.140:81Content-Length: 133Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246Host: 192.168.1.140:81Content-Length: 133Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246Host: 192.168.1.140:81Content-Length: 133Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246Host: 192.168.1.140:81Content-Length: 133Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246Host: 192.168.1.140:81Content-Length: 133Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246Host: 192.168.1.140:81Content-Length: 133Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246Host: 192.168.1.140:81Content-Length: 133Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246Host: 192.168.1.140:81Content-Length: 133Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246Host: 192.168.1.140:81Content-Length: 133Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246Host: 192.168.1.140:81Content-Length: 133Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246Host: 192.168.1.140:81Content-Length: 133Expect: 100-continueConnection: Keep-Alive

Source: C:\Windows\System32\sihost.exe

Code function: 4_2_00007FF849230C9F recv,

4_2_00007FF849230C9F

Source: unknown

HTTP traffic detected: POST / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246Host: 192.168.1.140:81Content-Length: 133Expect: 100-continueConnection: Keep-Alive

Source: sihost.exe, 00000004.00000002.3331065779.0000024EB6421000.00000004.00000001.00020000.00000000.sdmp, sihost.exe, 00000004.00000002.3331065779.0000024EB657A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://192.168.1.140:81
Source: sihost.exe, 00000004.00000002.3331065779.0000024EB657A000.00000004.00000001.00020000.00000000.sdmp, sihost.exe, 00000004.00000002.3330504947.0000024EB62C3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://192.168.1.140:81/
Source: sihost.exe, 00000004.00000002.3330504947.0000024EB62C3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://192.168.1.140:81/-
Source: sihost.exe, 00000004.00000002.3330504947.0000024EB62C3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://192.168.1.140:81/:
Source: sihost.exe, 00000004.00000002.3331065779.0000024EB65D0000.00000004.00000001.00020000.00000000.sdmp, sihost.exe, 00000004.00000002.3331065779.0000024EB65B5000.00000004.00000001.00020000.00000000.sdmp, sihost.exe, 00000004.00000002.3331065779.0000024EB64C7000.00000004.00000001.00020000.00000000.sdmp, sihost.exe, 00000004.00000002.3331065779.0000024EB659C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://192.168.1.140:81/X
Source: sihost.exe, 00000004.00000002.3331065779.0000024EB65D0000.00000004.00000001.00020000.00000000.sdmp, sihost.exe, 00000004.00000002.3331065779.0000024EB65B5000.00000004.00000001.00020000.00000000.sdmp, sihost.exe, 00000004.00000002.3331065779.0000024EB65EC000.00000004.00000001.00020000.00000000.sdmp, sihost.exe, 00000004.00000002.3331065779.0000024EB659C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://192.168.1.140:81pV
Source: sihost.exe, 00000004.00000002.3331065779.0000024EB64C7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

System Summary

Malicious sample detected (through community Yara rule)

Source: Qe73sKzGgb.dll, type: SAMPLE	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: Qe73sKzGgb.dll, type: SAMPLE	Matched rule: Windows_Trojan_Donutloader_5c38878d Author: unknown
Source: 00000003.00000002.2139912895.000001BDF7DF0000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000003.00000002.2139912895.000001BDF7DF0000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_5c38878d Author: unknown
Source: 00000004.00000000.2092567006.0000024EB5E20000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000004.00000000.2092567006.0000024EB5E20000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_5c38878d Author: unknown
Source: 00000004.00000002.3329850570.0000024EB5E10000.00000020.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000004.00000002.3329850570.0000024EB5E10000.00000020.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_5c38878d Author: unknown
Source: 00000004.00000002.3329877059.0000024EB5E20000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000004.00000002.3329877059.0000024EB5E20000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_5c38878d Author: unknown
Source: 00000000.00000002.2098220710.000001FA21A10000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000000.00000002.2098220710.000001FA21A10000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_5c38878d Author: unknown

Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF848FF1332 NtQuerySystemInformation,		4_2_00007FF848FF1332
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF848FF2FE6 NtQuerySystemInformation,		4_2_00007FF848FF2FE6

Source: C:\Windows\System32\sihost.exe	Code function: 4_2_0000024EB5E13777	4_2_0000024EB5E13777
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_0000024EB5E13B97	4_2_0000024EB5E13B97
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_0000024EB5E12B4F	4_2_0000024EB5E12B4F
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_0000024EB5E13FCF	4_2_0000024EB5E13FCF
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_0000024EB5E14457	4_2_0000024EB5E14457
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_0000024EB5E23777	4_2_0000024EB5E23777
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_0000024EB5E23B97	4_2_0000024EB5E23B97
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_0000024EB5E22B4F	4_2_0000024EB5E22B4F
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_0000024EB5E23FCF	4_2_0000024EB5E23FCF
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_0000024EB5E24457	4_2_0000024EB5E24457
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF848FFC205	4_2_00007FF848FFC205
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF848FFCA58	4_2_00007FF848FFCA58
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF848FF59AF	4_2_00007FF848FF59AF
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF848FF2B4A	4_2_00007FF848FF2B4A
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF848FFCB88	4_2_00007FF848FFCB88
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF848FFCBD8	4_2_00007FF848FFCBD8
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF849006DFB	4_2_00007FF849006DFB
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF848FFF6A3	4_2_00007FF848FFF6A3
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF849043070	4_2_00007FF849043070
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF849007790	4_2_00007FF849007790
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF849001A7F	4_2_00007FF849001A7F
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF849001AB0	4_2_00007FF849001AB0
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF8490012D8	4_2_00007FF8490012D8
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF849001AF3	4_2_00007FF849001AF3
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF849002AF3	4_2_00007FF849002AF3
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF849002AF0	4_2_00007FF849002AF0
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF848FF10FA	4_2_00007FF848FF10FA
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF848FFC939	4_2_00007FF848FFC939
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF848FFE9E0	4_2_00007FF848FFE9E0
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF848FFA3FA	4_2_00007FF848FFA3FA
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF848FF8322	4_2_00007FF848FF8322
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF848FF8330	4_2_00007FF848FF8330
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF848FF1328	4_2_00007FF848FF1328
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF849009B60	4_2_00007FF849009B60
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF848FFCB80	4_2_00007FF848FFCB80
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF849005BD3	4_2_00007FF849005BD3
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF848FFCDF8	4_2_00007FF848FFCDF8
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF848FFD578	4_2_00007FF848FFD578
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF8490025A0	4_2_00007FF8490025A0
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF8490025A8	4_2_00007FF8490025A8
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF8490025D0	4_2_00007FF8490025D0
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF8490055F2	4_2_00007FF8490055F2
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF848FF50D3	4_2_00007FF848FF50D3
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF848FF5960	4_2_00007FF848FF5960
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF849233A1D	4_2_00007FF849233A1D
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF849231B9D	4_2_00007FF849231B9D
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF849232B7C	4_2_00007FF849232B7C

Source: Qe73sKzGgb.dll, type: SAMPLE	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: Qe73sKzGgb.dll, type: SAMPLE	Matched rule: Windows_Trojan_Donutloader_5c38878d os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 3b55ec6c37891880b53633b936d10f94d2b806db1723875e4ac95f8a34d97150, id = 5c38878d-ca94-4fd9-a36e-1ae5fe713ca2, last_modified = 2021-01-13
Source: 00000003.00000002.2139912895.000001BDF7DF0000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000003.00000002.2139912895.000001BDF7DF0000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_5c38878d os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 3b55ec6c37891880b53633b936d10f94d2b806db1723875e4ac95f8a34d97150, id = 5c38878d-ca94-4fd9-a36e-1ae5fe713ca2, last_modified = 2021-01-13
Source: 00000004.00000000.2092567006.0000024EB5E20000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000004.00000000.2092567006.0000024EB5E20000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_5c38878d os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 3b55ec6c37891880b53633b936d10f94d2b806db1723875e4ac95f8a34d97150, id = 5c38878d-ca94-4fd9-a36e-1ae5fe713ca2, last_modified = 2021-01-13
Source: 00000004.00000002.3329850570.0000024EB5E10000.00000020.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000004.00000002.3329850570.0000024EB5E10000.00000020.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_5c38878d os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 3b55ec6c37891880b53633b936d10f94d2b806db1723875e4ac95f8a34d97150, id = 5c38878d-ca94-4fd9-a36e-1ae5fe713ca2, last_modified = 2021-01-13
Source: 00000004.00000002.3329877059.0000024EB5E20000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000004.00000002.3329877059.0000024EB5E20000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_5c38878d os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 3b55ec6c37891880b53633b936d10f94d2b806db1723875e4ac95f8a34d97150, id = 5c38878d-ca94-4fd9-a36e-1ae5fe713ca2, last_modified = 2021-01-13
Source: 00000000.00000002.2098220710.000001FA21A10000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000000.00000002.2098220710.000001FA21A10000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_5c38878d os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 3b55ec6c37891880b53633b936d10f94d2b806db1723875e4ac95f8a34d97150, id = 5c38878d-ca94-4fd9-a36e-1ae5fe713ca2, last_modified = 2021-01-13

Source: Qe73sKzGgb.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal76.troj.evad.winDLL@6/0@0/1

Source: C:\Windows\System32\sihost.exe

Code function: 4_2_00007FF848FF24B8 AdjustTokenPrivileges,

4_2_00007FF848FF24B8

Source: C:\Windows\System32\sihost.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:576:120:WilError_03

Source: Qe73sKzGgb.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Qe73sKzGgb.dll",#1

Source: Qe73sKzGgb.dll	ReversingLabs: Detection: 34%
Source: Qe73sKzGgb.dll	Virustotal: Detection: 45%

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\Qe73sKzGgb.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Qe73sKzGgb.dll",#1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Qe73sKzGgb.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Qe73sKzGgb.dll",#1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Qe73sKzGgb.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Windows\System32\sihost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Qe73sKzGgb.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: Qe73sKzGgb.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Qe73sKzGgb.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Qe73sKzGgb.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Qe73sKzGgb.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Qe73sKzGgb.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Qe73sKzGgb.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Qe73sKzGgb.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: Qe73sKzGgb.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\NEO\Desktop\RavinAcademy\RedTeam-01\10\HTTPMalware\Persist\x64\Release\DLL.pdb source: Qe73sKzGgb.dll
Source:	Binary string: C:\Users\NEO\Desktop\RavinAcademy\RedTeam-01\10\HTTPMalware\HTTPMalw\HTTPMalw\obj\Release\HTTPMalw.pdb source: sihost.exe, 00000004.00000002.3330089530.0000024EB5ED0000.00000004.10000000.00040000.00000000.sdmp, sihost.exe, 00000004.00000000.2092725357.0000024EB5E50000.00000004.00000001.00020000.00000000.sdmp, sihost.exe, 00000004.00000002.3331065779.0000024EB64E6000.00000004.00000001.00020000.00000000.sdmp, sihost.exe, 00000004.00000002.3331065779.0000024EB6421000.00000004.00000001.00020000.00000000.sdmp

Source: Qe73sKzGgb.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Qe73sKzGgb.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Qe73sKzGgb.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Qe73sKzGgb.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Qe73sKzGgb.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF848FF72F0 push ebx; retf	4_2_00007FF848FF73DA
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF848FF5458 push ebx; retf	4_2_00007FF848FF73DA
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF848FF7300 push ebx; retf	4_2_00007FF848FF73DA
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF848FF72F8 push ebx; retf	4_2_00007FF848FF73DA
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF848FF7338 push ebx; retf	4_2_00007FF848FF73DA
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF8490025A0 push FFFFFFE8h; ret	4_2_00007FF8490026F9
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF8490025A8 push FFFFFFE8h; ret	4_2_00007FF8490026F9
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF8490025D0 push FFFFFFE8h; ret	4_2_00007FF8490026F9
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF84923096A push edx; ret	4_2_00007FF84923096B
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF84923294D pushad ; ret	4_2_00007FF849232974
Source: C:\Windows\System32\sihost.exe	Code function: 4_2_00007FF849236F90 pushfd ; iretd	4_2_00007FF849236F91

Source: Qe73sKzGgb.dll

Static PE information: section name: .text entropy: 7.125462328457127

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 81
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 81
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 81
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 81
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 81
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 81
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 81
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 81
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 81
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 81
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 81
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 81

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\sihost.exe	Memory allocated: 24EB5EA0000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory allocated: 24ECE420000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Windows\System32\loaddll64.exe TID: 2000

Thread sleep time: -120000s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\loaddll64.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: sihost.exe, 00000004.00000002.3330504947.0000024EB629A000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\loaddll64.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\sihost.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\loaddll64.exe	Thread created: C:\Windows\System32\sihost.exe EIP: B5E10000			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread created: C:\Windows\System32\sihost.exe EIP: B5E20000			Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\System32\loaddll64.exe	NtMapViewOfSection: Direct from: 0x7FF8BFAB65DF			Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtCreateThreadEx: Direct from: 0x7FF8BFAB661F			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Windows\System32\loaddll64.exe	Section loaded: NULL target: C:\Windows\System32\sihost.exe protection: execute and read			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Section loaded: NULL target: C:\Windows\System32\sihost.exe protection: execute and read			Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Qe73sKzGgb.dll",#1

Jump to behavior

Source: sihost.exe, 00000004.00000002.3329405613.0000024EB3A21000.00000002.00000001.00040000.00000000.sdmp, sihost.exe, 00000004.00000000.2091868600.0000024EB3A21000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: sihost.exe, 00000004.00000002.3329405613.0000024EB3A21000.00000002.00000001.00040000.00000000.sdmp, sihost.exe, 00000004.00000000.2091868600.0000024EB3A21000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: sihost.exe, 00000004.00000002.3329405613.0000024EB3A21000.00000002.00000001.00040000.00000000.sdmp, sihost.exe, 00000004.00000000.2091868600.0000024EB3A21000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: sihost.exe, 00000004.00000002.3329405613.0000024EB3A21000.00000002.00000001.00040000.00000000.sdmp, sihost.exe, 00000004.00000000.2091868600.0000024EB3A21000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\sihost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation	Jump to behavior

Source: C:\Windows\System32\sihost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Access Token Manipulation	1 Disable or Modify Tools	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	212 Process Injection	21 Virtualization/Sandbox Evasion	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Abuse Elevation Control Mechanism	1 Access Token Manipulation	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	212 Process Injection	NTDS	12 System Information Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Abuse Elevation Control Mechanism	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	11 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Rundll32	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Qe73sKzGgb.dll	34%	ReversingLabs	Win64.Exploit.DonutMarte
Qe73sKzGgb.dll	46%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe

Name	Malicious	Antivirus Detection	Reputation
http://192.168.1.140:81/	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://192.168.1.140:81	sihost.exe, 00000004.00000002.3331065779.0000024EB6421000.00000004.00000001.00020000.00000000.sdmp, sihost.exe, 00000004.00000002.3331065779.0000024EB657A000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://192.168.1.140:81/-	sihost.exe, 00000004.00000002.3330504947.0000024EB62C3000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://192.168.1.140:81/X	sihost.exe, 00000004.00000002.3331065779.0000024EB65D0000.00000004.00000001.00020000.00000000.sdmp, sihost.exe, 00000004.00000002.3331065779.0000024EB65B5000.00000004.00000001.00020000.00000000.sdmp, sihost.exe, 00000004.00000002.3331065779.0000024EB64C7000.00000004.00000001.00020000.00000000.sdmp, sihost.exe, 00000004.00000002.3331065779.0000024EB659C000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	sihost.exe, 00000004.00000002.3331065779.0000024EB64C7000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://192.168.1.140:81/:	sihost.exe, 00000004.00000002.3330504947.0000024EB62C3000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://192.168.1.140:81pV	sihost.exe, 00000004.00000002.3331065779.0000024EB65D0000.00000004.00000001.00020000.00000000.sdmp, sihost.exe, 00000004.00000002.3331065779.0000024EB65B5000.00000004.00000001.00020000.00000000.sdmp, sihost.exe, 00000004.00000002.3331065779.0000024EB65EC000.00000004.00000001.00020000.00000000.sdmp, sihost.exe, 00000004.00000002.3331065779.0000024EB659C000.00000004.00000001.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious

Private

IP
192.168.1.140

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1522596
Start date and time:	2024-09-30 12:31:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Qe73sKzGgb.dll (renamed file extension from exe to dll, renamed because original name is a hash value)
Original Sample Name:	17561b8a9ca5b29c23d27dd75f9d5aea43bc77625f1203a015e3d17ee33a6a61.exe
Detection:	MAL
Classification:	mal76.troj.evad.winDLL@6/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
06:32:02	API Interceptor	1x Sleep call for process: loaddll64.exe modified

File type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Entropy (8bit):	6.590458203325001
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	Qe73sKzGgb.dll
File size:	33'792 bytes
MD5:	91d4990ea1a6cf19d40cc96f32202b63
SHA1:	6a03998802559f88b5236c8372d3683f081227bb
SHA256:	17561b8a9ca5b29c23d27dd75f9d5aea43bc77625f1203a015e3d17ee33a6a61
SHA512:	6e5ff5b4b1364f62c2db983779f6abe76f813db655567a133f2d9217f708ea26db15ce520ffa5f22f6b4c86ee77916503fcf981b2f07c850913405fd69066b9a
SSDEEP:	768:dToluwJhfhRiJww1esduIKICvwphx54+Fg/CHCY:dAPKwOes8457S/ACY
TLSH:	A4E2AE94FBE500E8C572D135CDB6A92BDEF079A4232552DF539089292F333A2B93C316
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................C.....................................................I.......I.......I./.....I.......Rich...................

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x180006974
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x180000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x613C382D [Sat Sep 11 05:01:33 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	9767b8148a95fb0b17884f0c6cd6e7c4

Entrypoint Preview

Instruction
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], esi
push edi
dec eax
sub esp, 20h
dec ecx
mov edi, eax
mov ebx, edx
dec eax
mov esi, ecx
cmp edx, 01h
jne 00007FED0C7E92E7h
call 00007FED0C7E9480h
dec esp
mov eax, edi
mov edx, ebx
dec eax
mov ecx, esi
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov esi, dword ptr [esp+38h]
dec eax
add esp, 20h
pop edi
jmp 00007FED0C7E9174h
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [00001683h]
dec eax
mov ecx, ebx
call dword ptr [00001672h]
call dword ptr [00001634h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [00001668h]
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [0000165Ch]
test eax, eax
je 00007FED0C7E92E9h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [000026E2h]
call 00007FED0C7E938Eh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [000027C9h], eax
dec eax
lea eax, dword ptr [esp+38h]
dec eax
add eax, 08h
dec eax
mov dword ptr [00002759h], eax
dec eax
mov eax, dword ptr [000027B2h]
dec eax
mov dword ptr [00002623h], eax

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8934	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xb000	0x240	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd000	0x24	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x824c	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x82c0	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6478	0x6600	33436ca9217957cfc4a06e5a3be93cf6	False	0.7673483455882353	data	7.125462328457127	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0xe38	0x1000	bc547a0417f81714bdeaca78bb316f39	False	0.39404296875	data	4.037276543622751	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x1604	0x200	4e3cf939c6b9143de49c819a775b7f91	False	0.09375	data	0.44978594583004794	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xb000	0x240	0x400	ad3465f7531b0c8d5c05ad7c16c6ef12	False	0.30859375	data	2.445728612624437	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0x1e0	0x200	033f07f58c3c8ea3a98fbea3867bbc54	False	0.53125	data	4.708553337303423	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd000	0x24	0x200	b8255c69f8aa4a2196d987b0fd662c0c	False	0.099609375	data	0.5286804121647501	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0xc060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
KERNEL32.dll	Process32First, GetCurrentProcess, OpenProcess, CreateToolhelp32Snapshot, Process32Next, CloseHandle, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, InitializeSListHead, GetSystemTimeAsFileTime, GetCurrentThreadId, GetCurrentProcessId, QueryPerformanceCounter, RtlCaptureContext
VCRUNTIME140.dll	memcpy, __std_type_info_destroy_list, __C_specific_handler, memset
api-ms-win-crt-stdio-l1-1-0.dll	__acrt_iob_func, __stdio_common_vfprintf
api-ms-win-crt-string-l1-1-0.dll	tolower
api-ms-win-crt-runtime-l1-1-0.dll	_initialize_narrow_environment, _initterm, _cexit, _initialize_onexit_table, _execute_onexit_table, _configure_narrow_argv, _seh_filter_dll, _initterm_e

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 30, 2024 12:32:03.123704910 CEST	49704	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:32:03.221426010 CEST	81	49704	192.168.1.140	192.168.2.5
Sep 30, 2024 12:32:03.221586943 CEST	49704	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:32:03.221913099 CEST	49704	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:32:03.226705074 CEST	81	49704	192.168.1.140	192.168.2.5
Sep 30, 2024 12:32:03.580365896 CEST	49704	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:32:03.585794926 CEST	81	49704	192.168.1.140	192.168.2.5
Sep 30, 2024 12:32:10.085061073 CEST	49705	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:32:10.090013981 CEST	81	49705	192.168.1.140	192.168.2.5
Sep 30, 2024 12:32:10.090107918 CEST	49705	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:32:10.369533062 CEST	49705	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:32:10.374804974 CEST	81	49705	192.168.1.140	192.168.2.5
Sep 30, 2024 12:32:10.905343056 CEST	49705	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:32:10.910243988 CEST	81	49705	192.168.1.140	192.168.2.5
Sep 30, 2024 12:32:24.600053072 CEST	81	49704	192.168.1.140	192.168.2.5
Sep 30, 2024 12:32:24.600126028 CEST	49704	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:32:24.687328100 CEST	49704	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:32:24.692110062 CEST	81	49704	192.168.1.140	192.168.2.5
Sep 30, 2024 12:32:24.760921001 CEST	49711	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:32:24.765851974 CEST	81	49711	192.168.1.140	192.168.2.5
Sep 30, 2024 12:32:24.765957117 CEST	49711	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:32:24.766163111 CEST	49711	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:32:24.770967007 CEST	81	49711	192.168.1.140	192.168.2.5
Sep 30, 2024 12:32:25.120131016 CEST	49711	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:32:25.127752066 CEST	81	49711	192.168.1.140	192.168.2.5
Sep 30, 2024 12:32:31.440201998 CEST	81	49705	192.168.1.140	192.168.2.5
Sep 30, 2024 12:32:31.440327883 CEST	49705	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:32:31.611555099 CEST	49705	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:32:31.616533041 CEST	81	49705	192.168.1.140	192.168.2.5
Sep 30, 2024 12:32:31.704248905 CEST	49712	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:32:31.709322929 CEST	81	49712	192.168.1.140	192.168.2.5
Sep 30, 2024 12:32:31.709419966 CEST	49712	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:32:31.709532022 CEST	49712	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:32:31.714540005 CEST	81	49712	192.168.1.140	192.168.2.5
Sep 30, 2024 12:32:32.057497978 CEST	49712	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:32:32.062453985 CEST	81	49712	192.168.1.140	192.168.2.5
Sep 30, 2024 12:32:46.145035028 CEST	81	49711	192.168.1.140	192.168.2.5
Sep 30, 2024 12:32:46.145275116 CEST	49711	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:32:46.145459890 CEST	49711	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:32:46.150234938 CEST	81	49711	192.168.1.140	192.168.2.5
Sep 30, 2024 12:32:46.180272102 CEST	49713	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:32:46.185177088 CEST	81	49713	192.168.1.140	192.168.2.5
Sep 30, 2024 12:32:46.185362101 CEST	49713	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:32:46.185484886 CEST	49713	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:32:46.190253973 CEST	81	49713	192.168.1.140	192.168.2.5
Sep 30, 2024 12:32:46.541853905 CEST	49713	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:32:46.546789885 CEST	81	49713	192.168.1.140	192.168.2.5
Sep 30, 2024 12:32:53.081165075 CEST	81	49712	192.168.1.140	192.168.2.5
Sep 30, 2024 12:32:53.081419945 CEST	49712	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:32:53.081516981 CEST	49712	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:32:53.086285114 CEST	81	49712	192.168.1.140	192.168.2.5
Sep 30, 2024 12:32:53.107152939 CEST	49714	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:32:53.112071037 CEST	81	49714	192.168.1.140	192.168.2.5
Sep 30, 2024 12:32:53.112189054 CEST	49714	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:32:53.112296104 CEST	49714	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:32:53.117069006 CEST	81	49714	192.168.1.140	192.168.2.5
Sep 30, 2024 12:32:53.463738918 CEST	49714	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:32:53.468717098 CEST	81	49714	192.168.1.140	192.168.2.5
Sep 30, 2024 12:33:07.585616112 CEST	81	49713	192.168.1.140	192.168.2.5
Sep 30, 2024 12:33:07.585794926 CEST	49713	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:33:07.587475061 CEST	49713	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:33:07.592279911 CEST	81	49713	192.168.1.140	192.168.2.5
Sep 30, 2024 12:33:07.623199940 CEST	49716	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:33:07.628004074 CEST	81	49716	192.168.1.140	192.168.2.5
Sep 30, 2024 12:33:07.628101110 CEST	49716	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:33:07.628222942 CEST	49716	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:33:07.633146048 CEST	81	49716	192.168.1.140	192.168.2.5
Sep 30, 2024 12:33:07.979672909 CEST	49716	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:33:07.984595060 CEST	81	49716	192.168.1.140	192.168.2.5
Sep 30, 2024 12:33:14.472104073 CEST	81	49714	192.168.1.140	192.168.2.5
Sep 30, 2024 12:33:14.472270966 CEST	49714	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:33:14.476938009 CEST	49714	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:33:14.482496023 CEST	81	49714	192.168.1.140	192.168.2.5
Sep 30, 2024 12:33:14.498806000 CEST	49717	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:33:14.504102945 CEST	81	49717	192.168.1.140	192.168.2.5
Sep 30, 2024 12:33:14.504343033 CEST	49717	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:33:14.504343033 CEST	49717	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:33:14.510108948 CEST	81	49717	192.168.1.140	192.168.2.5
Sep 30, 2024 12:33:14.854376078 CEST	49717	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:33:14.860404015 CEST	81	49717	192.168.1.140	192.168.2.5
Sep 30, 2024 12:33:29.024735928 CEST	81	49716	192.168.1.140	192.168.2.5
Sep 30, 2024 12:33:29.024832964 CEST	49716	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:33:29.025000095 CEST	49716	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:33:29.031708956 CEST	81	49716	192.168.1.140	192.168.2.5
Sep 30, 2024 12:33:29.060653925 CEST	49718	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:33:29.065592051 CEST	81	49718	192.168.1.140	192.168.2.5
Sep 30, 2024 12:33:29.065720081 CEST	49718	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:33:29.065802097 CEST	49718	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:33:29.071094990 CEST	81	49718	192.168.1.140	192.168.2.5
Sep 30, 2024 12:33:29.417032003 CEST	49718	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:33:29.422044992 CEST	81	49718	192.168.1.140	192.168.2.5
Sep 30, 2024 12:33:35.878846884 CEST	81	49717	192.168.1.140	192.168.2.5
Sep 30, 2024 12:33:35.878973961 CEST	49717	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:33:35.879126072 CEST	49717	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:33:35.883944035 CEST	81	49717	192.168.1.140	192.168.2.5
Sep 30, 2024 12:33:35.972742081 CEST	49719	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:33:35.977937937 CEST	81	49719	192.168.1.140	192.168.2.5
Sep 30, 2024 12:33:35.978049994 CEST	49719	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:33:35.978285074 CEST	49719	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:33:35.983053923 CEST	81	49719	192.168.1.140	192.168.2.5
Sep 30, 2024 12:33:36.323138952 CEST	49719	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:33:36.328955889 CEST	81	49719	192.168.1.140	192.168.2.5
Sep 30, 2024 12:33:50.425817013 CEST	81	49718	192.168.1.140	192.168.2.5
Sep 30, 2024 12:33:50.425921917 CEST	49718	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:33:50.426065922 CEST	49718	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:33:50.430835009 CEST	81	49718	192.168.1.140	192.168.2.5
Sep 30, 2024 12:33:50.450970888 CEST	49720	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:33:50.455800056 CEST	81	49720	192.168.1.140	192.168.2.5
Sep 30, 2024 12:33:50.455988884 CEST	49720	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:33:50.456130981 CEST	49720	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:33:50.460894108 CEST	81	49720	192.168.1.140	192.168.2.5
Sep 30, 2024 12:33:50.810224056 CEST	49720	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:33:50.815992117 CEST	81	49720	192.168.1.140	192.168.2.5
Sep 30, 2024 12:33:57.364347935 CEST	81	49719	192.168.1.140	192.168.2.5
Sep 30, 2024 12:33:57.364444017 CEST	49719	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:33:57.364558935 CEST	49719	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:33:57.369340897 CEST	81	49719	192.168.1.140	192.168.2.5
Sep 30, 2024 12:33:57.393368959 CEST	49721	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:33:57.399422884 CEST	81	49721	192.168.1.140	192.168.2.5
Sep 30, 2024 12:33:57.399511099 CEST	49721	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:33:57.399617910 CEST	49721	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:33:57.404870987 CEST	81	49721	192.168.1.140	192.168.2.5
Sep 30, 2024 12:33:57.745109081 CEST	49721	81	192.168.2.5	192.168.1.140
Sep 30, 2024 12:33:57.749978065 CEST	81	49721	192.168.1.140	192.168.2.5

HTTP Request Dependency Graph

192.168.1.140:81

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	192.168.1.140	81	3388	C:\Windows\System32\sihost.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:32:03.221913099 CEST	251	OUT	POST / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246 Host: 192.168.1.140:81 Content-Length: 133 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	192.168.1.140	81	3388	C:\Windows\System32\sihost.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:32:10.369533062 CEST	251	OUT	POST / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246 Host: 192.168.1.140:81 Content-Length: 133 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49711	192.168.1.140	81	3388	C:\Windows\System32\sihost.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:32:24.766163111 CEST	251	OUT	POST / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246 Host: 192.168.1.140:81 Content-Length: 133 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49712	192.168.1.140	81	3388	C:\Windows\System32\sihost.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:32:31.709532022 CEST	251	OUT	POST / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246 Host: 192.168.1.140:81 Content-Length: 133 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49713	192.168.1.140	81	3388	C:\Windows\System32\sihost.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:32:46.185484886 CEST	251	OUT	POST / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246 Host: 192.168.1.140:81 Content-Length: 133 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49714	192.168.1.140	81	3388	C:\Windows\System32\sihost.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:32:53.112296104 CEST	251	OUT	POST / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246 Host: 192.168.1.140:81 Content-Length: 133 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49716	192.168.1.140	81	3388	C:\Windows\System32\sihost.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:33:07.628222942 CEST	251	OUT	POST / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246 Host: 192.168.1.140:81 Content-Length: 133 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49717	192.168.1.140	81	3388	C:\Windows\System32\sihost.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:33:14.504343033 CEST	251	OUT	POST / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246 Host: 192.168.1.140:81 Content-Length: 133 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49718	192.168.1.140	81	3388	C:\Windows\System32\sihost.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:33:29.065802097 CEST	251	OUT	POST / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246 Host: 192.168.1.140:81 Content-Length: 133 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49719	192.168.1.140	81	3388	C:\Windows\System32\sihost.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:33:35.978285074 CEST	251	OUT	POST / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246 Host: 192.168.1.140:81 Content-Length: 133 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49720	192.168.1.140	81	3388	C:\Windows\System32\sihost.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:33:50.456130981 CEST	251	OUT	POST / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246 Host: 192.168.1.140:81 Content-Length: 133 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49721	192.168.1.140	81	3388	C:\Windows\System32\sihost.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 12:33:57.399617910 CEST	251	OUT	POST / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246 Host: 192.168.1.140:81 Content-Length: 133 Expect: 100-continue Connection: Keep-Alive

Target ID:	0
Start time:	06:32:01
Start date:	30/09/2024
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\Qe73sKzGgb.dll"
Imagebase:	0x7ff674e80000
File size:	165'888 bytes
MD5 hash:	763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000002.2098220710.000001FA21A10000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_5c38878d, Description: unknown, Source: 00000000.00000002.2098220710.000001FA21A10000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	06:32:01
Start date:	30/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:32:01
Start date:	30/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Qe73sKzGgb.dll",#1
Imagebase:	0x7ff607bd0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:32:01
Start date:	30/09/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\Qe73sKzGgb.dll",#1
Imagebase:	0x7ff615fd0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000003.00000002.2139912895.000001BDF7DF0000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_5c38878d, Description: unknown, Source: 00000003.00000002.2139912895.000001BDF7DF0000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:32:01
Start date:	30/09/2024
Path:	C:\Windows\System32\sihost.exe
Wow64 process (32bit):	false
Commandline:	sihost.exe
Imagebase:	0x7ff6f27b0000
File size:	111'616 bytes
MD5 hash:	A21E7719D73D0322E2E7D61802CB8F80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000004.00000000.2092567006.0000024EB5E20000.00000020.80000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_5c38878d, Description: unknown, Source: 00000004.00000000.2092567006.0000024EB5E20000.00000020.80000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000004.00000002.3329850570.0000024EB5E10000.00000020.00000001.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_5c38878d, Description: unknown, Source: 00000004.00000002.3329850570.0000024EB5E10000.00000020.00000001.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000004.00000002.3329877059.0000024EB5E20000.00000020.80000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_5c38878d, Description: unknown, Source: 00000004.00000002.3329877059.0000024EB5E20000.00000020.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	15.1%
Dynamic/Decrypted Code Coverage:	45.2%
Signature Coverage:	34.8%
Total number of Nodes:	115
Total number of Limit Nodes:	12

Executed Functions

Function 0000024EB5E23777 Relevance: 7.9, APIs: 5, Instructions: 406
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 0000024EB5E237EC
LoadLibraryA.KERNEL32 ref: 0000024EB5E238F1
VirtualAlloc.KERNEL32 ref: 0000024EB5E239CE
VirtualAlloc.KERNEL32 ref: 0000024EB5E23A57
VirtualFree.KERNELBASE ref: 0000024EB5E23AB3

Memory Dump Source

Source File: 00000004.00000002.3329877059.0000024EB5E20000.00000020.80000000.00040000.00000000.sdmp, Offset: 0000024EB5E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_24eb5e20000_sihost.jbxd

Yara matches

Similarity

API ID: Virtual$Alloc$FreeLibraryLoad
String ID:
API String ID: 352157779-0
Opcode ID: 60595fa5053f1866d63c87b1b8d7f0fee698ebc8641127cacdaf14d5899dacb3
Instruction ID: 1be3d720e8da04a3ad09c55f3770599f5f7e42a0851172349de712626d89e83d
Opcode Fuzzy Hash: 60595fa5053f1866d63c87b1b8d7f0fee698ebc8641127cacdaf14d5899dacb3
Instruction Fuzzy Hash: 54D15730614A084BFF78EB28C8997AAB3D1FB9D30CF55496DD48BC718ADA21D9468B41

Function 00007FF849232B7C Relevance: 6.0, Strings: 4, Instructions: 1047
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

x1 I, xrefs: 00007FF849233060
x1 I, xrefs: 00007FF849232F61
x1 I, xrefs: 00007FF849233027
x1 I, xrefs: 00007FF849232FDC

Memory Dump Source

Source File: 00000004.00000002.3339175273.00007FF849230000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF849230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff849230000_sihost.jbxd

Similarity

API ID:
String ID: x1 I$x1 I$x1 I$x1 I
API String ID: 0-3632624455
Opcode ID: d00ff6eb508413aa2a5b7bc626f6c8f2031e4659dae01dcbe7525f45f3d93ca6
Instruction ID: 85e13a38c0b1ae47e6b767245bc1ba0d1a1ff8b6a120cd0428f25a60599f6499
Opcode Fuzzy Hash: d00ff6eb508413aa2a5b7bc626f6c8f2031e4659dae01dcbe7525f45f3d93ca6
Instruction Fuzzy Hash: 6D72B230E1CA9A4FFBA9EF2884556BA77E1FF59344F54007ED45EC72D2CE28A8428741

Function 00007FF848FF59AF Relevance: 5.8, Strings: 4, Instructions: 825
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

#, xrefs: 00007FF8490259D6
/, xrefs: 00007FF849025726
?, xrefs: 00007FF8490259CE
#, xrefs: 00007FF849025863

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID:
String ID: #$#$/$?
API String ID: 0-581573540
Opcode ID: 984dcbf51dab4a6baaca7d6ccd1eab407f846dd54177bb54a29e1ab8d0131bf0
Instruction ID: 3a86fcdfc9f734c9fd9e7d9887ad88975fe522a29949634f9a94e77d9cbeec12
Opcode Fuzzy Hash: 984dcbf51dab4a6baaca7d6ccd1eab407f846dd54177bb54a29e1ab8d0131bf0
Instruction Fuzzy Hash: BA52AB30A1CA8A8FEB69EF188455679B7E1FF88350F50427DD48AC7295DB38FC428785

Function 0000024EB5E13777 Relevance: 5.4, APIs: 4, Instructions: 406
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 0000024EB5E137EC
VirtualAlloc.KERNEL32 ref: 0000024EB5E139CE
VirtualAlloc.KERNEL32 ref: 0000024EB5E13A57
VirtualFree.KERNELBASE ref: 0000024EB5E13AB3

Memory Dump Source

Source File: 00000004.00000002.3329850570.0000024EB5E10000.00000020.00000001.00040000.00000000.sdmp, Offset: 0000024EB5E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_24eb5e10000_sihost.jbxd

Yara matches

Similarity

API ID: Virtual$Alloc$Free
String ID:
API String ID: 3668210933-0
Opcode ID: 60595fa5053f1866d63c87b1b8d7f0fee698ebc8641127cacdaf14d5899dacb3
Instruction ID: 48348d5cc30b1550d8d06f8e5947d455fe652339ea161bb8d7c4c377ffb95f17
Opcode Fuzzy Hash: 60595fa5053f1866d63c87b1b8d7f0fee698ebc8641127cacdaf14d5899dacb3
Instruction Fuzzy Hash: BCD15630614A094BFF78EB28CC99BAA73D1FB5C30CF55457DD48BC7286DA24E9468742

Function 00007FF848FFCB88 Relevance: 3.5, Strings: 2, Instructions: 1008
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

[-Gi, xrefs: 00007FF84900DB33
C4_L, xrefs: 00007FF84900E16F

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID:
String ID: C4_L$[-Gi
API String ID: 0-1041822024
Opcode ID: dfaf711af4b613d7534c71d6bc116d83c94e324345b798efb851285d4dc504c5
Instruction ID: cdc207a9f3ad8d4c93ac8843316fd6a5267e9f32f21474a22ede9c61a778dd42
Opcode Fuzzy Hash: dfaf711af4b613d7534c71d6bc116d83c94e324345b798efb851285d4dc504c5
Instruction Fuzzy Hash: 5772743091CA899FDF98EF28C495BA97BE1FF59344F1401EDD44ED7292DA24E842CB81

Function 00007FF848FF5960 Relevance: 2.6, Strings: 1, Instructions: 1357COMMON

Download Yara Rule

Strings

@, xrefs: 00007FF84902210D

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 7bcae29d72fc093ccf68a9a2c7dcf28dec4fa0fcc8172f1cb409f0d7ff5ab0ab
Instruction ID: db87d97f1de3737fddc5f250dac2083b35f7cc3174b6d725c5b5b305c3d353bd
Opcode Fuzzy Hash: 7bcae29d72fc093ccf68a9a2c7dcf28dec4fa0fcc8172f1cb409f0d7ff5ab0ab
Instruction Fuzzy Hash: 09A24930918A8A4FEBACEF58C8957B973E1FF59354F54457DD48AC7292CA28EC42CB40

Function 00007FF848FFC939 Relevance: 2.2, Strings: 1, Instructions: 920
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

z5_^, xrefs: 00007FF848FFCA01

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID:
String ID: z5_^
API String ID: 0-3063318007
Opcode ID: 5760202720cd516495280400df15b46d08491c81333f526abd76c0c30aa1d86d
Instruction ID: 6f6846ec747445c1c8d74fbc6c8acdd5ac1e29b2c7831f5f130dcc77ea66dc29
Opcode Fuzzy Hash: 5760202720cd516495280400df15b46d08491c81333f526abd76c0c30aa1d86d
Instruction Fuzzy Hash: 79623A31A0C94A8FDB98FF28C490BA577E1FF98344F1444AAD54EDB2D6DB35A842CB44

Function 00007FF849230C9F Relevance: 1.9, APIs: 1, Instructions: 369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3339175273.00007FF849230000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF849230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff849230000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c342c68c14476c785ff6824844d339e1b63480a17e7764126b513857a37514c6
Instruction ID: 6fcfa636d472df6e2c5475e3490b5a37fd4e24bd0349b04a9374d3b215be647e
Opcode Fuzzy Hash: c342c68c14476c785ff6824844d339e1b63480a17e7764126b513857a37514c6
Instruction Fuzzy Hash: A6B10531E1C6994FEB79BB7898562B97BE0EF55350F04017FD09EC3193DE28A8468782

Function 00007FF848FF1332 Relevance: 1.7, APIs: 1, Instructions: 228nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 00007FF848FF30B1

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 23572fceca3b68fa246262d4ce7fd4c89d6eff11b2dc1af3ac1fb6cd3fd28465
Instruction ID: f88a8d165f7373a8ab4d2809ccfb580a79aa8bcf874777333ad9f7b3dfd5d6e3
Opcode Fuzzy Hash: 23572fceca3b68fa246262d4ce7fd4c89d6eff11b2dc1af3ac1fb6cd3fd28465
Instruction Fuzzy Hash: 6F614C3190DA894FD709EB6CD8955F87FA0EF46365F0842BFD088C7193DB64684AC791

Function 00007FF848FF2FE6 Relevance: 1.7, APIs: 1, Instructions: 161nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 00007FF848FF30B1

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: f7a1de9979badb2aa948a1b7e0e7db032b063b8b50bd140f408018164e27a17d
Instruction ID: c021abb4ce4e4a22563810b71c359c787d0edd43d3cf4f6c099f3efd2183b600
Opcode Fuzzy Hash: f7a1de9979badb2aa948a1b7e0e7db032b063b8b50bd140f408018164e27a17d
Instruction Fuzzy Hash: 7541273090DBC84FD71A97A89C555E9BFF1EF57324F0842AFD088C7193CA69584AC792

Function 00007FF848FF24B8 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE ref: 00007FF848FF25B8

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 24cd3511078c3dc5780ca914db6f473356d83f41f912a6d63a3612a5d0e7a33f
Instruction ID: 85c304a17812f891d558fdbb736bcce37777a2a7d790aad575f1203f68f9e24f
Opcode Fuzzy Hash: 24cd3511078c3dc5780ca914db6f473356d83f41f912a6d63a3612a5d0e7a33f
Instruction Fuzzy Hash: 1E41F93190DB884FDB19DB6C98456E8BBF0EF56321F0842AFE049D3192DB78A845C795

Function 00007FF848FFCBD8 Relevance: 1.2, Instructions: 1171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c287e06b61c6df4f72e64a40b76c35958920066ee58c376784187b2e968f769d
Instruction ID: adfcc6586ad504ee412d29842635409906109d6835594b3d4fc1421be3546e8b
Opcode Fuzzy Hash: c287e06b61c6df4f72e64a40b76c35958920066ee58c376784187b2e968f769d
Instruction Fuzzy Hash: 63923C70A1894A8FDF98EF28C495BA977E1FF58344F1441ADD44EC7292DB35E842CB41

Function 00007FF849006DFB Relevance: .8, Instructions: 850COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0923150fcd9a04ca9cb3b9da5aa2017fde3ff7fcb8d539721f0893b59767de58
Instruction ID: c1d84d431e34513bfbd5860abb5fdaaa0887b2ecfe0dc013236039b4f7f9cbea
Opcode Fuzzy Hash: 0923150fcd9a04ca9cb3b9da5aa2017fde3ff7fcb8d539721f0893b59767de58
Instruction Fuzzy Hash: B342D621E1DAC78EEBB9AA28A4546B577D1FF95780F1445FEC04EC31C2EE2CE8428351

Function 00007FF848FFCA58 Relevance: .8, Instructions: 841COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 083cda04a1b92c15e22e9a965fdc58290643507e2985fef46dadd8832b117b01
Instruction ID: 17cdcd3f3e28a1caa13b3e001d092a27ddd9875397ddd17b21d0cab52e811329
Opcode Fuzzy Hash: 083cda04a1b92c15e22e9a965fdc58290643507e2985fef46dadd8832b117b01
Instruction Fuzzy Hash: 12523D30A1CA8A8FEFA9EF28D495AA977E1FF58344F5441B9D40DC7296DE34E841CB40

Function 00007FF848FFF6A3 Relevance: .8, Instructions: 787COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 938cc36c2e31927d415235c6575b9889962a2c3c243eafedf8ad163c4fd8c712
Instruction ID: 4f7d3847202c8dd00008ddf2bf01ac686c96469c16a8969dd46ee46bc67ee6c7
Opcode Fuzzy Hash: 938cc36c2e31927d415235c6575b9889962a2c3c243eafedf8ad163c4fd8c712
Instruction Fuzzy Hash: D3320630A1CE494FEB69FB2888556F977D2EF59340F1405BED94EC72D3DE28A8028785

Function 00007FF849233A1D Relevance: .5, Instructions: 549COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3339175273.00007FF849230000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF849230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff849230000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 104ca61a4a4f19e0dbcc794025e696420547e90b3ebc85c1b1dff6a75950e94a
Instruction ID: 0cbf953344026f0f7c0fee30e5db1400d5fb3c5403fcb74ab2c5f1f3e62bbf26
Opcode Fuzzy Hash: 104ca61a4a4f19e0dbcc794025e696420547e90b3ebc85c1b1dff6a75950e94a
Instruction Fuzzy Hash: 45126030A1C99A8FEBA8EF68C4557BA77E1FF58344F5405BAD05DD72D2CE28A842C740

Function 00007FF849231B9D Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3339175273.00007FF849230000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF849230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff849230000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c8ef870b8481ae660a4b839ec0933d3aee2b119160d7357e57990d610032ce0
Instruction ID: e9826baccdf5e854133b36ad375a9fcab642507b0fa3a81af3483b2e233524e3
Opcode Fuzzy Hash: 7c8ef870b8481ae660a4b839ec0933d3aee2b119160d7357e57990d610032ce0
Instruction Fuzzy Hash: 2CD14631A1DA994FF779AB3C48555B97BE2EF86350B0841BBD05ED71D3DE28A8028341

Function 00007FF849007790 Relevance: .4, Instructions: 433COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaf3d21019396a8e9e7baaf564aad04617e2e8d11eb1d3e8b33f8134c8019de9
Instruction ID: fe0e3fcb98e223169976a2ee3555c3e4563b3369dc8d7058843b43aeb429c778
Opcode Fuzzy Hash: eaf3d21019396a8e9e7baaf564aad04617e2e8d11eb1d3e8b33f8134c8019de9
Instruction Fuzzy Hash: 5EF16330618A468FDB69DE28D8956B6B3E1FF99344F14457DC49E83186DF38B842C781

Function 00007FF848FF2B4A Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a40f147608364735fe880e72b25139f91784296c3e4171a2c356d90a006ae6e
Instruction ID: 40c40ca741a8fbfbc6ddc5185bd5374660d5abb433cd6165509c4e811a34a6a8
Opcode Fuzzy Hash: 6a40f147608364735fe880e72b25139f91784296c3e4171a2c356d90a006ae6e
Instruction Fuzzy Hash: 59D1E231E1C94A4FE799EB6898652FDB7E1FF88750F5840BAD50EC32C2DF2868428745

Function 0000024EB5E13B97 Relevance: .4, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3329850570.0000024EB5E10000.00000020.00000001.00040000.00000000.sdmp, Offset: 0000024EB5E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_24eb5e10000_sihost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fada67dd69a878079f445c3374591fcb82eea671de6f7e20ef545f7ea71a1fb7
Instruction ID: 149918a0fb826c5baf87f57800d524ef075c46ba65f135c5b23b6427cda7afc9
Opcode Fuzzy Hash: fada67dd69a878079f445c3374591fcb82eea671de6f7e20ef545f7ea71a1fb7
Instruction Fuzzy Hash: 69E14C71508B488FEF59DF28C889AAAB7E2FF98304F14466DE84AC7155DF30E945CB42

Function 0000024EB5E23B97 Relevance: .4, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3329877059.0000024EB5E20000.00000020.80000000.00040000.00000000.sdmp, Offset: 0000024EB5E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_24eb5e20000_sihost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fada67dd69a878079f445c3374591fcb82eea671de6f7e20ef545f7ea71a1fb7
Instruction ID: 9b0e1f5bd637090aff85aeaf1009fdacde4cbc478002b2b09ffac70d0b8b24a3
Opcode Fuzzy Hash: fada67dd69a878079f445c3374591fcb82eea671de6f7e20ef545f7ea71a1fb7
Instruction Fuzzy Hash: 06E14D31508B488BEF59DF28D889AAAB7E2FF98304F14462EE84BC7155DF31E5468B41

Function 00007FF849043070 Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df321609bf2f6019d5c084f60ef762129d0b57a6208c38585fe93d867ef5c2a2
Instruction ID: 3e0fec29ed30b665e894447f2be3fa26b70402914944fec7d687d265286a9410
Opcode Fuzzy Hash: df321609bf2f6019d5c084f60ef762129d0b57a6208c38585fe93d867ef5c2a2
Instruction Fuzzy Hash: 83B11331A1CA8A4FEBA9EF2C94556B977E1FF59391F0801BAD04EC71D2CE28E8458741

Function 00007FF848FFC205 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89cb8a15862a3d0dc9e9d002925f42c3e722f152126b4958b51910ce609db11a
Instruction ID: c1c0af6dee51071b9ddc4cd9995c460c302306898f78276bd85576dafdf19509
Opcode Fuzzy Hash: 89cb8a15862a3d0dc9e9d002925f42c3e722f152126b4958b51910ce609db11a
Instruction Fuzzy Hash: ADA17762A1DAD65FE759BB7C94565F07BC0EF42760F0841BAC0CECB1D3EE09A8468349

Function 0000024EB5E2292C Relevance: 7.6, APIs: 5, Instructions: 115
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 0000024EB5E22939
VirtualProtect.KERNEL32 ref: 0000024EB5E22991
VirtualProtect.KERNEL32 ref: 0000024EB5E229BA
VirtualProtect.KERNEL32 ref: 0000024EB5E229F7
VirtualProtect.KERNEL32 ref: 0000024EB5E22A1B

Memory Dump Source

Source File: 00000004.00000002.3329877059.0000024EB5E20000.00000020.80000000.00040000.00000000.sdmp, Offset: 0000024EB5E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_24eb5e20000_sihost.jbxd

Yara matches

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: 8376526e6f9b08ac5ded5f047546a3d77998a4ba4b3fbcf6a418e03179d0eef1
Instruction ID: ca0493555cf12c94009ad198da440ae774becb4c0b7d2a6842ad959ac0220020
Opcode Fuzzy Hash: 8376526e6f9b08ac5ded5f047546a3d77998a4ba4b3fbcf6a418e03179d0eef1
Instruction Fuzzy Hash: 0531913171CA084FEF69AA58AC5936973D5FBD8324F010669EC4BC72C9ED61DD0587C1

Function 0000024EB5E1291F Relevance: 3.1, APIs: 2, Instructions: 122
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32 ref: 0000024EB5E12991
VirtualProtect.KERNEL32 ref: 0000024EB5E129F7

Memory Dump Source

Source File: 00000004.00000002.3329850570.0000024EB5E10000.00000020.00000001.00040000.00000000.sdmp, Offset: 0000024EB5E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_24eb5e10000_sihost.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: bfda783f5ca1fd6fb9186c17778dacb2659a1bebf61e0df8ac96dde0cb6dbf3c
Instruction ID: 238674f87fee1462fe41387f8c262c24a82042ec20c32dcb90a1ab46e92037be
Opcode Fuzzy Hash: bfda783f5ca1fd6fb9186c17778dacb2659a1bebf61e0df8ac96dde0cb6dbf3c
Instruction Fuzzy Hash: B431613171CA084FEF69AA5C9C5936973D5FB98324F050269EC4BC32C6EE60DD4687C2

Function 0000024EB5E22A37 Relevance: 3.1, APIs: 2, Instructions: 95
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32 ref: 0000024EB5E22AA9
VirtualProtect.KERNEL32 ref: 0000024EB5E22AD2

Memory Dump Source

Source File: 00000004.00000002.3329877059.0000024EB5E20000.00000020.80000000.00040000.00000000.sdmp, Offset: 0000024EB5E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_24eb5e20000_sihost.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 18a4ee0c0fbbbd8b54119e5cc46d63908d3b74472e1bde1c0fec93ee136364e9
Instruction ID: 7789d11d26f460eb2520df089a8614656abaccbbdd9603fa1690754c2cd11cba
Opcode Fuzzy Hash: 18a4ee0c0fbbbd8b54119e5cc46d63908d3b74472e1bde1c0fec93ee136364e9
Instruction Fuzzy Hash: E421223120CA094FEF58FF58DC882AA37E6FB94354F00056AEC4BC718AEE64D94287C1

Function 0000024EB5E12984 Relevance: 3.1, APIs: 2, Instructions: 85
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32 ref: 0000024EB5E12991
VirtualProtect.KERNEL32 ref: 0000024EB5E129F7

Memory Dump Source

Source File: 00000004.00000002.3329850570.0000024EB5E10000.00000020.00000001.00040000.00000000.sdmp, Offset: 0000024EB5E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_24eb5e10000_sihost.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d51cd149a33023f9f63d0840ea467992e07603848864701ae833ffcc32a164d4
Instruction ID: e37348bac5e19592b4325c706876f1217e7fcc90d247d91fd3f864f915c4efcf
Opcode Fuzzy Hash: d51cd149a33023f9f63d0840ea467992e07603848864701ae833ffcc32a164d4
Instruction Fuzzy Hash: B1217F3171CA184BEF69AA5CAC5936973D1FBD8724F110269EC4BC32C6DD64DD0287C2

Function 0000024EB5E22AFC Relevance: 3.0, APIs: 2, Instructions: 41
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32 ref: 0000024EB5E22B0F
VirtualProtect.KERNEL32 ref: 0000024EB5E22B33

Memory Dump Source

Source File: 00000004.00000002.3329877059.0000024EB5E20000.00000020.80000000.00040000.00000000.sdmp, Offset: 0000024EB5E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_24eb5e20000_sihost.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: cfae08904b5e4da564dc9ff95eef1beca8b2af7edbc7850c7c6da6351f9cbcf2
Instruction ID: 6660754e02833a815e0d5f2222a8984dc954f5904c970c4543e1f36052bc1f11
Opcode Fuzzy Hash: cfae08904b5e4da564dc9ff95eef1beca8b2af7edbc7850c7c6da6351f9cbcf2
Instruction Fuzzy Hash: 8FF0E93070C7444BEB14EA58A85A269B3D2FBC4314F10145AE88BC328ACD55DD578782

Function 00007FF84923512D Relevance: 1.8, APIs: 1, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3339175273.00007FF849230000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF849230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff849230000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8013d0b25fe2130a8da41c916c502543bf38a8ef32a1d68c7d565a22dddd2b0e
Instruction ID: c843355d20c5e963d9d66ce7f6e7acf305bd32c53dea003565a20065c8f6ad3e
Opcode Fuzzy Hash: 8013d0b25fe2130a8da41c916c502543bf38a8ef32a1d68c7d565a22dddd2b0e
Instruction Fuzzy Hash: 3BB1E63190C69D8FEB64EF68D845AE97BE1FF59320F1401BBE44DC7282DA34A845CB41

Function 00007FF848FF151A Relevance: 1.8, APIs: 1, Instructions: 267COMMON

Download Yara Rule

APIs

K32GetModuleBaseNameW.KERNEL32 ref: 00007FF84902F415

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID: BaseModuleName
String ID:
API String ID: 595626670-0
Opcode ID: 9f26d4dab2cca1f9fac8cb7dcb1a5eac69899935286dc1d360101d68b21785a1
Instruction ID: 85ff7456f784aa0f717bd93ea782ef99347c922420af00696d3d3c34bfb53fec
Opcode Fuzzy Hash: 9f26d4dab2cca1f9fac8cb7dcb1a5eac69899935286dc1d360101d68b21785a1
Instruction Fuzzy Hash: B491AE30508A8D8FEBA9EF18C8457F937E1FF59340F14822AD84EC7282CB74A945CB81

Function 00007FF848FF152A Relevance: 1.8, APIs: 1, Instructions: 258COMMON

Download Yara Rule

APIs

K32GetModuleBaseNameW.KERNEL32 ref: 00007FF84902F415

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID: BaseModuleName
String ID:
API String ID: 595626670-0
Opcode ID: 1720b17bae01793d51a728b3343e2f602b62aa07d6c376c37e30e0058d983bbf
Instruction ID: c321ff3e7065af193c88693fecbbe5a57c56906887791d2d02243b91306708cc
Opcode Fuzzy Hash: 1720b17bae01793d51a728b3343e2f602b62aa07d6c376c37e30e0058d983bbf
Instruction Fuzzy Hash: 29819E30518A8D8FDBA9EF18C8457F977E1FF59340F14822AD84EC7282DB74A945CB81

Function 0000024EB5E2352F Relevance: 1.7, APIs: 1, Instructions: 236COMMON

Download Yara Rule

APIs

CLRCreateInstance.MSCOREE ref: 0000024EB5E2357E

Memory Dump Source

Source File: 00000004.00000002.3329877059.0000024EB5E20000.00000020.80000000.00040000.00000000.sdmp, Offset: 0000024EB5E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_24eb5e20000_sihost.jbxd

Yara matches

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: e37ef25e2111d73c0337327c8f8530a4bc554f1c567b3b8c72cc7807f61a1e03
Instruction ID: c7f0ca0bcb6b8e8a8c9a2480ff55f5eede6bc258089bdfd8e678e6a184d9b5c0
Opcode Fuzzy Hash: e37ef25e2111d73c0337327c8f8530a4bc554f1c567b3b8c72cc7807f61a1e03
Instruction Fuzzy Hash: EB815231208B488FEB68DF28C889BA6B7E5FF99309F014A6DD48BC7155EA31E5458B41

Function 00007FF84902EFF3 Relevance: 1.7, APIs: 1, Instructions: 211COMMON

Download Yara Rule

APIs

K32GetModuleInformation.KERNEL32 ref: 00007FF84902F14B

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID: InformationModule
String ID:
API String ID: 3425974696-0
Opcode ID: 9523907ac102b513e677b4737da8d973925180a3a62c74aa5de729a6d58de9f3
Instruction ID: 436022a9a3269494eaba4a8c6bb1a2c150fa86bd55d9a620715f267c2647dbdd
Opcode Fuzzy Hash: 9523907ac102b513e677b4737da8d973925180a3a62c74aa5de729a6d58de9f3
Instruction Fuzzy Hash: 8451073190CA8C8FDB58EF68D846AF9BBF0EF56311F04426AD04DD7252DA74A846CB91

Function 00007FF848FF2174 Relevance: 1.7, APIs: 1, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b1ba17914a082f8991f91d4dcfab1e3519167f81a551f0be84bd6ee5843c515
Instruction ID: a06af77f117e70d7566170838daabc5042ea50c1d2a0e951ef63c8975e31c696
Opcode Fuzzy Hash: 1b1ba17914a082f8991f91d4dcfab1e3519167f81a551f0be84bd6ee5843c515
Instruction Fuzzy Hash: 7C41023190CA4C8FDB68AB9898056FA7BE0EF95310F00427FD04ED3292DF74A845CB90

Function 00007FF848FF21B2 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32 ref: 00007FF848FF229A

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 5d8f6e93735d53084d69d96ad427a6a2b1c4a671f56866e1986fbacceac8675d
Instruction ID: 5e46144c2601668394c00c654cefb32e7eed2fa636edd1e858b95a565fe9c63f
Opcode Fuzzy Hash: 5d8f6e93735d53084d69d96ad427a6a2b1c4a671f56866e1986fbacceac8675d
Instruction Fuzzy Hash: 7F41D33190CB588FD719DB98D845AFA7BE0EB55321F04426FD04AD3292CB74A945CB91

Function 00007FF848FF150A Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

APIs

K32GetModuleInformation.KERNEL32 ref: 00007FF84902F14B

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID: InformationModule
String ID:
API String ID: 3425974696-0
Opcode ID: a426db13b0ad2385b4b6f960a77cc2b370df9c5aa3753378a5d8fc7917a03a79
Instruction ID: 86cf4185242b5402b11f668a7779aeb2a9eba7456ca35593feaefb51bd796bbd
Opcode Fuzzy Hash: a426db13b0ad2385b4b6f960a77cc2b370df9c5aa3753378a5d8fc7917a03a79
Instruction Fuzzy Hash: 02417F31908A4C8FDB58EF98D849BF9B7F1FB98311F00826AD40DD7256CA70A885CB81

Function 00007FF849237ECD Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

APIs

shutdown.WS2_32 ref: 00007FF849237F9E

Memory Dump Source

Source File: 00000004.00000002.3339175273.00007FF849230000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF849230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff849230000_sihost.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: 600cf3a07adde0db239f0f963a83f0233583966f03a9eadeeea6843f639ad918
Instruction ID: b7ee090042ac39b5ada891b8c4d7abede7ed59ed4a585fce8ed70c21ee7cc5f0
Opcode Fuzzy Hash: 600cf3a07adde0db239f0f963a83f0233583966f03a9eadeeea6843f639ad918
Instruction Fuzzy Hash: 4941D57190CA5C8FDB68EFA8D8466E9BBF0FB55310F00426BD00CD7252CB346946CB91

Function 00007FF848FF14DA Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32 ref: 00007FF84902EF91

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID: EnumModulesProcess
String ID:
API String ID: 1082081703-0
Opcode ID: c1a2d7019c96b776c7a3e7283ba0372e0280d9b8092f04749c424a3adfb697d2
Instruction ID: 0e6fbf857c09c3b6e0bf3f982cd852a3384e779cd9fac5c6df97cd48227bf86f
Opcode Fuzzy Hash: c1a2d7019c96b776c7a3e7283ba0372e0280d9b8092f04749c424a3adfb697d2
Instruction Fuzzy Hash: BB416E30908A5C8FDB58EF98D849AFDB7F1EB98311F10416FD40DD7252CA70A885CB81

Function 00007FF848FF276D Relevance: 1.6, APIs: 1, Instructions: 128COMMON

Download Yara Rule

APIs

EnumWindows.USER32 ref: 00007FF848FF2822

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 40d63ad4ab9ef78772e4a67218b98477ef0c4a6405be93eb20f9d67bbb96b958
Instruction ID: 3c31ac6802ead0e7d283e07d64e4b4cc1d2971bd57febb75050a5accabf3d65d
Opcode Fuzzy Hash: 40d63ad4ab9ef78772e4a67218b98477ef0c4a6405be93eb20f9d67bbb96b958
Instruction Fuzzy Hash: 7131E231A0CA588FDB58EF68C84A7F97BE1EF59311F04416BD44DC7292DB74A801CB91

Function 00007FF848FF12F2 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

EnumWindows.USER32 ref: 00007FF848FF2822

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 16569c5e348fcd4b2bfe672cebbf23e519282e54926cc2f1595aa1f75171bf5f
Instruction ID: 5a6519fbaec6e2b5a60a9a135cfbde92944dd9c2ad7fdc2d634ea9c6ffa73c25
Opcode Fuzzy Hash: 16569c5e348fcd4b2bfe672cebbf23e519282e54926cc2f1595aa1f75171bf5f
Instruction Fuzzy Hash: 56317071A0CA1C8FDB98EF58C84A7BD77E1EB59311F14412BD44ED3292DB74A812CB91

Function 0000024EB5E12A37 Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 0000024EB5E12AA9

Memory Dump Source

Source File: 00000004.00000002.3329850570.0000024EB5E10000.00000020.00000001.00040000.00000000.sdmp, Offset: 0000024EB5E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_24eb5e10000_sihost.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 21ee1aac594a535b75769d2789b3ff089ba461df40fcfc1960a676b839515576
Instruction ID: 1babd8905cf3cc7c7ea4fba823c4faa80250b8dbef74b544f9d8d19d787ce4cd
Opcode Fuzzy Hash: 21ee1aac594a535b75769d2789b3ff089ba461df40fcfc1960a676b839515576
Instruction Fuzzy Hash: D521F23120CA094FEF58EF69DC896AA77D6FB94354F010169DC4BC718AEE64D94287C2

Function 0000024EB5E12AFC Relevance: 1.5, APIs: 1, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 0000024EB5E12B0F

Memory Dump Source

Source File: 00000004.00000002.3329850570.0000024EB5E10000.00000020.00000001.00040000.00000000.sdmp, Offset: 0000024EB5E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_24eb5e10000_sihost.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: cfae08904b5e4da564dc9ff95eef1beca8b2af7edbc7850c7c6da6351f9cbcf2
Instruction ID: dcdf73d32a754f1852e3685ca1a93b600e9fb8e6bd795cab4c49a92dd05c9a8b
Opcode Fuzzy Hash: cfae08904b5e4da564dc9ff95eef1beca8b2af7edbc7850c7c6da6351f9cbcf2
Instruction Fuzzy Hash: E2F0E93030C7484BEB14EA59AC5A269B3D2FBC4314F14106AE88BC3286D954DD478783

Function 0000024EB5E2291F Relevance: 1.5, APIs: 1, Instructions: 33memorylibraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0000024EB5E22939
VirtualProtect.KERNEL32 ref: 0000024EB5E22991
VirtualProtect.KERNEL32 ref: 0000024EB5E229BA
VirtualProtect.KERNEL32 ref: 0000024EB5E229F7
VirtualProtect.KERNEL32 ref: 0000024EB5E22A1B

Memory Dump Source

Source File: 00000004.00000002.3329877059.0000024EB5E20000.00000020.80000000.00040000.00000000.sdmp, Offset: 0000024EB5E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_24eb5e20000_sihost.jbxd

Yara matches

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: e4a5286ffe1b2342e106e94802514f7029e58dd553e54f75e1adad82c9e662dd
Instruction ID: a23511867953195bbd5007bf3b22c4ec6d4e7e17043252a9986839b021a2aa0c
Opcode Fuzzy Hash: e4a5286ffe1b2342e106e94802514f7029e58dd553e54f75e1adad82c9e662dd
Instruction Fuzzy Hash: 5DE0263160CA0D0FFB6CAA9CDC8A3B563C8F798279F00003EE58AC2216F046D8824391

Function 00007FF848FF2601 Relevance: 1.4, APIs: 1, Instructions: 140COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF848FF269C

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 2d1f74e8073297a2b416e59878d255c5593ac42ad1315b159a27d3704190981c
Instruction ID: 4726babada3a17551d6ec23dc6cf48f5215d3f4ec2f2baddbc871c4d87ae24f2
Opcode Fuzzy Hash: 2d1f74e8073297a2b416e59878d255c5593ac42ad1315b159a27d3704190981c
Instruction Fuzzy Hash: C941263180CA899FDB5DDB6888456E9BBE0FF56321F0842AFC049C35D2DB746855CB91

Function 00007FF848F4055B Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3336140488.00007FF848F40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f40000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62766e366a233b107f49519b5b6432fb784922b47b3d16ca94a836e775abead0
Instruction ID: 6018ee524d5104887b6fcc13f9aa96bfe82c7a113285434a4ee1b4af6ec66329
Opcode Fuzzy Hash: 62766e366a233b107f49519b5b6432fb784922b47b3d16ca94a836e775abead0
Instruction Fuzzy Hash: 56610A2061D9882FE395F77C44AA6BA7FE1EF9A550F5804F9D4C9DB2A3DD189842C340

Function 00007FF848F40D36 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3336140488.00007FF848F40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f40000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96fa98aa7ad1b7843ff259b886fe18ec823dd71b60add948254a9041bf29d28f
Instruction ID: fc894af7b7a0124bb17397ac28e66d6caf42365ecdc9ae8c265d361ee0f77903
Opcode Fuzzy Hash: 96fa98aa7ad1b7843ff259b886fe18ec823dd71b60add948254a9041bf29d28f
Instruction Fuzzy Hash: 95519031A1D8489FDB95FB2C8459AA97BE1EFA9341B0500FAE44DCB2B3DE24EC41C741

Function 00007FF848F400B8 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3336140488.00007FF848F40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f40000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 022e69cae10d43dc94be0ea51e25852044459a55aa0657d19e8d238faa00d05e
Instruction ID: e70cbaa206d7e8e93c57f2144daa96fbd469c3a2419a03e2b43a0f028eee7111
Opcode Fuzzy Hash: 022e69cae10d43dc94be0ea51e25852044459a55aa0657d19e8d238faa00d05e
Instruction Fuzzy Hash: 47517D30A198489FDB94FB2CC459A697BE1FFA9741B0500BAE44ED72B2DE24EC41C741

Function 00007FF848F40A9C Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3336140488.00007FF848F40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f40000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cec22daed85d58cd233f79aa98f855a77ca1d3afab01bcbc75d5f6da9c9ae093
Instruction ID: 99f5cc8570c89ec1e3e92f44e2792fb4de89f1f5444585436a84383cea325a09
Opcode Fuzzy Hash: cec22daed85d58cd233f79aa98f855a77ca1d3afab01bcbc75d5f6da9c9ae093
Instruction Fuzzy Hash: 5C51F720A1DE816FE709B37858266AAFFE1EF49240F6855FEE089C32C3DD1998018755

Function 00007FF848F40991 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3336140488.00007FF848F40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f40000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 327453114d5fa0c643452c2e3bc58b452bdb5b6d951d8034ef92d2ee83a6c2fd
Instruction ID: b2fd1efe88e784f98a12fb09b83bb3bc8f92f45557f67e0d68a1fa7099b26590
Opcode Fuzzy Hash: 327453114d5fa0c643452c2e3bc58b452bdb5b6d951d8034ef92d2ee83a6c2fd
Instruction Fuzzy Hash: 0641E47080D3889FD74AAB789C156E47FE0EFA6321F0941EFC088CB193C758584AC7A2

Function 00007FF848F40C59 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3336140488.00007FF848F40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f40000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1447cbb7869594855696833fde0e81459870a908e5fcbe8ad14b60ed8327052c
Instruction ID: 883fdf7174e3817bedcd7fd644f98606f6c949708709ca7410f3d9723003135b
Opcode Fuzzy Hash: 1447cbb7869594855696833fde0e81459870a908e5fcbe8ad14b60ed8327052c
Instruction Fuzzy Hash: 6021D120A1E9896FE386B37C486976A7BD1DF9A204F0804FAD489CB2F3DD1D9C46C341

Function 00007FF848F404A9 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3336140488.00007FF848F40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f40000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 883423d53aa0fb09e80f79126376c63e2aebafcf6c69355891496c6551bd98fc
Instruction ID: f2839fe08de8cc24ab992e63eb4f972ff619e3ac21755a8912ee634519482049
Opcode Fuzzy Hash: 883423d53aa0fb09e80f79126376c63e2aebafcf6c69355891496c6551bd98fc
Instruction Fuzzy Hash: 1A21037090DAD85FE7A2F778485A6AE7FF1EF9A650F0400EFD489C7193DA281802C741

Function 00007FF848F40C91 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3336140488.00007FF848F40000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848f40000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbf7902d66dbeac3e041cc3ef0f4b69d7071a91ddadf8da783370193cdef7c6f
Instruction ID: 153a26d654b8a6778f8d517bf556c77b218f0fc9e6a2424a643b1e0c9ae8def3
Opcode Fuzzy Hash: cbf7902d66dbeac3e041cc3ef0f4b69d7071a91ddadf8da783370193cdef7c6f
Instruction Fuzzy Hash: 6511A1606199856FE78AB77844697AA7BD2DF8A604F0404FDD489C72F3DE2998468340

Non-executed Functions

Function 00007FF848FFCDF8 Relevance: 4.0, Strings: 3, Instructions: 290COMMON

Download Yara Rule

Strings

v5_^, xrefs: 00007FF848FFCE01
[v5, xrefs: 00007FF848FFCE5F
t5_^, xrefs: 00007FF848FFD001

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID:
String ID: t5_^$v5_^$[v5
API String ID: 0-441636731
Opcode ID: a00236fcb5a5742462eaf363ec5e0e8560cd7cd25983e0ebaba34970c650d30c
Instruction ID: 04f3eaf200e0d419beeb8752cfeb9971de0a6f78c7c60c15a7f157833accc688
Opcode Fuzzy Hash: a00236fcb5a5742462eaf363ec5e0e8560cd7cd25983e0ebaba34970c650d30c
Instruction Fuzzy Hash: BC8158A3D4D9662EE758B77CB8810F97790EF412A4F0C457BD28DCB1C3DF18A8468698

Function 00007FF8490012D8 Relevance: 1.5, Strings: 1, Instructions: 298COMMON

Download Yara Rule

Strings

15_^, xrefs: 00007FF849001301

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID:
String ID: 15_^
API String ID: 0-4202912459
Opcode ID: b4a4274447a1e064c941891ca4f7b84e6cb312dc43c0aacea821a612a68f26b5
Instruction ID: d82b600c5b5b169ae72e264e66c38c2b84aa3916ba22ff23ec6ec30b4c6a425a
Opcode Fuzzy Hash: b4a4274447a1e064c941891ca4f7b84e6cb312dc43c0aacea821a612a68f26b5
Instruction Fuzzy Hash: 9FA1FCA7C4E6D21EE75E7A78B8515F63F10EF42668B0C81F7D08C8E0A3DE085545C7A9

Function 00007FF848FFD578 Relevance: 1.4, Strings: 1, Instructions: 188COMMON

Download Yara Rule

Strings

m5_^, xrefs: 00007FF848FFD701

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID:
String ID: m5_^
API String ID: 0-2069424849
Opcode ID: f92ab4069c455a39f69131b31b0534cfff05eb6a2e197ba2e17d977b8620df0d
Instruction ID: 23d64589733ce02c53645c4cebb009ee437e21eaf78533bac5e50217c9df65d9
Opcode Fuzzy Hash: f92ab4069c455a39f69131b31b0534cfff05eb6a2e197ba2e17d977b8620df0d
Instruction Fuzzy Hash: 6A5193E688E5A23EE24DB7B8F4520F53750EF016ACF0CD5B6D09C8D093DF1864458AAD

Function 00007FF849005BD3 Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

4_^, xrefs: 00007FF849005C01

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID:
String ID: 4_^
API String ID: 0-3117248850
Opcode ID: 71e196f22f7704f3eaa6ac57a753390f7b932202c27c51f3d8bb44d7075cb2aa
Instruction ID: 72db9d3e1c7ef4372c2aed3666fcc8f93f9100c663b449bb6501139f1502a4f3
Opcode Fuzzy Hash: 71e196f22f7704f3eaa6ac57a753390f7b932202c27c51f3d8bb44d7075cb2aa
Instruction Fuzzy Hash: FB31C7D6C8E7633FE618BA7CB4960E53780EF027B4B0CB5B6D08C4D093ED1894429998

Function 00007FF849009B60 Relevance: 1.0, Instructions: 993COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c61967627a29d469e0c93f6153f08143d8605f7543ada790f0c78cb734958fb
Instruction ID: 112ab3694b251b3a20c863479ac92a2600e9a3b4a73181d7b0a9b10966d1bcd4
Opcode Fuzzy Hash: 6c61967627a29d469e0c93f6153f08143d8605f7543ada790f0c78cb734958fb
Instruction Fuzzy Hash: 1262393051DAC95FDB66EB3898556FA7BE0EF46350F1801FED49EC7193EA28A842C341

Function 00007FF848FFCB80 Relevance: .7, Instructions: 730COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6eb3ab97b0dd39ecb3758c1cf4b32173b01e59e60adf13d57202df70a52cfbd
Instruction ID: aa0445da2fec3e51a2608108d276ea11a7437f24cf425f32f3355f32cede201f
Opcode Fuzzy Hash: a6eb3ab97b0dd39ecb3758c1cf4b32173b01e59e60adf13d57202df70a52cfbd
Instruction Fuzzy Hash: 22329030A1CA498FDF98EF28D455AB977E1FFA8340F1441ADD44EC7292DE25E842CB81

Function 0000024EB5E13FCF Relevance: .5, Instructions: 500COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3329850570.0000024EB5E10000.00000020.00000001.00040000.00000000.sdmp, Offset: 0000024EB5E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_24eb5e10000_sihost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ae6622aa1becc6f0b3361d8082316eeb2111423ed2edd8e8b06ab6ec02ac85a
Instruction ID: 3dde882326e24ac1b20d56a90fa9215ff6345974d281b046893a414aa861ce94
Opcode Fuzzy Hash: 3ae6622aa1becc6f0b3361d8082316eeb2111423ed2edd8e8b06ab6ec02ac85a
Instruction Fuzzy Hash: 43F18530618B098BEB68EF28CC497A573E1FB54319F55463DD89BC7291EB34E842C792

Function 0000024EB5E23FCF Relevance: .5, Instructions: 500COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3329877059.0000024EB5E20000.00000020.80000000.00040000.00000000.sdmp, Offset: 0000024EB5E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_24eb5e20000_sihost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ae6622aa1becc6f0b3361d8082316eeb2111423ed2edd8e8b06ab6ec02ac85a
Instruction ID: ca59f1a7d427e26620da2b9c539ae7fbc2a8576c2ee70ff346ff713513152f1b
Opcode Fuzzy Hash: 3ae6622aa1becc6f0b3361d8082316eeb2111423ed2edd8e8b06ab6ec02ac85a
Instruction Fuzzy Hash: 60F1B530218B098BEB68EF19CC497A5B3D1FB54319F554A2DD88BC7295EF35E8028B91

Function 00007FF849002AF3 Relevance: .4, Instructions: 370COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b199fd9308e994a65bd7be8def7f12de664468a90059d895145728e354524da
Instruction ID: 3e5e38965e8c43ea72db2ff2bddd7626222312bb6c543ae1d9bd5cda092ada73
Opcode Fuzzy Hash: 5b199fd9308e994a65bd7be8def7f12de664468a90059d895145728e354524da
Instruction Fuzzy Hash: 6EB1C8E288D9927EE61CBABCF4820F97750EF013A8F0CD576D09D49093EE1874458AAD

Function 00007FF848FF10FA Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55815dfeffbe63752a4b117cb11ef8b88f7ee0b96f07b59866d74a8327fe2315
Instruction ID: 2a968b4a1338508a912a63a710c67580ce355c9015c14bf2d677543a7aa2e17d
Opcode Fuzzy Hash: 55815dfeffbe63752a4b117cb11ef8b88f7ee0b96f07b59866d74a8327fe2315
Instruction Fuzzy Hash: 5E911731F1DA995FEB69AB7C58193B977D1EF99750F0840BED04DC3283DE28A8428781

Function 00007FF849002AF0 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3a6dbc74a9df9ebd0fae764264dcd953b5be7cdc0ab1c7acf65ccd864f91b6c
Instruction ID: 1f190519d24392f64398d7844b0418e6b020508469612d278f8498ac9b76e250
Opcode Fuzzy Hash: b3a6dbc74a9df9ebd0fae764264dcd953b5be7cdc0ab1c7acf65ccd864f91b6c
Instruction Fuzzy Hash: 7791A7E68CE9A27EE61DB6BCF4820F93750EF017A8F0CD577D09C4D093AE18648549AD

Function 00007FF848FFA3FA Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1e42aa19e33c24c91d14f570f7f010c09645dbd95e0be10b21f4ecfb0a943e0
Instruction ID: e4efa0912e7ae2bcbc7ecdfc04c4185c0cd9cccd8ec2665f6cecc58169450fac
Opcode Fuzzy Hash: b1e42aa19e33c24c91d14f570f7f010c09645dbd95e0be10b21f4ecfb0a943e0
Instruction Fuzzy Hash: AA913AF295D9566FEA49B77CA4114F93B90EF81398F0C41B6D19CCB0D3DF08A48187A9

Function 00007FF848FF1328 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35ae10848d4cda9fad458db94d3bbda12dba55fe208b88a0302413a562ba65f3
Instruction ID: f14159a03bf0c6c7d63206e57765b46422c7cc896377722b505d32bd986e89a2
Opcode Fuzzy Hash: 35ae10848d4cda9fad458db94d3bbda12dba55fe208b88a0302413a562ba65f3
Instruction Fuzzy Hash: F291E562D0EAC28FE72B573C78201356FA5AFA3654B0D01FBC288CB0DFD5649D858389

Function 0000024EB5E14457 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3329850570.0000024EB5E10000.00000020.00000001.00040000.00000000.sdmp, Offset: 0000024EB5E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_24eb5e10000_sihost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84009931e7f848139f79284c09e5e23a1816cabe5d90ed6c98f401aee13329b7
Instruction ID: 5d0eb1ce3a3312eed524574f80a0ddbd96f97be02cb48b327abafc6d973a3e7a
Opcode Fuzzy Hash: 84009931e7f848139f79284c09e5e23a1816cabe5d90ed6c98f401aee13329b7
Instruction Fuzzy Hash: 65A12E31608A0C8FDB55EF28C889BEA77F5FBA8319F10462EE44AD7160EB30D645CB41

Function 0000024EB5E24457 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3329877059.0000024EB5E20000.00000020.80000000.00040000.00000000.sdmp, Offset: 0000024EB5E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_24eb5e20000_sihost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84009931e7f848139f79284c09e5e23a1816cabe5d90ed6c98f401aee13329b7
Instruction ID: bd4ae280760525c584ddbba8f3950be1af45d77b30160fd2cd67fb773574055a
Opcode Fuzzy Hash: 84009931e7f848139f79284c09e5e23a1816cabe5d90ed6c98f401aee13329b7
Instruction Fuzzy Hash: 8FA12D31608A0C8FDB55EF28C889BEA77F5FBA8315F10462EE44AC7160EB31D645CB41

Function 0000024EB5E12B4F Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3329850570.0000024EB5E10000.00000020.00000001.00040000.00000000.sdmp, Offset: 0000024EB5E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_24eb5e10000_sihost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baf9f8ba10b3c58b15deb0dbe79cd3853049ecf256b57d1b0a981b6d20cc13aa
Instruction ID: 33ad3ceef2661e16b57fa726ede6373fb15901e07387ad5b123d47478d0211b2
Opcode Fuzzy Hash: baf9f8ba10b3c58b15deb0dbe79cd3853049ecf256b57d1b0a981b6d20cc13aa
Instruction Fuzzy Hash: 89817271618B494BEBA8DF25CC897EAB7E5FB58309F01463ED89BC2141DF30E5458B82

Function 0000024EB5E22B4F Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3329877059.0000024EB5E20000.00000020.80000000.00040000.00000000.sdmp, Offset: 0000024EB5E20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_24eb5e20000_sihost.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baf9f8ba10b3c58b15deb0dbe79cd3853049ecf256b57d1b0a981b6d20cc13aa
Instruction ID: e5c093404620af875fbb4a9ca642e349d8008f4d5351aeca5640634972694670
Opcode Fuzzy Hash: baf9f8ba10b3c58b15deb0dbe79cd3853049ecf256b57d1b0a981b6d20cc13aa
Instruction Fuzzy Hash: 8E816471618B494BEBA8DF24C8897EAB7E5FB58305F014A2ED89FC2145DF30E5458BC1

Function 00007FF848FF50D3 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbca3f245e09cc090c6e49640930dfa2f0602d1a0b3f946075a8a75a46275876
Instruction ID: 7a8f2e257f8615c8200a0c2208c4da318e3cbbf45e28b16f5cdea1136c992f72
Opcode Fuzzy Hash: dbca3f245e09cc090c6e49640930dfa2f0602d1a0b3f946075a8a75a46275876
Instruction Fuzzy Hash: 74513AE299E8963FE26CB77CB4520F67B50EF052A8B0CD576D0CC8A093DE09644646A8

Function 00007FF848FF8330 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eab45629e2580248d91d3bd0761c53b6581f60286176e8214e6cdcb08887c1a
Instruction ID: 81ce939aa04c4e904ce8f98bff2fa8082c1d3086ac0521ce369cc4f0efef0f7c
Opcode Fuzzy Hash: 7eab45629e2580248d91d3bd0761c53b6581f60286176e8214e6cdcb08887c1a
Instruction Fuzzy Hash: 86513AF159DA866FD259B778AC054F53750EF012A8F0C8B7BD1AE890D3CF1460429A9D

Function 00007FF848FFE9E0 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a2dead3d81cc2ba13f90c0577daba1245b86902f464439d72bd17e966c4977b
Instruction ID: a271b03985a1f011e99083fad138c4b47514990149f408cd820154a056f4b27b
Opcode Fuzzy Hash: 9a2dead3d81cc2ba13f90c0577daba1245b86902f464439d72bd17e966c4977b
Instruction Fuzzy Hash: 8E4188E7C8E6923EE219B7B8B4560F97B50EF016B8F0CD5B7D1CC4D0939E0960458A6D

Function 00007FF8490055F2 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68e46feaaec314101b3c9b7424273102e67068dfe295e95930bfb8cfd9c9daea
Instruction ID: ab026294ed6ab51844b117453bd3d6ebb374c5a654996a92d5b7a8df7aee2413
Opcode Fuzzy Hash: 68e46feaaec314101b3c9b7424273102e67068dfe295e95930bfb8cfd9c9daea
Instruction Fuzzy Hash: 5031E1C385A73A39961835BCB4440F72384DA13BF5B48B237D54CCC063598590CB7AD4

Function 00007FF849001A7F Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca05d170a36e0c3f45624d36c6e56ff19f03a26e843bdcf197615e507d33a169
Instruction ID: 37fc86bb32bff2128e4cd747fbd19a14ae720e372734b53322eaed521e4da8b8
Opcode Fuzzy Hash: ca05d170a36e0c3f45624d36c6e56ff19f03a26e843bdcf197615e507d33a169
Instruction Fuzzy Hash: 2941B6E68CE9A27DE64C7AB8B0460F97710FF01798F0CD676D0DD8D0839F1964814AAD

Function 00007FF8490025A8 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc7c2de9dca404b95eea67251cfb59500c515c542caf17bbf69335ee09a8fea6
Instruction ID: a0761886dfa3c14d60fc96e06702d82f882cd9fc2660935ab85a203713dab77b
Opcode Fuzzy Hash: cc7c2de9dca404b95eea67251cfb59500c515c542caf17bbf69335ee09a8fea6
Instruction Fuzzy Hash: 2241DDF7899A126DE208BE7CF4814FA7350FF44675B189A7BD1DDC9043DB14A08145B4

Function 00007FF8490025A0 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e371c62c58207b73cc92d263da71412ec43bd4768bc29e2bdd9adc6a9779d3f
Instruction ID: 1c8906421999c47faf9357b78a38d0adf62591a1fd984a4b47e9afc1214b06dd
Opcode Fuzzy Hash: 1e371c62c58207b73cc92d263da71412ec43bd4768bc29e2bdd9adc6a9779d3f
Instruction Fuzzy Hash: AD311BE799D9126DE648BABCF4814E97340FF80779B18DA37D1E9C80839B24A08145F8

Function 00007FF849001AB0 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbb0adba0990282a1ce53a43167835343f613ffbf296f8927febced5037c83a5
Instruction ID: 2ee086a69856f286fc39536560b003338808fbca87efed34aa748d643336f220
Opcode Fuzzy Hash: bbb0adba0990282a1ce53a43167835343f613ffbf296f8927febced5037c83a5
Instruction Fuzzy Hash: D5313EE68DA9A27DE64C7AB8F0061F96310BF047A8F1CE636D0DD4D0839F1864814DAD

Function 00007FF8490025D0 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 849f05ab3470c2c5feee52ef941397049cb3fe35a297d5cc72de243c88025068
Instruction ID: 52ce5f72a72888451e79556e38bd9f76bfbdf93cbba4539c428739377a6a7297
Opcode Fuzzy Hash: 849f05ab3470c2c5feee52ef941397049cb3fe35a297d5cc72de243c88025068
Instruction Fuzzy Hash: 1A31D9E75999566CE608BEBCF4814E96340FF40B75F58DA37E1EDC80839F24A08145B9

Function 00007FF848FF8322 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20e0b3644c5f6db763c748312832b90eb239985e76473186595e992d424ff93c
Instruction ID: 4e921232dc5b774ebd6f40e539fe6daf4117efc1276cb54875f7dfa21db92e5d
Opcode Fuzzy Hash: 20e0b3644c5f6db763c748312832b90eb239985e76473186595e992d424ff93c
Instruction Fuzzy Hash: 8F31D5F15D9952BED24C7AB8F8054F92300AF016A8F0CDF35D0BE8A0D3CF14A0419AAD

Function 00007FF849001AF3 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3336675266.00007FF848FF0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00007FF848FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff848ff0000_sihost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a79efc34b0f953a52130ff138b830dc1cb45dda38ecbc4a175567ca75dfc84d
Instruction ID: cc92f562a426ad1d84978fea49d0815f8d10734aef72bfd06358b55677f82ec4
Opcode Fuzzy Hash: 1a79efc34b0f953a52130ff138b830dc1cb45dda38ecbc4a175567ca75dfc84d
Instruction Fuzzy Hash: 312144E68D99A27DE64C7AB8F0061F96310BF047A8F1CE636D0DD4D0839F1964814DBD

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Qe73sKzGgb.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

TCP Packets

HTTP Request Dependency Graph

HTTP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Windows Analysis Report
Qe73sKzGgb.dll

Function 0000024EB5E23777 Relevance: 7.9, APIs: 5, Instructions: 406
memorylibraryCOMMON

Function 00007FF849232B7C Relevance: 6.0, Strings: 4, Instructions: 1047
COMMON

Function 00007FF848FF59AF Relevance: 5.8, Strings: 4, Instructions: 825
COMMON

Function 0000024EB5E13777 Relevance: 5.4, APIs: 4, Instructions: 406
memoryCOMMON

Function 00007FF848FFCB88 Relevance: 3.5, Strings: 2, Instructions: 1008
COMMON

Function 00007FF848FFC939 Relevance: 2.2, Strings: 1, Instructions: 920
COMMON

Function 0000024EB5E2292C Relevance: 7.6, APIs: 5, Instructions: 115
memorylibraryCOMMON

Function 0000024EB5E1291F Relevance: 3.1, APIs: 2, Instructions: 122
memoryCOMMON

Function 0000024EB5E22A37 Relevance: 3.1, APIs: 2, Instructions: 95
memoryCOMMON

Function 0000024EB5E12984 Relevance: 3.1, APIs: 2, Instructions: 85
memoryCOMMON

Function 0000024EB5E22AFC Relevance: 3.0, APIs: 2, Instructions: 41
memoryCOMMON