Edit tour

Windows Analysis Report
mtgjyX9gHF.exe

Overview

General Information

Sample name:	mtgjyX9gHF.exe renamed because original name is a hash value
Original sample name:	641cb02c429feb106094750765d0d6af.exe
Analysis ID:	1523151
MD5:	641cb02c429feb106094750765d0d6af
SHA1:	db5be32e7ef7c5e93b7ef4f06bd6854f3a393cbd
SHA256:	4a04da4d657c3c6bc45ea42cfef67039cd51173159ce7b707467f69146e086f9
Tags:	exeQuasarRATRATuser-abuse_ch
Infos:

Detection

Quasar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Quasar

Suricata IDS alerts for network traffic

Yara detected Quasar RAT

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Installs a global keyboard hook

Machine Learning detection for dropped file

Machine Learning detection for sample

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to detect virtual machines (STR)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

mtgjyX9gHF.exe (PID: 3620 cmdline: "C:\Users\user\Desktop\mtgjyX9gHF.exe" MD5: 641CB02C429FEB106094750765D0D6AF)

schtasks.exe (PID: 2404 cmdline: "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Clienty.exe" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 5852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Clienty.exe (PID: 6136 cmdline: "C:\Users\user\AppData\Roaming\SubDir\Clienty.exe" MD5: 641CB02C429FEB106094750765D0D6AF)

schtasks.exe (PID: 6284 cmdline: "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Clienty.exe" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Clienty.exe (PID: 4620 cmdline: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe MD5: 641CB02C429FEB106094750765D0D6AF)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Quasar RAT, QuasarRAT	Quasar RAT is a malware family written in .NET which is used by a variety of attackers. The malware is fully functional and open source, and is often packed to make analysis of the source more difficult.	APT33 Dropping Elephant Stone Panda The Gorgon Group	http://researchcenter.paloaltonetworks.com/2017/01/unit42-downeks-and-quasar-rat-used-in-recent-targeted-attacks-against-governments http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/master-of-rats-how-to-create-your-own-tracker/20848 https://adeo.com.tr/wp-content/uploads/2020/02/APT10_Report.pdf https://asec.ahnlab.com/en/31089/	https://malpedia.caad.fkie.fraunhofer.de/details/win.quasar_rat

Malware Configuration

Threatname: Quasar

{"Version": "1.4.1", "Host:Port": "39.102.36.209:4782;", "SubDirectory": "SubDir", "InstallName": "Clienty.exe", "MutexName": "6d2ccfb9-4bf8-4a23-933c-5674d8e6fac2", "StartupKey": "Quasar Client Startup", "Tag": "Office04", "LogDirectoryName": "Logs", "ServerSignature": "MunencjUTwH3Ra5nDH8gt96KcRM9mKu0wE4LzbN5Xg+bYmEv6qlfx6WL5Ta4bEXF24wNDWupkwJXDpw/qMVcZvYiCJtBQf2PuZxrCHM0mstLkmiwoQ0nbYpXKrZ2YdGKL+WYRtQN0M4ZcMZyJxey1kIHawzZuoj84okmDrx/0p4d2DcNmaA1Hf77+GVe5G6gBCBCTeyDOX2jBwhJvBmfujeQPJujOtB1M+Owjd86DzaI0Plhx66ZwxmGfbH53PQ3lTD8I1xyF7V15wlgg2u4x2V4Xuhdf9hkX1cjB1lLKCQIg2VZuPXA8571iwOAREaEvZairheJtNbRZlWewwbjN75m2WK+6utu1AEvx4J3TfdHNZRur4gpFmadnNE7fw5+eqIvNrbHEvneH8l4MRlP07Cr2FVyN0FjCf8hkjdUKZgA4dHvsyYBwNzJG7fAIZvvR4SrCkpd6QCYqGs6s6o//zfDoXreAYkb3TafFP+XJsJWCEphn9bYADO9OHDM4Yqf210wnQT3H8Yc3bUMYcvGeiQcVgrrumuGLwM0JAzeXv+0H7bFarlITXkraXmbTXsNAIEq+85bmY9mvfWa2Kxkphe3y30OklLiDeYBHNw9PbekrDev69XyxDjHsl6Z/Dz4z6jPrLX43rEOyBp4u+WWiSwmGO/rXPSlBWTQa6PLSWk=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQAJZfSV2md4GTYPNwNOg35TANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTIzMDQxNjExMTUxNloYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAt45/WV2IDnURejARa6ANVEKcE1MRG09a0F01beaKfmfzKl7ZP0EhXZgdwfKC6UL6Jyw2LZtpnu1OS+30FAYnMUHDKqP14vR1Ehmbbiwz3k4LsdOVYfOwj6+uEkPeed7xASxN0j5dC1b1OSC4CFVsT77L/rgg/yBsZ/CpwNDMdD+zUy2ddbNbj5oWlXh1cG9a1JNA6HHlW0D6rXaa1uNSvP0f9XNZnP8umF8c+e4NNRIGKbWZatjKSfuB3iwS+Jbs4rgW8H/sUDTtRH29aXmV/+DhHBn3RaSqkMhGT8KAwK1wx23rYvJ/4ZZJVbFd+fuOU0CmIwbEjEGBUS+MvxUHUWAlafgzm9tobaXYtiUPZ6IthZsqMOIo8yaJKoEYB9HX6cBDiS6cWCeycSp2aICWRqBJSLzlE/srea4gcpbDu8mO9kNL6IUTctAfv0131MSCqBFIF/tI7GEZX2xp2WCZiWB2IPuMRKfObeFkv5QdYHa3qy4qxK150JqtE+e8S6KpynfWrOs5NobOE8mMrdSvo5HbEF1QWDJJtFoTQf6dIWQB7m2fRIeKdjWQu4nHCfLiejkghNTjqiKOEc5aP62ypPZjez18JqIjzXlfmLL7uTdOdAVPo2rqlTLOnaLoX3atBoJVLSIT9WwNcXMZ69sbYBtr7426huA0Q7MFs4o7grUCAwEAAaMyMDAwHQYDVR0OBBYEFMp80NgW2J/+iOP3WvJP4L53JhahMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBAG45tviqQInCqTewWS3NmUDsteYZO3eTBXDH8zwaZ1IbeZqf7rlCX5Nse4WQ9URXSGMEt+zhm9IGBPJtLzmal9pk9ITKe05XbLw+CHmlzo/4V0qlt75Oc6GcropFRYZrfD31zYj3dfYKDZYiY9cdDlpsyjK5OAaPc6cIUib1O+0S4M+IOPMpmfkdjgWTkpVRW6O5CMP5EMXTF1Cvgopm8eSn9+dYo1gLzVnSUUdUZvk8waTO3gmaUtHs5H9YZXzbKML32EAmE4AUKOJPdGxS1CpC5aQMKxRU3NOgf8kdsT55sCXi+ziAI0Y+MBPNcv7UaAqc8UiN+yLt9446s3tRAvDYQNvN0hPjQs5E3B0EY6i8A1eqXdwFQ+fn6zgDXRvazt0XNgzIPqxnXZIhiGMBEptzyVyFe8Gli/gyHVHp+lVG9Fd9nGALVLbPZ8Om52ywhG1XOuwee3PpN9g4EkxyuHXVAQjrYp5lKbBeYDpyrXi9RWYFxrYQMZ/M0709K/DEIpBzHV9suxI+xXXgwCI/Aqw0FQG1TMeNws+K4oPJrSdQzBTi+znjfIZWP18QARZPjLAXqUcTZgEDH7nKI6T2KR89xXRr2jCrSr6FqvKZq9sNhwbAVHkf2c3Z15HWJGO0EaNMreObx7Wx6gDRB19CEpMDCPEvxeplpWGwqYgL9+qo"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
mtgjyX9gHF.exe	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
mtgjyX9gHF.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
mtgjyX9gHF.exe	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28eecf:$x1: Quasar.Common.Messages 0x29f1f8:$x1: Quasar.Common.Messages 0x2ab7ba:$x4: Uninstalling... good bye :-( 0x2acfaf:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
mtgjyX9gHF.exe	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aad6c:$f1: FileZilla\recentservers.xml 0x2aadac:$f2: FileZilla\sitemanager.xml 0x2aadee:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab03a:$b1: Chrome\User Data\ 0x2ab090:$b1: Chrome\User Data\ 0x2ab368:$b2: Mozilla\Firefox\Profiles 0x2ab464:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fd3e8:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ab5bc:$b4: Opera Software\Opera Stable\Login Data 0x2ab676:$b5: YandexBrowser\User Data\ 0x2ab6e4:$b5: YandexBrowser\User Data\ 0x2ab3b8:$s4: logins.json 0x2ab0ee:$a1: username_value 0x2ab10c:$a2: password_value 0x2ab3f8:$a3: encryptedUsername 0x2fd32c:$a3: encryptedUsername 0x2ab41c:$a4: encryptedPassword 0x2fd34a:$a4: encryptedPassword 0x2fd2c8:$a5: httpRealm
mtgjyX9gHF.exe	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x164f16:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ab8a4:$s3: Process already elevated. 0x28ebce:$s4: get_PotentiallyVulnerablePasswords 0x278c8a:$s5: GetKeyloggerLogsDirectory 0x29e957:$s5: GetKeyloggerLogsDirectory 0x28ebf1:$s6: set_PotentiallyVulnerablePasswords 0x2fea16:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28eecf:$x1: Quasar.Common.Messages 0x29f1f8:$x1: Quasar.Common.Messages 0x2ab7ba:$x4: Uninstalling... good bye :-( 0x2acfaf:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aad6c:$f1: FileZilla\recentservers.xml 0x2aadac:$f2: FileZilla\sitemanager.xml 0x2aadee:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab03a:$b1: Chrome\User Data\ 0x2ab090:$b1: Chrome\User Data\ 0x2ab368:$b2: Mozilla\Firefox\Profiles 0x2ab464:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fd3e8:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ab5bc:$b4: Opera Software\Opera Stable\Login Data 0x2ab676:$b5: YandexBrowser\User Data\ 0x2ab6e4:$b5: YandexBrowser\User Data\ 0x2ab3b8:$s4: logins.json 0x2ab0ee:$a1: username_value 0x2ab10c:$a2: password_value 0x2ab3f8:$a3: encryptedUsername 0x2fd32c:$a3: encryptedUsername 0x2ab41c:$a4: encryptedPassword 0x2fd34a:$a4: encryptedPassword 0x2fd2c8:$a5: httpRealm
C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x164f16:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ab8a4:$s3: Process already elevated. 0x28ebce:$s4: get_PotentiallyVulnerablePasswords 0x278c8a:$s5: GetKeyloggerLogsDirectory 0x29e957:$s5: GetKeyloggerLogsDirectory 0x28ebf1:$s6: set_PotentiallyVulnerablePasswords 0x2fea16:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.2185203736.0000026FF6A55000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000004.00000002.4617304861.0000000002EB9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000005.00000002.2199659201.000002B938AC0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000002.00000002.2185070461.000000CA288A9000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000005.00000002.2199369633.000002B938880000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000002.00000002.2185117580.0000026FF6830000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000005.00000002.2199659201.000002B938AC5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000005.00000002.2197566283.000000FE32879000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000000.2152636170.00000000007B0000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000002.00000002.2185203736.0000026FF6A50000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000005.00000002.2199369633.000002B938888000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000004.00000002.4617304861.00000000032B3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000002.00000002.2185117580.0000026FF683F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000002.2186712821.0000000002A31000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000000.2152321586.0000000000492000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000007.00000002.2221194608.0000000002E51000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: mtgjyX9gHF.exe PID: 3620	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: schtasks.exe PID: 2404	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: Clienty.exe PID: 6136	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: schtasks.exe PID: 6284	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: Clienty.exe PID: 4620	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.mtgjyX9gHF.exe.490000.0.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
0.0.mtgjyX9gHF.exe.490000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.mtgjyX9gHF.exe.490000.0.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28eecf:$x1: Quasar.Common.Messages 0x29f1f8:$x1: Quasar.Common.Messages 0x2ab7ba:$x4: Uninstalling... good bye :-( 0x2acfaf:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
0.0.mtgjyX9gHF.exe.490000.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aad6c:$f1: FileZilla\recentservers.xml 0x2aadac:$f2: FileZilla\sitemanager.xml 0x2aadee:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab03a:$b1: Chrome\User Data\ 0x2ab090:$b1: Chrome\User Data\ 0x2ab368:$b2: Mozilla\Firefox\Profiles 0x2ab464:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fd3e8:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ab5bc:$b4: Opera Software\Opera Stable\Login Data 0x2ab676:$b5: YandexBrowser\User Data\ 0x2ab6e4:$b5: YandexBrowser\User Data\ 0x2ab3b8:$s4: logins.json 0x2ab0ee:$a1: username_value 0x2ab10c:$a2: password_value 0x2ab3f8:$a3: encryptedUsername 0x2fd32c:$a3: encryptedUsername 0x2ab41c:$a4: encryptedPassword 0x2fd34a:$a4: encryptedPassword 0x2fd2c8:$a5: httpRealm
0.0.mtgjyX9gHF.exe.490000.0.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x164f16:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ab8a4:$s3: Process already elevated. 0x28ebce:$s4: get_PotentiallyVulnerablePasswords 0x278c8a:$s5: GetKeyloggerLogsDirectory 0x29e957:$s5: GetKeyloggerLogsDirectory 0x28ebf1:$s6: set_PotentiallyVulnerablePasswords 0x2fea16:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>

Sigma Signatures

AV Detection

Sigma detected: Quasar

Source: Process started

Author: Joe Security: Data: Command: "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Clienty.exe" /rl HIGHEST /f, CommandLine: "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Clienty.exe" /rl HIGHEST /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\mtgjyX9gHF.exe", ParentImage: C:\Users\user\Desktop\mtgjyX9gHF.exe, ParentProcessId: 3620, ParentProcessName: mtgjyX9gHF.exe, ProcessCommandLine: "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Clienty.exe" /rl HIGHEST /f, ProcessId: 2404, ProcessName: schtasks.exe

E-Banking Fraud

Sigma detected: Quasar

Source: Process started

System Summary

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Clienty.exe" /rl HIGHEST /f, CommandLine: "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Clienty.exe" /rl HIGHEST /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\SubDir\Clienty.exe", ParentImage: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe, ParentProcessId: 6136, ParentProcessName: Clienty.exe, ProcessCommandLine: "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Clienty.exe" /rl HIGHEST /f, ProcessId: 6284, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Clienty.exe" /rl HIGHEST /f, CommandLine: "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Clienty.exe" /rl HIGHEST /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\mtgjyX9gHF.exe", ParentImage: C:\Users\user\Desktop\mtgjyX9gHF.exe, ParentProcessId: 3620, ParentProcessName: mtgjyX9gHF.exe, ProcessCommandLine: "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Clienty.exe" /rl HIGHEST /f, ProcessId: 2404, ProcessName: schtasks.exe

Stealing of Sensitive Information

Sigma detected: Quasar

Source: Process started

Remote Access Functionality

Sigma detected: Quasar

Source: Process started

Suricata Signatures

ET MALWARE Generic AsyncRAT Style SSL Cert

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T07:38:03.504328+0200	2035595	1	Domain Observed Used for C2 Detected	39.102.36.209	4782	192.168.2.6	49712	TCP

ET MALWARE Observed Malicious SSL Cert (Quasar CnC)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T07:38:03.504328+0200	2027619	1	Domain Observed Used for C2 Detected	39.102.36.209	4782	192.168.2.6	49712	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: mtgjyX9gHF.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe

Avira: detection malicious, Label: HEUR/AGEN.1307453

Found malware configuration

Source: mtgjyX9gHF.exe

Malware Configuration Extractor: Quasar {"Version": "1.4.1", "Host:Port": "39.102.36.209:4782;", "SubDirectory": "SubDir", "InstallName": "Clienty.exe", "MutexName": "6d2ccfb9-4bf8-4a23-933c-5674d8e6fac2", "StartupKey": "Quasar Client Startup", "Tag": "Office04", "LogDirectoryName": "Logs", "ServerSignature": "MunencjUTwH3Ra5nDH8gt96KcRM9mKu0wE4LzbN5Xg+bYmEv6qlfx6WL5Ta4bEXF24wNDWupkwJXDpw/qMVcZvYiCJtBQf2PuZxrCHM0mstLkmiwoQ0nbYpXKrZ2YdGKL+WYRtQN0M4ZcMZyJxey1kIHawzZuoj84okmDrx/0p4d2DcNmaA1Hf77+GVe5G6gBCBCTeyDOX2jBwhJvBmfujeQPJujOtB1M+Owjd86DzaI0Plhx66ZwxmGfbH53PQ3lTD8I1xyF7V15wlgg2u4x2V4Xuhdf9hkX1cjB1lLKCQIg2VZuPXA8571iwOAREaEvZairheJtNbRZlWewwbjN75m2WK+6utu1AEvx4J3TfdHNZRur4gpFmadnNE7fw5+eqIvNrbHEvneH8l4MRlP07Cr2FVyN0FjCf8hkjdUKZgA4dHvsyYBwNzJG7fAIZvvR4SrCkpd6QCYqGs6s6o//zfDoXreAYkb3TafFP+XJsJWCEphn9bYADO9OHDM4Yqf210wnQT3H8Yc3bUMYcvGeiQcVgrrumuGLwM0JAzeXv+0H7bFarlITXkraXmbTXsNAIEq+85bmY9mvfWa2Kxkphe3y30OklLiDeYBHNw9PbekrDev69XyxDjHsl6Z/Dz4z6jPrLX43rEOyBp4u+WWiSwmGO/rXPSlBWTQa6PLSWk=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQAJZfSV2md4GTYPNwNOg35TANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTIzMDQxNjExMTUxNloYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAt45/WV2IDnURejARa6ANVEKcE1MRG09a0F01beaKfmfzKl7ZP0EhXZgdwfKC6UL6Jyw2LZtpnu1OS+30FAYnMUHDKqP14vR1Ehmbbiwz3k4LsdOVYfOwj6+uEkPeed7xASxN0j5dC1b1OSC4CFVsT77L/rgg/yBsZ/CpwNDMdD+zUy2ddbNbj5oWlXh1cG9a1JNA6HHlW0D6rXaa1uNSvP0f9XNZnP8umF8c+e4NNRIGKbWZatjKSfuB3iwS+Jbs4rgW8H/sUDTtRH29aXmV/+DhHBn3RaSqkMhGT8KAwK1wx23rYvJ/4ZZJVbFd+fuOU0CmIwbEjEGBUS+MvxUHUWAlafgzm9tobaXYtiUPZ6IthZsqMOIo8yaJKoEYB9HX6cBDiS6cWCeycSp2aICWRqBJSLzlE/srea4gcpbDu8mO9kNL6IUTctAfv0131MSCqBFIF/tI7GEZX2xp2WCZiWB2IPuMRKfObeFkv5QdYHa3qy4qxK150JqtE+e8S6KpynfWrOs5NobOE8mMrdSvo5HbEF1QWDJJtFoTQf6dIWQB7m2fRIeKdjWQu4nHCfLiejkghNTjqiKOEc5aP62ypPZjez18JqIjzXlfmLL7uTdOdAVPo2rqlTLOnaLoX3atBoJVLSIT9WwNcXMZ69sbYBtr7426huA0Q7MFs4o7grUCAwEAAaMyMDAwHQYDVR0OBBYEFMp80NgW2J/+iOP3WvJP4L53JhahMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBAG45tviqQInCqTewWS3NmUDsteYZO3eTBXDH8zwaZ1IbeZqf7rlCX5Nse4WQ9URXSGMEt+zhm9IGBPJtLzmal9pk9ITKe05XbLw+CHmlzo/4V0qlt75Oc6GcropFRYZrfD31zYj3dfYKDZYiY9cdDlpsyjK5OAaPc6cIUib1O+0S4M+IOPMpmfkdjgWTkpVRW6O5CMP5EMXTF1Cvgopm8eSn9+dYo1gLzVnSUUdUZvk8waTO3gmaUtHs5H9YZXzbKML32EAmE4AUKOJPdGxS1CpC5aQMKxRU3NOgf8kdsT55sCXi+ziAI0Y+MBPNcv7UaAqc8UiN+yLt9446s3tRAvDYQNvN0hPjQs5E3B0EY6i8A1eqXdwFQ+fn6zgDXRvazt0XNgzIPqxnXZIhiGMBEptzyVyFe8Gli/gyHVHp+lVG9Fd9nGALVLbPZ8Om52ywhG1XOuwee3PpN9g4EkxyuHXVAQjrYp5lKbBeYDpyrXi9RWYFxrYQMZ/M0709K/DEIpBzHV9suxI+xXXgwCI/Aqw0FQG1TMeNws+K4oPJrSdQzBTi+znjfIZWP18QARZPjLAXqUcTZgEDH7nKI6T2KR89xXRr2jCrSr6FqvKZq9sNhwbAVHkf2c3Z15HWJGO0EaNMreObx7Wx6gDRB19CEpMDCPEvxeplpWGwqYgL9+qo"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	ReversingLabs: Detection: 78%
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Virustotal: Detection: 78%			Perma Link

Multi AV Scanner detection for submitted file

Source: mtgjyX9gHF.exe	ReversingLabs: Detection: 78%
Source: mtgjyX9gHF.exe	Virustotal: Detection: 78%			Perma Link

Yara detected Quasar RAT

Source: Yara match	File source: mtgjyX9gHF.exe, type: SAMPLE
Source: Yara match	File source: 0.0.mtgjyX9gHF.exe.490000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2185203736.0000026FF6A55000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4617304861.0000000002EB9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2199659201.000002B938AC0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2185070461.000000CA288A9000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2199369633.000002B938880000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2185117580.0000026FF6830000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2199659201.000002B938AC5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2197566283.000000FE32879000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2152636170.00000000007B0000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2185203736.0000026FF6A50000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2199369633.000002B938888000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4617304861.00000000032B3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2185117580.0000026FF683F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2186712821.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2152321586.0000000000492000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2221194608.0000000002E51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mtgjyX9gHF.exe PID: 3620, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: schtasks.exe PID: 2404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Clienty.exe PID: 6136, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: schtasks.exe PID: 6284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Clienty.exe PID: 4620, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe, type: DROPPED

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: mtgjyX9gHF.exe

Joe Sandbox ML: detected

Source: mtgjyX9gHF.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 108.181.98.179:443 -> 192.168.2.6:49714 version: TLS 1.2

Source: mtgjyX9gHF.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2027619 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (Quasar CnC) : 39.102.36.209:4782 -> 192.168.2.6:49712
Source: Network traffic	Suricata IDS: 2035595 - Severity 1 - ET MALWARE Generic AsyncRAT Style SSL Cert : 39.102.36.209:4782 -> 192.168.2.6:49712

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 39.102.36.209

Yara detected Generic Downloader

Source: Yara match	File source: mtgjyX9gHF.exe, type: SAMPLE
Source: Yara match	File source: 0.0.mtgjyX9gHF.exe.490000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe, type: DROPPED

Source: global traffic

TCP traffic: 192.168.2.6:49712 -> 39.102.36.209:4782

Source: Joe Sandbox View

IP Address: 108.181.98.179 108.181.98.179

Source: Joe Sandbox View

ASN Name: CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: ipwho.is

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 39.102.36.209
Source: unknown	TCP traffic detected without corresponding DNS query: 39.102.36.209
Source: unknown	TCP traffic detected without corresponding DNS query: 39.102.36.209
Source: unknown	TCP traffic detected without corresponding DNS query: 39.102.36.209
Source: unknown	TCP traffic detected without corresponding DNS query: 39.102.36.209
Source: unknown	TCP traffic detected without corresponding DNS query: 39.102.36.209
Source: unknown	TCP traffic detected without corresponding DNS query: 39.102.36.209
Source: unknown	TCP traffic detected without corresponding DNS query: 39.102.36.209
Source: unknown	TCP traffic detected without corresponding DNS query: 39.102.36.209
Source: unknown	TCP traffic detected without corresponding DNS query: 39.102.36.209
Source: unknown	TCP traffic detected without corresponding DNS query: 39.102.36.209
Source: unknown	TCP traffic detected without corresponding DNS query: 39.102.36.209
Source: unknown	TCP traffic detected without corresponding DNS query: 39.102.36.209
Source: unknown	TCP traffic detected without corresponding DNS query: 39.102.36.209
Source: unknown	TCP traffic detected without corresponding DNS query: 39.102.36.209
Source: unknown	TCP traffic detected without corresponding DNS query: 39.102.36.209
Source: unknown	TCP traffic detected without corresponding DNS query: 39.102.36.209
Source: unknown	TCP traffic detected without corresponding DNS query: 39.102.36.209
Source: unknown	TCP traffic detected without corresponding DNS query: 39.102.36.209
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: ipwho.is

Source: Clienty.exe, 00000004.00000002.4616262413.0000000001155000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: 77EC63BDA74BD0D0E0426DC8F80085060.4.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: Clienty.exe, 00000004.00000002.4624416684.000000001B9E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabB
Source: Clienty.exe, 00000004.00000002.4617304861.0000000003263000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ipwho.is
Source: Clienty.exe, 00000004.00000002.4617304861.00000000032B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: mtgjyX9gHF.exe, 00000000.00000002.2186712821.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, Clienty.exe, 00000004.00000002.4617304861.0000000002EB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: mtgjyX9gHF.exe, Clienty.exe.0.dr	String found in binary or memory: https://api.ipify.org/
Source: Clienty.exe, 00000004.00000002.4617304861.0000000003249000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipwho.is
Source: mtgjyX9gHF.exe, Clienty.exe.0.dr	String found in binary or memory: https://ipwho.is/
Source: mtgjyX9gHF.exe, Clienty.exe.0.dr	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: mtgjyX9gHF.exe, Clienty.exe.0.dr	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: mtgjyX9gHF.exe, Clienty.exe.0.dr	String found in binary or memory: https://stackoverflow.com/q/2152978/23354sCannot

Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714

Source: unknown

HTTPS traffic detected: 108.181.98.179:443 -> 192.168.2.6:49714 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe

Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\SubDir\Clienty.exe

Jump to behavior

E-Banking Fraud

Yara detected Quasar RAT

Source: Yara match	File source: mtgjyX9gHF.exe, type: SAMPLE
Source: Yara match	File source: 0.0.mtgjyX9gHF.exe.490000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2185203736.0000026FF6A55000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4617304861.0000000002EB9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2199659201.000002B938AC0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2185070461.000000CA288A9000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2199369633.000002B938880000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2185117580.0000026FF6830000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2199659201.000002B938AC5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2197566283.000000FE32879000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2152636170.00000000007B0000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2185203736.0000026FF6A50000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2199369633.000002B938888000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4617304861.00000000032B3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2185117580.0000026FF683F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2186712821.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2152321586.0000000000492000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2221194608.0000000002E51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mtgjyX9gHF.exe PID: 3620, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: schtasks.exe PID: 2404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Clienty.exe PID: 6136, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: schtasks.exe PID: 6284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Clienty.exe PID: 4620, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: mtgjyX9gHF.exe, type: SAMPLE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: mtgjyX9gHF.exe, type: SAMPLE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: mtgjyX9gHF.exe, type: SAMPLE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 0.0.mtgjyX9gHF.exe.490000.0.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 0.0.mtgjyX9gHF.exe.490000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.0.mtgjyX9gHF.exe.490000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe, type: DROPPED	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe, type: DROPPED	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe, type: DROPPED	Matched rule: Detects Quasar infostealer Author: ditekshen

Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD341A3C6F	4_2_00007FFD341A3C6F
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD341AB7FB	4_2_00007FFD341AB7FB
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD341A403D	4_2_00007FFD341A403D
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD341A60FB	4_2_00007FFD341A60FB
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD341AB9F2	4_2_00007FFD341AB9F2
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD341AAB6F	4_2_00007FFD341AAB6F
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD3441347E	4_2_00007FFD3441347E
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD344215A0	4_2_00007FFD344215A0
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD344155D6	4_2_00007FFD344155D6
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD34438E30	4_2_00007FFD34438E30
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD3442FE80	4_2_00007FFD3442FE80
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD34419FD0	4_2_00007FFD34419FD0
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD3441AFDD	4_2_00007FFD3441AFDD
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD3442B7E1	4_2_00007FFD3442B7E1
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD3442C13A	4_2_00007FFD3442C13A
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD34428A0F	4_2_00007FFD34428A0F
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD34419271	4_2_00007FFD34419271
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD3442EB29	4_2_00007FFD3442EB29
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD34433AF9	4_2_00007FFD34433AF9
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD34427C16	4_2_00007FFD34427C16
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD34424CFA	4_2_00007FFD34424CFA
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD34424DFA	4_2_00007FFD34424DFA
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD344105FC	4_2_00007FFD344105FC
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD344217B0	4_2_00007FFD344217B0
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD344217D7	4_2_00007FFD344217D7
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD344217C8	4_2_00007FFD344217C8
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD344217EF	4_2_00007FFD344217EF
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD3441000A	4_2_00007FFD3441000A
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD344110D1	4_2_00007FFD344110D1
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD34421898	4_2_00007FFD34421898
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD3441115F	4_2_00007FFD3441115F
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD3441621F	4_2_00007FFD3441621F
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD344111F2	4_2_00007FFD344111F2
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD344121FA	4_2_00007FFD344121FA
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD344E2391	4_2_00007FFD344E2391
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD344E0808	4_2_00007FFD344E0808

Source: mtgjyX9gHF.exe, 00000000.00000000.2152636170.00000000007B0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameClient.exe. vs mtgjyX9gHF.exe
Source: mtgjyX9gHF.exe	Binary or memory string: OriginalFilenameClient.exe. vs mtgjyX9gHF.exe

Source: mtgjyX9gHF.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: mtgjyX9gHF.exe, type: SAMPLE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: mtgjyX9gHF.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: mtgjyX9gHF.exe, type: SAMPLE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 0.0.mtgjyX9gHF.exe.490000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 0.0.mtgjyX9gHF.exe.490000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.0.mtgjyX9gHF.exe.490000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe, type: DROPPED	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe, type: DROPPED	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@10/5@1/2

Source: C:\Users\user\Desktop\mtgjyX9gHF.exe

File created: C:\Users\user\AppData\Roaming\SubDir

Jump to behavior

Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:876:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5852:120:WilError_03
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\6d2ccfb9-4bf8-4a23-933c-5674d8e6fac2

Source: mtgjyX9gHF.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: mtgjyX9gHF.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\mtgjyX9gHF.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: mtgjyX9gHF.exe	ReversingLabs: Detection: 78%
Source: mtgjyX9gHF.exe	Virustotal: Detection: 78%

Source: mtgjyX9gHF.exe

String found in binary or memory: HasSubValue3Conflicting item/add type

Source: C:\Users\user\Desktop\mtgjyX9gHF.exe

File read: C:\Users\user\Desktop\mtgjyX9gHF.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\mtgjyX9gHF.exe "C:\Users\user\Desktop\mtgjyX9gHF.exe"
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Clienty.exe" /rl HIGHEST /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe "C:\Users\user\AppData\Roaming\SubDir\Clienty.exe"
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Clienty.exe" /rl HIGHEST /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe C:\Users\user\AppData\Roaming\SubDir\Clienty.exe
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Clienty.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe "C:\Users\user\AppData\Roaming\SubDir\Clienty.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Clienty.exe" /rl HIGHEST /f	Jump to behavior

Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Section loaded: msasn1.dll	Jump to behavior

Source: mtgjyX9gHF.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: mtgjyX9gHF.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: mtgjyX9gHF.exe

Static file information: File size 3265536 > 1048576

Source: mtgjyX9gHF.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x31c400

Source: mtgjyX9gHF.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD3408D2A5 pushad ; iretd	4_2_00007FFD3408D2A6
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD341A2C02 push eax; iretd	4_2_00007FFD341A2C4D
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD3441336E push eax; ret	4_2_00007FFD3441340C
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Code function: 4_2_00007FFD344E1021 push 8B48FFCCh; retf	4_2_00007FFD344E1029

Source: C:\Users\user\Desktop\mtgjyX9gHF.exe

File created: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\mtgjyX9gHF.exe

Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Clienty.exe" /rl HIGHEST /f

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	File opened: C:\Users\user\Desktop\mtgjyX9gHF.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	File opened: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	File opened: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe:Zone.Identifier read attributes \| delete	Jump to behavior

Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Memory allocated: EF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Memory allocated: 1AA30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Memory allocated: 1320000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Memory allocated: 1AE80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Memory allocated: 1150000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Memory allocated: 1AE50000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe

Code function: 4_2_00007FFD341AE5D8 rdtsc

4_2_00007FFD341AE5D8

Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe

Code function: 4_2_00007FFD341AF1F2 str ax

4_2_00007FFD341AF1F2

Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Window / User API: threadDelayed 6317			Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Window / User API: threadDelayed 3364			Jump to behavior

Source: C:\Users\user\Desktop\mtgjyX9gHF.exe TID: 3816	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe TID: 368	Thread sleep time: -27670116110564310s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe TID: 5700	Thread sleep count: 6317 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe TID: 5700	Thread sleep count: 3364 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe TID: 2888	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe TID: 1916	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Clienty.exe, 00000004.00000002.4623703825.000000001B836000.00000004.00000020.00020000.00000000.sdmp, Clienty.exe, 00000004.00000002.4624416684.000000001BA6A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Clienty.exe, 00000004.00000002.4624416684.000000001B9E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe

Code function: 4_2_00007FFD341AE5D8 rdtsc

4_2_00007FFD341AE5D8

Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\mtgjyX9gHF.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Clienty.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe "C:\Users\user\AppData\Roaming\SubDir\Clienty.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Clienty.exe" /rl HIGHEST /f	Jump to behavior

Source: C:\Users\user\Desktop\mtgjyX9gHF.exe	Queries volume information: C:\Users\user\Desktop\mtgjyX9gHF.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Queries volume information: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	Queries volume information: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\mtgjyX9gHF.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Quasar RAT

Source: Yara match	File source: mtgjyX9gHF.exe, type: SAMPLE
Source: Yara match	File source: 0.0.mtgjyX9gHF.exe.490000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2185203736.0000026FF6A55000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4617304861.0000000002EB9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2199659201.000002B938AC0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2185070461.000000CA288A9000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2199369633.000002B938880000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2185117580.0000026FF6830000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2199659201.000002B938AC5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2197566283.000000FE32879000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2152636170.00000000007B0000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2185203736.0000026FF6A50000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2199369633.000002B938888000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4617304861.00000000032B3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2185117580.0000026FF683F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2186712821.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2152321586.0000000000492000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2221194608.0000000002E51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mtgjyX9gHF.exe PID: 3620, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: schtasks.exe PID: 2404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Clienty.exe PID: 6136, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: schtasks.exe PID: 6284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Clienty.exe PID: 4620, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe, type: DROPPED

Remote Access Functionality

Yara detected Quasar RAT

Source: Yara match	File source: mtgjyX9gHF.exe, type: SAMPLE
Source: Yara match	File source: 0.0.mtgjyX9gHF.exe.490000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2185203736.0000026FF6A55000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4617304861.0000000002EB9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2199659201.000002B938AC0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2185070461.000000CA288A9000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2199369633.000002B938880000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2185117580.0000026FF6830000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2199659201.000002B938AC5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2197566283.000000FE32879000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2152636170.00000000007B0000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2185203736.0000026FF6A50000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2199369633.000002B938888000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4617304861.00000000032B3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2185117580.0000026FF683F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2186712821.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2152321586.0000000000492000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2221194608.0000000002E51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mtgjyX9gHF.exe PID: 3620, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: schtasks.exe PID: 2404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Clienty.exe PID: 6136, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: schtasks.exe PID: 6284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Clienty.exe PID: 4620, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 Scheduled Task/Job	11 Process Injection	1 Masquerading	11 Input Capture	1 Query Registry	Remote Services	11 Input Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	1 DLL Side-Loading	51 Virtualization/Sandbox Evasion	Security Account Manager	51 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Hidden Files and Directories	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	113 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	23 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
mtgjyX9gHF.exe	79%	ReversingLabs	ByteCode-MSIL.Backdoor.Quasar
mtgjyX9gHF.exe	78%	Virustotal		Browse
mtgjyX9gHF.exe	100%	Avira	HEUR/AGEN.1307453
mtgjyX9gHF.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	100%	Avira	HEUR/AGEN.1307453
C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	79%	ReversingLabs	ByteCode-MSIL.Backdoor.Quasar
C:\Users\user\AppData\Roaming\SubDir\Clienty.exe	78%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
ipwho.is	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://api.ipify.org/	0%	URL Reputation	safe
https://api.ipify.org/	0%	URL Reputation	safe
https://stackoverflow.com/q/14436606/23354	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://stackoverflow.com/q/11564914/23354;	0%	URL Reputation	safe
https://stackoverflow.com/q/2152978/23354sCannot	0%	Virustotal		Browse
http://schemas.datacontract.org/2004/07/	0%	Virustotal		Browse
https://ipwho.is	0%	Virustotal		Browse
http://ipwho.is	0%	Virustotal		Browse
39.102.36.209	1%	Virustotal		Browse
https://ipwho.is/	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ipwho.is	108.181.98.179	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
39.102.36.209	true	1%, Virustotal, Browse	unknown
https://ipwho.is/	false	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	mtgjyX9gHF.exe, Clienty.exe.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://stackoverflow.com/q/14436606/23354	mtgjyX9gHF.exe, Clienty.exe.0.dr	false	URL Reputation: safe	unknown
https://stackoverflow.com/q/2152978/23354sCannot	mtgjyX9gHF.exe, Clienty.exe.0.dr	false	0%, Virustotal, Browse	unknown
http://schemas.datacontract.org/2004/07/	Clienty.exe, 00000004.00000002.4617304861.00000000032B3000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	mtgjyX9gHF.exe, 00000000.00000002.2186712821.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, Clienty.exe, 00000004.00000002.4617304861.0000000002EB9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ipwho.is	Clienty.exe, 00000004.00000002.4617304861.0000000003263000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://stackoverflow.com/q/11564914/23354;	mtgjyX9gHF.exe, Clienty.exe.0.dr	false	URL Reputation: safe	unknown
https://ipwho.is	Clienty.exe, 00000004.00000002.4617304861.0000000003249000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
39.102.36.209	unknown	China		37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	true
108.181.98.179	ipwho.is	Canada		852	ASN852CA	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523151
Start date and time:	2024-10-01 07:37:00 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	mtgjyX9gHF.exe renamed because original name is a hash value
Original Sample Name:	641cb02c429feb106094750765d0d6af.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@10/5@1/2
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 93% Number of executed functions: 71 Number of non-executed functions: 17
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 93.184.221.240
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Clienty.exe, PID 4620 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:38:01	API Interceptor	12621463x Sleep call for process: Clienty.exe modified
07:38:00	Task Scheduler	Run new task: Quasar Client Startup path: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
108.181.98.179	http://1d807473.flca.pages.dev/	Get hash	malicious	TechSupportScam	Browse
	https://f0mlxe0jneh1.pages.dev/	Get hash	malicious	Unknown	Browse
	http://yzkgxjyz0y4417anol.pages.dev/	Get hash	malicious	Unknown	Browse
	https://312d5c44.flca.pages.dev/	Get hash	malicious	TechSupportScam	Browse
	https://e95lq1vmgxojxrxkv7.pages.dev/	Get hash	malicious	Unknown	Browse
	http://2204three.pages.dev/	Get hash	malicious	TechSupportScam	Browse
	IMKssbDprn.exe	Get hash	malicious	Unknown	Browse
	CVSIyqGKKK.exe	Get hash	malicious	Unknown	Browse
	rVAKIFBANK-#U00d6demeonaymakbuzu20240826.pdf.exe	Get hash	malicious	Quasar	Browse
	https://www.dropbox.com/scl/fi/2u0ns17aqf2nkkout3i4e/Wion-Setup.exe?rlkey=bczprnlv9lpsjsrcm2mwnqhrh&st=tkdq1g8n&dl=1	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipwho.is	SecuriteInfo.com.BackDoor.QuasarNET.3.14065.23993.exe	Get hash	malicious	Quasar	Browse	195.201.57.90
	http://ufvskbzrquea.pages.dev/	Get hash	malicious	TechSupportScam	Browse	195.201.57.90
	http://serviceappinfms12.pages.dev/	Get hash	malicious	TechSupportScam	Browse	195.201.57.90
	http://1d807473.flca.pages.dev/	Get hash	malicious	TechSupportScam	Browse	195.201.57.90
	https://f0mlxe0jneh1.pages.dev/	Get hash	malicious	Unknown	Browse	195.201.57.90
	https://bmrnyehuivryuaq.pages.dev/	Get hash	malicious	Unknown	Browse	195.201.57.90
	https://jltnm7ux9ko.pages.dev/	Get hash	malicious	Unknown	Browse	195.201.57.90
	http://irxpolrqchi.pages.dev/	Get hash	malicious	Unknown	Browse	195.201.57.90
	http://v1bwdoexd1lj9stgmwip.pages.dev/	Get hash	malicious	Unknown	Browse	195.201.57.90
	http://yzkgxjyz0y4417anol.pages.dev/	Get hash	malicious	Unknown	Browse	108.181.98.179

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	e4wLi4tmmo.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	47.120.3.3
	https://ebaite.cn/	Get hash	malicious	Unknown	Browse	120.25.112.99
	SecuriteInfo.com.FileRepMalware.23518.16980.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	106.14.141.209
	d3r1KVj317.exe	Get hash	malicious	Unknown	Browse	112.74.185.5
	http://aa5aa5aa5aa5aa44.app/	Get hash	malicious	Unknown	Browse	59.82.132.217
	http://hbyczyz.com/xrr	Get hash	malicious	Unknown	Browse	47.108.5.198
	http://www.tpckn.app/	Get hash	malicious	Unknown	Browse	203.107.62.140
	http://alibinaadi.com/.well-known/alibaba/Alibaba/index.php	Get hash	malicious	Unknown	Browse	59.82.33.225
	cjg7obu8xR.exe	Get hash	malicious	Unknown	Browse	112.74.185.5
	cjg7obu8xR.exe	Get hash	malicious	Unknown	Browse	112.74.185.5
ASN852CA	KYwOaWhyl6.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	108.181.20.39
	TJWbSGBK0I.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	108.181.20.39
	Cr4745ElZg.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	108.181.20.39
	SecuriteInfo.com.Linux.Siggen.9999.28931.8128.elf	Get hash	malicious	Mirai	Browse	161.187.154.36
	SecuriteInfo.com.Linux.Siggen.9999.30976.5557.elf	Get hash	malicious	Mirai	Browse	209.52.94.129
	http://1d807473.flca.pages.dev/	Get hash	malicious	TechSupportScam	Browse	108.181.98.179
	https://f0mlxe0jneh1.pages.dev/	Get hash	malicious	Unknown	Browse	108.181.98.179
	http://yzkgxjyz0y4417anol.pages.dev/	Get hash	malicious	Unknown	Browse	108.181.98.179
	https://312d5c44.flca.pages.dev/	Get hash	malicious	TechSupportScam	Browse	108.181.98.179
	https://e95lq1vmgxojxrxkv7.pages.dev/	Get hash	malicious	Unknown	Browse	108.181.98.179

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	PO_9876563647-FLOWTRONIX (FT)UUE.exe	Get hash	malicious	AgentTesla	Browse	108.181.98.179
	2zYP8qOYmJ.exe	Get hash	malicious	Unknown	Browse	108.181.98.179
	RFQ-00032035.PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	108.181.98.179
	RFQ -SCHOTTEL Type SRP200.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	108.181.98.179
	Purchase Order 007823-PO# 005307.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	108.181.98.179
	2zYP8qOYmJ.exe	Get hash	malicious	Unknown	Browse	108.181.98.179
	invoice.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	108.181.98.179
	file.exe	Get hash	malicious	Unknown	Browse	108.181.98.179
	file.exe	Get hash	malicious	Unknown	Browse	108.181.98.179
	file.exe	Get hash	malicious	Unknown	Browse	108.181.98.179

Process:	C:\Users\user\AppData\Roaming\SubDir\Clienty.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\AppData\Roaming\SubDir\Clienty.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.150184159866505
Encrypted:	false
SSDEEP:	6:kKhmYD9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:LaDnLNkPlE99SNxAhUe/3
MD5:	CDABDA8575769329515E7C9FDB329C14
SHA1:	467543A746EE7A00F88A81BF33A905CEA6E8EE87
SHA-256:	D1974614B93D06B0F140473953BA2F145D550EB3DAA03BB40348E8855B10E1B8
SHA-512:	F5E16CACD49F0C1B9E4467BD4E1EA8A5E9B7F2ADC90A30FCFD4BFF1E89296902561F9495AAB374825DAF2855100B0D84BC868E9D7EDB1ACFC96AE7C15A1A0EA2
Malicious:	false
Reputation:	low
Preview:	p...... ................(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Clienty.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\SubDir\Clienty.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\mtgjyX9gHF.exe.log

Download File

Process:	C:\Users\user\Desktop\mtgjyX9gHF.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Roaming\SubDir\Clienty.exe

Download File

Process:	C:\Users\user\Desktop\mtgjyX9gHF.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3265536
Entropy (8bit):	6.084189771990339
Encrypted:	false
SSDEEP:	49152:TIMa8I9WtxU/Pom7ZlHMgK+YISxoJXFacCbG1JoQoGdLTHHB72eh2NT:TI38I9WtxU/Pom7ZlHMg8ISxoJXEcC4
MD5:	641CB02C429FEB106094750765D0D6AF
SHA1:	DB5BE32E7EF7C5E93B7EF4F06BD6854F3A393CBD
SHA-256:	4A04DA4D657C3C6BC45EA42CFEF67039CD51173159CE7B707467F69146E086F9
SHA-512:	8C4BAA95D860C22E0EDE96DA48136DB417F61EC6B19FCCB847D0317F775E77D1E299F80E2F19230055FABF9E91EC8DBB2D90B055DDEB75B4C714C971AFBF37B9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe, Author: Joe Security Rule: MAL_QuasarRAT_May19_1, Description: Detects QuasarRAT malware, Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe, Author: ditekSHen Rule: MALWARE_Win_QuasarStealer, Description: Detects Quasar infostealer, Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe, Author: ditekshen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79% Antivirus: Virustotal, Detection: 78%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....>d..................1...........1.. ........@.. .......................@2...........@.................................P.1.K.....2...................... 2...................................................... ............... ..H............text.....1.. ....1................. ..`.rsrc.........2.......1.............@..@.reloc....... 2.......1.............@..B..................1.....H...........@............k..p............................................0..M....... ....(.....(...........s....(....(...........s....o....(.....(....s....(........0..8.......(....(0....s....%.o....%.o....%.o....(....&..&...(.............--..........00.......0..@........o....,7(....(0....s....%.o....%.o....%.o....(....&..&...(.............-5..........08......f~v...,.~....(....(.....v.(.....s....}.....s....}....r..(......(.....(......(....*....0..L........{....r...po....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.084189771990339
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	mtgjyX9gHF.exe
File size:	3'265'536 bytes
MD5:	641cb02c429feb106094750765d0d6af
SHA1:	db5be32e7ef7c5e93b7ef4f06bd6854f3a393cbd
SHA256:	4a04da4d657c3c6bc45ea42cfef67039cd51173159ce7b707467f69146e086f9
SHA512:	8c4baa95d860c22e0ede96da48136db417f61ec6b19fccb847d0317f775e77d1e299f80e2f19230055fabf9e91ec8dbb2d90b055ddeb75b4c714c971afbf37b9
SSDEEP:	49152:TIMa8I9WtxU/Pom7ZlHMgK+YISxoJXFacCbG1JoQoGdLTHHB72eh2NT:TI38I9WtxU/Pom7ZlHMg8ISxoJXEcC4
TLSH:	38E54A1437F85F23E1BBE27395B0041667F0EC2AB3A3FB5B6191677A1C53B505801AAB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....>d..................1...........1.. ........@.. .......................@2...........@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x71e39e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x643E9305 [Tue Apr 18 12:54:29 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x31e350	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x320000	0xa93	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x322000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x31c3a4	0x31c400	7f436c8c99e111aa851e51e5972669bd	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x320000	0xa93	0xc00	cdeae95ac72e9e58017d2bcc89d2fbea	False	0.36328125	data	4.653972105845318	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x322000	0xc	0x200	3c0195728bee9aba3505b4138467aef0	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x3200a0	0x31c	data			0.4484924623115578
RT_MANIFEST	0x3203bc	0x6d7	XML 1.0 document, Unicode text, UTF-8 (with BOM) text			0.40319817247287265

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-01T07:38:03.504328+0200	2027619	ET MALWARE Observed Malicious SSL Cert (Quasar CnC)	1	39.102.36.209	4782	192.168.2.6	49712	TCP
2024-10-01T07:38:03.504328+0200	2035595	ET MALWARE Generic AsyncRAT Style SSL Cert	1	39.102.36.209	4782	192.168.2.6	49712	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 1, 2024 07:38:02.553545952 CEST	49712	4782	192.168.2.6	39.102.36.209
Oct 1, 2024 07:38:02.558425903 CEST	4782	49712	39.102.36.209	192.168.2.6
Oct 1, 2024 07:38:02.558514118 CEST	49712	4782	192.168.2.6	39.102.36.209
Oct 1, 2024 07:38:02.587765932 CEST	49712	4782	192.168.2.6	39.102.36.209
Oct 1, 2024 07:38:02.592706919 CEST	4782	49712	39.102.36.209	192.168.2.6
Oct 1, 2024 07:38:03.493834019 CEST	4782	49712	39.102.36.209	192.168.2.6
Oct 1, 2024 07:38:03.493907928 CEST	4782	49712	39.102.36.209	192.168.2.6
Oct 1, 2024 07:38:03.493964911 CEST	49712	4782	192.168.2.6	39.102.36.209
Oct 1, 2024 07:38:03.499317884 CEST	49712	4782	192.168.2.6	39.102.36.209
Oct 1, 2024 07:38:03.504328012 CEST	4782	49712	39.102.36.209	192.168.2.6
Oct 1, 2024 07:38:03.828986883 CEST	4782	49712	39.102.36.209	192.168.2.6
Oct 1, 2024 07:38:03.869290113 CEST	49712	4782	192.168.2.6	39.102.36.209
Oct 1, 2024 07:38:05.139359951 CEST	49714	443	192.168.2.6	108.181.98.179
Oct 1, 2024 07:38:05.139410973 CEST	443	49714	108.181.98.179	192.168.2.6
Oct 1, 2024 07:38:05.139482975 CEST	49714	443	192.168.2.6	108.181.98.179
Oct 1, 2024 07:38:05.140501976 CEST	49714	443	192.168.2.6	108.181.98.179
Oct 1, 2024 07:38:05.140520096 CEST	443	49714	108.181.98.179	192.168.2.6
Oct 1, 2024 07:38:05.822007895 CEST	443	49714	108.181.98.179	192.168.2.6
Oct 1, 2024 07:38:05.822084904 CEST	49714	443	192.168.2.6	108.181.98.179
Oct 1, 2024 07:38:05.827241898 CEST	49714	443	192.168.2.6	108.181.98.179
Oct 1, 2024 07:38:05.827263117 CEST	443	49714	108.181.98.179	192.168.2.6
Oct 1, 2024 07:38:05.827569008 CEST	443	49714	108.181.98.179	192.168.2.6
Oct 1, 2024 07:38:05.832910061 CEST	49714	443	192.168.2.6	108.181.98.179
Oct 1, 2024 07:38:05.875412941 CEST	443	49714	108.181.98.179	192.168.2.6
Oct 1, 2024 07:38:05.966722965 CEST	443	49714	108.181.98.179	192.168.2.6
Oct 1, 2024 07:38:05.966795921 CEST	443	49714	108.181.98.179	192.168.2.6
Oct 1, 2024 07:38:05.966844082 CEST	49714	443	192.168.2.6	108.181.98.179
Oct 1, 2024 07:38:06.124419928 CEST	49714	443	192.168.2.6	108.181.98.179
Oct 1, 2024 07:38:06.403863907 CEST	49712	4782	192.168.2.6	39.102.36.209
Oct 1, 2024 07:38:06.408771992 CEST	4782	49712	39.102.36.209	192.168.2.6
Oct 1, 2024 07:38:06.408874989 CEST	49712	4782	192.168.2.6	39.102.36.209
Oct 1, 2024 07:38:06.413722038 CEST	4782	49712	39.102.36.209	192.168.2.6
Oct 1, 2024 07:38:07.011307001 CEST	4782	49712	39.102.36.209	192.168.2.6
Oct 1, 2024 07:38:07.056866884 CEST	49712	4782	192.168.2.6	39.102.36.209
Oct 1, 2024 07:38:07.313723087 CEST	4782	49712	39.102.36.209	192.168.2.6
Oct 1, 2024 07:38:07.369294882 CEST	49712	4782	192.168.2.6	39.102.36.209
Oct 1, 2024 07:38:32.322472095 CEST	49712	4782	192.168.2.6	39.102.36.209
Oct 1, 2024 07:38:32.327352047 CEST	4782	49712	39.102.36.209	192.168.2.6
Oct 1, 2024 07:38:57.338176012 CEST	49712	4782	192.168.2.6	39.102.36.209
Oct 1, 2024 07:38:57.343029022 CEST	4782	49712	39.102.36.209	192.168.2.6
Oct 1, 2024 07:39:22.359682083 CEST	49712	4782	192.168.2.6	39.102.36.209
Oct 1, 2024 07:39:22.364665031 CEST	4782	49712	39.102.36.209	192.168.2.6
Oct 1, 2024 07:39:47.543735027 CEST	49712	4782	192.168.2.6	39.102.36.209
Oct 1, 2024 07:39:47.548641920 CEST	4782	49712	39.102.36.209	192.168.2.6
Oct 1, 2024 07:40:12.653598070 CEST	49712	4782	192.168.2.6	39.102.36.209
Oct 1, 2024 07:40:13.067538023 CEST	4782	49712	39.102.36.209	192.168.2.6
Oct 1, 2024 07:40:38.072738886 CEST	49712	4782	192.168.2.6	39.102.36.209
Oct 1, 2024 07:40:38.077682972 CEST	4782	49712	39.102.36.209	192.168.2.6
Oct 1, 2024 07:41:03.244544029 CEST	49712	4782	192.168.2.6	39.102.36.209
Oct 1, 2024 07:41:03.256107092 CEST	4782	49712	39.102.36.209	192.168.2.6
Oct 1, 2024 07:41:28.432189941 CEST	49712	4782	192.168.2.6	39.102.36.209
Oct 1, 2024 07:41:28.437103033 CEST	4782	49712	39.102.36.209	192.168.2.6
Oct 1, 2024 07:41:53.447751999 CEST	49712	4782	192.168.2.6	39.102.36.209
Oct 1, 2024 07:41:53.452769995 CEST	4782	49712	39.102.36.209	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 1, 2024 07:38:05.127619982 CEST	57030	53	192.168.2.6	1.1.1.1
Oct 1, 2024 07:38:05.135721922 CEST	53	57030	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 1, 2024 07:38:05.127619982 CEST	192.168.2.6	1.1.1.1	0xbd4a	Standard query (0)	ipwho.is	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 1, 2024 07:38:05.135721922 CEST	1.1.1.1	192.168.2.6	0xbd4a	No error (0)	ipwho.is		108.181.98.179	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ipwho.is

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49714	108.181.98.179	443	6136	C:\Users\user\AppData\Roaming\SubDir\Clienty.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-01 05:38:05 UTC	150	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0 Host: ipwho.is Connection: Keep-Alive
2024-10-01 05:38:05 UTC	223	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 05:38:05 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Server: ipwhois Access-Control-Allow-Headers: * X-Robots-Tag: noindex
2024-10-01 05:38:05 UTC	1019	IN	Data Raw: 33 65 66 0d 0a 7b 0a 20 20 20 20 22 41 62 6f 75 74 20 55 73 22 3a 20 22 68 74 74 70 73 3a 5c 2f 5c 2f 69 70 77 68 6f 69 73 2e 69 6f 22 2c 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 73 75 63 63 65 73 73 22 3a 20 74 72 75 65 2c 0a 20 20 20 20 22 74 79 70 65 22 3a 20 22 49 50 76 34 22 2c 0a 20 20 20 20 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 20 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 0a 20 20 20 20 22 63 6f 6e 74 69 6e 65 6e 74 5f 63 6f 64 65 22 3a 20 22 4e 41 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 Data Ascii: 3ef{ "About Us": "https:\/\/ipwhois.io", "ip": "8.46.123.33", "success": true, "type": "IPv4", "continent": "North America", "continent_code": "NA", "country": "United States", "country_code": "US", "region": "New Yor

Target ID:	0
Start time:	01:37:55
Start date:	01/10/2024
Path:	C:\Users\user\Desktop\mtgjyX9gHF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\mtgjyX9gHF.exe"
Imagebase:	0x490000
File size:	3'265'536 bytes
MD5 hash:	641CB02C429FEB106094750765D0D6AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000000.2152636170.00000000007B0000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000002.2186712821.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000000.2152321586.0000000000492000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:37:58
Start date:	01/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Clienty.exe" /rl HIGHEST /f
Imagebase:	0x7ff6d2070000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000002.00000002.2185203736.0000026FF6A55000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000002.00000002.2185070461.000000CA288A9000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000002.00000002.2185117580.0000026FF6830000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000002.00000002.2185203736.0000026FF6A50000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000002.00000002.2185117580.0000026FF683F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:37:58
Start date:	01/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:37:59
Start date:	01/10/2024
Path:	C:\Users\user\AppData\Roaming\SubDir\Clienty.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\SubDir\Clienty.exe"
Imagebase:	0x8d0000
File size:	3'265'536 bytes
MD5 hash:	641CB02C429FEB106094750765D0D6AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000004.00000002.4617304861.0000000002EB9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000004.00000002.4617304861.00000000032B3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe, Author: Joe Security Rule: MAL_QuasarRAT_May19_1, Description: Detects QuasarRAT malware, Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe, Author: ditekSHen Rule: MALWARE_Win_QuasarStealer, Description: Detects Quasar infostealer, Source: C:\Users\user\AppData\Roaming\SubDir\Clienty.exe, Author: ditekshen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 79%, ReversingLabs Detection: 78%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	01:38:00
Start date:	01/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Clienty.exe" /rl HIGHEST /f
Imagebase:	0x7ff6d2070000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000005.00000002.2199659201.000002B938AC0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000005.00000002.2199369633.000002B938880000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000005.00000002.2199659201.000002B938AC5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000005.00000002.2197566283.000000FE32879000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000005.00000002.2199369633.000002B938888000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	01:38:00
Start date:	01/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:38:00
Start date:	01/10/2024
Path:	C:\Users\user\AppData\Roaming\SubDir\Clienty.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\SubDir\Clienty.exe
Imagebase:	0x800000
File size:	3'265'536 bytes
MD5 hash:	641CB02C429FEB106094750765D0D6AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000007.00000002.2221194608.0000000002E51000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	18.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	10
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD341B3525 Relevance: 1.6, APIs: 1, Instructions: 131
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE ref: 00007FFD341B3607

Memory Dump Source

Source File: 00000000.00000002.2189516930.00007FFD341B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd341b0000_mtgjyX9gHF.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 1a065ca52beb1ef6bf62af5153e935b091aea30dc438db42650642ef852b503e
Instruction ID: 6f3e59e128a425ae080986765b1d252f3281b76adaefc8178608bd272c32dc4f
Opcode Fuzzy Hash: 1a065ca52beb1ef6bf62af5153e935b091aea30dc438db42650642ef852b503e
Instruction Fuzzy Hash: CD41053290CB5C8FDB19DF6888596E97FF0FF56310F04826BD049D7692DB68A809C791

Function 00007FFD341B3569 Relevance: 1.6, APIs: 1, Instructions: 109
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE ref: 00007FFD341B3607

Memory Dump Source

Source File: 00000000.00000002.2189516930.00007FFD341B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd341b0000_mtgjyX9gHF.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 1a670805a6e5f5925cb18c7f75573f709f4198430047cf2b3a00d9ef335d2e7e
Instruction ID: 5b2e8eeaa864e24d9dcd0917710693e2eeabf0efa3f5f2d947e2bba79bef1da1
Opcode Fuzzy Hash: 1a670805a6e5f5925cb18c7f75573f709f4198430047cf2b3a00d9ef335d2e7e
Instruction Fuzzy Hash: 1631D03190CB5C8FDB19DB9888596E9BBF0FF66320F04426BD049D3292DB75A815CB91

Function 00007FFD341B206A Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE ref: 00007FFD341B3607

Memory Dump Source

Source File: 00000000.00000002.2189516930.00007FFD341B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd341b0000_mtgjyX9gHF.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 51d8d171a0d4411c9dc2cff336b178e49125ad0cc31b8f74702efd9713a53df8
Instruction ID: bdcac2db6bbe25de14207623dbd9b5abd26c97ce0cf396bb4275131c34f8a3b2
Opcode Fuzzy Hash: 51d8d171a0d4411c9dc2cff336b178e49125ad0cc31b8f74702efd9713a53df8
Instruction Fuzzy Hash: D431C131908A1C9FDB58DF98C449AF9BBE0FF69321F00822FD04AD3651DF74A8168B91

Analysis Process: Clienty.exePID: 6136, Parent PID: 3620COMMON

Execution Graph

Execution Coverage:	6.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	8
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFD344E2391 Relevance: 208.5, Strings: 162, Instructions: 5958COMMON

Download Yara Rule

Strings

P804, xrefs: 00007FFD344E4061
(Z04, xrefs: 00007FFD344E560E
p/04, xrefs: 00007FFD344E3A70
H104, xrefs: 00007FFD344E3BA5
H.04, xrefs: 00007FFD344E39A6
P-04, xrefs: 00007FFD344E3891
W+4, xrefs: 00007FFD344E46F3
P-04, xrefs: 00007FFD344E38DC
H, xrefs: 00007FFD344E542B
`;04, xrefs: 00007FFD344E428F
8H04, xrefs: 00007FFD344E4BCC
W+4, xrefs: 00007FFD344E31A5
W+4, xrefs: 00007FFD344E4E0D
W+4, xrefs: 00007FFD344E5AA0
W+4, xrefs: 00007FFD344E4A1B
W+4, xrefs: 00007FFD344E2B55
W+4, xrefs: 00007FFD344E4951
(%04, xrefs: 00007FFD344E33C1
0Q04, xrefs: 00007FFD344E521C
p/04, xrefs: 00007FFD344E3AAB
(%04, xrefs: 00007FFD344E345B
XG04, xrefs: 00007FFD344E4B3D
W+4, xrefs: 00007FFD344E4BAF
04, xrefs: 00007FFD344E24FB
X,04, xrefs: 00007FFD344E37C7
04, xrefs: 00007FFD344E2543
W+4, xrefs: 00007FFD344E28F7
XG04, xrefs: 00007FFD344E4B02
p>04, xrefs: 00007FFD344E4423
W+4, xrefs: 00007FFD344E3B1D
H.04, xrefs: 00007FFD344E39E1
<04, xrefs: 00007FFD344E42D3
W+4, xrefs: 00007FFD344E2A8B
8H04, xrefs: 00007FFD344E4B6D
`;04, xrefs: 00007FFD344E41F5
W+4, xrefs: 00007FFD344E23FE
8H04, xrefs: 00007FFD344E4B81
8]04, xrefs: 00007FFD344E57DD
X704, xrefs: 00007FFD344E3F97
W+4, xrefs: 00007FFD344E34CD
W+4, xrefs: 00007FFD344E506B
W+4, xrefs: 00007FFD344E3403
004, xrefs: 00007FFD344E3ADB
(R04, xrefs: 00007FFD344E5321
H04, xrefs: 00007FFD344E4CD1
P804, xrefs: 00007FFD344E40C0
W+4, xrefs: 00007FFD344E5919
W+4, xrefs: 00007FFD344E56BB
W+4, xrefs: 00007FFD344E4ED7
W+4, xrefs: 00007FFD344E276C
X704, xrefs: 00007FFD344E4031
W+4, xrefs: 00007FFD344E372B
W+4, xrefs: 00007FFD344E2468
H.04, xrefs: 00007FFD344E3947
H104, xrefs: 00007FFD344E3BB9
W+4, xrefs: 00007FFD344E47BD
XC04, xrefs: 00007FFD344E474B
XC04, xrefs: 00007FFD344E4710
<04, xrefs: 00007FFD344E4359
x"04, xrefs: 00007FFD344E32C7
<04, xrefs: 00007FFD344E431E
H04, xrefs: 00007FFD344E4C37
W+4, xrefs: 00007FFD344E2E7D
(Z04, xrefs: 00007FFD344E5649
<04, xrefs: 00007FFD344E42BF
H104, xrefs: 00007FFD344E3C04
504, xrefs: 00007FFD344E3E62
X704, xrefs: 00007FFD344E3FF6
0Q04, xrefs: 00007FFD344E5257
W+4, xrefs: 00007FFD344E2F47
W+4, xrefs: 00007FFD344E4FA1
X,04, xrefs: 00007FFD344E3812
XG04, xrefs: 00007FFD344E4AA3
p/04, xrefs: 00007FFD344E3A11
(R04, xrefs: 00007FFD344E52E6
W+4, xrefs: 00007FFD344E3011
x"04, xrefs: 00007FFD344E3241
0Q04, xrefs: 00007FFD344E51BD
x'04, xrefs: 00007FFD344E3555
W+4, xrefs: 00007FFD344E4629
0B04, xrefs: 00007FFD344E45E7
W+4, xrefs: 00007FFD344E4495
P804, xrefs: 00007FFD344E40FB
W+4, xrefs: 00007FFD344E416D
8]04, xrefs: 00007FFD344E5743
8A04, xrefs: 00007FFD344E4531
H104, xrefs: 00007FFD344E3C3F
W+4, xrefs: 00007FFD344E38BF
8]04, xrefs: 00007FFD344E57A2
W+4, xrefs: 00007FFD344E4887
(*04, xrefs: 00007FFD344E3748
8H04, xrefs: 00007FFD344E4C07
W+4, xrefs: 00007FFD344E5AB8
X,04, xrefs: 00007FFD344E384D
H04, xrefs: 00007FFD344E4C96
I04, xrefs: 00007FFD344E4D9B
004, xrefs: 00007FFD344E3B75
004, xrefs: 00007FFD344E3AEF
8A04, xrefs: 00007FFD344E451D
I04, xrefs: 00007FFD344E4D15
W+4, xrefs: 00007FFD344E326F
W+4, xrefs: 00007FFD344E3D7B
(*04, xrefs: 00007FFD344E3783
`;04, xrefs: 00007FFD344E4254
P-04, xrefs: 00007FFD344E3917
p/04, xrefs: 00007FFD344E3A25
W+4, xrefs: 00007FFD344E40A3
W+4, xrefs: 00007FFD344E3597
W+4, xrefs: 00007FFD344E3339
W+4, xrefs: 00007FFD344E3F0F
04, xrefs: 00007FFD344E257B
0B04, xrefs: 00007FFD344E4646
p>04, xrefs: 00007FFD344E43E8
504, xrefs: 00007FFD344E3E03
W+4, xrefs: 00007FFD344E5393
p>04, xrefs: 00007FFD344E4389
W+4, xrefs: 00007FFD344E282D
XC04, xrefs: 00007FFD344E46B1
(*04, xrefs: 00007FFD344E36E9
W+4, xrefs: 00007FFD344E5135
W+4, xrefs: 00007FFD344E2DB3
8A04, xrefs: 00007FFD344E457C
W+4, xrefs: 00007FFD344E4301
P804, xrefs: 00007FFD344E4075
`;04, xrefs: 00007FFD344E4209
8]04, xrefs: 00007FFD344E5757
(%04, xrefs: 00007FFD344E33D5
(%04, xrefs: 00007FFD344E3420
W+4, xrefs: 00007FFD344E4C79
W+4, xrefs: 00007FFD344E51FF
W+4, xrefs: 00007FFD344E37F5
x'04, xrefs: 00007FFD344E35EF
x'04, xrefs: 00007FFD344E35B4
X,04, xrefs: 00007FFD344E37B3
W+4, xrefs: 00007FFD344E5527
I04, xrefs: 00007FFD344E4D01
W+4, xrefs: 00007FFD344E4237
W+4, xrefs: 00007FFD344E4D43
(*04, xrefs: 00007FFD344E36FD
504, xrefs: 00007FFD344E3E9D
W+4, xrefs: 00007FFD344E2529
XC04, xrefs: 00007FFD344E46C5
W+4, xrefs: 00007FFD344E584F
8A04, xrefs: 00007FFD344E45B7
0Q04, xrefs: 00007FFD344E51D1
004, xrefs: 00007FFD344E3B3A
P-04, xrefs: 00007FFD344E387D
04, xrefs: 00007FFD344E24E7
H.04, xrefs: 00007FFD344E395B
W+4, xrefs: 00007FFD344E545D
0B04, xrefs: 00007FFD344E45FB
(R04, xrefs: 00007FFD344E5287
x"04, xrefs: 00007FFD344E328C
W+4, xrefs: 00007FFD344E455F
0B04, xrefs: 00007FFD344E4681
H04, xrefs: 00007FFD344E4C4B
I04, xrefs: 00007FFD344E4D60
(Z04, xrefs: 00007FFD344E55AF
x'04, xrefs: 00007FFD344E3569
W+4, xrefs: 00007FFD344E3661
W+4, xrefs: 00007FFD344E2C1F
x"04, xrefs: 00007FFD344E322D

Memory Dump Source

Source File: 00000004.00000002.4631372092.00007FFD344E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd344e0000_Clienty.jbxd

Similarity

API ID:
String ID: 004$ 004$ 004$ 004$ 504$ 504$ 504$(%04$(%04$(%04$(%04$(*04$(*04$(*04$(*04$(R04$(R04$(R04$(Z04$(Z04$(Z04$0B04$0B04$0B04$0B04$0Q04$0Q04$0Q04$0Q04$8A04$8A04$8A04$8A04$8H04$8H04$8H04$8H04$8]04$8]04$8]04$8]04$H$H.04$H.04$H.04$H.04$H104$H104$H104$H104$P-04$P-04$P-04$P-04$P804$P804$P804$P804$X,04$X,04$X,04$X,04$X704$X704$X704$XC04$XC04$XC04$XC04$XG04$XG04$XG04$`;04$`;04$`;04$`;04$p/04$p/04$p/04$p/04$p>04$p>04$p>04$x"04$x"04$x"04$x"04$x'04$x'04$x'04$x'04$04$04$04$04$<04$<04$<04$<04$H04$H04$H04$H04$I04$I04$I04$I04$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4$W+4
API String ID: 0-2354076621
Opcode ID: f74a79a1971048de3c4801911377f3df9f42c8b15ad098c3c71045fb8d67de83
Instruction ID: 29aa3507b300790f074bff2bd94e959198b704f5fd29875d2a3aa58bbd47b886
Opcode Fuzzy Hash: f74a79a1971048de3c4801911377f3df9f42c8b15ad098c3c71045fb8d67de83
Instruction Fuzzy Hash: FC73C852B19D4B0FFBE5962C04B523653C2EFDA640B5E41BAD55EC32CAED6CEC826340

Function 00007FFD34419FD0 Relevance: 9.8, Strings: 7, Instructions: 1064
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

HA4, xrefs: 00007FFD3441A84A
HA4, xrefs: 00007FFD3441A810
HA4, xrefs: 00007FFD3441A7D7
HA4, xrefs: 00007FFD3441A917
HA4, xrefs: 00007FFD3441A951
HA4, xrefs: 00007FFD3441AAA2
HA4, xrefs: 00007FFD3441A79D

Memory Dump Source

Source File: 00000004.00000002.4630606157.00007FFD34410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34410000_Clienty.jbxd

Similarity

API ID:
String ID: HA4$HA4$HA4$HA4$HA4$HA4$HA4
API String ID: 0-2049325341
Opcode ID: 076483732a08b7907ca5aa0d76fdf019c61d12aea921c21b5972275fa7064c06
Instruction ID: 18e9a477a1d049bae70e196881d496917ac12e8931df35f257a07e83a577f53f
Opcode Fuzzy Hash: 076483732a08b7907ca5aa0d76fdf019c61d12aea921c21b5972275fa7064c06
Instruction Fuzzy Hash: BB62593171C9494FEB98EB2CD4A5AB937D1FF9A310B0501BAD54EC72A6DE28EC42C741

Function 00007FFD3442C13A Relevance: 9.5, Strings: 7, Instructions: 776
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

HA4, xrefs: 00007FFD3442C1B6
_, xrefs: 00007FFD3442C1A9
HA4, xrefs: 00007FFD3442C73A
HA4, xrefs: 00007FFD3442C690
HA4, xrefs: 00007FFD3442C5EF
HA4, xrefs: 00007FFD3442C6FE
HA4, xrefs: 00007FFD3442C6E7

Memory Dump Source

Source File: 00000004.00000002.4630606157.00007FFD34410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34410000_Clienty.jbxd

Similarity

API ID:
String ID: HA4$HA4$HA4$HA4$HA4$HA4$_
API String ID: 0-2051887990
Opcode ID: 5c07ba787f7d0b66856e35d287c48a59ee4c750c930bd880c53e6bdad0df86aa
Instruction ID: 890456829e226843b23ce05bab818ea82a8cd74524a3cf558836a49403071475
Opcode Fuzzy Hash: 5c07ba787f7d0b66856e35d287c48a59ee4c750c930bd880c53e6bdad0df86aa
Instruction Fuzzy Hash: 86326931B1CA464FE765DB6884A56B977D0FF96340F0585BDD58EC318ADE2EF8028381

Function 00007FFD3442B7E1 Relevance: 8.4, Strings: 6, Instructions: 928
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(/.4, xrefs: 00007FFD3442B9A0
(/.4, xrefs: 00007FFD3442BE20
g&_H, xrefs: 00007FFD3442BD70
HA4, xrefs: 00007FFD3442BEE4
HA4, xrefs: 00007FFD3442BF48
HA4, xrefs: 00007FFD3442BEAB

Memory Dump Source

Source File: 00000004.00000002.4630606157.00007FFD34410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34410000_Clienty.jbxd

Similarity

API ID:
String ID: (/.4$(/.4$HA4$HA4$HA4$g&_H
API String ID: 0-742983036
Opcode ID: 6c09def7807422b611d4384ee98a29c69f7c0855abb72a4bffd1ffa9904c0f3b
Instruction ID: ea34311b40cc17a6c3b7a703ce866e15ce6ce983257532610755ff97ad5b9419
Opcode Fuzzy Hash: 6c09def7807422b611d4384ee98a29c69f7c0855abb72a4bffd1ffa9904c0f3b
Instruction Fuzzy Hash: D852E231B18E494BEBA8DF5C84A5675B3D1FF99340F41067ED54EC328ADE68F8428781

Function 00007FFD3442FE80 Relevance: 7.6, Strings: 5, Instructions: 1313COMMON

Download Yara Rule

Strings

HA4, xrefs: 00007FFD34430586
HA4, xrefs: 00007FFD34430609
HA4, xrefs: 00007FFD3443067A
, xrefs: 00007FFD34430561
, xrefs: 00007FFD34430256

Memory Dump Source

Source File: 00000004.00000002.4630606157.00007FFD34410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34410000_Clienty.jbxd

Similarity

API ID:
String ID: $ $HA4$HA4$HA4
API String ID: 0-1122398365
Opcode ID: bd3f500d702175007ec2d9188c815ca1e0fd2e25009289805a1e2653a3e82a08
Instruction ID: 83bea30f7695635da5b3d8dccfae755d42f11f299e3d2677a66440c77581e7f6
Opcode Fuzzy Hash: bd3f500d702175007ec2d9188c815ca1e0fd2e25009289805a1e2653a3e82a08
Instruction Fuzzy Hash: E982E631B08A4D4FEBA8EB1CC4B5A7437D1FF5A700B1601BAD18DC72AADE68EC419741

Function 00007FFD344155D6 Relevance: 7.1, Strings: 4, Instructions: 2124COMMON

Download Yara Rule

Strings

*M4, xrefs: 00007FFD34416880
pUA4, xrefs: 00007FFD34416BB0
HA4, xrefs: 00007FFD34416ADB
HA4, xrefs: 00007FFD34416A36

Memory Dump Source

Source File: 00000004.00000002.4630606157.00007FFD34410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34410000_Clienty.jbxd

Similarity

API ID:
String ID: *M4$HA4$HA4$pUA4
API String ID: 0-2735955535
Opcode ID: 502bd11ee031c380226b446588d1ddcb1956f0d0f6b2601876e24ef512a10bd8
Instruction ID: 123a9d5564b27c0a153a1a62132ab59b5e85c60a1daad9237f3b17cda83bde54
Opcode Fuzzy Hash: 502bd11ee031c380226b446588d1ddcb1956f0d0f6b2601876e24ef512a10bd8
Instruction Fuzzy Hash: B2F28F70B18A098FDB98EF18C494BA977E1FF99300F5541B9D44ED72A6DE39E881CB40

Function 00007FFD3442EB29 Relevance: 6.0, Strings: 4, Instructions: 969
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

HA4, xrefs: 00007FFD3442F0F0
p-4, xrefs: 00007FFD3442F337
HA4, xrefs: 00007FFD3442F129
HA4, xrefs: 00007FFD3442F097

Memory Dump Source

Source File: 00000004.00000002.4630606157.00007FFD34410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34410000_Clienty.jbxd

Similarity

API ID:
String ID: HA4$HA4$HA4$p-4
API String ID: 0-3295367865
Opcode ID: 2a8a511f047c7213c5f3864846db4ad4e411a9ac5dd1e7fb7ea555de64098390
Instruction ID: 9395eb5a5b073ff51aed93af83e5716a083385581e9ee3015c673c57d146e071
Opcode Fuzzy Hash: 2a8a511f047c7213c5f3864846db4ad4e411a9ac5dd1e7fb7ea555de64098390
Instruction Fuzzy Hash: 1362BF31B18A4A4FEB98DF5C84A16B973E2FF99340F5501B9E45AC7286CE38EC42D741

Function 00007FFD34419271 Relevance: 5.7, Strings: 4, Instructions: 682
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Po-4, xrefs: 00007FFD34419A29
Po-4, xrefs: 00007FFD34419A3C
Po-4, xrefs: 00007FFD34419A9F
Po-4, xrefs: 00007FFD34419A8C

Memory Dump Source

Source File: 00000004.00000002.4630606157.00007FFD34410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34410000_Clienty.jbxd

Similarity

API ID:
String ID: Po-4$Po-4$Po-4$Po-4
API String ID: 0-791248503
Opcode ID: 867b6606417faf3a68c34d4516ed02bda276064d36bf9d971e58190e9130aaf7
Instruction ID: 43b200d9de3e3321d4a9fd1c656504307afca697e976713185110692a88799b9
Opcode Fuzzy Hash: 867b6606417faf3a68c34d4516ed02bda276064d36bf9d971e58190e9130aaf7
Instruction Fuzzy Hash: FB228F31B18A094FEB98EA1884A57B977E2FF99300F15017DD54FD3296CE78E882CB41

Function 00007FFD34433AF9 Relevance: 4.3, Strings: 3, Instructions: 538
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

HA4, xrefs: 00007FFD34433E04
0d-4, xrefs: 00007FFD34433B67
HA4, xrefs: 00007FFD34433F07

Memory Dump Source

Source File: 00000004.00000002.4630606157.00007FFD34410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34410000_Clienty.jbxd

Similarity

API ID:
String ID: 0d-4$HA4$HA4
API String ID: 0-2373844608
Opcode ID: adb96fd5483f4ead344b9c13a4c0312522c910bef812e9f01e7f84c4dfb44031
Instruction ID: 6bf734f6b40a6ced398eea5b2c13ebeefe9cc9eb980c946cee073e2c9c4a1238
Opcode Fuzzy Hash: adb96fd5483f4ead344b9c13a4c0312522c910bef812e9f01e7f84c4dfb44031
Instruction Fuzzy Hash: 4DF13431B0CA494FEBA5EB2C84B56B477E2FF9A700B0901B9D14DC7296DE6DE8528740

Function 00007FFD3441621F Relevance: 1.8, Strings: 1, Instructions: 531COMMON

Download Yara Rule

Strings

*M4, xrefs: 00007FFD34416880

Memory Dump Source

Source File: 00000004.00000002.4630606157.00007FFD34410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34410000_Clienty.jbxd

Similarity

API ID:
String ID: *M4
API String ID: 0-1367679375
Opcode ID: 8408cec4d5291c9c2416987020bece86cb54219199199160e22b17d37467b7b4
Instruction ID: a2eb2114e0019f3d397598fb49a5c2b923023e65b1c7717b3dcd0099a987ac1a
Opcode Fuzzy Hash: 8408cec4d5291c9c2416987020bece86cb54219199199160e22b17d37467b7b4
Instruction Fuzzy Hash: FA025C30A18A1A8FEB98DF18C4957B9B7E1FF59301F1141BAD54ED32A5DA78F881CB40

Function 00007FFD3441347E Relevance: 1.7, Strings: 1, Instructions: 452COMMON

Download Yara Rule

Strings

HH.4, xrefs: 00007FFD34413868

Memory Dump Source

Source File: 00000004.00000002.4630606157.00007FFD34410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34410000_Clienty.jbxd

Similarity

API ID:
String ID: HH.4
API String ID: 0-736005679
Opcode ID: ef5249f0bd95c445e9643f396ba1fafa45d271c7d0248de17897abdb37703740
Instruction ID: a91ca551804232cad54d51e6c678defb18f2497c82a1c33f8fd0a667a1e6f997
Opcode Fuzzy Hash: ef5249f0bd95c445e9643f396ba1fafa45d271c7d0248de17897abdb37703740
Instruction Fuzzy Hash: E2D18A72B0D98D0FF765EA2C88A92B877D0EF96310F0601BAD14DC7296ED6CAC46C740

Function 00007FFD341A3C6F Relevance: 1.7, Strings: 1, Instructions: 412COMMON

Download Yara Rule

Strings

w+4, xrefs: 00007FFD341A3EB1

Memory Dump Source

Source File: 00000004.00000002.4627251365.00007FFD341A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd341a0000_Clienty.jbxd

Similarity

API ID:
String ID: w+4
API String ID: 0-757429887
Opcode ID: ea3ff61feded55f97cc014854701a02d85ffeba2fb723f92f475f17ed36725e8
Instruction ID: 64b5d3b8477012816f61d9135e37df00cce9ff88befb57070dfaae276ce89b89
Opcode Fuzzy Hash: ea3ff61feded55f97cc014854701a02d85ffeba2fb723f92f475f17ed36725e8
Instruction Fuzzy Hash: EDA11C2B70D9A64AE712B67EB8652E97B50EFC2677718057BD2C8CD083D914588F83F0

Function 00007FFD3441AFDD Relevance: .9, Instructions: 864COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4630606157.00007FFD34410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34410000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6cae3c6fce39e7bb553fb409bf1058a6020a7e3500bf951da25ba1b9a7c4220
Instruction ID: 6e8b5a04cbeeb11b79a1245d0496d69c592e16579e911422aa0b7ec29ebe8e1e
Opcode Fuzzy Hash: b6cae3c6fce39e7bb553fb409bf1058a6020a7e3500bf951da25ba1b9a7c4220
Instruction Fuzzy Hash: 66524E30B08A498FEBA8EB2CC4A8B6577E1FF99300F1545B9E44DC72A6DE75E841C741

Function 00007FFD34438E30 Relevance: .6, Instructions: 576COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4630606157.00007FFD34410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34410000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: def8db18c5232f68e715d2b76ff958c1ff32e1213cea9538302a819d36733380
Instruction ID: fa306ab54f58b136000f2d6c7fad8cb6f8644f4e6ea4fc4d786256386ee3f18a
Opcode Fuzzy Hash: def8db18c5232f68e715d2b76ff958c1ff32e1213cea9538302a819d36733380
Instruction Fuzzy Hash: 00025431B1890D4FDB98EF6CC4A5AA977E2FFA9340F514179E50DC329ACE68EC518780

Function 00007FFD34427C16 Relevance: .5, Instructions: 472COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4630606157.00007FFD34410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34410000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c4831378c06536c96eb1f23531fbea79625b70237ce7a56e552ba431086654c
Instruction ID: 4ee90e8029ef95577e3a09d73e71aa4ff84965b85fe70805d3f88493eb82e486
Opcode Fuzzy Hash: 6c4831378c06536c96eb1f23531fbea79625b70237ce7a56e552ba431086654c
Instruction Fuzzy Hash: 4EF1B330618A4D8FEBA8DF68C8957F977E1FF55350F04427AE80DC7295DB7898418B82

Function 00007FFD344217B0 Relevance: .4, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4630606157.00007FFD34410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34410000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 439d9b9d8c1067d6f3cf2d3ef89badacf75c35bbd2d7e46d1f9c97eab4d9c26c
Instruction ID: d9b419e2ad7610f386fe259c23e847e435b575eeb176ad1aa65ccff9c411918c
Opcode Fuzzy Hash: 439d9b9d8c1067d6f3cf2d3ef89badacf75c35bbd2d7e46d1f9c97eab4d9c26c
Instruction Fuzzy Hash: 03C1B917B0D1A65AEB22F6FCB4B21EB7B94DF426397080177D1DC8E093DD18644E82A5

Function 00007FFD344217D7 Relevance: .4, Instructions: 424COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4630606157.00007FFD34410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34410000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a20399567cda3a4f228238d0e421b12f45e20d174a4d35568ad1828d5a7999c9
Instruction ID: 0ae867517111cec0c26e39cd7cd347317d7b373fd1ac5a37951b31c06e1bcc4e
Opcode Fuzzy Hash: a20399567cda3a4f228238d0e421b12f45e20d174a4d35568ad1828d5a7999c9
Instruction Fuzzy Hash: 4FC1B917B0D1A65AEB22F6FCB4B20EB7B94DF4263970C01B7D1DC8E093DD18644E82A5

Function 00007FFD34428A0F Relevance: .4, Instructions: 424COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4630606157.00007FFD34410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34410000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bc403eac100a7f9f63a5af3e3c7063b819a7e53c952bba75c8d47ec88d96faf
Instruction ID: fd09f85b0ac146c43c98f06f5dba891a5632650b51b0959489ea5db49230d9c3
Opcode Fuzzy Hash: 8bc403eac100a7f9f63a5af3e3c7063b819a7e53c952bba75c8d47ec88d96faf
Instruction Fuzzy Hash: 96E18170A08A4D8FEBA8DF68C8957E977D1FB55350F00423EE80DC7295DF78A9458B81

Function 00007FFD344217EF Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4630606157.00007FFD34410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34410000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a7598b6935e3b8457e7fc47326c57f03378dd18253c5e5948f942f94726d904
Instruction ID: cda1bfe1e365c4bbced74661a404bf8b6e4be26ca22af5c24b039c2100eedd60
Opcode Fuzzy Hash: 5a7598b6935e3b8457e7fc47326c57f03378dd18253c5e5948f942f94726d904
Instruction Fuzzy Hash: 5EC1B917B0D1A65AEB22F6FCB4B20EB7B94DF4263D70801B7D1DC8A093DD18604E82A5

Function 00007FFD344217C8 Relevance: .4, Instructions: 419COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4630606157.00007FFD34410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34410000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90c8a7bd1fea099c7e977c6f9ce5468ab0bca5312033583f21ced622bcdc9361
Instruction ID: 8759e057f972a3aaea780bf99ff6382758d415e8728431f3f9f4e751bf077189
Opcode Fuzzy Hash: 90c8a7bd1fea099c7e977c6f9ce5468ab0bca5312033583f21ced622bcdc9361
Instruction Fuzzy Hash: F5C1B817B0D1A65AEB22F6FCB4B20EB7B94DF4263970C01B7D1DC8E093DD18604E82A5

Function 00007FFD34421898 Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4630606157.00007FFD34410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34410000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fb0ee2c1251514e212b4a9e6a7822621c856a5414e5920901dd571a255257e1
Instruction ID: bc0300f716b7d63552434a7d38b3da3a0e722c068c2754bcfdf2b8602c9612a2
Opcode Fuzzy Hash: 0fb0ee2c1251514e212b4a9e6a7822621c856a5414e5920901dd571a255257e1
Instruction Fuzzy Hash: 30A1B717B0D1A65AEB22F7FCB4B21EB7FA4DF4263970801B7D1DC8A093DD18544E82A5

Function 00007FFD344215A0 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4630606157.00007FFD34410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34410000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6212463a996b6c635d70bbfc6f2955276145bb24682c1e603b2377002065e14
Instruction ID: 5b91ce57d4bf48be9925349deea797579c1751cf4ada8e2ac68923b248f54fde
Opcode Fuzzy Hash: b6212463a996b6c635d70bbfc6f2955276145bb24682c1e603b2377002065e14
Instruction Fuzzy Hash: 64412D33B0C6154BE768EEACB4A66EEB7D0EF95335B08013FD14DC6182CE2998468394

Function 00007FFD344E3FA2 Relevance: 5.1, Strings: 4, Instructions: 107COMMON

Download Yara Rule

Strings

X704, xrefs: 00007FFD344E4031
X704, xrefs: 00007FFD344E3FAB
X704, xrefs: 00007FFD344E3FF6
W+4, xrefs: 00007FFD344E3FD9

Memory Dump Source

Source File: 00000004.00000002.4631372092.00007FFD344E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd344e0000_Clienty.jbxd

Similarity

API ID:
String ID: X704$X704$X704$W+4
API String ID: 0-3017591796
Opcode ID: 65a8a72b7b91d31874a5f6b6823def41d1dc76e76e17806f688384d388ac3c94
Instruction ID: 419d8e1ecf3cced09c46bd26ff572fb9dc70e4571ef5a99c5b0290b04a283934
Opcode Fuzzy Hash: 65a8a72b7b91d31874a5f6b6823def41d1dc76e76e17806f688384d388ac3c94
Instruction Fuzzy Hash: 7521E652B09D4B0FF7E6A62C04F523667C2EF99600B5E017AD65EC328AEC5CEC826341

Function 00007FFD344E4AAE Relevance: 5.1, Strings: 4, Instructions: 106COMMON

Download Yara Rule

Strings

XG04, xrefs: 00007FFD344E4B3D
XG04, xrefs: 00007FFD344E4AB7
W+4, xrefs: 00007FFD344E4AE5
XG04, xrefs: 00007FFD344E4B02

Memory Dump Source

Source File: 00000004.00000002.4631372092.00007FFD344E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd344e0000_Clienty.jbxd

Similarity

API ID:
String ID: XG04$XG04$XG04$W+4
API String ID: 0-2349584376
Opcode ID: fd44ff92bffa59cbfda9b2f96a70cff86e2c5102da9e8d75cb686cc0fa6c34ac
Instruction ID: 68c8446a3772ae355594255abd057fa059ceb041fa12143599498284fed06be5
Opcode Fuzzy Hash: fd44ff92bffa59cbfda9b2f96a70cff86e2c5102da9e8d75cb686cc0fa6c34ac
Instruction Fuzzy Hash: 5F21F612B09D4A0FF7E5A62C14F423663C2EFDA55075E01BAD51DC72CADC6CEC826340

Function 00007FFD344E3E0F Relevance: 5.1, Strings: 4, Instructions: 106COMMON

Download Yara Rule

Strings

504, xrefs: 00007FFD344E3E9D
504, xrefs: 00007FFD344E3E17
504, xrefs: 00007FFD344E3E62
W+4, xrefs: 00007FFD344E3E45

Memory Dump Source

Source File: 00000004.00000002.4631372092.00007FFD344E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd344e0000_Clienty.jbxd

Similarity

API ID:
String ID: 504$ 504$ 504$W+4
API String ID: 0-818557063
Opcode ID: 34729a3a402320ae44469e9fa53dc7afa07e1efa0dd19420adc39f2077442703
Instruction ID: 3dead9c67c6b607d9b28f3f6bd90e589ee93fcb297dfeb9d2e85ecde54110c89
Opcode Fuzzy Hash: 34729a3a402320ae44469e9fa53dc7afa07e1efa0dd19420adc39f2077442703
Instruction Fuzzy Hash: C0210A12B0ED4A0FF7E6A62C04F427662C2EFDA65075D11BAD15DC72DAED6CEC825340

Function 00007FFD344E5293 Relevance: 5.1, Strings: 4, Instructions: 104COMMON

Download Yara Rule

Strings

(R04, xrefs: 00007FFD344E5321
W+4, xrefs: 00007FFD344E52C9
(R04, xrefs: 00007FFD344E52E6
(R04, xrefs: 00007FFD344E529B

Memory Dump Source

Source File: 00000004.00000002.4631372092.00007FFD344E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd344e0000_Clienty.jbxd

Similarity

API ID:
String ID: (R04$(R04$(R04$W+4
API String ID: 0-4172039301
Opcode ID: 79c3971f594418d6ba6281bec30471a254f1270bc2cc1879a46cce7afd89e392
Instruction ID: a87bde642d7bace7a9242fc6d9a3382955a4ecc5d1ed1b6a8a4ca13e2abe0b40
Opcode Fuzzy Hash: 79c3971f594418d6ba6281bec30471a254f1270bc2cc1879a46cce7afd89e392
Instruction Fuzzy Hash: 1B21F812B09E4A0FF7E6A66C04F423566C2DF9A610B9D01BAD55DC32CBDD6CEC825340

Function 00007FFD344E4398 Relevance: 5.1, Strings: 4, Instructions: 103COMMON

Download Yara Rule

Strings

p>04, xrefs: 00007FFD344E43E8
W+4, xrefs: 00007FFD344E43CB
p>04, xrefs: 00007FFD344E4423
p>04, xrefs: 00007FFD344E439D

Memory Dump Source

Source File: 00000004.00000002.4631372092.00007FFD344E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd344e0000_Clienty.jbxd

Similarity

API ID:
String ID: p>04$p>04$p>04$W+4
API String ID: 0-726580395
Opcode ID: c9cd1ac4f85968a518c8f4af00d280dcf84c4f814fabdffa7f9ecca5ceefcba7
Instruction ID: c2103e2ae2799ebf0af51dd20b1a41149fcb41b7af3998c08fbd5c88758067b6
Opcode Fuzzy Hash: c9cd1ac4f85968a518c8f4af00d280dcf84c4f814fabdffa7f9ecca5ceefcba7
Instruction Fuzzy Hash: DE210512B0DD4A0FF7E5A62C14B523663C2EF9A654B5E01BAD54EC32CBDD6CEC826340

Function 00007FFD344E3966 Relevance: 5.1, Strings: 4, Instructions: 83COMMON

Download Yara Rule

Strings

H.04, xrefs: 00007FFD344E39E1
H.04, xrefs: 00007FFD344E39A6
p/04, xrefs: 00007FFD344E3A25
p/04, xrefs: 00007FFD344E3A11

Memory Dump Source

Source File: 00000004.00000002.4631372092.00007FFD344E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd344e0000_Clienty.jbxd

Similarity

API ID:
String ID: H.04$H.04$p/04$p/04
API String ID: 0-1075630546
Opcode ID: 643a4ac68a9bcf1ae33fbfd8e6d1f8a5cc3603773df90492ec0ab14e13e3b9a9
Instruction ID: 99909e871a0807188a73a0829ccebd39c0955e5f929f026716f0d776791b20f3
Opcode Fuzzy Hash: 643a4ac68a9bcf1ae33fbfd8e6d1f8a5cc3603773df90492ec0ab14e13e3b9a9
Instruction Fuzzy Hash: 7B212C22B1DD470BF7A6A72C04B513966C2DF96200B6E11BDC64EC76DAED5DEC825340

Function 00007FFD344E5762 Relevance: 3.8, Strings: 3, Instructions: 96COMMON

Download Yara Rule

Strings

8]04, xrefs: 00007FFD344E57DD
8]04, xrefs: 00007FFD344E57A2
W+4, xrefs: 00007FFD344E5785

Memory Dump Source

Source File: 00000004.00000002.4631372092.00007FFD344E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd344e0000_Clienty.jbxd

Similarity

API ID:
String ID: 8]04$8]04$W+4
API String ID: 0-95130122
Opcode ID: 5e8250ffb5c5bbdfb1ce364292b9b66d38f66597b7f12e13f50bb24b49d0da05
Instruction ID: 6f94a599385a3de76cf4ff7eb4932d1ed64dbf1548452e14441eb8aacd161227
Opcode Fuzzy Hash: 5e8250ffb5c5bbdfb1ce364292b9b66d38f66597b7f12e13f50bb24b49d0da05
Instruction Fuzzy Hash: 4021F512B0AE0A0FF7E5A66C04B423A62C2DF99110B6D05BED51EC32CBEC6CDC826344

Function 00007FFD344E55CF Relevance: 3.8, Strings: 3, Instructions: 95COMMON

Download Yara Rule

Strings

(Z04, xrefs: 00007FFD344E560E
W+4, xrefs: 00007FFD344E55F1
(Z04, xrefs: 00007FFD344E5649

Memory Dump Source

Source File: 00000004.00000002.4631372092.00007FFD344E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd344e0000_Clienty.jbxd

Similarity

API ID:
String ID: (Z04$(Z04$W+4
API String ID: 0-883391548
Opcode ID: 905ec5719efea5ce4223fdd2c4604b705c27c92fde7d356dc97fcae24fe06fb1
Instruction ID: d209ae85b778b79b5c046cab37a303efed2f36cf7a82c5bf0a2ae7eabdcf066d
Opcode Fuzzy Hash: 905ec5719efea5ce4223fdd2c4604b705c27c92fde7d356dc97fcae24fe06fb1
Instruction Fuzzy Hash: 1F21F852B19E0B0FF7E5A66C04F527A62C2DF99210B5D01BAD55DC328BED6DEC425340

Function 00007FFD344E3968 Relevance: 3.8, Strings: 3, Instructions: 95COMMON

Download Yara Rule

Strings

W+4, xrefs: 00007FFD344E3989
H.04, xrefs: 00007FFD344E39E1
H.04, xrefs: 00007FFD344E39A6

Memory Dump Source

Source File: 00000004.00000002.4631372092.00007FFD344E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd344e0000_Clienty.jbxd

Similarity

API ID:
String ID: H.04$H.04$W+4
API String ID: 0-783351214
Opcode ID: 08ca5c7feb065e78878a7b231baf170560ec073d3eb43b1cb5dd3a3dc7c469d8
Instruction ID: 3638550695db9443e056f2b17e295b0d51f976b0154b8d24f1e58b80128dc6ae
Opcode Fuzzy Hash: 08ca5c7feb065e78878a7b231baf170560ec073d3eb43b1cb5dd3a3dc7c469d8
Instruction Fuzzy Hash: 6121C512B0DD0A0FF7E6A62C04B527A62C2DFD9610B6D11BAD61EC769AED6CDC825340

Function 00007FFD344E3A37 Relevance: 3.8, Strings: 3, Instructions: 94COMMON

Download Yara Rule

Strings

p/04, xrefs: 00007FFD344E3A70
p/04, xrefs: 00007FFD344E3AAB
W+4, xrefs: 00007FFD344E3A53

Memory Dump Source

Source File: 00000004.00000002.4631372092.00007FFD344E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd344e0000_Clienty.jbxd

Similarity

API ID:
String ID: p/04$p/04$W+4
API String ID: 0-1747664269
Opcode ID: 67b5542a894b8ac6f457ebaa6c16585c38859c77c078a584c75588ecbfd98f56
Instruction ID: 2f74ea770cc12b7813cc7dbe05d653d734f3a14195c6e370fc68188fb7044cbb
Opcode Fuzzy Hash: 67b5542a894b8ac6f457ebaa6c16585c38859c77c078a584c75588ecbfd98f56
Instruction Fuzzy Hash: 0F219812B0DD4A0BF7E6A62C04F527662C2DFD9650B5D11BED11DC32DAED6CDC826340

Function 00007FFD344E3BCD Relevance: 3.8, Strings: 3, Instructions: 93COMMON

Download Yara Rule

Strings

H104, xrefs: 00007FFD344E3C3F
W+4, xrefs: 00007FFD344E3BE7
H104, xrefs: 00007FFD344E3C04

Memory Dump Source

Source File: 00000004.00000002.4631372092.00007FFD344E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd344e0000_Clienty.jbxd

Similarity

API ID:
String ID: H104$H104$W+4
API String ID: 0-3909057305
Opcode ID: 1781e543abb58d28f5fe2a4d05f567e4c9ffad076cf31258c2a9ad004bb8e66d
Instruction ID: 483f5e0835ac111524f1792e5da969b0b085367c3c05fa4d500256c2f919d2a6
Opcode Fuzzy Hash: 1781e543abb58d28f5fe2a4d05f567e4c9ffad076cf31258c2a9ad004bb8e66d
Instruction Fuzzy Hash: 6221DA13B0DD4A0FF7E6A22C04B527566C2DF8951076E01BAD51DC728BEC6DDC825340

Function 00007FFD344E55BA Relevance: 3.8, Strings: 3, Instructions: 83COMMON

Download Yara Rule

Strings

(Z04, xrefs: 00007FFD344E560E
(Z04, xrefs: 00007FFD344E55C3
(Z04, xrefs: 00007FFD344E5649

Memory Dump Source

Source File: 00000004.00000002.4631372092.00007FFD344E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd344e0000_Clienty.jbxd

Similarity

API ID:
String ID: (Z04$(Z04$(Z04
API String ID: 0-3525749543
Opcode ID: fb9ba029737cd37493dbd6663896402006dba335f466229f6c43a8fca243481b
Instruction ID: cd568b8375d1c80508d870606687e72d7c4b25a923d3ddc1b54bd1f63e37edb8
Opcode Fuzzy Hash: fb9ba029737cd37493dbd6663896402006dba335f466229f6c43a8fca243481b
Instruction Fuzzy Hash: DB110A52B1DE0B0BF7E6A66C14F123662C2EF95210B9E017AD55EC32CAED6CDC825300

Function 00007FFD3441E6F9 Relevance: 1.8, APIs: 1, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4630606157.00007FFD34410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34410000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4587ce164f5a400b4f476d05bc443bd633f77ad52b4ad0e159506bf5f1afcc24
Instruction ID: f7edb944155042fad966ffa40c2ea4e6ccc21a1405960ca1d2d488d976aadcb8
Opcode Fuzzy Hash: 4587ce164f5a400b4f476d05bc443bd633f77ad52b4ad0e159506bf5f1afcc24
Instruction Fuzzy Hash: 10710631B1CA594FEB58EB6C98A65B97BE0EF59310B14417FD05ED3283DE28A842C781

Function 00007FFD341A3525 Relevance: 1.6, APIs: 1, Instructions: 131fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32 ref: 00007FFD341A3607

Memory Dump Source

Source File: 00000004.00000002.4627251365.00007FFD341A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd341a0000_Clienty.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 2a5b41c59dc7f1392d93ed98d4af11e626aa2d5498eab06eb9c07d2d4ae63837
Instruction ID: 3f09e6d8796fdf3f9886bd9f74bb3958013ed6033929d2fc725b4e7d4d6defd6
Opcode Fuzzy Hash: 2a5b41c59dc7f1392d93ed98d4af11e626aa2d5498eab06eb9c07d2d4ae63837
Instruction Fuzzy Hash: 5941143190DB4C8FDB59DF6888596E9BFF0FF56310F0442ABC049D3692DA28A805C791

Function 00007FFD341A3569 Relevance: 1.6, APIs: 1, Instructions: 109fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32 ref: 00007FFD341A3607

Memory Dump Source

Source File: 00000004.00000002.4627251365.00007FFD341A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd341a0000_Clienty.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 69056ee7071f165133155e72a9ae508da65c2a47db105dc5af069e03b2523ebc
Instruction ID: 9f0108b6bb5e3e4004e721da9284b702b2ddf072d311a1fe1fbf40c588154a24
Opcode Fuzzy Hash: 69056ee7071f165133155e72a9ae508da65c2a47db105dc5af069e03b2523ebc
Instruction Fuzzy Hash: EB31F03190CB5C8FDB59DB9888596E9BBF0FF66320F04426FC049D3292CB74A805CB91

Function 00007FFD344E01BA Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

"&_L, xrefs: 00007FFD344E01D2

Memory Dump Source

Source File: 00000004.00000002.4631372092.00007FFD344E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd344e0000_Clienty.jbxd

Similarity

API ID:
String ID: "&_L
API String ID: 0-1442238171
Opcode ID: 7be10c99ede2b022fe0a461fe5e281533003581ef1ae704ffa1039d0aa649c8d
Instruction ID: 1787440c8da1ee4292b3938f5d4fa24d3d63130d5ea22e669fb7673e76a22fcd
Opcode Fuzzy Hash: 7be10c99ede2b022fe0a461fe5e281533003581ef1ae704ffa1039d0aa649c8d
Instruction Fuzzy Hash: 98312662B0CA990FE799EB6C5876275B7C1EB56310F0901BED4ADC32D3DD59AC828342

Function 00007FFD344E2CB2 Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

W+4, xrefs: 00007FFD344E2CE9

Memory Dump Source

Source File: 00000004.00000002.4631372092.00007FFD344E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd344e0000_Clienty.jbxd

Similarity

API ID:
String ID: W+4
API String ID: 0-359149727
Opcode ID: dbf82f76d7671daa2921a0b92c0d7e7ca82e121445367c89560313e3e73eb149
Instruction ID: 75c439c347b83e1a2511d85612c02aab6358ec0ce7c960063719c7c9e8a01574
Opcode Fuzzy Hash: dbf82f76d7671daa2921a0b92c0d7e7ca82e121445367c89560313e3e73eb149
Instruction Fuzzy Hash: 1E21E712B09D0A0FF7E5A62C04B527562C2FF9A650B5D01BED55EC32DADD6DEC826340

Function 00007FFD344E30A4 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

W+4, xrefs: 00007FFD344E30DB

Memory Dump Source

Source File: 00000004.00000002.4631372092.00007FFD344E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd344e0000_Clienty.jbxd

Similarity

API ID:
String ID: W+4
API String ID: 0-359149727
Opcode ID: 0d9a33f6538fc0b371f9939f671cfbb1f37e7c89127405c2508425aeeb1cb9d8
Instruction ID: b682614bb87396cce3e4488740b157087c49a2cb8462a5fcd081f7f30a1965b5
Opcode Fuzzy Hash: 0d9a33f6538fc0b371f9939f671cfbb1f37e7c89127405c2508425aeeb1cb9d8
Instruction Fuzzy Hash: 34213A12B09D4A0FFBE6A62C04F027562C2DF89600B5D01BED55DC32CAED6DEC825340

Function 00007FFD344E25B5 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

W+4, xrefs: 00007FFD344E25EA

Memory Dump Source

Source File: 00000004.00000002.4631372092.00007FFD344E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd344e0000_Clienty.jbxd

Similarity

API ID:
String ID: W+4
API String ID: 0-359149727
Opcode ID: f9d46f49126dbac814e193521427bf6224ee05bc90f068dea905ae505f96a00c
Instruction ID: 2ebe38269de3e757d7fb8ee2d142a82e1e50100705ededebd362590b2afc0b66
Opcode Fuzzy Hash: f9d46f49126dbac814e193521427bf6224ee05bc90f068dea905ae505f96a00c
Instruction Fuzzy Hash: 8321C712B19E0B0BF7E9A62C14B527A62C3EFD9250B5D02BBD15EC328ADC5CDC876341

Function 00007FFD344E59C1 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

W+4, xrefs: 00007FFD344E59E3

Memory Dump Source

Source File: 00000004.00000002.4631372092.00007FFD344E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd344e0000_Clienty.jbxd

Similarity

API ID:
String ID: W+4
API String ID: 0-359149727
Opcode ID: f6f771ff68fe66dadfd20e2460b11e92f67b5a11e704c4075dc7c85694849d7f
Instruction ID: ec2b58f4f584cbe69e5ecf2ac7483a65d0d5a12979f0441f7f20bcd562740a0d
Opcode Fuzzy Hash: f6f771ff68fe66dadfd20e2460b11e92f67b5a11e704c4075dc7c85694849d7f
Instruction Fuzzy Hash: F021B652B0AE4A0FF7E5A66C04F527962C2EF99110B5E01BED51DC379BDC6CEC826340

Function 00007FFD344E299E Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

W+4, xrefs: 00007FFD344E29C1

Memory Dump Source

Source File: 00000004.00000002.4631372092.00007FFD344E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd344e0000_Clienty.jbxd

Similarity

API ID:
String ID: W+4
API String ID: 0-359149727
Opcode ID: e8db771a18baff56f2111194ca9f764a3886f230d1e5c5d608df997ac500ea4d
Instruction ID: 33e8306c9f44559da6634f75ce68a3977cc9adada74d17ea4f8f811547ddd9ef
Opcode Fuzzy Hash: e8db771a18baff56f2111194ca9f764a3886f230d1e5c5d608df997ac500ea4d
Instruction Fuzzy Hash: E1210A12B09D4A0FF7E6A66C04B523A62C2FFD9600B5D01BED55EC328BDD6DEC426340

Function 00007FFD344E3C97 Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

W+4, xrefs: 00007FFD344E3CB1

Memory Dump Source

Source File: 00000004.00000002.4631372092.00007FFD344E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd344e0000_Clienty.jbxd

Similarity

API ID:
String ID: W+4
API String ID: 0-359149727
Opcode ID: 5cdc2013169ec4fb3f2120e489fd95b8c4018dba5a79f58f1c254a6f7d28e152
Instruction ID: 43d11c6183b60b21210792f46940ab8e9a3b543fc4a23ce49a690c50a349f854
Opcode Fuzzy Hash: 5cdc2013169ec4fb3f2120e489fd95b8c4018dba5a79f58f1c254a6f7d28e152
Instruction Fuzzy Hash: 8321DA13B0DD0A0FF7E6A62C04B523562C2EFD9210B6E11BAD11DC329AED6CDC425341

Function 00007FFD344E2689 Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

W+4, xrefs: 00007FFD344E26AB

Memory Dump Source

Source File: 00000004.00000002.4631372092.00007FFD344E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd344e0000_Clienty.jbxd

Similarity

API ID:
String ID: W+4
API String ID: 0-359149727
Opcode ID: bfee6eed0264693dcca19859c3cf3660a003fa6ab2a0692a20f86f174da845b1
Instruction ID: 145e84da586921e9b9126a9b81741ab67ddfd5fa9e00fd86f13e3dcaeca2ae09
Opcode Fuzzy Hash: bfee6eed0264693dcca19859c3cf3660a003fa6ab2a0692a20f86f174da845b1
Instruction Fuzzy Hash: EB21C222B0AE4A0BF3E5A62C04B527662C3EFC9110B5D41BAD61DC329ADC6CEC866240

Function 00007FFD344E20ED Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4631372092.00007FFD344E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd344e0000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f78f992f9775ef3e0c3790eafb8f023faa4ec6720dc0e0e54436fbb0b73829d3
Instruction ID: 589684afd4134a2b593304170bcecddda8da53e73a80e1f9b6da7c011f25ee01
Opcode Fuzzy Hash: f78f992f9775ef3e0c3790eafb8f023faa4ec6720dc0e0e54436fbb0b73829d3
Instruction Fuzzy Hash: 17818E12B19EAB0BE7869B6C44F53766696FF9A700F4A407AD20DC72CBCD5CEC055382

Function 00007FFD344E0000 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4631372092.00007FFD344E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd344e0000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff33752fdd54d1ee384dd4e7ff38645da7dd373d646c78f832bde295c7abae6e
Instruction ID: 6230d09529f3f25f80fb670c149158d7e528a073499a84a93a678e45230e29ca
Opcode Fuzzy Hash: ff33752fdd54d1ee384dd4e7ff38645da7dd373d646c78f832bde295c7abae6e
Instruction Fuzzy Hash: E351C022A0EBD50FE76787285CB56663FA0EF23210F0E01FBC499CB1E3D94CA8459352

Function 00007FFD3408ED80 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4626594518.00007FFD3408D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD3408D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd3408d000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 013c7b525b94f10b6a4ce9c82fe35c6fa3a92d505718eb6bceb091781c611a91
Instruction ID: 25f769435e01bd1aa77aaf52405b6587468370d4d739be55657d306cac16a749
Opcode Fuzzy Hash: 013c7b525b94f10b6a4ce9c82fe35c6fa3a92d505718eb6bceb091781c611a91
Instruction Fuzzy Hash: D441C33150DBC45FD796DB28D8959623FF0EF57320B1506DFD088CB1A3D629A84AC7A2

Function 00007FFD344E06E6 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4631372092.00007FFD344E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd344e0000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f8b837c6f502b765be4975400060c49a3f0fa88b76258a1a55af26c5ede3938
Instruction ID: b2b700add2d8d6604ebc54aa954e76624587426aba661745254fc32aa2491987
Opcode Fuzzy Hash: 1f8b837c6f502b765be4975400060c49a3f0fa88b76258a1a55af26c5ede3938
Instruction Fuzzy Hash: DF312862B0DA890FE798DA1C58662B9B7C1EF5A310F4901BED09EC3293DD1DAC428342

Function 00007FFD344E2DBF Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4631372092.00007FFD344E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd344e0000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df90c55aa47c72b812ce368069c667c663c4d14d483acbfbfc1aa9a661a2f8f9
Instruction ID: c32e3ac5ef26bbf739493537a1905e960a3564b1bd2f3f3d972786ab6f078e33
Opcode Fuzzy Hash: df90c55aa47c72b812ce368069c667c663c4d14d483acbfbfc1aa9a661a2f8f9
Instruction Fuzzy Hash: 4411C812B09E4A0FF7EAA62C04B163563C2EF99210B6E017ED51DC32DADD6DEC825340

Function 00007FFD344E0F51 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4631372092.00007FFD344E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd344e0000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d76894b3688c49c9aeee4ef3b8aef4ba73d7558aeaab9e6907abe1f10fe02ac
Instruction ID: dcd471917937a1f80eb581eb0da2c9360ac7f002576897bdcc0babfe13ff5edd
Opcode Fuzzy Hash: 2d76894b3688c49c9aeee4ef3b8aef4ba73d7558aeaab9e6907abe1f10fe02ac
Instruction Fuzzy Hash: 5CD0C91376A91207F684218C68A23F9B285DB89710F54513AE619C22CBC8CEADC152C3

Non-executed Functions

Function 00007FFD341A403D Relevance: 5.3, Strings: 4, Instructions: 309COMMON

Download Yara Rule

Strings

}+4, xrefs: 00007FFD341A4141
8{+4, xrefs: 00007FFD341A40D9
(|+4, xrefs: 00007FFD341A40E9
~+4, xrefs: 00007FFD341A4191

Memory Dump Source

Source File: 00000004.00000002.4627251365.00007FFD341A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd341a0000_Clienty.jbxd

Similarity

API ID:
String ID: (|+4$8{+4$}+4$~+4
API String ID: 0-394687215
Opcode ID: a513d6bf1549b20396f7e808193c2b4526c27ce00dd3591669a433e5bd7f7448
Instruction ID: e74e7988ca07b30f40546b540c1211613b94fce3391817eaa753529cf7762a79
Opcode Fuzzy Hash: a513d6bf1549b20396f7e808193c2b4526c27ce00dd3591669a433e5bd7f7448
Instruction Fuzzy Hash: EDA1FB47A0FEC10FFBA2866C28651B96F90AF9336471C01F7D5D8DA1DB990CAC0DA356

Function 00007FFD341A60FB Relevance: 3.4, Strings: 2, Instructions: 935COMMON

Download Yara Rule

Strings

4, xrefs: 00007FFD341A67E0
N_^, xrefs: 00007FFD341A6101

Memory Dump Source

Source File: 00000004.00000002.4627251365.00007FFD341A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd341a0000_Clienty.jbxd

Similarity

API ID:
String ID: 4$N_^
API String ID: 0-238985750
Opcode ID: 8c5217fa31bfad5bd2fcd54e9ae0d7ffb11a3806e99a5f46913ec42b7d2e99bf
Instruction ID: ef49bb2ab766f4eeabc805e0c56d3cf68f4489e806b3c9984db7b35ed17e536c
Opcode Fuzzy Hash: 8c5217fa31bfad5bd2fcd54e9ae0d7ffb11a3806e99a5f46913ec42b7d2e99bf
Instruction Fuzzy Hash: 77426317B0D6A286F662B6BCB4F61EB3F54CF4263E70841B7D2DCD9093AC0C544E92A5

Function 00007FFD3441000A Relevance: 3.1, Strings: 2, Instructions: 584COMMON

Download Yara Rule

Strings

?(_^, xrefs: 00007FFD34410501
B(_^, xrefs: 00007FFD34410201

Memory Dump Source

Source File: 00000004.00000002.4630606157.00007FFD34410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34410000_Clienty.jbxd

Similarity

API ID:
String ID: ?(_^$B(_^
API String ID: 0-1559863765
Opcode ID: 0511481ca227489a4a62e807b8d190b4bed2e3670aaf2bce9c672be367aa593a
Instruction ID: 699443b19a721669d4137c08a4fab39c61be1c19e7d1df26b19a90811412ff19
Opcode Fuzzy Hash: 0511481ca227489a4a62e807b8d190b4bed2e3670aaf2bce9c672be367aa593a
Instruction Fuzzy Hash: 53124E17A0E2D25AEB23F3B964B20EA7F64DF0362E71D01F7D1DC89493D90C644E92A5

Function 00007FFD344121FA Relevance: 1.8, Strings: 1, Instructions: 580COMMON

Download Yara Rule

Strings

!(_^, xrefs: 00007FFD34412301

Memory Dump Source

Source File: 00000004.00000002.4630606157.00007FFD34410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34410000_Clienty.jbxd

Similarity

API ID:
String ID: !(_^
API String ID: 0-3194240375
Opcode ID: 90859071c33ea71aef9ba472011cd445ca3e12b45fb55774e02dc7b042d3318e
Instruction ID: 1885e0f55a37899618b4f03ddd3c7bab02da58af3b25b1b7de0a08f8d14b90a1
Opcode Fuzzy Hash: 90859071c33ea71aef9ba472011cd445ca3e12b45fb55774e02dc7b042d3318e
Instruction Fuzzy Hash: 4202E217A0D3D26AE712F7FCA4B60E63F54EF0332E71841B7D1989A493DD1D604AC2A5

Function 00007FFD344105FC Relevance: .5, Instructions: 506COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4630606157.00007FFD34410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34410000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f07836aeaaf8edf3a345e73375adb67e390902f25e223e1a4f3e2001e4905812
Instruction ID: 9f14c4ddf78895d6f5bf6c5caf7f98e5bae366b410963636e88143e33accb647
Opcode Fuzzy Hash: f07836aeaaf8edf3a345e73375adb67e390902f25e223e1a4f3e2001e4905812
Instruction Fuzzy Hash: F1F1C617A0E2E25BE622F3BDB4B20E63F54DF4322D71901B7D1D89E493DD1C618AC2A5

Function 00007FFD344E0808 Relevance: .5, Instructions: 462COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4631372092.00007FFD344E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd344e0000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a607fda3ab303adba8004ed0a2f3e75865f7484be453ba3aa0b2321dde8ca43
Instruction ID: 31dfa34554c2120b623588fbe5ce165b29fd14fe9fe6b48330b380ad36d52c06
Opcode Fuzzy Hash: 9a607fda3ab303adba8004ed0a2f3e75865f7484be453ba3aa0b2321dde8ca43
Instruction Fuzzy Hash: C7D1272170CA890FE765EB2C88A56767BD1FF56310F0902BED19DC72D7DE58AC829381

Function 00007FFD344110D1 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4630606157.00007FFD34410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34410000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c54a6c93bf68e03d9e030fe5a89fe15ffff78c1473a38d7a4a81b1c492550ca
Instruction ID: 615135fd8862b03b79bd4cba55fd3a98417725777ae677f8915b62f5c3565a7c
Opcode Fuzzy Hash: 4c54a6c93bf68e03d9e030fe5a89fe15ffff78c1473a38d7a4a81b1c492550ca
Instruction Fuzzy Hash: 24918107A0D2E25AFA23F7BC64B60EB7F58DF0332E71941B7D1DC9A4539D0C204A92A5

Function 00007FFD341AAB6F Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4627251365.00007FFD341A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd341a0000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ca7ceeb96ca68e2ce27d98bb0af801a5c2a1f243abaca6c88b421bd366e1e6d
Instruction ID: 920e74eb417e4572e56d0bef1aefc8ec3c134b7d49a87545851a7bff8db1cfe0
Opcode Fuzzy Hash: 0ca7ceeb96ca68e2ce27d98bb0af801a5c2a1f243abaca6c88b421bd366e1e6d
Instruction Fuzzy Hash: 2281B827B0D6A24BE723E7BCBCB51D57B90DF4267E70841B7C298CA093DD18604A87A5

Function 00007FFD3441115F Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4630606157.00007FFD34410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34410000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 307ffb26de06f605e2c0c552a4a2425e9c1054579c486640f853ade6e0ad1541
Instruction ID: 0766587f4c8d5742e17098ee49e189b2e53805fc57754c368cac3a4d1993a9d3
Opcode Fuzzy Hash: 307ffb26de06f605e2c0c552a4a2425e9c1054579c486640f853ade6e0ad1541
Instruction Fuzzy Hash: 1E818307A0D2E25AFA23F7FC64B60EB7F58DF0322E71941B7D1DC9A4539D09204A92A5

Function 00007FFD341AB7FB Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4627251365.00007FFD341A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd341a0000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5680492b8f7367f1e99446aa82b19174858b7960f8f06f03ab17d1d5ab9edd2
Instruction ID: 3c0721e512f8791ed563595d7b29b380b007b87757ee82e379b4a859172de7f6
Opcode Fuzzy Hash: c5680492b8f7367f1e99446aa82b19174858b7960f8f06f03ab17d1d5ab9edd2
Instruction Fuzzy Hash: E18162275092D246EB16F7BDA8F64E73F54DF0262DB0901BBD6DD8D053ED08214AC3A6

Function 00007FFD344111F2 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4630606157.00007FFD34410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34410000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef0add74981ba757365f1b2da597737d994e912b0c8a9a3bb01ead380a8fc49e
Instruction ID: f75adcf0ad95cc29c30e11c8919bd7eba38f6f9cfb3b05c0d138c4613cf696a0
Opcode Fuzzy Hash: ef0add74981ba757365f1b2da597737d994e912b0c8a9a3bb01ead380a8fc49e
Instruction Fuzzy Hash: 21618207A0D2D25AFA23F7BC64B60EB7F58DF0332E71D41B7D1DC9A4539C09244A92A5

Function 00007FFD341AB9F2 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4627251365.00007FFD341A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd341a0000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 086b004d0ba3e4668d31ac5e14c8de76fd8828b929fd2f3f9b1824332f41c4e3
Instruction ID: 7f7c081527991b58935b907c516dc43aa602a569641c6ceebdb8cd364783f153
Opcode Fuzzy Hash: 086b004d0ba3e4668d31ac5e14c8de76fd8828b929fd2f3f9b1824332f41c4e3
Instruction Fuzzy Hash: 8651802790D2D19BE726E7ACA8B60E77F54DF1222D71D02FAC2DC8D153ED09214AC396

Function 00007FFD34424CFA Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4630606157.00007FFD34410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34410000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c65bd3113e4e5a454ea4cc05639362aebb294c0331b26248b646bbc30c61a224
Instruction ID: fef7859bf00fd1a63f1f5bba52e91e45c36a2bfd9c41040827789e2f8d7759ec
Opcode Fuzzy Hash: c65bd3113e4e5a454ea4cc05639362aebb294c0331b26248b646bbc30c61a224
Instruction Fuzzy Hash: 5A41C357B1DAD22BE363566E78F60D52BE4EF932B070A04B3C6C4CB097EE0D184B5261

Function 00007FFD34424DFA Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4630606157.00007FFD34410000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd34410000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56c067427ff0be904a10791b0684c03cd17ab19b1afe67fe8ae7cfd4835c1d94
Instruction ID: 950082371dafc5ddc9a00b55c18b054dc1317968d54f3aae1a7481d1c0347c29
Opcode Fuzzy Hash: 56c067427ff0be904a10791b0684c03cd17ab19b1afe67fe8ae7cfd4835c1d94
Instruction Fuzzy Hash: 1131654BB0DAD21AF7A2516D69B71DA2BD4EF932F170A10B3C7C4C7097AE4D0C4B6291

Function 00007FFD341AF1F2 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4627251365.00007FFD341A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd341a0000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62906d9daef1d1c305430d2485b55b774a25cbb4d308c348371bc6185efb049e
Instruction ID: 653f3f941cd8e77f83792a89dc22f8dc03adbee371540ed752e505d6cd61fe0c
Opcode Fuzzy Hash: 62906d9daef1d1c305430d2485b55b774a25cbb4d308c348371bc6185efb049e
Instruction Fuzzy Hash: 4431231BA0D1A156FA22F3FCB4B20EB3B54DF5267E70841B3D29C9D4539C18548E86E5

Function 00007FFD341AE5D8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4627251365.00007FFD341A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd341a0000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cd6373230cc95bf826495cf659ba7de2ebab09d11fc6134300c381f0ac6b5d5
Instruction ID: 3d5fbe5ed5b1728bebd12a38bffb0e16515f77f5acfbc330ce125d4be8a32349
Opcode Fuzzy Hash: 5cd6373230cc95bf826495cf659ba7de2ebab09d11fc6134300c381f0ac6b5d5
Instruction Fuzzy Hash: 4BD0C927E092A28BFA62F6B874B21DB33949F0262D75841B2D0989A083EE1D64495155

Function 00007FFD344E5AC5 Relevance: 5.2, Strings: 4, Instructions: 165COMMON

Download Yara Rule

Strings

04, xrefs: 00007FFD344E5B72
04, xrefs: 00007FFD344E5BA4
04, xrefs: 00007FFD344E5BDC
04, xrefs: 00007FFD344E5B47

Memory Dump Source

Source File: 00000004.00000002.4631372092.00007FFD344E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd344e0000_Clienty.jbxd

Similarity

API ID:
String ID: 04$04$04$04
API String ID: 0-2611335706
Opcode ID: 3eca21e7686257ad32056ab06cd334298ced0d4f9805168ecb1944805f3994dc
Instruction ID: beb965af470b50e009a96dc0e30c18ec0552a103697509c79b4f795312303823
Opcode Fuzzy Hash: 3eca21e7686257ad32056ab06cd334298ced0d4f9805168ecb1944805f3994dc
Instruction Fuzzy Hash: 2241F522B0EEC60FE7E2937804B11B62BE19F87120B1E01FAD18CC71C7DD6DA8829351

Analysis Process: Clienty.exePID: 4620, Parent PID: 1064COMMON

Executed Functions

Function 00007FFD341D20F8 Relevance: 6.6, Strings: 5, Instructions: 357COMMON

Download Yara Rule

Strings

XA.4, xrefs: 00007FFD341D220F
8B.4, xrefs: 00007FFD341D22FF
X.4, xrefs: 00007FFD341D2367
H].4, xrefs: 00007FFD341D22B5
0W.4, xrefs: 00007FFD341D232C

Memory Dump Source

Source File: 00000007.00000002.2227526097.00007FFD341D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd341d0000_Clienty.jbxd

Similarity

API ID:
String ID: 0W.4$8B.4$H].4$XA.4$X.4
API String ID: 0-2580930554
Opcode ID: 9f0bd2a3fd4592af57e914337342072e933b276026a99d287da94d54c5eee02c
Instruction ID: bd7344fabe9f4a4c7411d84297ef48e904765dbd92575845177c3707b2552d25
Opcode Fuzzy Hash: 9f0bd2a3fd4592af57e914337342072e933b276026a99d287da94d54c5eee02c
Instruction Fuzzy Hash: ADA1E5A3F0AD8A0FEBD5EB2884A56B977D1EF97340F0401BAD55DC7197CE2CA8429341

Function 00007FFD341D2DC8 Relevance: 1.5, Strings: 1, Instructions: 249COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFD341D2FCD

Memory Dump Source

Source File: 00000007.00000002.2227526097.00007FFD341D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd341d0000_Clienty.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: bc02f5046f8a8b0bcdbbe9be8f8aeb7130f9b4ccbeffc922e29b5539b242a6e5
Instruction ID: 3d9f61e270036213eb898e020201c55e9e092f4678b385826b3a82d9eec0db92
Opcode Fuzzy Hash: bc02f5046f8a8b0bcdbbe9be8f8aeb7130f9b4ccbeffc922e29b5539b242a6e5
Instruction Fuzzy Hash: A1716D62F19D0D4FEB98EB5884A57BCB3E2EF9A310F540579D51ED32C2CE28AC029740

Function 00007FFD341D0BE8 Relevance: 1.5, Strings: 1, Instructions: 227COMMON

Download Yara Rule

Strings

;L_I, xrefs: 00007FFD341D0C04

Memory Dump Source

Source File: 00000007.00000002.2227526097.00007FFD341D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd341d0000_Clienty.jbxd

Similarity

API ID:
String ID: ;L_I
API String ID: 0-1305308343
Opcode ID: d870cb4bfb5c4889a22e6a36d262d4432a8fd081993f47062e98f6f56b6c2186
Instruction ID: d4e98ea94ce28253e15ca87e4c839e43678d6910085f3a6d36b964ddd1140173
Opcode Fuzzy Hash: d870cb4bfb5c4889a22e6a36d262d4432a8fd081993f47062e98f6f56b6c2186
Instruction Fuzzy Hash: A3813567B1E9814BF795E7AC94B51F53FA0EF43308F9480FAD4C88729BD928A845C385

Function 00007FFD341D24A2 Relevance: 1.4, Strings: 1, Instructions: 186COMMON

Download Yara Rule

Strings

`.4, xrefs: 00007FFD341D251B

Memory Dump Source

Source File: 00000007.00000002.2227526097.00007FFD341D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd341d0000_Clienty.jbxd

Similarity

API ID:
String ID: `.4
API String ID: 0-1228617679
Opcode ID: 9d10527ea4541ff623f7ea747e7ba4a63cac76e67c3c4ee8d725a52eb47c4eb9
Instruction ID: b0e8cd11f89b748a1721bcb28716a51d81f573c88d4a4ff69bd7660cbbf3fa88
Opcode Fuzzy Hash: 9d10527ea4541ff623f7ea747e7ba4a63cac76e67c3c4ee8d725a52eb47c4eb9
Instruction Fuzzy Hash: 9D519056F5DE560BFBD6B3B840B56F92BD2AB87250B9481B5D008C7297CD1C9C42C385

Function 00007FFD341D2110 Relevance: 1.4, Strings: 1, Instructions: 166COMMON

Download Yara Rule

Strings

XA.4, xrefs: 00007FFD341D220F

Memory Dump Source

Source File: 00000007.00000002.2227526097.00007FFD341D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd341d0000_Clienty.jbxd

Similarity

API ID:
String ID: XA.4
API String ID: 0-1947656767
Opcode ID: 6dafb6ec134dde6fa8dcea61f6d7f99cba3bd15eb3ee6b6678bca8d3a6d4baae
Instruction ID: bdc245f0d18ae2e161035c2559899f2a512208e2372c2bcc162f3c45d9a08f08
Opcode Fuzzy Hash: 6dafb6ec134dde6fa8dcea61f6d7f99cba3bd15eb3ee6b6678bca8d3a6d4baae
Instruction Fuzzy Hash: E3410463F0D9894FEB92EB6884B1AF977A1EF97310F0400B6E15DC7183CE2CA8419742

Function 00007FFD341D15FA Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

.L_^, xrefs: 00007FFD341D1601

Memory Dump Source

Source File: 00000007.00000002.2227526097.00007FFD341D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd341d0000_Clienty.jbxd

Similarity

API ID:
String ID: .L_^
API String ID: 0-2849591005
Opcode ID: 0531e5763babfe534dab1a8cfc178ff1c69e08c4802e928a8d793ddea18e6399
Instruction ID: 0924d9f5e4dbd58e18475fb8fe64a4295a061b635e5a5d4185802f0d70567526
Opcode Fuzzy Hash: 0531e5763babfe534dab1a8cfc178ff1c69e08c4802e928a8d793ddea18e6399
Instruction Fuzzy Hash: 5B21AE67B0DA590FE795A62CACA61F53BD1EF9723170901B7C248C7153CC1C5C0A9396

Function 00007FFD341D0875 Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

0w*4, xrefs: 00007FFD341D08A6

Memory Dump Source

Source File: 00000007.00000002.2227526097.00007FFD341D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd341d0000_Clienty.jbxd

Similarity

API ID:
String ID: 0w*4
API String ID: 0-3457049077
Opcode ID: ff23f44d5aaae8a7ef3f52c5f7d2815d544ea91b0abd7d4b4675fcfc6c480bb2
Instruction ID: 45477efac5effc1054c70dac80e32b159df218045b2200ae4165d90c2627dc12
Opcode Fuzzy Hash: ff23f44d5aaae8a7ef3f52c5f7d2815d544ea91b0abd7d4b4675fcfc6c480bb2
Instruction Fuzzy Hash: 8B21B192E1EE854FF795A77858752B56B90EF97244F4805BEC089CB1D7DC0C68058391

Function 00007FFD341D2729 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2227526097.00007FFD341D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd341d0000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb1c356903a549cac2e589c3cedefa3903a04b7609133a84c98341696f8e841d
Instruction ID: 0458c6f444a326928878de487c151175345954af2921f47aface60650d2c351c
Opcode Fuzzy Hash: cb1c356903a549cac2e589c3cedefa3903a04b7609133a84c98341696f8e841d
Instruction Fuzzy Hash: 8941F962B1DE454FE768A75894667BEB7D1EF9A314F04017EE05EC32C2CD2C68428392

Function 00007FFD341D196D Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2227526097.00007FFD341D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd341d0000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc99da702a45bd78acd495b07da0ffe306bc850e8380c36c29b3d173c56d1a72
Instruction ID: b452456c9429c49b6ae6d846b310a58b04f2f7db69d48619ff8179790d3bb4be
Opcode Fuzzy Hash: cc99da702a45bd78acd495b07da0ffe306bc850e8380c36c29b3d173c56d1a72
Instruction Fuzzy Hash: 90210532E099424FEB88DF58C4D15B573A1EF57310B2482B5D10CCB1ABEA2CEC86C780

Function 00007FFD341D1BF5 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2227526097.00007FFD341D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd341d0000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc8cfea4c634458fe8476d3863a676a4465246234656a79048e4c42661197d5d
Instruction ID: a32943015074af39943af2a6299dde863b23921f5d2c63bec26ac5d16f3aedbf
Opcode Fuzzy Hash: cc8cfea4c634458fe8476d3863a676a4465246234656a79048e4c42661197d5d
Instruction Fuzzy Hash: BD31B83A7696454FF358F75C80B62E53FA2AB85304FE0856DD418837C6CE7C6540C791

Function 00007FFD341D32DD Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2227526097.00007FFD341D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd341d0000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1028db9fc50a0a2c1610476fa5a634577a3bd61a9d41fa7e19c59ce4eabf1e5d
Instruction ID: b911c950beb7950fc156c0fa24bcdf624338329ea6dd3ecfd0c0110cd4e62657
Opcode Fuzzy Hash: 1028db9fc50a0a2c1610476fa5a634577a3bd61a9d41fa7e19c59ce4eabf1e5d
Instruction Fuzzy Hash: 5921A131F19A594FE795FB6884A96B973E1FF5A301B4504BAE40DC72A2DE28EC40C780

Function 00007FFD341D3491 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2227526097.00007FFD341D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd341d0000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31ebfa2e474191d06eee1ea1b26d25125b22216390965c531aa76420ba242d1e
Instruction ID: 0406c4d888cfd2d129cb5cb95ea3a708ef0700d4602b5575d8b90f6c0fabbd38
Opcode Fuzzy Hash: 31ebfa2e474191d06eee1ea1b26d25125b22216390965c531aa76420ba242d1e
Instruction Fuzzy Hash: BA115072F0EE850FE356E67868994F67BD1DF9622470842BBD44DC31A3CD0D99868351

Function 00007FFD341D28D5 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2227526097.00007FFD341D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd341d0000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3536228ab0c2dc71954f0c62ed3d59e7f5764aa5f8b03ffa38a8fc85924525e
Instruction ID: bdcaf6aadcd75e3800b433969503ba349c29fc1840816e2165035e30e6e0af80
Opcode Fuzzy Hash: d3536228ab0c2dc71954f0c62ed3d59e7f5764aa5f8b03ffa38a8fc85924525e
Instruction Fuzzy Hash: 2E11E521B0EAC80FE347E33858A8BB47FE1AF87211B0901F7E088CB1A3C95D4845C342

Function 00007FFD341D0DA9 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2227526097.00007FFD341D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd341d0000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ed08fccea15859cc18379cba88557e77a89475f4112a0fca05d78354f2b309d
Instruction ID: 76cb980401491c0502935247727337cb5dbf34d54d90164b78279c526110a456
Opcode Fuzzy Hash: 6ed08fccea15859cc18379cba88557e77a89475f4112a0fca05d78354f2b309d
Instruction Fuzzy Hash: 10016D53F2AC870EE795A22C54E55FA2BD1EF97310B04057BD44ED3186DC086C824381

Function 00007FFD341D1E58 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2227526097.00007FFD341D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd341d0000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b123134e7845bac698a5e052c261b89184ccacaa2b08ef5006481fcea0712fd9
Instruction ID: 6317b0c464e10a77b27866e85d8d0a6e996c6776b737e244e6991cd7ebb85097
Opcode Fuzzy Hash: b123134e7845bac698a5e052c261b89184ccacaa2b08ef5006481fcea0712fd9
Instruction Fuzzy Hash: 43F0B422B19C1D0FE794F2AD54E9AFA67D5DBAD22671401B7E40CC72A3DC1898428391

Function 00007FFD341D1E70 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2227526097.00007FFD341D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd341d0000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf2fcb768ab3a1872187fcdbb8022f921e44b6d07f0cb8218b4d4bf76eaae054
Instruction ID: b239492807b849f28662e7fbf9e7cd3818fbd8ac7d8b4317bf6a1c8a9ccc7eef
Opcode Fuzzy Hash: cf2fcb768ab3a1872187fcdbb8022f921e44b6d07f0cb8218b4d4bf76eaae054
Instruction Fuzzy Hash: FFE09232F19C1D1FABA8F6AD44D9B7962D6EBAD21171006B6E80CC73A6DC199C419380

Function 00007FFD341D094D Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2227526097.00007FFD341D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD341D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd341d0000_Clienty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3821f6940dd39a6fbf2b227f744f565f90f44156a17ac0bdf24e285a0af1ddea
Instruction ID: 7ac8f857d82e7ffcd041edf9876ee45cecd9540ab270be116c1f9bf6efd0345c
Opcode Fuzzy Hash: 3821f6940dd39a6fbf2b227f744f565f90f44156a17ac0bdf24e285a0af1ddea
Instruction Fuzzy Hash: 41E08663F1AD1607E5DA323C64721BD13C0DF9A695B40147AE60DD6687DC2E6C829285

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report mtgjyX9gHF.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Quasar

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

AV Detection

E-Banking Fraud

System Summary

Stealing of Sensitive Information

Remote Access Functionality

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Clienty.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\mtgjyX9gHF.exe.log

C:\Users\user\AppData\Roaming\SubDir\Clienty.exe

Static File Info

General

Windows Analysis Report
mtgjyX9gHF.exe

Function 00007FFD341B3525 Relevance: 1.6, APIs: 1, Instructions: 131
fileCOMMON

Function 00007FFD341B3569 Relevance: 1.6, APIs: 1, Instructions: 109
fileCOMMON

Function 00007FFD341B206A Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON

Function 00007FFD34419FD0 Relevance: 9.8, Strings: 7, Instructions: 1064
COMMON

Function 00007FFD3442C13A Relevance: 9.5, Strings: 7, Instructions: 776
COMMON

Function 00007FFD3442B7E1 Relevance: 8.4, Strings: 6, Instructions: 928
COMMON

Function 00007FFD3442EB29 Relevance: 6.0, Strings: 4, Instructions: 969
COMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre