Edit tour

Windows Analysis Report
NgenTool.exe

Overview

General Information

Sample name:	NgenTool.exe
Analysis ID:	1523267
MD5:	28c81359da168d5f0fd071abc2651dec
SHA1:	15b69391fa49a2684eed322eab04017a8bfe440a
SHA256:	8059e259a6744f78dd41ad5854522c8e5f7ae61940d9187f95fa3e4f7af5f5a6
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Program does not show much activity (idle)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

NgenTool.exe (PID: 1984 cmdline: "C:\Users\user\Desktop\NgenTool.exe" MD5: 28C81359DA168D5F0FD071ABC2651DEC)

conhost.exe (PID: 3868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: NgenTool.exe

Virustotal: Detection: 7%

Perma Link

Source: NgenTool.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: NgenTool.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: G:\Projects\Git\SLSII_v4.2\Installer\NgenTool\Release\NgenTool.pdb source: NgenTool.exe

Source: C:\Users\user\Desktop\NgenTool.exe	Code function: 0_2_001A1000 FindFirstFileW,_wcsstr,FindNextFileW,FindClose,		0_2_001A1000
Source: C:\Users\user\Desktop\NgenTool.exe	Code function: 0_2_001A54C2 FindFirstFileExW,		0_2_001A54C2

Source: C:\Users\user\Desktop\NgenTool.exe	Code function: 0_2_001A1100		0_2_001A1100
Source: C:\Users\user\Desktop\NgenTool.exe	Code function: 0_2_001AB255		0_2_001AB255

Source: NgenTool.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal48.winEXE@2/0@0/0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3868:120:WilError_03

Source: NgenTool.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\NgenTool.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: NgenTool.exe

Virustotal: Detection: 7%

Source: unknown	Process created: C:\Users\user\Desktop\NgenTool.exe "C:\Users\user\Desktop\NgenTool.exe"
Source: C:\Users\user\Desktop\NgenTool.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\NgenTool.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\NgenTool.exe	Section loaded: kernel.appcore.dll			Jump to behavior

Source: NgenTool.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: NgenTool.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: NgenTool.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: NgenTool.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: NgenTool.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: NgenTool.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: NgenTool.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: NgenTool.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: G:\Projects\Git\SLSII_v4.2\Installer\NgenTool\Release\NgenTool.pdb source: NgenTool.exe

Source: NgenTool.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: NgenTool.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: NgenTool.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: NgenTool.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: NgenTool.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\NgenTool.exe

Code function: 0_2_001A2096 push ecx; ret

0_2_001A20A9

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\NgenTool.exe	Code function: 0_2_001A1000 FindFirstFileW,_wcsstr,FindNextFileW,FindClose,		0_2_001A1000
Source: C:\Users\user\Desktop\NgenTool.exe	Code function: 0_2_001A54C2 FindFirstFileExW,		0_2_001A54C2

Source: C:\Users\user\Desktop\NgenTool.exe

Code function: 0_2_001A485C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_001A485C

Source: C:\Users\user\Desktop\NgenTool.exe

Code function: 0_2_001A3DF1 mov eax, dword ptr fs:[00000030h]

0_2_001A3DF1

Source: C:\Users\user\Desktop\NgenTool.exe

Code function: 0_2_001A7649 GetProcessHeap,

0_2_001A7649

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\NgenTool.exe	Code function: 0_2_001A485C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_001A485C
Source: C:\Users\user\Desktop\NgenTool.exe	Code function: 0_2_001A1944 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_001A1944
Source: C:\Users\user\Desktop\NgenTool.exe	Code function: 0_2_001A1E3F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_001A1E3F
Source: C:\Users\user\Desktop\NgenTool.exe	Code function: 0_2_001A1F9E SetUnhandledExceptionFilter,	0_2_001A1F9E

Source: C:\Users\user\Desktop\NgenTool.exe

Code function: 0_2_001A21C2 cpuid

0_2_001A21C2

Source: C:\Users\user\Desktop\NgenTool.exe

Code function: 0_2_001A1D24 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_001A1D24

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Process Injection	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 DLL Side-Loading	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	12 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
NgenTool.exe	2%	ReversingLabs
NgenTool.exe	7%	Virustotal		Browse

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523267
Start date and time:	2024-10-01 11:38:38 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 1m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	NgenTool.exe
Detection:	MAL
Classification:	mal48.winEXE@2/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 5 Number of non-executed functions: 13
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Not all processes where analyzed, report is missing behavior information

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	6.305161796001363
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	NgenTool.exe
File size:	80'384 bytes
MD5:	28c81359da168d5f0fd071abc2651dec
SHA1:	15b69391fa49a2684eed322eab04017a8bfe440a
SHA256:	8059e259a6744f78dd41ad5854522c8e5f7ae61940d9187f95fa3e4f7af5f5a6
SHA512:	6c995151203a882b31b4cadd284d61d648d90e6c2da27004b270a3e98967f3ff9fa40cda1278ea470e60b8b8b1090dba1c0034635eab508a70f18f30c2ede9e4
SSDEEP:	1536:bRAMkGk50LRVxXoCmNB80YKJiyRdq4fal+mqEjsY/R4IsWMcdQATD/Yptn/7:O5KxXoC8b1gyRda+4jsWFQATD/Ypt/7
TLSH:	37734A03B5D19471E47359325870C9B19A2EF9214F60DEAB6798173E4F380D09A3AEBB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P.A`../3../3../3.M.3../3.M.3m./3.M.3../3/.,2../3/.*27./3/.+2../3...3../3...3K./3..&2../3../2../3...3../3..-2../3Rich../3.......

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x40193a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5BEB7FC3 [Wed Nov 14 01:52:03 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	11b54a0dfe1242390c8cbbe62ba9ee15

Entrypoint Preview

Instruction
call 00007F15DD15CD4Ah
jmp 00007F15DD15C7ECh
push ebp
mov ebp, esp
push 00000000h
call dword ptr [0040D048h]
push dword ptr [ebp+08h]
call dword ptr [0040D044h]
push C0000409h
call dword ptr [0040D010h]
push eax
call dword ptr [0040D04Ch]
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 00000324h
push 00000017h
call 00007F15DD166805h
test eax, eax
je 00007F15DD15C967h
push 00000002h
pop ecx
int 29h
mov dword ptr [004138E8h], eax
mov dword ptr [004138E4h], ecx
mov dword ptr [004138E0h], edx
mov dword ptr [004138DCh], ebx
mov dword ptr [004138D8h], esi
mov dword ptr [004138D4h], edi
mov word ptr [00413900h], ss
mov word ptr [004138F4h], cs
mov word ptr [004138D0h], ds
mov word ptr [004138CCh], es
mov word ptr [004138C8h], fs
mov word ptr [004138C4h], gs
pushfd
pop dword ptr [004138F8h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [004138ECh], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [004138F0h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [004138FCh], eax
mov eax, dword ptr [ebp-00000324h]
mov dword ptr [00413838h], 00010001h

Rich Headers

Programming Language:

[EXP] VS2015 UPD3.1 build 24215
[RES] VS2015 UPD3 build 24213
[LNK] VS2015 UPD3.1 build 24215

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x12580	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x125e4	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x16000	0x1e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x17000	0xecc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x11c00	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x11c70	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xd000	0x13c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xbb17	0xbc00	39a6bb936b987204b6719f14eae321e1	False	0.5854180518617021	data	6.628609223744442	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xd000	0x5d26	0x5e00	b6f708ff8b0919be45fc54fcb87b990e	False	0.42137632978723405	data	4.874557617214814	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x13000	0x1308	0x800	ccad542ebfe74a9ed27efa01de45c1a2	False	0.1962890625	data	2.3897071320344967	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.gfids	0x15000	0xdc	0x200	a70d99d6c2640540375a7055666b462f	False	0.31640625	data	1.6486420276660951	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x16000	0x1e8	0x200	67d99a0fbaad406a6bdc2924a81afdac	False	0.537109375	data	4.7605137014493595	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x17000	0xecc	0x1000	b2bb5bec1555864a927bf74a15798777	False	0.768310546875	data	6.339476613310989	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x16060	0x188	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5892857142857143

Imports

DLL	Import
SHLWAPI.dll	PathFileExistsW
KERNEL32.dll	GetCurrentProcess, GetEnvironmentVariableW, FindClose, WaitForSingleObject, FindNextFileW, GetCurrentDirectoryW, SetCurrentDirectoryW, CreateProcessW, IsWow64Process, FindFirstFileW, DecodePointer, CloseHandle, GetModuleFileNameW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, RaiseException, RtlUnwind, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, CreateFileW, MultiByteToWideChar, WideCharToMultiByte, ExitProcess, GetModuleHandleExW, GetCommandLineA, GetCommandLineW, GetACP, HeapFree, HeapAlloc, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, CompareStringW, LCMapStringW, SetStdHandle, GetFileType, GetStringTypeW, GetProcessHeap, HeapSize, HeapReAlloc, FlushFileBuffers, GetConsoleCP, GetConsoleMode, SetFilePointerEx, WriteConsoleW
ADVAPI32.dll	RegOpenKeyExW, RegQueryValueExW, RegCloseKey

Exports

Name	Ordinal	Address
_Install@4	1	0x401670
_UnInstall@4	2	0x401690

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	05:39:27
Start date:	01/10/2024
Path:	C:\Users\user\Desktop\NgenTool.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\NgenTool.exe"
Imagebase:	0x1a0000
File size:	80'384 bytes
MD5 hash:	28C81359DA168D5F0FD071ABC2651DEC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:39:27
Start date:	01/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5%
Total number of Nodes:	1672
Total number of Limit Nodes:	19

Executed Functions

Function 001A1100 Relevance: 45.9, APIs: 16, Strings: 10, Instructions: 363
registryprocesssynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentVariableW.KERNEL32(WINDIR,?,00000200), ref: 001A1149
GetCurrentProcess.KERNEL32(?), ref: 001A1186
IsWow64Process.KERNEL32(00000000), ref: 001A118D
PathFileExistsW.KERNELBASE(?), ref: 001A11DC
RegOpenKeyExW.ADVAPI32(80000002,?), ref: 001A1269
RegQueryValueExW.ADVAPI32(?,Install Directory,00000000,00000000,00000000,?), ref: 001A1288
RegQueryValueExW.ADVAPI32(?,Install Directory,00000000,00000000,00000000,?,?), ref: 001A12C7
RegCloseKey.ADVAPI32(?), ref: 001A12D1
PathFileExistsW.SHLWAPI(00000000), ref: 001A12E0
GetCurrentDirectoryW.KERNEL32(00000002,00000000,?), ref: 001A12FE
SetCurrentDirectoryW.KERNEL32(00000000), ref: 001A1305
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,?,?), ref: 001A158E
WaitForSingleObject.KERNEL32(?,000493E0), ref: 001A159F
CloseHandle.KERNEL32(?), ref: 001A15B3
CloseHandle.KERNEL32(?), ref: 001A15BD
SetCurrentDirectoryW.KERNEL32(?,?,00000000,00000044), ref: 001A15DD

Strings

Rigaku.Plugins.*.dll, xrefs: 001A133D
\Microsoft.NET\Framework, xrefs: 001A1167
D, xrefs: 001A14E6
WINDIR, xrefs: 001A1144
Install Directory, xrefs: 001A127F, 001A12BE
*.exe, xrefs: 001A130B
\, xrefs: 001A114F
\v4.0.30319\ngen.exe, xrefs: 001A11B4
Rigaku.Services.*.dll, xrefs: 001A1391
SOFTWARE\Rigaku\SmartLabStudioII\, xrefs: 001A11FB

Memory Dump Source

Source File: 00000000.00000002.1669327277.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.1669295555.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669342783.00000000001AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669356710.00000000001B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669370026.00000000001B5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_NgenTool.jbxd

Similarity

API ID: Current$CloseDirectoryProcess$ExistsFileHandlePathQueryValue$CreateEnvironmentObjectOpenSingleVariableWaitWow64
String ID: *.exe$D$Install Directory$Rigaku.Plugins.*.dll$Rigaku.Services.*.dll$SOFTWARE\Rigaku\SmartLabStudioII\$WINDIR$\$\Microsoft.NET\Framework$\v4.0.30319\ngen.exe
API String ID: 3366988239-3307221270
Opcode ID: 3c1229cc4d411c8fc72967979e535662ad1eb3c70ffed9c5b20b2f6454f13030
Instruction ID: 9b383380512b36b0d78f4a01a2ce3769e1be161b242cd0dc8ad53cd9d96e41ea
Opcode Fuzzy Hash: 3c1229cc4d411c8fc72967979e535662ad1eb3c70ffed9c5b20b2f6454f13030
Instruction Fuzzy Hash: 42D14776904340ABD720DF24DD16BDFB7E8FF99740F004A2DF98996191FB70A6858B82

Function 001A3DF1 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000003,?,001A3DC7,00000003,001B2248,0000000C,001A3EDA,00000003,00000002,00000000,?,001A47FE,00000003), ref: 001A3E12
TerminateProcess.KERNEL32(00000000,?,001A3DC7,00000003,001B2248,0000000C,001A3EDA,00000003,00000002,00000000,?,001A47FE,00000003), ref: 001A3E19
ExitProcess.KERNEL32 ref: 001A3E2B

Memory Dump Source

Source File: 00000000.00000002.1669327277.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.1669295555.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669342783.00000000001AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669356710.00000000001B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669370026.00000000001B5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_NgenTool.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 14745758ba9d5447e6702a8d7151afcdda9281f3ce2dcc3493eba53e91ce2209
Instruction ID: 6edc27ccc43a8888c3efcf7814753644626251def8ee108e0da664f65c1a0b4c
Opcode Fuzzy Hash: 14745758ba9d5447e6702a8d7151afcdda9281f3ce2dcc3493eba53e91ce2209
Instruction Fuzzy Hash: DBE0B635000748ABCF11AF64EE09A993B69EB56741F044414FA568B922CB39EE93DA90

Function 001A6548 Relevance: 6.1, APIs: 4, Instructions: 52
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00000000,00000000,?,001A64EF,?,00000000,00000000,00000000,?,001A6760,00000006,FlsSetValue), ref: 001A657A
GetLastError.KERNEL32(?,001A64EF,?,00000000,00000000,00000000,?,001A6760,00000006,FlsSetValue,001AE718,001AE720,00000000,00000364,?,001A512E), ref: 001A6586
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,001A64EF,?,00000000,00000000,00000000,?,001A6760,00000006,FlsSetValue,001AE718,001AE720,00000000), ref: 001A6594

Memory Dump Source

Source File: 00000000.00000002.1669327277.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.1669295555.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669342783.00000000001AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669356710.00000000001B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669370026.00000000001B5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_NgenTool.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: d20b8602577dfcd0a7e13cd6b6ca05af4cba44af6efcf697cc4cbeeb56a37ed0
Instruction ID: 83b6e1f7a207464897f81fa13ea1f9024b621d2dfebd41fda9f7f3053d41e5f8
Opcode Fuzzy Hash: d20b8602577dfcd0a7e13cd6b6ca05af4cba44af6efcf697cc4cbeeb56a37ed0
Instruction Fuzzy Hash: 47012B3AA116329FCB215F79AC44A567798AF07BE1F2A0325F916D7544D730DC01CAE0

Function 001A6CF9 Relevance: 3.1, APIs: 2, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 001A6D45
GetFileType.KERNELBASE(00000000), ref: 001A6D57

Memory Dump Source

Source File: 00000000.00000002.1669327277.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.1669295555.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669342783.00000000001AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669356710.00000000001B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669370026.00000000001B5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_NgenTool.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 64c31b37874678f058e01da53768be98a7cc022f8bbaf038bff738435592637e
Instruction ID: 8d6ff4607eb0348c06c4559877878eae923a70f632c10edee2fe356660f81bce
Opcode Fuzzy Hash: 64c31b37874678f058e01da53768be98a7cc022f8bbaf038bff738435592637e
Instruction Fuzzy Hash: 5C11D339308B414ACB344EBE9C88626BA95AB673B0F3D071ED0F7C69F2C734D9859641

Function 001A64AC Relevance: 3.1, APIs: 2, Instructions: 65
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 001A650C
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 001A6519

Memory Dump Source

Source File: 00000000.00000002.1669327277.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.1669295555.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669342783.00000000001AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669356710.00000000001B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669370026.00000000001B5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_NgenTool.jbxd

Similarity

API ID: AddressProc__crt_fast_encode_pointer
String ID:
API String ID: 2279764990-0
Opcode ID: 3922cfae273efd1d347048e08400c8c14af0fcbe36549139f6ee766b8cd7d1b7
Instruction ID: 2d007d1e0b673eeb02648a47acda04c15ff99fcd878f7f37fdfa002473561994
Opcode Fuzzy Hash: 3922cfae273efd1d347048e08400c8c14af0fcbe36549139f6ee766b8cd7d1b7
Instruction Fuzzy Hash: 0311CA3BE005259F9F25AE28EC405AAB7959F8A7A071A4260FD25AB258D730DD4186D0

Non-executed Functions

Function 001A1000 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNEL32(?,?,00000000,?), ref: 001A1020
_wcsstr.LIBVCRUNTIME ref: 001A109E
FindNextFileW.KERNEL32(00000000,00000010), ref: 001A10CE
FindClose.KERNEL32(00000000), ref: 001A10D9

Strings

.INTERFACE.V, xrefs: 001A1098

Memory Dump Source

Source File: 00000000.00000002.1669327277.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.1669295555.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669342783.00000000001AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669356710.00000000001B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669370026.00000000001B5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_NgenTool.jbxd

Similarity

API ID: Find$File$CloseFirstNext_wcsstr
String ID: .INTERFACE.V
API String ID: 2060593500-2538022656
Opcode ID: f5d3d1a82646d6f85af0888130b2aa4beac26234f73ae91bf87241c35b498233
Instruction ID: 32b7107b9410aa84ae2b14ea3a8ac66d1ff44168452d192ce590b8fe978ece97
Opcode Fuzzy Hash: f5d3d1a82646d6f85af0888130b2aa4beac26234f73ae91bf87241c35b498233
Instruction Fuzzy Hash: 1621B6B5A4031C7BCB20EB64AD45FFAB3ACEF56310F0005A5FA19D3181EB719F848A50

Function 001A485C Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 001A4954
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 001A495E
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 001A496B

Memory Dump Source

Source File: 00000000.00000002.1669327277.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.1669295555.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669342783.00000000001AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669356710.00000000001B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669370026.00000000001B5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_NgenTool.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: a894ffa7f52650a9b0aa8199c6fbeaa37c3cb8d3725b2e000cd2ecfc1962e604
Instruction ID: 1ac1e8a1a74f82a9473269cb886ff5ee7b6f6798fee49d6d9663aabb4bbd76c4
Opcode Fuzzy Hash: a894ffa7f52650a9b0aa8199c6fbeaa37c3cb8d3725b2e000cd2ecfc1962e604
Instruction Fuzzy Hash: 4C31F574901218ABCB21DF68DD88B8DBBB8AF19310F1042EAE40CA7290E7749B858F44

Function 001A54C2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 001A558C

Memory Dump Source

Source File: 00000000.00000002.1669327277.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.1669295555.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669342783.00000000001AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669356710.00000000001B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669370026.00000000001B5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_NgenTool.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: d3d3a7548d4b1990f9c6f116421b232139e597751e4ec2047e65a4d1976ed57b
Instruction ID: fafdd561b6f16df8cee082caf7060e7e2baad66498a23b914f131448d95c91cc
Opcode Fuzzy Hash: d3d3a7548d4b1990f9c6f116421b232139e597751e4ec2047e65a4d1976ed57b
Instruction Fuzzy Hash: 7541297A9046196FCB24DFB9DC49EAB77BAEB86310F604169F905C7180F7709E81CB50

Function 001AB255 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,001AB250,?,?,00000008,?,?,001AAEF0,00000000), ref: 001AB482

Memory Dump Source

Source File: 00000000.00000002.1669327277.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.1669295555.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669342783.00000000001AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669356710.00000000001B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669370026.00000000001B5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_NgenTool.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 5545f04f84920e1629f0cc39018941a8a7dfd7de1ed0479bf7d3b58868ad3daa
Instruction ID: 751307cbb986c79c5362d764ead64f1a3c270e7b1d127aae2e398b89c5824ee7
Opcode Fuzzy Hash: 5545f04f84920e1629f0cc39018941a8a7dfd7de1ed0479bf7d3b58868ad3daa
Instruction Fuzzy Hash: D0B16E39514648DFDB19CF28C4CAB647BE0FF46364F258658E89ACF2A2C335E991CB40

Function 001A1F9E Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00001FAA,001A17BE), ref: 001A1FA3

Memory Dump Source

Source File: 00000000.00000002.1669327277.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.1669295555.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669342783.00000000001AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669356710.00000000001B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669370026.00000000001B5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_NgenTool.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: d7cbc20bfd91f27d4caaa6aa83abf79cd08e4ce2260f06907143036e71f3e2b2
Instruction ID: f44c2e9d0e5d43e9cad7e6beb029a127de7a3b9f36c3ae3bbb212fa28a243c2a
Opcode Fuzzy Hash: d7cbc20bfd91f27d4caaa6aa83abf79cd08e4ce2260f06907143036e71f3e2b2
Instruction Fuzzy Hash:

Function 001A7649 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 001A7649

Memory Dump Source

Source File: 00000000.00000002.1669327277.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.1669295555.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669342783.00000000001AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669356710.00000000001B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669370026.00000000001B5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_NgenTool.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 4eed4626f519dae5c7b7f9a1148e8a3d397548b27311f4836eb48519dfaea3be
Instruction ID: d3fe034026cef18441f003f147f647fa79c02e1b9aa6fe8b8d8fb4d29660a756
Opcode Fuzzy Hash: 4eed4626f519dae5c7b7f9a1148e8a3d397548b27311f4836eb48519dfaea3be
Instruction Fuzzy Hash: DCA002705416118B57408F757A0530D359577455917058599B415C5961D72444905605

Function 001A860F Relevance: 12.2, APIs: 8, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00000100,?,00000000,?,?,?,001A8860,?,?,00000000), ref: 001A8669
__alloca_probe_16.LIBCMT ref: 001A86A1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?,?,?,?,001A8860,?,?,00000000,?,?,?), ref: 001A86EF
__alloca_probe_16.LIBCMT ref: 001A8786
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 001A87E9
__freea.LIBCMT ref: 001A87F6

Part of subcall function 001A4714: HeapAlloc.KERNEL32(00000000,00020119,00000000,?,001A1A98,00020119,?,001A12F4,00000208), ref: 001A4746

__freea.LIBCMT ref: 001A87FF
__freea.LIBCMT ref: 001A8824

Memory Dump Source

Source File: 00000000.00000002.1669327277.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.1669295555.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669342783.00000000001AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669356710.00000000001B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669370026.00000000001B5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_NgenTool.jbxd

Similarity

API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 2597970681-0
Opcode ID: c4f6f90b0701e5fcf7de9cd76e568405b70c71938c01703381fb2f59c2afd5a0
Instruction ID: 82c5c0ac3b08eee6e940f58c44564e23d72ed82f7b30f9696f1b826a4dc50670
Opcode Fuzzy Hash: c4f6f90b0701e5fcf7de9cd76e568405b70c71938c01703381fb2f59c2afd5a0
Instruction Fuzzy Hash: A651E27A600216AFEB259FA4CC41EBB77AAEF46750F254628FC08D7190EF34DC40C660

Function 001A91C8 Relevance: 10.7, APIs: 7, Instructions: 152
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,001A993D,?,00000000,?,00000000,00000000), ref: 001A920A
__fassign.LIBCMT ref: 001A9285
__fassign.LIBCMT ref: 001A92A0
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 001A92C6
WriteFile.KERNEL32(?,?,00000000,001A993D,00000000,?,?,?,?,?,?,?,?,?,001A993D,?), ref: 001A92E5
WriteFile.KERNEL32(?,?,00000001,001A993D,00000000,?,?,?,?,?,?,?,?,?,001A993D,?), ref: 001A931E

Memory Dump Source

Source File: 00000000.00000002.1669327277.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.1669295555.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669342783.00000000001AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669356710.00000000001B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669370026.00000000001B5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_NgenTool.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: fc049fe4df9d7616530f6d0ec8e7c16bdab4acc11e4392a000e529173dd6f6b2
Instruction ID: fffe59bc454f37265e52963161979a0f3f7a28b74a24b80302cd930f400d2935
Opcode Fuzzy Hash: fc049fe4df9d7616530f6d0ec8e7c16bdab4acc11e4392a000e529173dd6f6b2
Instruction Fuzzy Hash: 5251B675A00249AFDF10CFA8DC45AEEBBF8FF0A310F14411AE955E7291D7709981CBA1

Function 001A3E32 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,001A3E27,00000003,?,001A3DC7,00000003,001B2248,0000000C,001A3EDA,00000003,00000002), ref: 001A3E52
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 001A3E65
FreeLibrary.KERNEL32(00000000,?,?,?,001A3E27,00000003,?,001A3DC7,00000003,001B2248,0000000C,001A3EDA,00000003,00000002,00000000), ref: 001A3E88

Strings

CorExitProcess, xrefs: 001A3E5D
mscoree.dll, xrefs: 001A3E4B

Memory Dump Source

Source File: 00000000.00000002.1669327277.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.1669295555.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669342783.00000000001AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669356710.00000000001B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669370026.00000000001B5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_NgenTool.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: d72396d778ab477a4f61ada2d51944fe0c7f8f1b8b8eb68e08a33bd76c60b01a
Instruction ID: 58194a9cdea2f3ef61ac2993946f2760cc8e04817637439043ad0a3c107c45ab
Opcode Fuzzy Hash: d72396d778ab477a4f61ada2d51944fe0c7f8f1b8b8eb68e08a33bd76c60b01a
Instruction Fuzzy Hash: FEF06834A0060CBBCB119F91ED09BDEBFB5DF46711F000154F80AA2960CF704E81DA51

Function 001A7123 Relevance: 7.6, APIs: 5, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,?,00000100,?,00000000,?,?,00000000), ref: 001A7170
__alloca_probe_16.LIBCMT ref: 001A71A8
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 001A71F9
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 001A720B
__freea.LIBCMT ref: 001A7214

Part of subcall function 001A4714: HeapAlloc.KERNEL32(00000000,00020119,00000000,?,001A1A98,00020119,?,001A12F4,00000208), ref: 001A4746

Memory Dump Source

Source File: 00000000.00000002.1669327277.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.1669295555.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669342783.00000000001AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669356710.00000000001B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669370026.00000000001B5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_NgenTool.jbxd

Similarity

API ID: ByteCharMultiWide$AllocHeapStringType__alloca_probe_16__freea
String ID:
API String ID: 1857427562-0
Opcode ID: 4196404319f64f45a09cc28afc5514eb472742986fe666de276a81b3187c70e7
Instruction ID: e404291c949b2c2f8b2e1bec2773ad1863aaa5bc71d63506481e7b30c46216f6
Opcode Fuzzy Hash: 4196404319f64f45a09cc28afc5514eb472742986fe666de276a81b3187c70e7
Instruction Fuzzy Hash: 7F31D036A0020AABDF249F64EC81EAE7BA6EF42310F054129FC05D7291E735CE50CBA0

Function 001A170D Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

___scrt_initialize_onexit_tables.LIBCMT ref: 001A1730
__RTC_Initialize.LIBCMT ref: 001A173F

Part of subcall function 001A1D0F: __onexit.LIBCMT ref: 001A1D15

Part of subcall function 001A1DCD: InitializeSListHead.KERNEL32(001B3B28,001A1764), ref: 001A1DD2

___scrt_fastfail.LIBCMT ref: 001A17AB
___scrt_initialize_default_local_stdio_options.LIBCMT ref: 001A17B1

Memory Dump Source

Source File: 00000000.00000002.1669327277.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.1669295555.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669342783.00000000001AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669356710.00000000001B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669370026.00000000001B5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_NgenTool.jbxd

Similarity

API ID: Initialize$HeadList___scrt_fastfail___scrt_initialize_default_local_stdio_options___scrt_initialize_onexit_tables__onexit
String ID:
API String ID: 3692885319-0
Opcode ID: e33e70795811d21c1f3ff3cbae2848eecd5531fb5c86768a029c925a4238c3bc
Instruction ID: 154514eb0006d544669bc646c233ac59b74b7b02619323957d733c4ec6d43ea4
Opcode Fuzzy Hash: e33e70795811d21c1f3ff3cbae2848eecd5531fb5c86768a029c925a4238c3bc
Instruction Fuzzy Hash: A4F0179DE5570235DA1433F5190FB6E22894F737A5F240C15F8A0AA0C3EFA6C64481B2

Function 001A505C Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000104,00000000,001A318E,00000000,00000000,?,001A33A6,00000104,00000104,?,00000103,?), ref: 001A5060
SetLastError.KERNEL32(00000000,?,001A33A6,00000104,00000104,?,00000103,?), ref: 001A50C8
SetLastError.KERNEL32(00000000,?,001A33A6,00000104,00000104,?,00000103,?), ref: 001A50D4
_abort.LIBCMT ref: 001A50DA

Memory Dump Source

Source File: 00000000.00000002.1669327277.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.1669295555.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669342783.00000000001AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669356710.00000000001B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669370026.00000000001B5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_NgenTool.jbxd

Similarity

API ID: ErrorLast$_abort
String ID:
API String ID: 88804580-0
Opcode ID: 3d2e12df9ff44576c2e341b07015a43bb583a38e630e72b8f17c2d7604218a65
Instruction ID: 8c5fcf4ef40bbd1ccfd37853a2e976e610cfee3eeb2613e88341153e1ffb3438
Opcode Fuzzy Hash: 3d2e12df9ff44576c2e341b07015a43bb583a38e630e72b8f17c2d7604218a65
Instruction Fuzzy Hash: 98F0A43E108E00A7C3227774BE0AA6F252B9FD3760F350118F529D2991EFA4C94241A0

Function 001A27C6 Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 001A27C6
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 001A27CB
___vcrt_initialize_locks.LIBVCRUNTIME ref: 001A27D0

Part of subcall function 001A2C28: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 001A2C39

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 001A27E5

Memory Dump Source

Source File: 00000000.00000002.1669327277.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.1669295555.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669342783.00000000001AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669356710.00000000001B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1669370026.00000000001B5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_NgenTool.jbxd

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: 9d642d21bf565df718a84f259e5d4d5067247cae24688ba3bef7e1a3f1c206bb
Instruction ID: bcb87c0548ec7de1ab7ce61373d335c5a9197a64498d1a5856cd276b042813ea
Opcode Fuzzy Hash: 9d642d21bf565df718a84f259e5d4d5067247cae24688ba3bef7e1a3f1c206bb
Instruction Fuzzy Hash: 00C0482D000301981C383AFD22422AE23401C73396BE125C9F8491B807AF361A8F6A33

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report NgenTool.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: NgenTool.exePID: 1984, Parent PID: 2580

General

Chronological Activities

Analysis Process: conhost.exePID: 3868, Parent PID: 1984

General

Chronological Activities

Disassembly

Analysis Process: NgenTool.exePID: 1984, Parent PID: 2580COMMON

Windows Analysis Report
NgenTool.exe

Function 001A1100 Relevance: 45.9, APIs: 16, Strings: 10, Instructions: 363
registryprocesssynchronizationCOMMON

Function 001A3DF1 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Function 001A6548 Relevance: 6.1, APIs: 4, Instructions: 52
libraryCOMMONLIBRARYCODE

Function 001A6CF9 Relevance: 3.1, APIs: 2, Instructions: 67
COMMON

Function 001A64AC Relevance: 3.1, APIs: 2, Instructions: 65
libraryloaderCOMMONLIBRARYCODE

Function 001A1000 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81
fileCOMMON

Function 001A860F Relevance: 12.2, APIs: 8, Instructions: 216
COMMON

Function 001A91C8 Relevance: 10.7, APIs: 7, Instructions: 152
fileCOMMON