Edit tour

Windows Analysis Report
1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe

Overview

General Information

Sample name:	1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe
Analysis ID:	1525927
MD5:	4e9ff90c6ded1a8c1e1eb52006a0a8dc
SHA1:	192055ae0a6398531b4ed2b998abf33b172c607b
SHA256:	f80400459be849fddbd8eab9d922d356e289d23c13af4f49e09a8b7df4f41b17
Tags:	base64-decodedexeuser-abuse_ch
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected Powershell download and execute

AI detected suspicious sample

Machine Learning detection for sample

PE file has a writeable .text section

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to read the PEB

Found potential string decryption / allocating functions

One or more processes crash

PE file does not import any functions

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe (PID: 6072 cmdline: "C:\Users\user\Desktop\1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe" MD5: 4E9FF90C6DED1A8C1E1EB52006A0A8DC)

WerFault.exe (PID: 3652 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6072 -s 204 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: 1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe PID: 6072	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: 1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe

Joe Sandbox ML: detected

Source: 1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Amcache.hve.4.dr

String found in binary or memory: http://upx.sf.net

System Summary

PE file has a writeable .text section

Source: 1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe

Code function: String function: 00404778 appears 32 times

Source: C:\Users\user\Desktop\1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6072 -s 204

Source: 1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe

Static PE information: No import functions for PE file found

Source: 1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal68.evad.winEXE@2/5@0/0

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6072

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\829167bd-126e-43a6-8e55-464957240845

Jump to behavior

Source: 1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe

ReversingLabs: Detection: 47%

Source: unknown	Process created: C:\Users\user\Desktop\1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe "C:\Users\user\Desktop\1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe"
Source: C:\Users\user\Desktop\1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6072 -s 204

Source: C:\Users\user\Desktop\1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe

Section loaded: apphelp.dll

Jump to behavior

Source: 1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe	Code function: 1_2_0040AD12 push eax; retf	1_2_0040AD13
Source: C:\Users\user\Desktop\1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe	Code function: 1_2_0040A5F7 pushad ; iretd	1_2_0040A5F8
Source: C:\Users\user\Desktop\1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe	Code function: 1_2_00406670 pushfd ; ret	1_2_00406671
Source: C:\Users\user\Desktop\1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe	Code function: 1_2_0040667F pushfd ; ret	1_2_00406680
Source: C:\Users\user\Desktop\1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe	Code function: 1_2_0040668E pushfd ; ret	1_2_0040668F

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe

Code function: 1_2_0041A57E mov eax, dword ptr fs:[00000030h]

1_2_0041A57E

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: 1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe, type: SAMPLE
Source: Yara match	File source: Process Memory Space: 1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe PID: 6072, type: MEMORYSTR

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	21 Security Software Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe	47%	ReversingLabs	Win32.Trojan.Generic
1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.4.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1525927
Start date and time:	2024-10-04 16:41:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe
Detection:	MAL
Classification:	mal68.evad.winEXE@2/5@0/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 10
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.21
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, login.live.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe, PID 6072 because there are no executed function
VT rate limit hit for: 1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe

Simulations

Behavior and APIs

Time	Type	Description
10:43:08	API Interceptor	1x Sleep call for process: WerFault.exe modified

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_1728051010049c89_8378edbd9a5ae273677a90ea09276385aff130_85a4951b_66965332-0ad7-4bee-8a71-5a777a0a9dcb\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7129991917507406
Encrypted:	false
SSDEEP:	96:K4FaC1mDUAOgsZhqT1yDf0QXIDcQzc6CmcE1cw3CP+HbHg6ZAX/d5FMT2SlPkpXg:XsnfOgP00NXfvjEzuiFEZ24IO83s
MD5:	9F1BD2715668F97C5B4427B2A895241A
SHA1:	DA86A9D0DA72B78E5F5393445BB2E170FB1CC84C
SHA-256:	F90FFAEF0294043BD86D8FA429FDE976C04D38E338030F1B0E95865E8451C90A
SHA-512:	6C7EAA42D73F96F0A8F5CE4E99DC94415DEA2ED3D61E377C73B4090B697F72A6B694E43F6BD043CBEF97B2F8FBA1DF784106E20D4066E8475AC1CAB984A6D64B
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.5.2.6.5.6.3.9.2.3.7.2.1.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.5.2.6.5.6.5.0.7.9.9.4.9.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.6.9.6.5.3.3.2.-.0.a.d.7.-.4.b.e.e.-.8.a.7.1.-.5.a.7.7.7.a.0.a.9.d.c.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.5.1.b.4.8.9.7.-.d.0.7.f.-.4.7.3.e.-.8.f.9.f.-.1.a.2.4.f.3.2.c.7.8.e.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.1.7.2.8.0.5.1.0.1.0.0.4.9.c.8.9.4.0.b.0.0.1.c.0.f.3.a.b.f.1.1.d.0.5.8.a.d.1.4.1.2.5.b.1.7.c.0.f.8.6.c.1.c.1.b.c.b.3.d.1.c.f.2.2.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.7.b.8.-.0.0.0.1.-.0.0.1.4.-.4.b.c.b.-.5.9.a.a.6.b.1.6.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.e.e.e.8.a.4.6.7.6.b.0.3.a.0.6.4.e.4.5.e.9.7.5.9.5.2.4.8.c.e.1.0.0.0.0.f.f.f.f.!.0.0.0.0.1.9.2.0.5.5.a.e.0.a.6.3.9.8.5.3.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4088.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Oct 4 14:42:44 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	19618
Entropy (8bit):	2.054141332955526
Encrypted:	false
SSDEEP:	96:5E8DTT6FzRJH87i7n1vuvM4JVQ3hWI/WItoI5JvbJ:Be5H87OZuvZ23JJDJ
MD5:	F85D5AFE6FDB1D575365319F4707DCD4
SHA1:	D956FEA6239D21A0039694F5DCC19300CBD569FB
SHA-256:	C9BB28BBF95D59E2FF4598187EAC9C55FD821D4883AAC54F544CB09E5D11D7DD
SHA-512:	E15C494B48C7AACE8AB3F165AA680861A1C8C53B47475385767C44934054672801DE6C0E14F8730229337A79E88A086AA738ABC1A39E4D0D95AC11A4B9A5FC15
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ..........f............4...............<.......d...<...........T.......8...........T...........H...ZC......................................................................................................eJ......L.......GenuineIntel............T..............f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4154.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8564
Entropy (8bit):	3.699045285650676
Encrypted:	false
SSDEEP:	192:R6l7wVeJuz6j6Y9bSU9UjxMgmf+JPWOxpxj89bQpsf/Qm:R6lXJa6j6YxSU9Ujqgmf+JPWOqQCf9
MD5:	D1BEF527C49739DFBC61D2AD94050494
SHA1:	DBC6873DDAA33FA99F1DEF62EDB4474C24CD4924
SHA-256:	119748433D48AFC8F05FB371F099CBFA31A80D1682CA1F69753252114EC62C0C
SHA-512:	6FDAAA60F9817AAF9E2F01953613F3CE8C007DB97DA6EBE634A34D0CBBF4A835CE08C61CEC01C922980CE02FE4FC882599743A5A62EB1E3A5B456AB4EB8C7C9E
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.0.7.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER425F.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4893
Entropy (8bit):	4.54657845639295
Encrypted:	false
SSDEEP:	48:cvIwWl8zsEJg77aI97QWpW8VYoYm8M4JBgY5g0KFq+q88gz0CgReguDguad:uIjfCI75p7V4JBL5FxbC6exDxad
MD5:	8C26C99609BA2D316E0D592B9262170A
SHA1:	0DCF88F22D9BF83370B948BBD9E1F30861E2213D
SHA-256:	89D9C2EBF9C511EA8B42C8B0F337C5305EBE3A473A0800524C0807AE2C2AEA15
SHA-512:	D452518C5E520F11A696E71C630C7A8B44F9048D0C798D5E16C9788444E1B530F0BE4035AC821448C7230BCD505D35510BA14FE46CC190383BC32BB3A7F66204
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="528825" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465978539086643
Encrypted:	false
SSDEEP:	6144:UIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNIdwBCswSbco:pXD94+WlLZMM6YFHm+co
MD5:	AC1E75E2E0623B63B27226EECE11820F
SHA1:	64A37BD08113C4F9F85389BD8C1059D1DE217F0B
SHA-256:	4D346C47FACAE9C0A1091CEF6EA98D7FC680ED875C27C495828917A48DA5A6C1
SHA-512:	C0B093AE7D7C4267522D2EF3E23CAC2B8DD634C27B2838B92F2400C9F8265671CA88B331C82FEE9E403BD5507CA7A18502943994A6D0C3453E8A9232757DF72C
Malicious:	false
Reputation:	low
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmJ..k................................................................................................................................................................................................................................................................................................................................................=.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.470826247958057
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe
File size:	199'500 bytes
MD5:	4e9ff90c6ded1a8c1e1eb52006a0a8dc
SHA1:	192055ae0a6398531b4ed2b998abf33b172c607b
SHA256:	f80400459be849fddbd8eab9d922d356e289d23c13af4f49e09a8b7df4f41b17
SHA512:	8068de16570637ce49e78dcb02bc05641fcc9c34e37f8cd55ad2a7ef9347bd78f4de5bd706e5775834b3650197032201eee80e1064f56e9f7776379e191356ef
SSDEEP:	3072:KCbBe74znwdguLtmvhWtSW04I1hna9vyVATPWSFssPnxJ4W:KCNQ4zwqmmJfWA1Ja0QPbF9Pn34
TLSH:	F3145B30E5034019F4A349FE5A9E1FA6ECA96D620310C0D763DB5BAC16F14F5B8B4E6B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b...............u^......uk......u_......{v.....fz.......{f..............uZ......uh.....Rich............PE..L..._>.f...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x416490
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66A03E5F [Tue Jul 23 23:35:59 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:

Entrypoint Preview

Instruction
push eax
lea ecx, dword ptr [ebp-0Ch]
call 00007F086106F3C1h
lea ecx, dword ptr [ebp+3A81C3E0h]
fdivp st(7), st(0)
jmp far eax
popad
dec ebp
add byte ptr [eax], al
jmp 00007F086106A61Fh
lea edx, dword ptr [ebp-18h]
push edx
lea ecx, dword ptr [ebp-54h]
call 00007F086106F3A8h
mov eax, dword ptr [0062CDCCh]
push eax
lea ecx, dword ptr [ebp-3Ch]
call 00007F086106F31Ah
mov ecx, dword ptr [0062CD0Ch]
push ecx
lea ecx, dword ptr [ebp-30h]
call 00007F086106F30Bh
lea edx, dword ptr [ebp-54h]
push edx
mov ecx, dword ptr [ebp+08h]
call 00007F08520567BFh
loopne 00007F086106A600h
mov bh, 8Dh
dec ebp
hlt
call 00007F086106F2D7h
lea ecx, dword ptr [ebp-18h]
call 00007F086106F2CFh
lea ecx, dword ptr [ebp-24h]
call 00007F086106F2C7h
lea ecx, dword ptr [ebp-60h]
call 00007F086106F2BFh
lea ecx, dword ptr [ebp-54h]
call 00007F0861056757h
lea ecx, dword ptr [ebp+0Ch]
call 00007F085205662Fh
loopne 00007F086106A600h
mov bh, 8Bh
inc ebp
or cl, ch
lds eax, fword ptr [eax]
add byte ptr [eax], al
push 004210C0h
lea ecx, dword ptr [ebp-0Ch]
call 00007F086106F56Ah
push eax
call dword ptr [0062D098h]
test eax, eax
jne 00007F086106A5C4h
push 0000EA60h
call dword ptr [0062CF04h]
jmp 00007F086106A10Bh
jmp 00007F086106A61Dh
lea eax, dword ptr [ebp-0Ch]
push eax
lea ecx, dword ptr [ebp-54h]
call 00007F086106F311h
mov ecx, dword ptr [0062C8E8h]

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2a9d8	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x23e000	0x2480	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1e000	0xf4	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1c64a	0x1c800	791d17de6cae01e1ffd7186a9bc9c14b	False	0.46223101699561403	data	6.188167896064244	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x1e000	0xceee	0xd000	c84e02b7333e58143339776cb9743bd4	False	0.5546123798076923	data	6.8111809347000305	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2b000	0x212b94	0xc00	d10a5dfd05124862bfc0e63b64dd1873	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x23e000	0x442a	0x4600	468d1470db7c6ef0fd14e93acd808d91	False	0.5749441964285714	data	5.841227643161666	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Analysis Process: 1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exePID: 6072, Parent PID: 2580

General

Target ID:	1
Start time:	10:42:41
Start date:	04/10/2024
Path:	C:\Users\user\Desktop\1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe"
Imagebase:	0x400000
File size:	199'500 bytes
MD5 hash:	4E9FF90C6DED1A8C1E1EB52006A0A8DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	10:42:43
Start date:	04/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6072 -s 204
Imagebase:	0xa90000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: 1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exePID: 6072, Parent PID: 2580COMMON

Non-executed Functions

Function 0041A57E Relevance: .0, Instructions: 1COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3320935979.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3320914397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3320959594.000000000041E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3320980091.000000000041F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3320999989.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3321071891.000000000063E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf22168649.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d8281cac619dc2e559911e340da3b7217049dd06fddd5b5b6d54d7a98ad1a35
Instruction ID: aee03658f1bf22bcdb1b933eb6c568a9a245f25b0b71ba2e591b1e6766abb584
Opcode Fuzzy Hash: 6d8281cac619dc2e559911e340da3b7217049dd06fddd5b5b6d54d7a98ad1a35
Instruction Fuzzy Hash:

Function 00403050 Relevance: 39.2, Strings: 31, Instructions: 473COMMON

Download Yara Rule

Strings

)*+,-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 004033AC
-----, xrefs: 0040356E
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@, xrefs: 00403602
eZilla, xrefs: 0040332A
*+,-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 004034BF
@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 00403052
-----, xrefs: 004035CD
-----, xrefs: 00403555
Chrome, xrefs: 004031B0
g\FileZilla\recentservers.xml, xrefs: 004032E4
"#$%&'()*+,-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 0040364D
*.*, xrefs: 00403267
<Pass encoding="base64">, xrefs: 00403311
password: , xrefs: 00403348
LY261D2VKOCFC7, xrefs: 004036CF
service, encrypted_token FROM token_service, xrefs: 00403133
VVW61IW97, xrefs: 00403733
967295, xrefs: 004032B2
Preferences, xrefs: 0040319C
71L6BNRKUP21, xrefs: 0040377E
RROR, xrefs: 004035EE
BW7D, xrefs: 00403765
-----, xrefs: 00403550
tadata-v2, xrefs: 00403294
ountId, xrefs: 00403151
orage\default\, xrefs: 00403280
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@, xrefs: 00403361
=@@@@@@@, xrefs: 004034A1
-, xrefs: 00403587
UMKCIC, xrefs: 004037E0
null, xrefs: 0040332F

Memory Dump Source

Source File: 00000001.00000002.3320935979.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3320914397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3320959594.000000000041E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3320980091.000000000041F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3320999989.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3321071891.000000000063E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf22168649.jbxd

Similarity

API ID:
String ID: null$"#$%&'()*+,-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/$)*+,-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/$*+,-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/$*.*$-$-----$-----$-----$-----$71L6BNRKUP21$967295$<Pass encoding="base64">$=@@@@@@@$@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@$@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@$@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/$BW7D$Chrome$LY261D2VKOCFC7$Preferences$RROR$UMKCIC$VVW61IW97$eZilla$g\FileZilla\recentservers.xml$orage\default\$ountId$password: $service, encrypted_token FROM token_service$tadata-v2
API String ID: 0-2497462746
Opcode ID: 644fe88a239d3e163b416bb155bb3124ef4ae8bc911bae87077ceef34f950afb
Instruction ID: 557390a47efa0d13401e813f0fd1134d910092d2c615f2b087ae9c76ddf79ccd
Opcode Fuzzy Hash: 644fe88a239d3e163b416bb155bb3124ef4ae8bc911bae87077ceef34f950afb
Instruction Fuzzy Hash: 76F152B1FC07207AE224AF617D03F683A659B91B29FA0103BFE047A1D2F6FD0615565E

Function 0040288A Relevance: 19.1, Strings: 15, Instructions: 362COMMON

Download Yara Rule

Strings

system32\rundll32.exe, xrefs: 00402E28
64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00402B9B
Mar, xrefs: 0040295B
DEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_., xrefs: 00402B69
Friday, xrefs: 00402910
ndows 11, xrefs: 00402A0B
@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@, xrefs: 00402C13
Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00402DD5
?456789:;<=@@@@@@@, xrefs: 00402A51
Saturday, xrefs: 004028B1
BCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=, xrefs: 004029A2
@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 00402877
()*+,-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 00402C63
!"#$%&'()*+,-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 00402A6A
x(New-Object Net.WebClient).DownloadString(', xrefs: 00402DA8

Memory Dump Source

Source File: 00000001.00000002.3320935979.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3320914397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3320959594.000000000041E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3320980091.000000000041F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3320999989.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3321071891.000000000063E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf22168649.jbxd

Similarity

API ID:
String ID: !"#$%&'()*+,-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/$ 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30$()*+,-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/$?456789:;<=@@@@@@@$@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@$@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/$BCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=$DEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_.$Friday$Mar$Saturday$Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe$ndows 11$system32\rundll32.exe$x(New-Object Net.WebClient).DownloadString('
API String ID: 0-377527654
Opcode ID: 2eb897bca5c3de43d7b7944faa2ec18ed3970421acf31e717c488e79593d57eb
Instruction ID: 65f6d3f489a47c62380f47a09f55616004dfc399d6cfd4acd918f8bac70caa85
Opcode Fuzzy Hash: 2eb897bca5c3de43d7b7944faa2ec18ed3970421acf31e717c488e79593d57eb
Instruction Fuzzy Hash: 43C11FE2F807207AE7207B61BE07F2836919792B14FE55037FA04BA1D2E7ED01558A5F

Function 004045E1 Relevance: 15.1, Strings: 12, Instructions: 94COMMON

Download Yara Rule

Strings

F6UY4P2, xrefs: 004046DF
K!X3 ps, xrefs: 00404603
x4+7Y1,@, xrefs: 00404694
._&-["K, xrefs: 004046E4
U9RNR31MIHRN2RVVID5WTFJTOSFR6732OZFW3AWKODDB832RFH5NP3SP0889XKQKOZ9DL92HQVIQBHVVZXLZCPMUGZ65BXWDX2XI3, xrefs: 00404635
TCWG3GS, xrefs: 0040475C
Z3WLO1EREO, xrefs: 00404761
3%sd, xrefs: 004045FE
ZKID, xrefs: 004045EA
,PT\, xrefs: 004046C6
TDTSD5QKE89VIS3R4Q5O3KZNROM95Y5, xrefs: 004046F8
3*;[, xrefs: 0040461C

Memory Dump Source

Source File: 00000001.00000002.3320935979.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3320914397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3320959594.000000000041E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3320980091.000000000041F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3320999989.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3321071891.000000000063E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf22168649.jbxd

Similarity

API ID:
String ID: ,PT\$._&-["K$3%sd$3*;[$F6UY4P2$K!X3 ps$TCWG3GS$TDTSD5QKE89VIS3R4Q5O3KZNROM95Y5$U9RNR31MIHRN2RVVID5WTFJTOSFR6732OZFW3AWKODDB832RFH5NP3SP0889XKQKOZ9DL92HQVIQBHVVZXLZCPMUGZ65BXWDX2XI3$Z3WLO1EREO$ZKID$x4+7Y1,@
API String ID: 0-248987284
Opcode ID: 193ea5b7ef061c54fbe419d8fd580d88a846145733016444699b4f106f27fbac
Instruction ID: 87d242548547e5451a88fc3d8aebfad2438da0c738beb7adf00b6d522298c26b
Opcode Fuzzy Hash: 193ea5b7ef061c54fbe419d8fd580d88a846145733016444699b4f106f27fbac
Instruction Fuzzy Hash: DD31C6A1FC17206AE2206BA6BC03F1D39A1DBD1B14FA51037F7047A2D2F6FD1515469D

Function 00403593 Relevance: 13.9, Strings: 11, Instructions: 166COMMON

Download Yara Rule

Strings

LY261D2VKOCFC7, xrefs: 004036CF
-----, xrefs: 004035CD
VVW61IW97, xrefs: 00403733
71L6BNRKUP21, xrefs: 0040377E
"#$%&'()*+,-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 0040364D
-, xrefs: 00403587
RROR, xrefs: 004035EE
UMKCIC, xrefs: 004037E0
0B, xrefs: 0040356A
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@, xrefs: 00403602
BW7D, xrefs: 00403765

Memory Dump Source

Source File: 00000001.00000002.3320935979.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3320914397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3320959594.000000000041E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3320980091.000000000041F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3320999989.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3321071891.000000000063E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf22168649.jbxd

Similarity

API ID:
String ID: "#$%&'()*+,-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/$-$-----$0B$71L6BNRKUP21$@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@$BW7D$LY261D2VKOCFC7$RROR$UMKCIC$VVW61IW97
API String ID: 0-1171767764
Opcode ID: 7c90bb1f42bdc628f93964ad6c6d2503e1d9fdd34a54c4c055dbcd270f13fcf1
Instruction ID: 20943aa9c9ac02ac0f9caaa94c98f4a03c9e0bd844012407b9b3825682024efa
Opcode Fuzzy Hash: 7c90bb1f42bdc628f93964ad6c6d2503e1d9fdd34a54c4c055dbcd270f13fcf1
Instruction Fuzzy Hash: 4B5188B1FC07207AD210AF717C03B643A615791F1EFA4117BFE046A1C1E6AD07154A6E

Function 004047B4 Relevance: 12.6, Strings: 10, Instructions: 96COMMON

Download Yara Rule

Strings

&L](-%, xrefs: 0040480E
DAZWW72LQZ, xrefs: 004047C9
UEN70E8FP1NV40GL8IDZRD7AV0MD3I5Y7P1XAHOCV424LYDR0VH8NZDRHNL915LG5YXP8SK03BDWKDZ6X4MHB6KIMKPX6PK0TW8WAXSIKR, xrefs: 00404918
FYGE3KOR9K6, xrefs: 0040492E
DOZ8QJORTMPLM9RBGWKWSCL3JQW06ZNMGU0OXM6Z5AZZJAS20472VC, xrefs: 00404939
ZZWH1FXCIHBNRECFVUEFB8XAJMZIJW9KDBW0, xrefs: 004047D4
8ZNR5G, xrefs: 00404859
GSV681BS, xrefs: 004048BC
2ROE9, xrefs: 0040482F
4P6SMLH3JWK, xrefs: 00404819

Memory Dump Source

Source File: 00000001.00000002.3320935979.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3320914397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3320959594.000000000041E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3320980091.000000000041F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3320999989.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3321071891.000000000063E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf22168649.jbxd

Similarity

API ID:
String ID: &L](-%$2ROE9$4P6SMLH3JWK$8ZNR5G$DAZWW72LQZ$DOZ8QJORTMPLM9RBGWKWSCL3JQW06ZNMGU0OXM6Z5AZZJAS20472VC$FYGE3KOR9K6$GSV681BS$UEN70E8FP1NV40GL8IDZRD7AV0MD3I5Y7P1XAHOCV424LYDR0VH8NZDRHNL915LG5YXP8SK03BDWKDZ6X4MHB6KIMKPX6PK0TW8WAXSIKR$ZZWH1FXCIHBNRECFVUEFB8XAJMZIJW9KDBW0
API String ID: 0-3108060997
Opcode ID: 6f099a52d1fcf65a102af6e8c21447e277b500ffb90f5fb3f28496bccec55a72
Instruction ID: 2fcfa6d1144a428def51383edafab60c9b4eb39c47d40f16f1b87c6b5e12a81d
Opcode Fuzzy Hash: 6f099a52d1fcf65a102af6e8c21447e277b500ffb90f5fb3f28496bccec55a72
Instruction Fuzzy Hash: BF41FB79640624EBC718AFA5EC89B997F70FF4C702BA4C062F9029A150C7B9D5029B3D

Function 004025C1 Relevance: 8.9, Strings: 7, Instructions: 152COMMON

Download Yara Rule

Strings

tionProcess, xrefs: 0040273A
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@, xrefs: 0040276C
#$%&'()*+,-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 004027BC
eryInfoA, xrefs: 00402758
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@, xrefs: 00402627
tOptionA, xrefs: 00402753
+,-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 00402677

Memory Dump Source

Source File: 00000001.00000002.3320935979.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3320914397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3320959594.000000000041E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3320980091.000000000041F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3320999989.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3321071891.000000000063E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf22168649.jbxd

Similarity

API ID:
String ID: #$%&'()*+,-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/$+,-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/$@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@$@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@$eryInfoA$tOptionA$tionProcess
API String ID: 0-692316494
Opcode ID: da469039873a7d4491a4d216a33cf53e1a1c3c9d58466b738a583c3b16b194cc
Instruction ID: 952786c2c196a05dca0fc704678852bd5b0e5b15b9b711b0cd1784030488c26f
Opcode Fuzzy Hash: da469039873a7d4491a4d216a33cf53e1a1c3c9d58466b738a583c3b16b194cc
Instruction Fuzzy Hash: 29513EB5FD0714AEE32077A17D03B293A5297F0B04FA1003BFA446A1E2E7F91519465E

Function 00402E8B Relevance: 7.6, Strings: 6, Instructions: 109COMMON

Download Yara Rule

Strings

@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@, xrefs: 00402FBE
.exe, xrefs: 00402E8D
!"#$%&'()*+,-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 00403004
aws, xrefs: 00402F3C
l.cache, xrefs: 00402F55
okens.txt, xrefs: 00402F5A

Memory Dump Source

Source File: 00000001.00000002.3320935979.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3320914397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3320959594.000000000041E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3320980091.000000000041F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3320999989.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3321071891.000000000063E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf22168649.jbxd

Similarity

API ID:
String ID: !"#$%&'()*+,-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/$.exe$@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@$aws$l.cache$okens.txt
API String ID: 0-1733428825
Opcode ID: 3c0e0c22d6b6df0633523a6090639bf153b75842aca337e7a31791d68688c236
Instruction ID: aa21b261d4b14992f969b1ab17820660c05ce79a9eba90f0f7aef1d40b6ca84b
Opcode Fuzzy Hash: 3c0e0c22d6b6df0633523a6090639bf153b75842aca337e7a31791d68688c236
Instruction Fuzzy Hash: F9313AB1FC07247AE2247B617E03F6836119791B28FE0113BFE053AAD2F6F90516565E

Function 00403663 Relevance: 7.6, Strings: 6, Instructions: 98COMMON

Download Yara Rule

Strings

LY261D2VKOCFC7, xrefs: 004036CF
VVW61IW97, xrefs: 00403733
71L6BNRKUP21, xrefs: 0040377E
UMKCIC, xrefs: 004037E0
BW7D, xrefs: 00403765
@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 00403666

Memory Dump Source

Source File: 00000001.00000002.3320935979.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3320914397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3320959594.000000000041E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3320980091.000000000041F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3320999989.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3321071891.000000000063E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf22168649.jbxd

Similarity

API ID:
String ID: 71L6BNRKUP21$@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/$BW7D$LY261D2VKOCFC7$UMKCIC$VVW61IW97
API String ID: 0-1973037340
Opcode ID: f9955e0c43ea7efb562166afc2fd87e0add56e17af525ed1d70be8ec65cc2a11
Instruction ID: c5b98e487db19d38c508dabcfa384e5bff3c5634ca0a8ccd7e789b7f75c60f85
Opcode Fuzzy Hash: f9955e0c43ea7efb562166afc2fd87e0add56e17af525ed1d70be8ec65cc2a11
Instruction Fuzzy Hash: DA3175A1FC0720BAD210AF617C03B243A615791B2EFA461BFFE446A1C1F6AC07044E6E

Function 0040488E Relevance: 5.0, Strings: 4, Instructions: 50COMMON

Download Yara Rule

Strings

UEN70E8FP1NV40GL8IDZRD7AV0MD3I5Y7P1XAHOCV424LYDR0VH8NZDRHNL915LG5YXP8SK03BDWKDZ6X4MHB6KIMKPX6PK0TW8WAXSIKR, xrefs: 00404918
FYGE3KOR9K6, xrefs: 0040492E
DOZ8QJORTMPLM9RBGWKWSCL3JQW06ZNMGU0OXM6Z5AZZJAS20472VC, xrefs: 00404939
GSV681BS, xrefs: 004048BC

Memory Dump Source

Source File: 00000001.00000002.3320935979.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3320914397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3320959594.000000000041E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3320980091.000000000041F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3320999989.000000000042B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3321071891.000000000063E000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf22168649.jbxd

Similarity

API ID:
String ID: DOZ8QJORTMPLM9RBGWKWSCL3JQW06ZNMGU0OXM6Z5AZZJAS20472VC$FYGE3KOR9K6$GSV681BS$UEN70E8FP1NV40GL8IDZRD7AV0MD3I5Y7P1XAHOCV424LYDR0VH8NZDRHNL915LG5YXP8SK03BDWKDZ6X4MHB6KIMKPX6PK0TW8WAXSIKR
API String ID: 0-1893229026
Opcode ID: cdd66dc330dbdf65523fda1d9d4af0f8fd3a41d5bae06c36ca0c1e4de994466b
Instruction ID: 04645d0250c19976142a01ca5793ead7ddfde332a01a8ef9e8063f423dba22aa
Opcode Fuzzy Hash: cdd66dc330dbdf65523fda1d9d4af0f8fd3a41d5bae06c36ca0c1e4de994466b
Instruction Fuzzy Hash: 8A118C74B40624EFCB089FA9EC89A9D7F71FF8C701754C066F9029A210C7B9D511DB29

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_1728051010049c89_8378edbd9a5ae273677a90ea09276385aff130_85a4951b_66965332-0ad7-4bee-8a71-5a777a0a9dcb\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4088.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4154.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER425F.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: 1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exePID: 6072, Parent PID: 2580

General

Windows Analysis Report
1728051010049c8940b001c0f3abf11d058ad14125b17c0f86c1c1bcb3d1cf221686491be0134.dat-decoded.exe