Edit tour

Windows Analysis Report
STlUEqhwpx.exe

Overview

General Information

Sample name:	STlUEqhwpx.exe renamed because original name is a hash value
Original sample name:	0a8cfbcfffa98cb54b6746fec4981101.exe
Analysis ID:	1528478
MD5:	0a8cfbcfffa98cb54b6746fec4981101
SHA1:	9394653bbd0ca684970c5d482e26a89f60d4e975
SHA256:	2a4751457c3ab5125478cfebea685b92046e047dedc07ecb0b32f2d6c6293a0f
Tags:	exeQuasarRATRATuser-abuse_ch
Infos:

Detection

Quasar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Quasar RAT

.NET source code references suspicious native API functions

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Writes to foreign memory regions

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

STlUEqhwpx.exe (PID: 7264 cmdline: "C:\Users\user\Desktop\STlUEqhwpx.exe" MD5: 0A8CFBCFFFA98CB54B6746FEC4981101)

RegAsm.exe (PID: 7288 cmdline: #system32 MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 7296 cmdline: #system32 MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Quasar RAT, QuasarRAT	Quasar RAT is a malware family written in .NET which is used by a variety of attackers. The malware is fully functional and open source, and is often packed to make analysis of the source more difficult.	APT33 Dropping Elephant Stone Panda The Gorgon Group	http://researchcenter.paloaltonetworks.com/2017/01/unit42-downeks-and-quasar-rat-used-in-recent-targeted-attacks-against-governments http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/master-of-rats-how-to-create-your-own-tracker/20848 https://adeo.com.tr/wp-content/uploads/2020/02/APT10_Report.pdf https://asec.ahnlab.com/en/31089/	https://malpedia.caad.fkie.fraunhofer.de/details/win.quasar_rat

Malware Configuration

Threatname: Quasar

{"Version": "1.4.1", "Host:Port": "165.22.194.189:5613;", "SubDirectory": "SubDir", "InstallName": "Client.exe", "MutexName": "2bdefbcb-91d1-48c0-8f2f-5de6eed0f91f", "StartupKey": "Quasar Client Startup", "LogDirectoryName": "Logs", "ServerSignature": "BEptALBhH5iqs6kuwXGFbjWTfhmu3jqDNxidblxNc7YNmZ1dcYk8+am/FW8Q8CaWGmDYsZgofDY9/EkmkR9twEqN2zJXxlk/IAyFVeplXHr1ASrzJw1fjLWkYnnvYaUnCpnlnTqiwp5G6eNHC05biuc2lmE288xAjlH4KS5cqmzLqxQXtC55kZE/UNkS1SutybT2XAIuZLGkvnnIWBgPaoO40hRViMu0Df4FTh/Kx+kyqlCW96IYdV6ep3eZR7p/EW0DoOVPRlZKADarQr3MGVyPFckBFhHsd4H9ChC2wtP4/ncJpbZ5HJogXkP1t6FMsecwFhJX0BGigE7sGLlQNwYbR8ZKe44AtguZUnHfKrJPOns+LObM9QTsfR77fOfCXBvmAGlWIWkvZbaZSZTDgXsiyIcsJJF3kHJaYAq+pq0S5fVbTc4JQ6z6kXsdk4Dk7MmsxaRecNcH27oCosU4V6kuAONgww2crG61ocYtNQ2qtwPvbFPVWg8L5uVKfXw1rYxCtpWNZQWdnz8FBn3UBRS2ytU+in1uLJlxgLdeww8I/AF/yJrxTGZYwwAneiC6AQ9FQCgF4ozJBNa6P1u7pJZYPZjIKX+zKRYGAUBfJH4DqyV6gEeDO262Y15PZ8yxeqLMWo072K4VH4Q/PmzwHWwxqU+Xb8D4CvbjxVqBLz8=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQAJG/dLBFXHlkEi08lEISZTANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI0MDkyOTA1NDczOVoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAhlizYr3H9pDXXpfhAUm/Ps9PkjoUjbktI1Esb5628jdrNnufpWksSb+sl0YI/ru1hyfa43QrdoHV89W0kMXEgrGuR4qBaDQGdKlBQl2a6N0ufqoLiNshG0D7peW24ykLN4pwC2Mt4gLgyZvyKilv4fljl8pzpoHcZDt5vTaFGvAZM58kHKwogJ5DLBXiFy8dL0H2o/AZ0Cwcjl5oPuuQPhot752WlwfyVWWjc5hIZ72JKn4WrieBXlr9ndlOcOAqvzaTfFHC3qXR9J3L1uazTawTYqiVuypX6hsL5z+YTWfnAz5ssoFQo3p3g0RNGFB85UDQbWWL/RxcQ2zd2MfuhaUaIf2Kls3gzUxwJf1Sla7F+YkH9jq9f/grm+Clk4O72dvh/oHE/B+dJkJ0twNpVR6fLMomn1qJWy2ig5BdfoZFHDidHIhWx4r+Y6p0WiN7bHlvTrgXPt55es3gZUEMS9hU9xFmvY4wTmWpBd7UdfvLxUL+h4Hw3f6GZD5BkhYrjOr4juvVdHAmqBKYw/xoW8ShxOck9oBV897bETY1c3dk0N9OjqGu4BumbfUmixZ5xQjcEYIP3cWL1BO56+xYMFOWxB9cWk8ae/CPQQi1FffwivxllWpPECRv9o6KyAzqgrTLuJPcVSQdqldd4tCJSU0kHv/e300AVJZtg70yD7MCAwEAAaMyMDAwHQYDVR0OBBYEFLU0Q9c5LNTkXI5WjAt0mzl2hMwfMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBAFHr4hVgpandM+0AiCyXl9DosOuW4my2BaDqjISsR8/E6yy+RrHidE4m/P99tHlW8PkB0564CzgGC25SX8vDnJuGnzMCjOLdunVObNOj/ZOHRQMK2r0Eax8q0R5/57V5kmwOkxJIfqBQdg7R2ikiLc0t0JH3z5uIU8hG+0fHlR/dlFKxGB1LAXqndF4N02bomYrPkwcRB4S2Avp9BPcEEHuHWSKHyCp7YAuY/xPp+YUgRJdAUTRPhF5Mm9+mQa3A7/mw8RhMAX2nsWRmF4+Ag/s7Ca+WMsNZ1iTkef0tSViNaqP8Ab99NTW90kVzUmhNNEvHA4ohd60XwMolmI0+ZwdvVzhuPI6MK8bNV0XK9dY1NEyPz0b3X85LavDHiZLpNH9gR0VMfmHCQ0yVg2VNjwHFREBa7esnv48NhUTZKjTDLEMst6HdTp2Mskoi3/Cus1Ao8PjRfJLm8Fs2IXyoshStth29EHtZW2TbbiHUQQu+R8WWFXh5E7KL9HGurw0L0Rya470vjJRlYm043tu4quqBsMdf3e0ko5/sQBweJSDZN17eVKXLSWvRZI1GYXuvTTPITVCkarPy14fjIC9+51DFFw9EPyVKiFMsj5/5Ea0GlIbOxxP6PuV8nAn1wqIy4CDMtYTC3dt5P5eivh4d3xFNsYQ0ecSY/P/gXIuQlJOY"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.2918490153.0000000000720000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000002.1672389499.0000000002781000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000002.00000002.2922324215.00000000033A6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000002.00000002.2922324215.0000000003111000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000002.00000002.2918490153.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000002.1672479758.0000000004184000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000002.1672479758.0000000003784000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: STlUEqhwpx.exe PID: 7264	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: RegAsm.exe PID: 7296	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.STlUEqhwpx.exe.3aa29a0.1.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
0.2.STlUEqhwpx.exe.3dbfdd0.0.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
0.2.STlUEqhwpx.exe.3aa29a0.1.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28d113:$x1: Quasar.Common.Messages 0x29d43c:$x1: Quasar.Common.Messages 0x2a99f6:$x4: Uninstalling... good bye :-( 0x2ab1eb:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
0.2.STlUEqhwpx.exe.3dbfdd0.0.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28d113:$x1: Quasar.Common.Messages 0x29d43c:$x1: Quasar.Common.Messages 0x2a99f6:$x4: Uninstalling... good bye :-( 0x2ab1eb:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
0.2.STlUEqhwpx.exe.3aa29a0.1.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2a8fa8:$f1: FileZilla\recentservers.xml 0x2a8fe8:$f2: FileZilla\sitemanager.xml 0x2a902a:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2a9276:$b1: Chrome\User Data\ 0x2a92cc:$b1: Chrome\User Data\ 0x2a95a4:$b2: Mozilla\Firefox\Profiles 0x2a96a0:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fb624:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2a97f8:$b4: Opera Software\Opera Stable\Login Data 0x2a98b2:$b5: YandexBrowser\User Data\ 0x2a9920:$b5: YandexBrowser\User Data\ 0x2a95f4:$s4: logins.json 0x2a932a:$a1: username_value 0x2a9348:$a2: password_value 0x2a9634:$a3: encryptedUsername 0x2fb568:$a3: encryptedUsername 0x2a9658:$a4: encryptedPassword 0x2fb586:$a4: encryptedPassword 0x2fb504:$a5: httpRealm
0.2.STlUEqhwpx.exe.3aa29a0.1.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x163116:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2a9ae0:$s3: Process already elevated. 0x28ce12:$s4: get_PotentiallyVulnerablePasswords 0x276ece:$s5: GetKeyloggerLogsDirectory 0x29cb9b:$s5: GetKeyloggerLogsDirectory 0x28ce35:$s6: set_PotentiallyVulnerablePasswords 0x2fcc52:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
0.2.STlUEqhwpx.exe.3dbfdd0.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2a8fa8:$f1: FileZilla\recentservers.xml 0x2a8fe8:$f2: FileZilla\sitemanager.xml 0x2a902a:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2a9276:$b1: Chrome\User Data\ 0x2a92cc:$b1: Chrome\User Data\ 0x2a95a4:$b2: Mozilla\Firefox\Profiles 0x2a96a0:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fb624:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2a97f8:$b4: Opera Software\Opera Stable\Login Data 0x2a98b2:$b5: YandexBrowser\User Data\ 0x2a9920:$b5: YandexBrowser\User Data\ 0x2a95f4:$s4: logins.json 0x2a932a:$a1: username_value 0x2a9348:$a2: password_value 0x2a9634:$a3: encryptedUsername 0x2fb568:$a3: encryptedUsername 0x2a9658:$a4: encryptedPassword 0x2fb586:$a4: encryptedPassword 0x2fb504:$a5: httpRealm
0.2.STlUEqhwpx.exe.3dbfdd0.0.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x163116:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2a9ae0:$s3: Process already elevated. 0x28ce12:$s4: get_PotentiallyVulnerablePasswords 0x276ece:$s5: GetKeyloggerLogsDirectory 0x29cb9b:$s5: GetKeyloggerLogsDirectory 0x28ce35:$s6: set_PotentiallyVulnerablePasswords 0x2fcc52:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
0.2.STlUEqhwpx.exe.3dbfdd0.0.raw.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
0.2.STlUEqhwpx.exe.3dbfdd0.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.STlUEqhwpx.exe.3dbfdd0.0.raw.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28ef13:$x1: Quasar.Common.Messages 0x29f23c:$x1: Quasar.Common.Messages 0x2ab7f6:$x4: Uninstalling... good bye :-( 0x2acfeb:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
0.2.STlUEqhwpx.exe.3dbfdd0.0.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aada8:$f1: FileZilla\recentservers.xml 0x2aade8:$f2: FileZilla\sitemanager.xml 0x2aae2a:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab076:$b1: Chrome\User Data\ 0x2ab0cc:$b1: Chrome\User Data\ 0x2ab3a4:$b2: Mozilla\Firefox\Profiles 0x2ab4a0:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fd424:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ab5f8:$b4: Opera Software\Opera Stable\Login Data 0x2ab6b2:$b5: YandexBrowser\User Data\ 0x2ab720:$b5: YandexBrowser\User Data\ 0x2ab3f4:$s4: logins.json 0x2ab12a:$a1: username_value 0x2ab148:$a2: password_value 0x2ab434:$a3: encryptedUsername 0x2fd368:$a3: encryptedUsername 0x2ab458:$a4: encryptedPassword 0x2fd386:$a4: encryptedPassword 0x2fd304:$a5: httpRealm
0.2.STlUEqhwpx.exe.3dbfdd0.0.raw.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x164f16:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ab8e0:$s3: Process already elevated. 0x28ec12:$s4: get_PotentiallyVulnerablePasswords 0x278cce:$s5: GetKeyloggerLogsDirectory 0x29e99b:$s5: GetKeyloggerLogsDirectory 0x28ec35:$s6: set_PotentiallyVulnerablePasswords 0x2fea52:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
2.2.RegAsm.exe.400000.0.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
2.2.RegAsm.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.RegAsm.exe.400000.0.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28ef13:$x1: Quasar.Common.Messages 0x29f23c:$x1: Quasar.Common.Messages 0x2ab7f6:$x4: Uninstalling... good bye :-( 0x2acfeb:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
2.2.RegAsm.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aada8:$f1: FileZilla\recentservers.xml 0x2aade8:$f2: FileZilla\sitemanager.xml 0x2aae2a:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab076:$b1: Chrome\User Data\ 0x2ab0cc:$b1: Chrome\User Data\ 0x2ab3a4:$b2: Mozilla\Firefox\Profiles 0x2ab4a0:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fd424:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ab5f8:$b4: Opera Software\Opera Stable\Login Data 0x2ab6b2:$b5: YandexBrowser\User Data\ 0x2ab720:$b5: YandexBrowser\User Data\ 0x2ab3f4:$s4: logins.json 0x2ab12a:$a1: username_value 0x2ab148:$a2: password_value 0x2ab434:$a3: encryptedUsername 0x2fd368:$a3: encryptedUsername 0x2ab458:$a4: encryptedPassword 0x2fd386:$a4: encryptedPassword 0x2fd304:$a5: httpRealm
2.2.RegAsm.exe.400000.0.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x164f16:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ab8e0:$s3: Process already elevated. 0x28ec12:$s4: get_PotentiallyVulnerablePasswords 0x278cce:$s5: GetKeyloggerLogsDirectory 0x29e99b:$s5: GetKeyloggerLogsDirectory 0x28ec35:$s6: set_PotentiallyVulnerablePasswords 0x2fea52:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
0.2.STlUEqhwpx.exe.3aa29a0.1.raw.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
0.2.STlUEqhwpx.exe.3aa29a0.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.STlUEqhwpx.exe.3aa29a0.1.raw.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28ef13:$x1: Quasar.Common.Messages 0x29f23c:$x1: Quasar.Common.Messages 0x5ac343:$x1: Quasar.Common.Messages 0x5bc66c:$x1: Quasar.Common.Messages 0x2ab7f6:$x4: Uninstalling... good bye :-( 0x5c8c26:$x4: Uninstalling... good bye :-( 0x2acfeb:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ... 0x5ca41b:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
0.2.STlUEqhwpx.exe.3aa29a0.1.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aada8:$f1: FileZilla\recentservers.xml 0x5c81d8:$f1: FileZilla\recentservers.xml 0x2aade8:$f2: FileZilla\sitemanager.xml 0x5c8218:$f2: FileZilla\sitemanager.xml 0x2aae2a:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x5c825a:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab076:$b1: Chrome\User Data\ 0x2ab0cc:$b1: Chrome\User Data\ 0x5c84a6:$b1: Chrome\User Data\ 0x5c84fc:$b1: Chrome\User Data\ 0x2ab3a4:$b2: Mozilla\Firefox\Profiles 0x5c87d4:$b2: Mozilla\Firefox\Profiles 0x2ab4a0:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fd424:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x5c88d0:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x61a854:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ab5f8:$b4: Opera Software\Opera Stable\Login Data 0x5c8a28:$b4: Opera Software\Opera Stable\Login Data 0x2ab6b2:$b5: YandexBrowser\User Data\ 0x2ab720:$b5: YandexBrowser\User Data\ 0x5c8ae2:$b5: YandexBrowser\User Data\
0.2.STlUEqhwpx.exe.3aa29a0.1.raw.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x164f16:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x482346:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ab8e0:$s3: Process already elevated. 0x5c8d10:$s3: Process already elevated. 0x28ec12:$s4: get_PotentiallyVulnerablePasswords 0x5ac042:$s4: get_PotentiallyVulnerablePasswords 0x278cce:$s5: GetKeyloggerLogsDirectory 0x29e99b:$s5: GetKeyloggerLogsDirectory 0x5960fe:$s5: GetKeyloggerLogsDirectory 0x5bbdcb:$s5: GetKeyloggerLogsDirectory 0x28ec35:$s6: set_PotentiallyVulnerablePasswords 0x5ac065:$s6: set_PotentiallyVulnerablePasswords 0x2fea52:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues> 0x61be82:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>
Click to see the 18 entries

Suricata Signatures

ET MALWARE Generic AsyncRAT Style SSL Cert

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T00:08:00.035013+0200	2035595	1	Domain Observed Used for C2 Detected	165.22.194.189	5613	192.168.2.4	49730	TCP

ET MALWARE Observed Malicious SSL Cert (Quasar CnC)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T00:08:00.035013+0200	2027619	1	Domain Observed Used for C2 Detected	165.22.194.189	5613	192.168.2.4	49730	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: STlUEqhwpx.exe

Avira: detected

Found malware configuration

Source: 0.2.STlUEqhwpx.exe.3dbfdd0.0.raw.unpack

Malware Configuration Extractor: Quasar {"Version": "1.4.1", "Host:Port": "165.22.194.189:5613;", "SubDirectory": "SubDir", "InstallName": "Client.exe", "MutexName": "2bdefbcb-91d1-48c0-8f2f-5de6eed0f91f", "StartupKey": "Quasar Client Startup", "LogDirectoryName": "Logs", "ServerSignature": "BEptALBhH5iqs6kuwXGFbjWTfhmu3jqDNxidblxNc7YNmZ1dcYk8+am/FW8Q8CaWGmDYsZgofDY9/EkmkR9twEqN2zJXxlk/IAyFVeplXHr1ASrzJw1fjLWkYnnvYaUnCpnlnTqiwp5G6eNHC05biuc2lmE288xAjlH4KS5cqmzLqxQXtC55kZE/UNkS1SutybT2XAIuZLGkvnnIWBgPaoO40hRViMu0Df4FTh/Kx+kyqlCW96IYdV6ep3eZR7p/EW0DoOVPRlZKADarQr3MGVyPFckBFhHsd4H9ChC2wtP4/ncJpbZ5HJogXkP1t6FMsecwFhJX0BGigE7sGLlQNwYbR8ZKe44AtguZUnHfKrJPOns+LObM9QTsfR77fOfCXBvmAGlWIWkvZbaZSZTDgXsiyIcsJJF3kHJaYAq+pq0S5fVbTc4JQ6z6kXsdk4Dk7MmsxaRecNcH27oCosU4V6kuAONgww2crG61ocYtNQ2qtwPvbFPVWg8L5uVKfXw1rYxCtpWNZQWdnz8FBn3UBRS2ytU+in1uLJlxgLdeww8I/AF/yJrxTGZYwwAneiC6AQ9FQCgF4ozJBNa6P1u7pJZYPZjIKX+zKRYGAUBfJH4DqyV6gEeDO262Y15PZ8yxeqLMWo072K4VH4Q/PmzwHWwxqU+Xb8D4CvbjxVqBLz8=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQAJG/dLBFXHlkEi08lEISZTANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI0MDkyOTA1NDczOVoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAhlizYr3H9pDXXpfhAUm/Ps9PkjoUjbktI1Esb5628jdrNnufpWksSb+sl0YI/ru1hyfa43QrdoHV89W0kMXEgrGuR4qBaDQGdKlBQl2a6N0ufqoLiNshG0D7peW24ykLN4pwC2Mt4gLgyZvyKilv4fljl8pzpoHcZDt5vTaFGvAZM58kHKwogJ5DLBXiFy8dL0H2o/AZ0Cwcjl5oPuuQPhot752WlwfyVWWjc5hIZ72JKn4WrieBXlr9ndlOcOAqvzaTfFHC3qXR9J3L1uazTawTYqiVuypX6hsL5z+YTWfnAz5ssoFQo3p3g0RNGFB85UDQbWWL/RxcQ2zd2MfuhaUaIf2Kls3gzUxwJf1Sla7F+YkH9jq9f/grm+Clk4O72dvh/oHE/B+dJkJ0twNpVR6fLMomn1qJWy2ig5BdfoZFHDidHIhWx4r+Y6p0WiN7bHlvTrgXPt55es3gZUEMS9hU9xFmvY4wTmWpBd7UdfvLxUL+h4Hw3f6GZD5BkhYrjOr4juvVdHAmqBKYw/xoW8ShxOck9oBV897bETY1c3dk0N9OjqGu4BumbfUmixZ5xQjcEYIP3cWL1BO56+xYMFOWxB9cWk8ae/CPQQi1FffwivxllWpPECRv9o6KyAzqgrTLuJPcVSQdqldd4tCJSU0kHv/e300AVJZtg70yD7MCAwEAAaMyMDAwHQYDVR0OBBYEFLU0Q9c5LNTkXI5WjAt0mzl2hMwfMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBAFHr4hVgpandM+0AiCyXl9DosOuW4my2BaDqjISsR8/E6yy+RrHidE4m/P99tHlW8PkB0564CzgGC25SX8vDnJuGnzMCjOLdunVObNOj/ZOHRQMK2r0Eax8q0R5/57V5kmwOkxJIfqBQdg7R2ikiLc0t0JH3z5uIU8hG+0fHlR/dlFKxGB1LAXqndF4N02bomYrPkwcRB4S2Avp9BPcEEHuHWSKHyCp7YAuY/xPp+YUgRJdAUTRPhF5Mm9+mQa3A7/mw8RhMAX2nsWRmF4+Ag/s7Ca+WMsNZ1iTkef0tSViNaqP8Ab99NTW90kVzUmhNNEvHA4ohd60XwMolmI0+ZwdvVzhuPI6MK8bNV0XK9dY1NEyPz0b3X85LavDHiZLpNH9gR0VMfmHCQ0yVg2VNjwHFREBa7esnv48NhUTZKjTDLEMst6HdTp2Mskoi3/Cus1Ao8PjRfJLm8Fs2IXyoshStth29EHtZW2TbbiHUQQu+R8WWFXh5E7KL9HGurw0L0Rya470vjJRlYm043tu4quqBsMdf3e0ko5/sQBweJSDZN17eVKXLSWvRZI1GYXuvTTPITVCkarPy14fjIC9+51DFFw9EPyVKiFMsj5/5Ea0GlIbOxxP6PuV8nAn1wqIy4CDMtYTC3dt5P5eivh4d3xFNsYQ0ecSY/P/gXIuQlJOY"}

Multi AV Scanner detection for submitted file

Source: STlUEqhwpx.exe

ReversingLabs: Detection: 79%

Yara detected Quasar RAT

Source: Yara match	File source: 0.2.STlUEqhwpx.exe.3aa29a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.STlUEqhwpx.exe.3dbfdd0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.STlUEqhwpx.exe.3dbfdd0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.STlUEqhwpx.exe.3aa29a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2918490153.0000000000720000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1672389499.0000000002781000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2922324215.00000000033A6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2922324215.0000000003111000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2918490153.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1672479758.0000000004184000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1672479758.0000000003784000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: STlUEqhwpx.exe PID: 7264, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7296, type: MEMORYSTR

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: STlUEqhwpx.exe

Joe Sandbox ML: detected

Source: STlUEqhwpx.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 195.201.57.90:443 -> 192.168.2.4:49732 version: TLS 1.2

Source: STlUEqhwpx.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2027619 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (Quasar CnC) : 165.22.194.189:5613 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2035595 - Severity 1 - ET MALWARE Generic AsyncRAT Style SSL Cert : 165.22.194.189:5613 -> 192.168.2.4:49730

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 165.22.194.189

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.STlUEqhwpx.exe.3dbfdd0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.STlUEqhwpx.exe.3aa29a0.1.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 165.22.194.189:5613

Source: Joe Sandbox View	IP Address: 195.201.57.90 195.201.57.90
Source: Joe Sandbox View	IP Address: 195.201.57.90 195.201.57.90

Source: Joe Sandbox View

ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: ipwho.is

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.194.189
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.194.189
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.194.189
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.194.189
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.194.189
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.194.189
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.194.189
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.194.189
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.194.189
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.194.189
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.194.189
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.194.189
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.194.189
Source: unknown	TCP traffic detected without corresponding DNS query: 165.22.194.189
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: ipwho.is

Source: RegAsm.exe, 00000002.00000002.2926778262.0000000005931000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mi
Source: RegAsm.exe, 00000002.00000002.2920963808.00000000012D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: RegAsm.exe, 00000002.00000002.2920591615.0000000001271000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: RegAsm.exe, 00000002.00000002.2926778262.000000000593E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab4&Z
Source: RegAsm.exe, 00000002.00000002.2920591615.0000000001271000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabn
Source: RegAsm.exe, 00000002.00000002.2920963808.00000000012D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enE
Source: RegAsm.exe, 00000002.00000002.2922324215.000000000335A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ipwho.is
Source: RegAsm.exe, 00000002.00000002.2922324215.000000000335A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ipwho.isd
Source: RegAsm.exe, 00000002.00000002.2922324215.00000000033A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: RegAsm.exe, 00000002.00000002.2922324215.00000000033A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/d
Source: RegAsm.exe, 00000002.00000002.2922324215.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: STlUEqhwpx.exe, 00000000.00000002.1672479758.0000000004184000.00000004.00000800.00020000.00000000.sdmp, STlUEqhwpx.exe, 00000000.00000002.1672479758.0000000003784000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2918490153.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: RegAsm.exe, 00000002.00000002.2922324215.0000000003347000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipwho.is
Source: STlUEqhwpx.exe, 00000000.00000002.1672479758.0000000004184000.00000004.00000800.00020000.00000000.sdmp, STlUEqhwpx.exe, 00000000.00000002.1672479758.0000000003784000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2918490153.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2922324215.0000000003347000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipwho.is/
Source: STlUEqhwpx.exe, 00000000.00000002.1672479758.0000000004184000.00000004.00000800.00020000.00000000.sdmp, STlUEqhwpx.exe, 00000000.00000002.1672479758.0000000003784000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2918490153.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: STlUEqhwpx.exe, 00000000.00000002.1672479758.0000000004184000.00000004.00000800.00020000.00000000.sdmp, STlUEqhwpx.exe, 00000000.00000002.1672479758.0000000003784000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2918490153.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2922324215.0000000003197000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: STlUEqhwpx.exe, 00000000.00000002.1672479758.0000000004184000.00000004.00000800.00020000.00000000.sdmp, STlUEqhwpx.exe, 00000000.00000002.1672479758.0000000003784000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2918490153.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354sCannot

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443

Source: unknown

HTTPS traffic detected: 195.201.57.90:443 -> 192.168.2.4:49732 version: TLS 1.2

E-Banking Fraud

Yara detected Quasar RAT

Source: Yara match	File source: 0.2.STlUEqhwpx.exe.3aa29a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.STlUEqhwpx.exe.3dbfdd0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.STlUEqhwpx.exe.3dbfdd0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.STlUEqhwpx.exe.3aa29a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2918490153.0000000000720000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1672389499.0000000002781000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2922324215.00000000033A6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2922324215.0000000003111000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2918490153.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1672479758.0000000004184000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1672479758.0000000003784000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: STlUEqhwpx.exe PID: 7264, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7296, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.STlUEqhwpx.exe.3aa29a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 0.2.STlUEqhwpx.exe.3dbfdd0.0.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 0.2.STlUEqhwpx.exe.3aa29a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.2.STlUEqhwpx.exe.3aa29a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 0.2.STlUEqhwpx.exe.3dbfdd0.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.2.STlUEqhwpx.exe.3dbfdd0.0.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 0.2.STlUEqhwpx.exe.3dbfdd0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 0.2.STlUEqhwpx.exe.3dbfdd0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.2.STlUEqhwpx.exe.3dbfdd0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 0.2.STlUEqhwpx.exe.3aa29a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 0.2.STlUEqhwpx.exe.3aa29a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.2.STlUEqhwpx.exe.3aa29a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_02F4F03C	2_2_02F4F03C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_07C89980	2_2_07C89980
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_07C860E8	2_2_07C860E8

Source: STlUEqhwpx.exe

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: STlUEqhwpx.exe, 00000000.00000002.1672479758.0000000004184000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClient.exe. vs STlUEqhwpx.exe
Source: STlUEqhwpx.exe, 00000000.00000002.1670228558.000000000084E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs STlUEqhwpx.exe
Source: STlUEqhwpx.exe, 00000000.00000002.1672479758.0000000003784000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClient.exe. vs STlUEqhwpx.exe
Source: STlUEqhwpx.exe, 00000000.00000002.1672389499.0000000002781000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClient.exe. vs STlUEqhwpx.exe
Source: STlUEqhwpx.exe	Binary or memory string: OriginalFilenameruns1.exe4 vs STlUEqhwpx.exe

Source: STlUEqhwpx.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.STlUEqhwpx.exe.3aa29a0.1.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 0.2.STlUEqhwpx.exe.3dbfdd0.0.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 0.2.STlUEqhwpx.exe.3aa29a0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.2.STlUEqhwpx.exe.3aa29a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 0.2.STlUEqhwpx.exe.3dbfdd0.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.2.STlUEqhwpx.exe.3dbfdd0.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 0.2.STlUEqhwpx.exe.3dbfdd0.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 0.2.STlUEqhwpx.exe.3dbfdd0.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.2.STlUEqhwpx.exe.3dbfdd0.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 0.2.STlUEqhwpx.exe.3aa29a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 0.2.STlUEqhwpx.exe.3aa29a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.2.STlUEqhwpx.exe.3aa29a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer

Source: STlUEqhwpx.exe, by-unknown-------------------------.cs

Base64 encoded string: 'QzpcV2luZG93c1xNaWNyb3NvZnQuTkVUXEZyYW1ld29ya1x2NC4wLjMwMzE5XFJlZ0FzbS5leGU='

Source: classification engine

Classification label: mal100.troj.evad.winEXE@5/3@1/2

Source: C:\Users\user\Desktop\STlUEqhwpx.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\STlUEqhwpx.exe.log

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\2bdefbcb-91d1-48c0-8f2f-5de6eed0f91f

Source: STlUEqhwpx.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: STlUEqhwpx.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\STlUEqhwpx.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: STlUEqhwpx.exe

ReversingLabs: Detection: 79%

Source: unknown	Process created: C:\Users\user\Desktop\STlUEqhwpx.exe "C:\Users\user\Desktop\STlUEqhwpx.exe"
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #system32
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #system32
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #system32	Jump to behavior
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #system32	Jump to behavior

Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior

Source: STlUEqhwpx.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: STlUEqhwpx.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: STlUEqhwpx.exe

Static file information: File size 3309568 > 1048576

Source: STlUEqhwpx.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x327600

Source: STlUEqhwpx.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_07C86C62 push 0000005Eh; iretd

2_2_07C86CD6

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Memory allocated: 2570000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Memory allocated: 2780000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Memory allocated: 25B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2E60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 3110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2E60000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\STlUEqhwpx.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 458			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 738			Jump to behavior

Source: C:\Users\user\Desktop\STlUEqhwpx.exe TID: 7284	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7372	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\STlUEqhwpx.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: RegAsm.exe, 00000002.00000002.2920963808.00000000012D9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2933816999.0000000006D80000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2926778262.0000000005963000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\STlUEqhwpx.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\STlUEqhwpx.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: STlUEqhwpx.exe, by-unknown-------------------------.cs	Reference to suspicious API methods: ReadProcessMemory(by_002Dunknown_26A7_FFFD_FFFD_FFFD_2642_FFFD_FE0F_FFFD_D83D_DD35_D83D_DD14_D83E_DE33_FFFD_FFFD_FFFD_FE0F_200D_FFFD_D83D_DEA0_FFFD_FFFD_FFFD.ProcessHandle, num3 + 4 + 4, ref by_002Dunknown_FFFD_D83D_DF2B_FFFD_FFFD_FFFD_200D_FFFD_FFFD_D83E_DCA3_26A7_FFFD_FE0F_200D_FFFD_D83D_DC98_D83D_DCAB_FFFD_FFFD_FFFD_200D_FFFD, 4, ref by_002Dunknown_26A7_FE0F_FE0F_FFFD_FFFD_FFFD_FFFD_FE0F_FFFD_FFFD_FFFD_FE0F_2642_FFFD_FFFD_D83E_DD74_FFFD_FFFD_FE0F_FFFD_FFFD_200D_FFFD_FFFD)
Source: STlUEqhwpx.exe, by-unknown-------------------------.cs	Reference to suspicious API methods: VirtualAllocEx(by_002Dunknown_26A7_FFFD_FFFD_FFFD_2642_FFFD_FE0F_FFFD_D83D_DD35_D83D_DD14_D83E_DE33_FFFD_FFFD_FFFD_FE0F_200D_FFFD_D83D_DEA0_FFFD_FFFD_FFFD.ProcessHandle, num2, num4, 12288, 64)
Source: STlUEqhwpx.exe, by-unknown-------------------------.cs	Reference to suspicious API methods: WriteProcessMemory(by_002Dunknown_26A7_FFFD_FFFD_FFFD_2642_FFFD_FE0F_FFFD_D83D_DD35_D83D_DD14_D83E_DE33_FFFD_FFFD_FFFD_FE0F_200D_FFFD_D83D_DEA0_FFFD_FFFD_FFFD.ProcessHandle, num6, by_002Dunknown_FFFD_200D_200D_FFFD_FFFD_FFFD_D83D_DEA0_FFFD_FFFD_FFFD_D83C_DD70_FFFD_FFFD_FFFD_200D_FFFD_FE0F_200D_FFFD_FFFD_200D_D83C_DCA3, num5, ref by_002Dunknown_26A7_FE0F_FE0F_FFFD_FFFD_FFFD_FFFD_FE0F_FFFD_FFFD_FFFD_FE0F_2642_FFFD_FFFD_D83E_DD74_FFFD_FFFD_FE0F_FFFD_FFFD_200D_FFFD_FFFD)

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\STlUEqhwpx.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\STlUEqhwpx.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 720000	Jump to behavior
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 722000	Jump to behavior
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: E2F008	Jump to behavior

Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #system32			Jump to behavior
Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe #system32			Jump to behavior

Source: C:\Users\user\Desktop\STlUEqhwpx.exe	Queries volume information: C:\Users\user\Desktop\STlUEqhwpx.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\STlUEqhwpx.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Quasar RAT

Source: Yara match	File source: 0.2.STlUEqhwpx.exe.3aa29a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.STlUEqhwpx.exe.3dbfdd0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.STlUEqhwpx.exe.3dbfdd0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.STlUEqhwpx.exe.3aa29a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2918490153.0000000000720000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1672389499.0000000002781000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2922324215.00000000033A6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2922324215.0000000003111000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2918490153.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1672479758.0000000004184000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1672479758.0000000003784000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: STlUEqhwpx.exe PID: 7264, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7296, type: MEMORYSTR

Remote Access Functionality

Yara detected Quasar RAT

Source: Yara match	File source: 0.2.STlUEqhwpx.exe.3aa29a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.STlUEqhwpx.exe.3dbfdd0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.STlUEqhwpx.exe.3dbfdd0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.STlUEqhwpx.exe.3aa29a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2918490153.0000000000720000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1672389499.0000000002781000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2922324215.00000000033A6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2922324215.0000000003111000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2918490153.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1672479758.0000000004184000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1672479758.0000000003784000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: STlUEqhwpx.exe PID: 7264, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7296, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	311 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Hidden Files and Directories	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	113 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Obfuscated Files or Information	Cached Domain Credentials	23 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
STlUEqhwpx.exe	79%	ReversingLabs	ByteCode-MSIL.Hacktool.ResInject
STlUEqhwpx.exe	100%	Avira	TR/Dropper.Gen
STlUEqhwpx.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
https://stackoverflow.com/q/14436606/23354	0%	URL Reputation	safe
https://stackoverflow.com/q/11564914/23354;	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ipwho.is	195.201.57.90	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
165.22.194.189	true		unknown
https://ipwho.is/	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	STlUEqhwpx.exe, 00000000.00000002.1672479758.0000000004184000.00000004.00000800.00020000.00000000.sdmp, STlUEqhwpx.exe, 00000000.00000002.1672479758.0000000003784000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2918490153.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.datacontract.org/2004/07/d	RegAsm.exe, 00000002.00000002.2922324215.00000000033A6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://stackoverflow.com/q/14436606/23354	STlUEqhwpx.exe, 00000000.00000002.1672479758.0000000004184000.00000004.00000800.00020000.00000000.sdmp, STlUEqhwpx.exe, 00000000.00000002.1672479758.0000000003784000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2918490153.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2922324215.0000000003197000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.micro	RegAsm.exe, 00000002.00000002.2920963808.00000000012D9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.datacontract.org/2004/07/	RegAsm.exe, 00000002.00000002.2922324215.00000000033A6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://stackoverflow.com/q/11564914/23354;	STlUEqhwpx.exe, 00000000.00000002.1672479758.0000000004184000.00000004.00000800.00020000.00000000.sdmp, STlUEqhwpx.exe, 00000000.00000002.1672479758.0000000003784000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2918490153.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ipwho.isd	RegAsm.exe, 00000002.00000002.2922324215.000000000335A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ipwho.is	RegAsm.exe, 00000002.00000002.2922324215.0000000003347000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://stackoverflow.com/q/2152978/23354sCannot	STlUEqhwpx.exe, 00000000.00000002.1672479758.0000000004184000.00000004.00000800.00020000.00000000.sdmp, STlUEqhwpx.exe, 00000000.00000002.1672479758.0000000003784000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2918490153.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegAsm.exe, 00000002.00000002.2922324215.0000000003111000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ipwho.is	RegAsm.exe, 00000002.00000002.2922324215.000000000335A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://crl.mi	RegAsm.exe, 00000002.00000002.2926778262.0000000005931000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
165.22.194.189	unknown	United States		14061	DIGITALOCEAN-ASNUS	true
195.201.57.90	ipwho.is	Germany		24940	HETZNER-ASDE	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528478
Start date and time:	2024-10-08 00:07:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	STlUEqhwpx.exe renamed because original name is a hash value
Original Sample Name:	0a8cfbcfffa98cb54b6746fec4981101.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@5/3@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 60 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 93.184.221.240
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: STlUEqhwpx.exe

Simulations

Behavior and APIs

Time	Type	Description
18:08:00	API Interceptor	1x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
195.201.57.90	SPt4FUjZMt.exe	Get hash	malicious	AsyncRAT, Luca Stealer, MicroClip, PythonCryptoHijacker, RedLine	Browse	/?output=json
	765iYbgWn9.exe	Get hash	malicious	Luca Stealer	Browse	/?output=json
	765iYbgWn9.exe	Get hash	malicious	Luca Stealer	Browse	/?output=json
	WfKynArKjH.exe	Get hash	malicious	AsyncRAT, Luca Stealer, MicroClip, RedLine	Browse	/?output=json
	ubes6SC7Vd.exe	Get hash	malicious	Unknown	Browse	ipwhois.app/xml/
	cOQD62FceM.exe	Get hash	malicious	Luca Stealer, Rusty Stealer	Browse	/?output=json
	Clipper.exe	Get hash	malicious	Unknown	Browse	/?output=json
	cOQD62FceM.exe	Get hash	malicious	Luca Stealer	Browse	/?output=json
	Cryptor.exe	Get hash	malicious	Luca Stealer	Browse	/?output=json
	Cryptor.exe	Get hash	malicious	Luca Stealer, Rusty Stealer	Browse	/?output=json

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipwho.is	https://thiiirrrrddddddd-30x.pages.dev/	Get hash	malicious	TechSupportScam	Browse	195.201.57.90
	https://2204three.pages.dev/	Get hash	malicious	TechSupportScam	Browse	195.201.57.90
	sj9eYmr725.exe	Get hash	malicious	Quasar	Browse	108.181.98.179
	payload.cmd	Get hash	malicious	Unknown	Browse	195.201.57.90
	1 (2).cmd	Get hash	malicious	Unknown	Browse	195.201.57.90
	rbx-CO2.bat	Get hash	malicious	Unknown	Browse	147.135.36.89
	SC.cmd	Get hash	malicious	Unknown	Browse	195.201.57.90
	1.cmd	Get hash	malicious	Unknown	Browse	108.181.98.179
	2.cmd	Get hash	malicious	Unknown	Browse	195.201.57.90
	download_2.exe	Get hash	malicious	Quasar	Browse	147.135.36.89

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DIGITALOCEAN-ASNUS	https://statics.teams.cdn.office.net/evergreen-assets/safelinks/1/atp-safelinks.html?url=https%3A%2F%2Fphpstack-1335745-4931432.cloudwaysapps.com%2F%23%26%26%2B~XanJlZEBwcm9hZy5jb20=&locale=en-us&dest=https%3A%2F%2Fteams.microsoft.com%2Fapi%2Fmt%2Fpart%2Famer-03%2Fbeta%2Fatpsafelinks%2Fgeturlreputationsitev2%2F&pc=dqIG3sYngZE8N2eRBkF7CAkOWKg5g3tGjnQGJGQlc61U8QGlKCs5AzH6JKtW7FyetS1g5oEXSNBKJVlJbTCgrea0O041dBSjafsPfOc5KxbMkQRnpwalZQdhHfcjoeWL7rzuDGG%252fj2e7scaAUTCy2PY0WmBb87rgNNPdmEQne%252f00jq9aOpwCvhJrGkNK5f8MP5jaUwccFhr9IIoVaCOrXUhSnuRv%252fw%252bxhUGpneOsAgBs7CjJQbmepBIHfEqwCkqvDbYbxYB4Hm9sLVAOFaz9VFMFSXPJt4MqeWAChikWLAZATmvniptR3h97WVF%252fZtjtm3RxdNyPROzhUvL92w9fdWmSw%252bHBxn5rMHOUpaQU16ZpcfATiVaU51fqKaYO2v4ZnK7axAavLgOpgAJivuE6JO2sqksPH41Z6PVam5c4J%252bwwz5Z2pqrOSxPxEcPGeDff%252bxp9PApNxpvURRLl98WzRw%252ftZEOu%252foKPhjN0OiTGAQDLRWTF%252bMCzSQg37tk7ZYUYYc0Ycs4xDjchhFprJCCSfrZ8WyHq6cjqmnbgDKRQig28xGNFnSDEeWMDBQeeeVyNqDv0FAAxkSAMO%252b7t4Qu1y0h0MHJYEb5pxfOYe8Pyfcsn7pyR%252fkKEqziEQVGlIETrpjVMNyrhJrnX9S%252flWaxf0H3tD%252fqMhzPysO9QdPSJTG054WE4jq5GRqTKu8P25t4KJLY15Oz2j5iCg7Bd5lczhgv4PQevplLuCGckM%252fs5EPk2r2FkSOxHF51EB5FR2TgXQR5UAp2BbaWTm9irKwSSUK5z1MsGMDokVMEB4bQ9mpZrl1%252bDMixJ1mQyyLXpelmEyN8zw1nTsbXAvDQgIvPLPj0QUtphEMnmVEXMkQHiw2WHWUSxIxYcY%252fltyp6bnMrankPAnpChbWQmk95rKsUz8tqtLjNDclK1y1FLy%252fh7sed9duxDDFupXnhmXxGJOmUV6FG1arxXL8urm1F98thG8anfchv3DafKsyVHHgmdUFNH6Uhcu4sB8fo0kqm2y7IWS96w5BeG334JvnFDJPLDPvtK5ojeXfDXh%252boKJdBxXGC9NmPwgDp8XeOavQnNlJRfUAXkhukdjDg1EHGF%252b9luUuTH%252fEbKHniTzx4OvIWUnDvXcdpuEIAnW8mDJzMXpmxpl3nwtTqeQWMeSNzjute9yTZEU%252beQk498EMyU%252fuPUg%252fSOH5r%252fwjGCsPpm%252f%252bUA00SsNvWuDD0AbNIKYubFuNKQ3SX6N7M11wOksoUG%252fz9IheWtOawwl7F0lqN3xkTQhfiiHovdudAPiB%252fzt25Im27XxPQ9s1c%252bnOWOPh6m%252bvaCQcj6bcwkFbNl5Y1KL7XQvirYSFsNXnrYuQvTPMk1n5CRq6dxsl9FRGV9MMdrZduC%252bG4B0zxLA58d8fTW2zfEXnRcMTgQKLK%252fmeZT7K3wwAvQiA%253d%253d%3B%20expires%3DWed%2C%2009%20Oct%202024%2014%3A05%3A23%20GMT%3B%20path%3D%2F%3B%20SameSite%3DNone%3B%20secu	Get hash	malicious	HTMLPhisher	Browse	138.197.99.28
	na.elf	Get hash	malicious	Unknown	Browse	206.189.6.247
	https://forms.office.com/Pages/ShareFormPage.aspx?id=W8eUhlA4rUOuklSyoCn21mtmgAvPzYFJuSM99R6gX3dUQ1IyWUM1UUhTS1pWQ0xXNkI3RzlRRkFIVi4u&sharetoken=93tGEOrxpFy3X0nnxFcr	Get hash	malicious	HTMLPhisher	Browse	162.243.189.2
	na.elf	Get hash	malicious	Unknown	Browse	206.189.6.247
	na.elf	Get hash	malicious	Unknown	Browse	206.189.6.247
	na.elf	Get hash	malicious	Unknown	Browse	206.189.6.247
	na.elf	Get hash	malicious	Unknown	Browse	206.189.6.247
	na.elf	Get hash	malicious	Unknown	Browse	206.189.6.247
	https://www.masonpost.com:443/cgi-bin/redir?https://ctrk.klclick3.com/l/01J9K8KGETH6JCWEWSWY0Z1M23_0?upn=u001.itvpsDR1UD2k9ruxjm0OAspgqcVOQ2hpn9lpb50VxZJdbi9nOzDV7HSnhKeIcaLQsgzZhAfJ867-2F8IcC-2BBYACBF80J8eA0O7PKeZKrlC1Q54Fj-2FS5ho91OPbLHjsGsZQWTyMbbJfNaQPKh9-2FKW31wr-2BMvAwYD85cdCTmlJyLauY-3D1xqt_Zis0fkz6H88oOTECUjdmAu-2FGkDDLbhQT-2B-2B9-2BD8-2Fn-2BuGRBn47ofPUerdduk-2BghIIr31LJs6iNd0rpuOZI5rlm3TOpkCWZ1eNCAWCuASI4dMP9Tv6jbA2UWTI2YWLmFZqgYeVzSc0Fb4o9iKg-2BzjSlX63m5ZgVPzXZ0W3SrrpOTDVmr8Vwd0xwSjxu9efo9kpJLVs7HOh7Cib6eG0OHldiYrljs5jy-2BsmDgNausa6sMCHSoHHj10FI3IfGuCnAD3e6jEbbsHVD11-2FD9cWADvkKxwETdgNpgixeie55jSwivWDLRKcdIczYG3CyTpA1Y18cj-2FBGLZEHTJvF1rd5yfWClPzV1Xw6x2CQgpVVbtrTE5NXtV8WFomzmraH-2FRE0uCvY#QE5lb19IYWNrZXJAb2ZmaWNlLmNvbQ==	Get hash	malicious	Unknown	Browse	134.209.147.227
	na.elf	Get hash	malicious	Unknown	Browse	162.243.19.47
HETZNER-ASDE	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.ht.zpdzwq?v=frudxdBjlfmjfqymhfwj.ht.pjd.kwjsy___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzpiNGZlZGFhNjcxOTBhYjU4MTE5MjBlZTRiYTAxZmUwMTo3OmIxYWM6MDg1ODNlNjljZDkwNThkM2ZiM2RjYTI4MzFjZGY4NGFmMTYyZTlhYmVjYWYxY2Q4MmNkZDhiNmFmOWVkOWUxOTpoOlQ6VA#Sm9hbi5LbmlwcGVuQEVsa2F5LkNvbQ==	Get hash	malicious	Unknown	Browse	46.4.98.169
	out.exe	Get hash	malicious	Vidar	Browse	49.12.106.214
	down.exe	Get hash	malicious	Unknown	Browse	116.203.9.188
	BzLGqYKy7o.exe	Get hash	malicious	SmokeLoader	Browse	188.40.141.211
	https://cloud.list.lu/index.php/s/znw4dNSttiDzHTB	Get hash	malicious	Unknown	Browse	85.10.195.17
	UV2uLdRZix.exe	Get hash	malicious	SmokeLoader	Browse	188.40.141.211
	PURCHASE ORDER-6350.exe	Get hash	malicious	FormBook	Browse	148.251.114.233
	zncaKWwEdq.exe	Get hash	malicious	Vidar	Browse	116.203.9.188
	LKpIHL2abO.exe	Get hash	malicious	SmokeLoader	Browse	188.40.141.211
	na.elf	Get hash	malicious	Unknown	Browse	116.203.104.203

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	EUYIlr7uUX.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	195.201.57.90
	file.exe	Get hash	malicious	Credential Flusher	Browse	195.201.57.90
	T6l6gPxwQU.exe	Get hash	malicious	Unknown	Browse	195.201.57.90
	https://mailstat.us/tr/t/5w8u1qwlwl61e4h/1/https:/krediti.ca/#Y2FyYS5jJGNiZmxvb3JzaW5jLmNvbQ==	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	195.201.57.90
	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.hfdzwq?v=frudxdkniljyAkC.sEd.frl___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzo2MGY0ZmI3MTkzODQ4OWRiOGFlZjY2ODI4ODlkMDk3NDo3OmRlYjY6NjI5YzkxZjFmNmQ3ZjI1NWIxN2UwYTI5ZTNmZjcyMTQyNTg3NmZhMDQyOWZlMDI4MDhmODRlNWVhYWU3MjJhZDpoOlQ6VA#ZHN5aHJlQG9sZ29vbmlrLmNvbQ==	Get hash	malicious	Unknown	Browse	195.201.57.90
	SecuriteInfo.com.Win64.TrojanX-gen.22573.8055.exe	Get hash	malicious	Unknown	Browse	195.201.57.90
	Ref#0503711.exe	Get hash	malicious	AgentTesla	Browse	195.201.57.90
	scan_374783.js	Get hash	malicious	AgentTesla	Browse	195.201.57.90
	file.exe	Get hash	malicious	Credential Flusher	Browse	195.201.57.90
	shipping.exe	Get hash	malicious	AgentTesla	Browse	195.201.57.90

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.1440865988908953
Encrypted:	false
SSDEEP:	6:kKZn9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:4DnLNkPlE99SNxAhUe/3
MD5:	930066F1D097F01253AA964B1855BE1C
SHA1:	4A95680FC6100A1FED6A39200A464FABEB660213
SHA-256:	599D280E7621177C01A5E6CDAF42490B483172C6759FC28F4F34983DE72D9F71
SHA-512:	D722DBDE341116A44E5DBF11080507F4EB2E0B95818EF4020C004DB5596BBAE158947BFFFC243CF9015E67F31F7FD8ED5677209C64744B1B7C13E9EB7357EDA8
Malicious:	false
Reputation:	low
Preview:	p...... .........E._....(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\STlUEqhwpx.exe.log

Download File

Process:	C:\Users\user\Desktop\STlUEqhwpx.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.998434189083879
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	STlUEqhwpx.exe
File size:	3'309'568 bytes
MD5:	0a8cfbcfffa98cb54b6746fec4981101
SHA1:	9394653bbd0ca684970c5d482e26a89f60d4e975
SHA256:	2a4751457c3ab5125478cfebea685b92046e047dedc07ecb0b32f2d6c6293a0f
SHA512:	b6b37161737d582f885bcba9685ad5badc8116e8c46c2f6c888908e6ac44613a85a34cae93915832ac660204fb99dbc23e5b354dfc2b4999d1ca45bb7193753b
SSDEEP:	49152:soe3aWG7CWXpqWNSCsaY3CvuNC9RKb0r0OucozUNXFsnlVIE9z:sh3NGOQzd7EeuFb05uF3nl+EV
TLSH:	50E5330B18C1382ED077203B118B5F11A66ABD937C4FDBA211B50B4D6B656CEE51AFE3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f.................v2...........2.. ....2...@.. ........................2...........@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x7294ee
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FD8F0A [Wed Oct 2 18:20:58 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x329498	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x32a000	0x542	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x32c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x3274f4	0x327600	c2cda2f17cae7fb1b1b700e5bed7123a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x32a000	0x542	0x600	def116b2d3ea08f0e27a74f821008310	False	0.4049479166666667	data	3.9039212694753482	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x32c000	0xc	0x200	43a00802d736bf93eacbb559f2622f6f	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x32a0a0	0x2b8	COM executable for DOS			0.45977011494252873
RT_MANIFEST	0x32a358	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T00:08:00.035013+0200	2027619	ET MALWARE Observed Malicious SSL Cert (Quasar CnC)	1	165.22.194.189	5613	192.168.2.4	49730	TCP
2024-10-08T00:08:00.035013+0200	2035595	ET MALWARE Generic AsyncRAT Style SSL Cert	1	165.22.194.189	5613	192.168.2.4	49730	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 00:07:59.408647060 CEST	49730	5613	192.168.2.4	165.22.194.189
Oct 8, 2024 00:07:59.413793087 CEST	5613	49730	165.22.194.189	192.168.2.4
Oct 8, 2024 00:07:59.413876057 CEST	49730	5613	192.168.2.4	165.22.194.189
Oct 8, 2024 00:07:59.421200037 CEST	49730	5613	192.168.2.4	165.22.194.189
Oct 8, 2024 00:07:59.426131010 CEST	5613	49730	165.22.194.189	192.168.2.4
Oct 8, 2024 00:08:00.023108959 CEST	5613	49730	165.22.194.189	192.168.2.4
Oct 8, 2024 00:08:00.023163080 CEST	5613	49730	165.22.194.189	192.168.2.4
Oct 8, 2024 00:08:00.023338079 CEST	49730	5613	192.168.2.4	165.22.194.189
Oct 8, 2024 00:08:00.029933929 CEST	49730	5613	192.168.2.4	165.22.194.189
Oct 8, 2024 00:08:00.035012960 CEST	5613	49730	165.22.194.189	192.168.2.4
Oct 8, 2024 00:08:00.198863029 CEST	5613	49730	165.22.194.189	192.168.2.4
Oct 8, 2024 00:08:00.246985912 CEST	49730	5613	192.168.2.4	165.22.194.189
Oct 8, 2024 00:08:01.501506090 CEST	49732	443	192.168.2.4	195.201.57.90
Oct 8, 2024 00:08:01.501594067 CEST	443	49732	195.201.57.90	192.168.2.4
Oct 8, 2024 00:08:01.501679897 CEST	49732	443	192.168.2.4	195.201.57.90
Oct 8, 2024 00:08:01.503978014 CEST	49732	443	192.168.2.4	195.201.57.90
Oct 8, 2024 00:08:01.504012108 CEST	443	49732	195.201.57.90	192.168.2.4
Oct 8, 2024 00:08:02.380373001 CEST	443	49732	195.201.57.90	192.168.2.4
Oct 8, 2024 00:08:02.380508900 CEST	49732	443	192.168.2.4	195.201.57.90
Oct 8, 2024 00:08:02.384138107 CEST	49732	443	192.168.2.4	195.201.57.90
Oct 8, 2024 00:08:02.384166956 CEST	443	49732	195.201.57.90	192.168.2.4
Oct 8, 2024 00:08:02.384691000 CEST	443	49732	195.201.57.90	192.168.2.4
Oct 8, 2024 00:08:02.417081118 CEST	49732	443	192.168.2.4	195.201.57.90
Oct 8, 2024 00:08:02.463397026 CEST	443	49732	195.201.57.90	192.168.2.4
Oct 8, 2024 00:08:02.604368925 CEST	443	49732	195.201.57.90	192.168.2.4
Oct 8, 2024 00:08:02.604526043 CEST	443	49732	195.201.57.90	192.168.2.4
Oct 8, 2024 00:08:02.604605913 CEST	49732	443	192.168.2.4	195.201.57.90
Oct 8, 2024 00:08:02.692287922 CEST	49732	443	192.168.2.4	195.201.57.90
Oct 8, 2024 00:08:02.814096928 CEST	49730	5613	192.168.2.4	165.22.194.189
Oct 8, 2024 00:08:02.819341898 CEST	5613	49730	165.22.194.189	192.168.2.4
Oct 8, 2024 00:08:02.819442034 CEST	49730	5613	192.168.2.4	165.22.194.189
Oct 8, 2024 00:08:02.824575901 CEST	5613	49730	165.22.194.189	192.168.2.4
Oct 8, 2024 00:08:03.100800037 CEST	5613	49730	165.22.194.189	192.168.2.4
Oct 8, 2024 00:08:03.153028011 CEST	49730	5613	192.168.2.4	165.22.194.189
Oct 8, 2024 00:08:03.230510950 CEST	5613	49730	165.22.194.189	192.168.2.4
Oct 8, 2024 00:08:03.278143883 CEST	49730	5613	192.168.2.4	165.22.194.189
Oct 8, 2024 00:08:28.231337070 CEST	49730	5613	192.168.2.4	165.22.194.189
Oct 8, 2024 00:08:28.236488104 CEST	5613	49730	165.22.194.189	192.168.2.4
Oct 8, 2024 00:08:53.247076035 CEST	49730	5613	192.168.2.4	165.22.194.189
Oct 8, 2024 00:08:53.252062082 CEST	5613	49730	165.22.194.189	192.168.2.4
Oct 8, 2024 00:09:18.262586117 CEST	49730	5613	192.168.2.4	165.22.194.189
Oct 8, 2024 00:09:18.267725945 CEST	5613	49730	165.22.194.189	192.168.2.4
Oct 8, 2024 00:09:43.278276920 CEST	49730	5613	192.168.2.4	165.22.194.189
Oct 8, 2024 00:09:43.283344984 CEST	5613	49730	165.22.194.189	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 00:08:01.433872938 CEST	55792	53	192.168.2.4	1.1.1.1
Oct 8, 2024 00:08:01.441819906 CEST	53	55792	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 8, 2024 00:08:01.433872938 CEST	192.168.2.4	1.1.1.1	0x4e94	Standard query (0)	ipwho.is	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 00:08:01.441819906 CEST	1.1.1.1	192.168.2.4	0x4e94	No error (0)	ipwho.is		195.201.57.90	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ipwho.is

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	195.201.57.90	443	7296	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 22:08:02 UTC	150	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0 Host: ipwho.is Connection: Keep-Alive
2024-10-07 22:08:02 UTC	223	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:08:02 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Server: ipwhois Access-Control-Allow-Headers: * X-Robots-Tag: noindex
2024-10-07 22:08:02 UTC	1019	IN	Data Raw: 33 65 66 0d 0a 7b 0a 20 20 20 20 22 41 62 6f 75 74 20 55 73 22 3a 20 22 68 74 74 70 73 3a 5c 2f 5c 2f 69 70 77 68 6f 69 73 2e 69 6f 22 2c 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 73 75 63 63 65 73 73 22 3a 20 74 72 75 65 2c 0a 20 20 20 20 22 74 79 70 65 22 3a 20 22 49 50 76 34 22 2c 0a 20 20 20 20 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 20 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 0a 20 20 20 20 22 63 6f 6e 74 69 6e 65 6e 74 5f 63 6f 64 65 22 3a 20 22 4e 41 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 Data Ascii: 3ef{ "About Us": "https:\/\/ipwhois.io", "ip": "8.46.123.33", "success": true, "type": "IPv4", "continent": "North America", "continent_code": "NA", "country": "United States", "country_code": "US", "region": "New Yor

Target ID:	0
Start time:	18:07:56
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\STlUEqhwpx.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\STlUEqhwpx.exe"
Imagebase:	0x10000
File size:	3'309'568 bytes
MD5 hash:	0A8CFBCFFFA98CB54B6746FEC4981101
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000002.1672389499.0000000002781000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000002.1672479758.0000000004184000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000002.1672479758.0000000003784000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	18:07:56
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	#system32
Imagebase:	0x620000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	18:07:56
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	#system32
Imagebase:	0xd20000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000002.00000002.2918490153.0000000000720000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000002.00000002.2922324215.00000000033A6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000002.00000002.2922324215.0000000003111000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000002.00000002.2918490153.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	42%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	48
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 02570CD1 Relevance: 3.4, APIs: 2, Instructions: 359
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02570548: CreateProcessW.KERNELBASE(00000000,?,00000009,?,?,?,?,?,?,?), ref: 02571354

Part of subcall function 02570554: Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,?,02570DCC), ref: 025714B3

Part of subcall function 02570560: ReadProcessMemory.KERNELBASE(?,?,?,?,00010002,?,?,?,?,?,?,02570E0A,?,00000004,?), ref: 02571571

VirtualAllocEx.KERNELBASE(?,?,00000000,00003000,00000040), ref: 02570ECF
ResumeThread.KERNELBASE(?), ref: 02570FE4

Memory Dump Source

Source File: 00000000.00000002.1672315236.0000000002570000.00000040.00000800.00020000.00000000.sdmp, Offset: 02570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2570000_STlUEqhwpx.jbxd

Similarity

API ID: ProcessThread$AllocContextCreateMemoryReadResumeVirtualWow64
String ID:
API String ID: 2498194165-0
Opcode ID: e554882d28bd18111cd9983304393ef6977997ab2f0018c136668b050ad6c835
Instruction ID: 6965b31edbad04da3a9cd7c40313b4d831d54e923c1a0e45c0e0a1c0ef19f9e3
Opcode Fuzzy Hash: e554882d28bd18111cd9983304393ef6977997ab2f0018c136668b050ad6c835
Instruction Fuzzy Hash: 2DD18071E002198FDB14DFA5D850BAEBBF2BF84344F248159D40AAB395DF34AD85CB98

Function 0257120C Relevance: 1.6, APIs: 1, Instructions: 142
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(00000000,?,00000009,?,?,?,?,?,?,?), ref: 02571354

Memory Dump Source

Source File: 00000000.00000002.1672315236.0000000002570000.00000040.00000800.00020000.00000000.sdmp, Offset: 02570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2570000_STlUEqhwpx.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: dcef326152ea12d596fc75f0b10f7412b79e6d8249440e2abe970a58e3732075
Instruction ID: 668fbd9896f48b323a2f6bd94dd2a6e16f2604a565892ad7e1b030e7d30034b9
Opcode Fuzzy Hash: dcef326152ea12d596fc75f0b10f7412b79e6d8249440e2abe970a58e3732075
Instruction Fuzzy Hash: A8513471900629DFDF20CFA9D940BDEBBB6BF49304F1480AAE508AB250D7749A88CF51

Function 02570548 Relevance: 1.6, APIs: 1, Instructions: 140
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(00000000,?,00000009,?,?,?,?,?,?,?), ref: 02571354

Memory Dump Source

Source File: 00000000.00000002.1672315236.0000000002570000.00000040.00000800.00020000.00000000.sdmp, Offset: 02570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2570000_STlUEqhwpx.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: dc49782372cd14408d2066f5a5ee7288d68613b4773f3cabac493c2f49cfacb9
Instruction ID: 6ecf45530e23ddc046e31b92855ba78e9e9f06d039a663d26bcd0f2b151285c5
Opcode Fuzzy Hash: dc49782372cd14408d2066f5a5ee7288d68613b4773f3cabac493c2f49cfacb9
Instruction Fuzzy Hash: E0512771900729DFDF24CF99D940BDEBBB6BF49304F1480AAE908A7250D7759A88CF91

Function 0257056C Relevance: 1.6, APIs: 1, Instructions: 63
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?,?,?,?,00000000,00000000,?,025711AD,?,?,00000000), ref: 0257163C

Memory Dump Source

Source File: 00000000.00000002.1672315236.0000000002570000.00000040.00000800.00020000.00000000.sdmp, Offset: 02570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2570000_STlUEqhwpx.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 8a90a6203a9bbd40315020990c92e77949e8049e062569f1c6eacc5ca32e836b
Instruction ID: 21280a35e369b5b2e09eda552a9312298ce8976a6ee542513b30df30d609a20e
Opcode Fuzzy Hash: 8a90a6203a9bbd40315020990c92e77949e8049e062569f1c6eacc5ca32e836b
Instruction Fuzzy Hash: CC2107B5900759DFCB10CF9AD884BDEBBF4FB48310F54842AE918A7250D378A944CFA4

Function 025715B9 Relevance: 1.6, APIs: 1, Instructions: 61
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?,?,?,?,00000000,00000000,?,025711AD,?,?,00000000), ref: 0257163C

Memory Dump Source

Source File: 00000000.00000002.1672315236.0000000002570000.00000040.00000800.00020000.00000000.sdmp, Offset: 02570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2570000_STlUEqhwpx.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: ba727b92c1316492be62021ff8b7f42faa5a3b94a23c3041fdb8320d2df5b823
Instruction ID: d31c857ba151e7cb988a6c088cf39fc6d5047aa99148eb3b79499150fe8cc28c
Opcode Fuzzy Hash: ba727b92c1316492be62021ff8b7f42faa5a3b94a23c3041fdb8320d2df5b823
Instruction Fuzzy Hash: 832104B1900259DFDB10CF99D984BDEFBF4FB48310F14842AE558A7250C378A944CF64

Function 025714F8 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,00010002,?,?,?,?,?,?,02570E0A,?,00000004,?), ref: 02571571

Memory Dump Source

Source File: 00000000.00000002.1672315236.0000000002570000.00000040.00000800.00020000.00000000.sdmp, Offset: 02570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2570000_STlUEqhwpx.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: fa264ad77237856b611f3a67518e64d0036c83d90a24901fe74ff301a6fa184c
Instruction ID: 0224b07e0688a1226dd322354c97650a257f6b2760e13a967106761544c85e5b
Opcode Fuzzy Hash: fa264ad77237856b611f3a67518e64d0036c83d90a24901fe74ff301a6fa184c
Instruction Fuzzy Hash: 6321E4B59002599FDB10CF9AD985BDEFBF4FB48320F10846AE958A7250C378A944CFA5

Function 02570560 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,00010002,?,?,?,?,?,?,02570E0A,?,00000004,?), ref: 02571571

Memory Dump Source

Source File: 00000000.00000002.1672315236.0000000002570000.00000040.00000800.00020000.00000000.sdmp, Offset: 02570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2570000_STlUEqhwpx.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 2dbee0dc8272d1964ffed76a31aa69c3f703272eb267449896a33da05491be78
Instruction ID: f50baac6e0a0a829d6843d1c7bcefa96cc95ac5a030243120584e513266f5f63
Opcode Fuzzy Hash: 2dbee0dc8272d1964ffed76a31aa69c3f703272eb267449896a33da05491be78
Instruction Fuzzy Hash: 8E21E4B59007599FCB10CF9AD984BDEFBF4FB48320F10842AE958A7250D374A944CFA5

Function 02570554 Relevance: 1.6, APIs: 1, Instructions: 57
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,?,02570DCC), ref: 025714B3

Memory Dump Source

Source File: 00000000.00000002.1672315236.0000000002570000.00000040.00000800.00020000.00000000.sdmp, Offset: 02570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2570000_STlUEqhwpx.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: a5ae51c7f9b0b4de1fe8a4601d6c8b83e83cf060689ce98e77a2b0e8f50d5809
Instruction ID: 6c670707260636010b9a9597d0479a167102af45c60b885362b5c093900db1c6
Opcode Fuzzy Hash: a5ae51c7f9b0b4de1fe8a4601d6c8b83e83cf060689ce98e77a2b0e8f50d5809
Instruction Fuzzy Hash: E81112B19006498FCB10CF9AD945BEEFBF9FB88320F14C469E458A7200D378A544CFA5

Function 02570578 Relevance: 1.6, APIs: 1, Instructions: 57
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,?,02570DCC), ref: 025714B3

Memory Dump Source

Source File: 00000000.00000002.1672315236.0000000002570000.00000040.00000800.00020000.00000000.sdmp, Offset: 02570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2570000_STlUEqhwpx.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: f50f42a794b50f70bc5f08185615ea0eddac3953dae0bf1ab798c4ac16460ea6
Instruction ID: 7e981e59eae37acf4407b770599102089eb79d54dd6cc760518b4ff468836c4f
Opcode Fuzzy Hash: f50f42a794b50f70bc5f08185615ea0eddac3953dae0bf1ab798c4ac16460ea6
Instruction Fuzzy Hash: 6A1112B19006498FCB10CF9AD944BEEFBF9FB88324F14C469E458A7200D778A544CFA5

Function 02571441 Relevance: 1.6, APIs: 1, Instructions: 56
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000,?,?,?,?,00000000,?,?,?,02570DCC), ref: 025714B3

Memory Dump Source

Source File: 00000000.00000002.1672315236.0000000002570000.00000040.00000800.00020000.00000000.sdmp, Offset: 02570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2570000_STlUEqhwpx.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 325e066aafb1579a3ad0e3d8a29b5d8a1b110746146a9f4f7fc852d5a96242f8
Instruction ID: 6ee35c78f2f05386b5a202097e84b82651084226c15b49dfb7ff82f087dfa153
Opcode Fuzzy Hash: 325e066aafb1579a3ad0e3d8a29b5d8a1b110746146a9f4f7fc852d5a96242f8
Instruction Fuzzy Hash: 081100B2D006498FCB10CFAAD944BEEFBF5AB88320F14C56AD459A3250D378A545CFA5

Analysis Process: RegAsm.exePID: 7296, Parent PID: 7264COMMON

Execution Graph

Execution Coverage:	8.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	120
Total number of Limit Nodes:	15

Executed Functions

Function 07C89980 Relevance: 3.2, Strings: 2, Instructions: 711
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(oq, xrefs: 07C8A18B
(oq, xrefs: 07C89B40

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID: (oq$(oq
API String ID: 0-3207256227
Opcode ID: c2ed01159e8f5c7d4ce65436b1bcc85fbf78ef59b49822e1a1582f9974125b2c
Instruction ID: c1e219da953495d276d19995aca2e92e03b410eee91adbf138ecbcd26ee96d63
Opcode Fuzzy Hash: c2ed01159e8f5c7d4ce65436b1bcc85fbf78ef59b49822e1a1582f9974125b2c
Instruction Fuzzy Hash: 33426BB1B006168FCB59DF69C49466EBBF2FF88304F24852AD55ADB390DB34E901CB91

Function 02F46518 Relevance: 6.1, APIs: 4, Instructions: 142
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 02F465BE
GetCurrentThread.KERNEL32 ref: 02F465FB
GetCurrentProcess.KERNEL32 ref: 02F46638
GetCurrentThreadId.KERNEL32 ref: 02F46691

Memory Dump Source

Source File: 00000002.00000002.2921587900.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_RegAsm.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 9129c7c759198c55afd34faba0b572be7c146e424cbeb5cf0b48d148a47fd3de
Instruction ID: 9bb88d3c857d6ccb2a830b6ef965ffd7b4b4ff95318cbe9d99d3424ca9062b3f
Opcode Fuzzy Hash: 9129c7c759198c55afd34faba0b572be7c146e424cbeb5cf0b48d148a47fd3de
Instruction Fuzzy Hash: 2B5155B190024ACFDB14CFA9D64879EBFF1AF49314F24C45AE109AB3A0DB749984CF65

Function 02F44E90 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 02F465BE
GetCurrentThread.KERNEL32 ref: 02F465FB
GetCurrentProcess.KERNEL32 ref: 02F46638
GetCurrentThreadId.KERNEL32 ref: 02F46691

Memory Dump Source

Source File: 00000002.00000002.2921587900.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_RegAsm.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 985a90b900cd10adc3f6996ad1b00de90fd6288cd04b58689a931c068b9ea96f
Instruction ID: d283c9aeec31d2ca80b1eb7d820d096bf262a6850e2b589b3bc5750bbbf380ba
Opcode Fuzzy Hash: 985a90b900cd10adc3f6996ad1b00de90fd6288cd04b58689a931c068b9ea96f
Instruction Fuzzy Hash: 445144B0910209CFDB14CFA9D648BAEBFF5EB49304F20C459E509A73A0DB74A984CF65

Function 07C871E0 Relevance: 4.3, Strings: 3, Instructions: 529
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(oq, xrefs: 07C875A8
(oq, xrefs: 07C87780
(oq, xrefs: 07C872E5

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID: (oq$(oq$(oq
API String ID: 0-3965398577
Opcode ID: dc3d8a638c736fb9551ed7dccdba7f3ebcb85bf085e0750033667152c8572d25
Instruction ID: 49439ba69ff62b42c8d8524c18436467edabc37dec54861812aca6a701444863
Opcode Fuzzy Hash: dc3d8a638c736fb9551ed7dccdba7f3ebcb85bf085e0750033667152c8572d25
Instruction Fuzzy Hash: E812C070B006099FCB55EFA9C49465EBBF2FF88300B248969D44ADB794DB34ED02CB95

Function 07C80730 Relevance: 4.1, Strings: 3, Instructions: 367
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(oq, xrefs: 07C80885
Hoq, xrefs: 07C808B1
(oq, xrefs: 07C80859

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID: (oq$(oq$Hoq
API String ID: 0-3836682603
Opcode ID: fc88afdae30144a941b319fd9b9b8b69474bcea8610e73dfaec80d8703888974
Instruction ID: b3f69bbff7ac69c44350431259b7059c7a3f72fdb40488b71359ce647f9d41e9
Opcode Fuzzy Hash: fc88afdae30144a941b319fd9b9b8b69474bcea8610e73dfaec80d8703888974
Instruction Fuzzy Hash: 2EE16574B11209DFCB44EFA4D8949ADBBB2FF89310F508569E815AB364DB30ED85CB90

Function 07C85BB0 Relevance: 2.8, Strings: 2, Instructions: 312
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'kq, xrefs: 07C85E72
4'kq, xrefs: 07C85EA9

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq
API String ID: 0-4171853269
Opcode ID: cbda23fc283aced94013eb4d6b91ce6d9ca6223aeb6f0c8cda249449b19dc559
Instruction ID: 40e02559645100fb132d307f1e859a5424332087704f7d85eceb1b724ab980b8
Opcode Fuzzy Hash: cbda23fc283aced94013eb4d6b91ce6d9ca6223aeb6f0c8cda249449b19dc559
Instruction Fuzzy Hash: 69D11D74B10218CFC744EFA8D994AADB7B2FF89300F514169E915AB3A4DB71EC42CB50

Function 07C85BC0 Relevance: 2.8, Strings: 2, Instructions: 295
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'kq, xrefs: 07C85E72
4'kq, xrefs: 07C85EA9

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq
API String ID: 0-4171853269
Opcode ID: b44272ce865fec4370a19b3478bc75ce99f2d7d7890166c7456e8104b10fc472
Instruction ID: 96acf98046af19b70970200b5382b19abf7d210d931380ba97ce6c3d9dd9ed01
Opcode Fuzzy Hash: b44272ce865fec4370a19b3478bc75ce99f2d7d7890166c7456e8104b10fc472
Instruction Fuzzy Hash: 21C1C674B10218CFCB44EFA8C994A9DB7B6FF89300F514169E916AB3A5DB71EC42CB50

Function 02F4BFF0 Relevance: 1.7, APIs: 1, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 02F4C256

Memory Dump Source

Source File: 00000002.00000002.2921587900.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2887d7c4a427bec12718aab85389ff11650baefe0262b1a8a76cdeba50a247c7
Instruction ID: c50c046092c4c9080981329991b96be1b5e21dba91d5e20518eee3150370c4c9
Opcode Fuzzy Hash: 2887d7c4a427bec12718aab85389ff11650baefe0262b1a8a76cdeba50a247c7
Instruction Fuzzy Hash: 1A8155B0A01B058FD724DF69D54075ABBF1BF88744F008A2ED58ADBB50DBB5E845CB90

Function 02F46414 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02F47421

Memory Dump Source

Source File: 00000002.00000002.2921587900.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 61f4c846b6d5029490100810534cbbddfbe7371ccc9cb2cde241a719911dcee9
Instruction ID: 465323a5e5f036a5c7b38ffa5080e7aa5e73c09bb36f471bede706f12bc83099
Opcode Fuzzy Hash: 61f4c846b6d5029490100810534cbbddfbe7371ccc9cb2cde241a719911dcee9
Instruction Fuzzy Hash: F941FFB1D00619CBDB24DFA9C944B9EFFB5BF48304F20806AD508AB264DBB56985CF90

Function 02F47364 Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02F47421

Memory Dump Source

Source File: 00000002.00000002.2921587900.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: cb3aec8a7756b4b12c28f601f3ad71335fae748fbbacf76e39325db4d29258fe
Instruction ID: 00d8618bf90c403fca138c356564839d233fd6517eb07b6941a09f96b033e126
Opcode Fuzzy Hash: cb3aec8a7756b4b12c28f601f3ad71335fae748fbbacf76e39325db4d29258fe
Instruction Fuzzy Hash: 3F41F2B1C00619CEDB24DFA9C9447DDFFB5BF48314F2480AAD408AB265DB755949CF90

Function 02F46780 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02F4680F

Memory Dump Source

Source File: 00000002.00000002.2921587900.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 07b50efd80702d38b268a20f8dda328d0855ffc527eb52b4f81a63dafdf8a93d
Instruction ID: 3b97551148864d47129eff106e552c845002cb7d405466fdb199ef3cc86c31d2
Opcode Fuzzy Hash: 07b50efd80702d38b268a20f8dda328d0855ffc527eb52b4f81a63dafdf8a93d
Instruction Fuzzy Hash: 2621E5B6D002589FDB10CF99D984ADEBFF8EB48324F14841AE954A3310D774A944CFA5

Function 02F46788 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02F4680F

Memory Dump Source

Source File: 00000002.00000002.2921587900.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3f320b55d5536f2db1211f4493d068e40c848f2435df28badcfdd763990d0bee
Instruction ID: 02c028b76a6e09dff9f2948bf6a7cdc7ec593a0c2f643f54bbbd00ce0be92e1a
Opcode Fuzzy Hash: 3f320b55d5536f2db1211f4493d068e40c848f2435df28badcfdd763990d0bee
Instruction Fuzzy Hash: B921E4B5D002489FDB10CFAAD984ADEBFF8EB48324F14841AE954A3310D778A944CFA5

Function 07C84920 Relevance: 1.6, Strings: 1, Instructions: 309COMMON

Download Yara Rule

Strings

Plkq, xrefs: 07C8493F

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID: Plkq
API String ID: 0-177148220
Opcode ID: 75bcab036b1fd1d6d008d4fc66ad62e9d5c57cb9ae40db2472d4f532de80b5bb
Instruction ID: a9402f45b205d4bbbfe39a376eca13269af76be90a8bcf036ac4c0c6d50ff601
Opcode Fuzzy Hash: 75bcab036b1fd1d6d008d4fc66ad62e9d5c57cb9ae40db2472d4f532de80b5bb
Instruction Fuzzy Hash: 1CD11E74B112189FCB44EFA5D994E9EB7B6FF88700F508068E815AB3A5CB35ED41CB90

Function 02F4C1F0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 02F4C256

Memory Dump Source

Source File: 00000002.00000002.2921587900.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ff2ff400877c16fc8ee7d0d86ee124e2fe6c490ab669090803d2758303afc62e
Instruction ID: 15651c626edf142269a5cd1e9a5d06cad91ea2e159ebdaf0bd630e428301b567
Opcode Fuzzy Hash: ff2ff400877c16fc8ee7d0d86ee124e2fe6c490ab669090803d2758303afc62e
Instruction Fuzzy Hash: DE1113B6D006498FCB10CF9AC544ADEFBF4AB88724F10855AD959B7210C7B4A545CFA1

Function 07C80CC8 Relevance: 1.5, Strings: 1, Instructions: 296COMMON

Download Yara Rule

Strings

(oq, xrefs: 07C80F95

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID: (oq
API String ID: 0-3175707579
Opcode ID: fbc96097b39be84ba308c5b2d483652d966604a3e0641ec6025c73c5d149ecc8
Instruction ID: cf5d5359204307eb84cd8c33fb94cca1392a1e14738e0a4ac52b360e7a4296ea
Opcode Fuzzy Hash: fbc96097b39be84ba308c5b2d483652d966604a3e0641ec6025c73c5d149ecc8
Instruction Fuzzy Hash: EFA1C0713002019FD7559F64D894A2A7BA3FF89314F1584AAE6458F3B2CA36EC86CB50

Function 07C84913 Relevance: 1.5, Strings: 1, Instructions: 261COMMON

Download Yara Rule

Strings

Plkq, xrefs: 07C8493F

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID: Plkq
API String ID: 0-177148220
Opcode ID: d08d4a8068e9357f3976ff9f187e5b74f6d1c4de019362d76499fa9d3b8593d3
Instruction ID: 7135a6c6e43db4d8fd9de6f2717e748c24f1f0fc354e274b7bc1d6ecb6f319c1
Opcode Fuzzy Hash: d08d4a8068e9357f3976ff9f187e5b74f6d1c4de019362d76499fa9d3b8593d3
Instruction Fuzzy Hash: 43B13274B102189FC748EFA5D994E9EB7B6BF88700F108468E815AB3A5CB35ED41CB90

Function 07C81AA0 Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

4'kq, xrefs: 07C81C0E

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: 12a67da6ab6dec78235cb9939668110565c202bd76e978005bee5d4e9290247a
Instruction ID: f57445b4a81afa4de7f412010bb0edd6ff1804b2bdec698092f5d0b06de674ad
Opcode Fuzzy Hash: 12a67da6ab6dec78235cb9939668110565c202bd76e978005bee5d4e9290247a
Instruction Fuzzy Hash: C751D1B13402449FD345AB38C954B6A7BE6AF89714F1844AAE505CF3A2DA35EC82C7A1

Function 07C81B41 Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

4'kq, xrefs: 07C81C0E

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: 96245e9de38f50005d3a39a49e8015d912c897e8cf49f603a822488cb3ee859e
Instruction ID: 92a735e77c98f142818c8b3bcbc0f60904cffe8d0a7a3d56b63d08e358f157dc
Opcode Fuzzy Hash: 96245e9de38f50005d3a39a49e8015d912c897e8cf49f603a822488cb3ee859e
Instruction Fuzzy Hash: 8141CFB13406048FD345EB29C954B2A7BE6AFC9704F1484A9E50ACF3A6CE35EC42C791

Function 07C81B68 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

4'kq, xrefs: 07C81C0E

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: 50eee69d14f5137083712c3caef49cf5425e3bf1bcff3f34296201fb4bdd8370
Instruction ID: 240c393d67dadf18ecf2e4efaefe1216e73757af730366c60ac184a3926e8b90
Opcode Fuzzy Hash: 50eee69d14f5137083712c3caef49cf5425e3bf1bcff3f34296201fb4bdd8370
Instruction Fuzzy Hash: 6C318C713406149FD358EB69C994F2B77EAAFCC704F108468E60A8B3A5CE75EC42C790

Function 07C88F58 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

(oq, xrefs: 07C88FBF

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID: (oq
API String ID: 0-3175707579
Opcode ID: cb9396f642464dfc48567a1012e51c47289465db8f2282bb81ebc102e391cd83
Instruction ID: 736492fea8751dab5d2b6eb882a5113a8bd13f3f86fc82d0e604ae41b37aa05d
Opcode Fuzzy Hash: cb9396f642464dfc48567a1012e51c47289465db8f2282bb81ebc102e391cd83
Instruction Fuzzy Hash: 4B3126763042156FDB05AF69D89096EBFA7EFCA360705807AE908CB3A9DE31CC01C791

Function 07C88E59 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

x, xrefs: 07C88E5C

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID: x
API String ID: 0-2363233923
Opcode ID: 5b2c2671bd76d772dadeed9bb48ad412971a1a3fa4f08cbe5c026c584fae0586
Instruction ID: fad0ac157eb5f3819338d25242309478e5d552b603b9538e210b9e8c42efa106
Opcode Fuzzy Hash: 5b2c2671bd76d772dadeed9bb48ad412971a1a3fa4f08cbe5c026c584fae0586
Instruction Fuzzy Hash: A5217C75A102099FCB05DFA8C444ADD7FF2AF8D324F14912AE411BB394CB359881CB60

Function 07C887F1 Relevance: 1.3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

Strings

xoq, xrefs: 07C887F1

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID: xoq
API String ID: 0-2982640460
Opcode ID: eb1451902db281ba569a438c8ecac084cbddba6bbaf2f15565be39afb7924d74
Instruction ID: d0ca21863b3a4ef408302da1b6ba7343f92d83d5cca5e2038d8f659f86bf2163
Opcode Fuzzy Hash: eb1451902db281ba569a438c8ecac084cbddba6bbaf2f15565be39afb7924d74
Instruction Fuzzy Hash: DFF0E5357401009FDB44CB19D940A5ABBE5FF88314F158099E5099F362D731FC018F90

Function 07C80040 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b625e4a269d03606d2534a97b7aee83396a982eb340f2b558538eeeb2a0a7be3
Instruction ID: 44082d92aa02014399e46b62c6433d7788d239313a051862eaf7aabf05a0606f
Opcode Fuzzy Hash: b625e4a269d03606d2534a97b7aee83396a982eb340f2b558538eeeb2a0a7be3
Instruction Fuzzy Hash: 5F122C74B102198FCB54EF64C894A9DBBB2BF89300F5185A8D859AB365DF30ED89CF50

Function 07C89560 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58435fd1652e25690d1cd215d1c8c7d6e94c165f35e6c704e7acf322daf0a930
Instruction ID: cb8a762209736bf4dbe86ac69ddaaae209fc73744ddcffc5cfab039bd178f8fd
Opcode Fuzzy Hash: 58435fd1652e25690d1cd215d1c8c7d6e94c165f35e6c704e7acf322daf0a930
Instruction Fuzzy Hash: B1C1B2B1A046468FCB65DF29C494A3ABBF2FF85318F19855DE4878B692CB30F941CB41

Function 07C84DB4 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f368352ca094e83ab52b3d2afd984c5173ef0ce2340bcbfdd267c17a746f1de
Instruction ID: 63cbe0f8b5fea7ae21b0d041a821e0542222e2f005e5c5ff7c6ab798ce63dada
Opcode Fuzzy Hash: 4f368352ca094e83ab52b3d2afd984c5173ef0ce2340bcbfdd267c17a746f1de
Instruction Fuzzy Hash: 6FB1A2747106058FCB85EF74C8509AE7BB2AF89700F508569E8269F3A8DF35ED42CB91

Function 07C84DE8 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0336c829b89902b78c2991aa19e4292906ab612eec35f3c4a2862c2b543b441
Instruction ID: 8641d7e215b239259141d5d92a24c5721616470bbc83d8217ecbca99fffbab17
Opcode Fuzzy Hash: d0336c829b89902b78c2991aa19e4292906ab612eec35f3c4a2862c2b543b441
Instruction Fuzzy Hash: 6CA180747106188FCB44EF74C85096E77B2AFC9700F508968E8269B3A8DF75ED42CB91

Function 07C80006 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51a3edfa7ff1f0a2a4826f66e67f2461d3859a74b01e25d30c4745b49461af1a
Instruction ID: 2535a266a8e707992e4628f25245c8579a39e4b7254ad842c31fd35b57f310dd
Opcode Fuzzy Hash: 51a3edfa7ff1f0a2a4826f66e67f2461d3859a74b01e25d30c4745b49461af1a
Instruction Fuzzy Hash: 27B15B74B002158FCB54EF64C894B99BBB2BF89314F5581A8E849AB366DF30DD89CF50

Function 07C848F0 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee82bc541b91b64012b0a1996a80ac80ed053fa8e93724840720bd1e07bbaf5f
Instruction ID: a65d2a7d66a7ce6de7b202aeb2ce135d907a9876e959e1bdb1fa74cfcaebcd10
Opcode Fuzzy Hash: ee82bc541b91b64012b0a1996a80ac80ed053fa8e93724840720bd1e07bbaf5f
Instruction Fuzzy Hash: 12A14374B112199FCB44EFA5D994E9EB7B6FF89700F108068E811AB3A5CB35ED41CB90

Function 07C81000 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a6a35f5dd5cab1415e6d01ebf9d6c64073be5e31c44d9ef0a641a9235573b2b
Instruction ID: dfa6ae31ff0ad59347f98775dde6469c37d3d7dada760ddeb34296eb0dcb75e1
Opcode Fuzzy Hash: 1a6a35f5dd5cab1415e6d01ebf9d6c64073be5e31c44d9ef0a641a9235573b2b
Instruction Fuzzy Hash: D4914D74710219CFCB84EF68D894A6D77F6AF89710F1481A9E916DB3A5CB30ED42CB90

Function 07C8896B Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 869a89089664355927af2663a5341fedfa04fb6c160f0dbced48979dd754bae7
Instruction ID: d917d35d6720b03a698f45b80e0bad92a4ac7e473d2ec456892c5f3318af7b4d
Opcode Fuzzy Hash: 869a89089664355927af2663a5341fedfa04fb6c160f0dbced48979dd754bae7
Instruction Fuzzy Hash: A88110B4A21229AFCB94DF98D980EADB7F2BF88314F514159E901AB366D731EC41CB40

Function 07C80FF1 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ff8f75f33f02ed2166d5631ee530f8d6d1ce8dc002dd35ae58e8f5e49f444fa
Instruction ID: db1646ff58a36a59bf35f7dfaf6f9b338b9ee452877e58971d3ea0239b67c0a0
Opcode Fuzzy Hash: 6ff8f75f33f02ed2166d5631ee530f8d6d1ce8dc002dd35ae58e8f5e49f444fa
Instruction Fuzzy Hash: A2615E74710205DFCB44EF64D894A6DB7F6BF89710F5481A9E8169B3A5CB30ED42CB90

Function 07C83904 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eadf6bc42168271761fce1d11423f87fe8e2e3208b7029468e39390b62c1e16d
Instruction ID: feacb51fc39b36c885b8d0aed598806f6010f9f8cc26af4a8984dca0b29f122b
Opcode Fuzzy Hash: eadf6bc42168271761fce1d11423f87fe8e2e3208b7029468e39390b62c1e16d
Instruction Fuzzy Hash: 4241B071B002069FC745EB69D850A5ABBF6FFC9310B2485AAE109DB361DA31AD01CB80

Function 07C893F8 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1c3213d5d33a1bb54361fb445c4c08db3415e946850f03ee95c8e835338dd60
Instruction ID: deef3f264c58ae2dd38fa585e4bed275d5982f3b84615a599b7a0478f9e21a2c
Opcode Fuzzy Hash: a1c3213d5d33a1bb54361fb445c4c08db3415e946850f03ee95c8e835338dd60
Instruction Fuzzy Hash: F8419FB1B007198FCBA5DB78D5802AABBF1FFC4214B14896ED55AC7A54DB30F940CB81

Function 07C81328 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61a3a78f461c8bf3caa6b782fb344e1e04ca8771858715864f1993113b3b9b9b
Instruction ID: 2e3f92bfe6b8a300b5fe466c0d5887b3474cb1b08c1b21aa44de5949b0e6124f
Opcode Fuzzy Hash: 61a3a78f461c8bf3caa6b782fb344e1e04ca8771858715864f1993113b3b9b9b
Instruction Fuzzy Hash: DA316B75A001099BDF44EFA5DC94AEEB7B6FF88310F148029E801B73A4CB319D15CBA0

Function 0151D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2921281225.000000000151D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0151D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_151d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1851c7cec184cee00c1af5c7f20908f765ba4347c5ca4bc26246530add28afa1
Instruction ID: 0d5f278beebf7fceb46b26a378b172bce29f85558cb4ed8aa16f2176019881c4
Opcode Fuzzy Hash: 1851c7cec184cee00c1af5c7f20908f765ba4347c5ca4bc26246530add28afa1
Instruction Fuzzy Hash: 00210075604200DFEB16DF58D988B2ABBB1FB84314F20C96DD8094F25AD33AD846CA61

Function 07C88E68 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f4351f0779d3273715426d6843409e56e36083200b64ecd0b893c184ca88173
Instruction ID: 7611ddcc9f8e2e42d588521e964ac0fcbabf4ddede2366d5329ffec94dcbf897
Opcode Fuzzy Hash: 3f4351f0779d3273715426d6843409e56e36083200b64ecd0b893c184ca88173
Instruction Fuzzy Hash: 83217C71A102099FCB05DFA9C8549DEBFB6EF8D320F149129E811B7390CB319881CBA0

Function 0151D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2921281225.000000000151D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0151D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_151d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da411e93a22195a852d0a6b745c00cef95ecc7dd9d8ad91505b93300a4b090aa
Instruction ID: 6691653f443efe6f513e41f9bc9c821948cd5b0316a820a5269d60db0563a4c1
Opcode Fuzzy Hash: da411e93a22195a852d0a6b745c00cef95ecc7dd9d8ad91505b93300a4b090aa
Instruction Fuzzy Hash: 97219F755093808FDB03CF24D994B15BF71FB46214F28C5EAD8498F667C33A984ACB62

Function 07C893C0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 436676f4c9d265517a00a3d19c7cb0837b6a655bad411c5e4181cb22fb04e357
Instruction ID: 3892f9ca5f0431f34ca122ab7f18a085c0711a6df92956ee06bd2d5f93139c8a
Opcode Fuzzy Hash: 436676f4c9d265517a00a3d19c7cb0837b6a655bad411c5e4181cb22fb04e357
Instruction Fuzzy Hash: 6F0104F2509B815FC3629760D8C00E6BFB0DF43208719889BD099C74A3D235B94AD391

Function 07C81461 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e3f32c7ac5596bf2f81e2ca61bd998fa103ab95e6cfb087102f6e64d1b7c114
Instruction ID: b6c22633d01bc41ccf99bf5caf18ab3b4fc880d306f11ca01d48cc1195c2cb50
Opcode Fuzzy Hash: 7e3f32c7ac5596bf2f81e2ca61bd998fa103ab95e6cfb087102f6e64d1b7c114
Instruction Fuzzy Hash: 6C0104B53007448FC365AB30C944A7A3BE2ABC6314F1C896DE4568B6E5DB35DC43C791

Function 07C88AE2 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67e3b812cbc51632d1551b3a8ab5b6e98df6ee263d6bfe3e968ce52f363393d2
Instruction ID: 16f650912f4e0b5432cb84ea475570e299a82138af5daf9814a194a287ef5c0b
Opcode Fuzzy Hash: 67e3b812cbc51632d1551b3a8ab5b6e98df6ee263d6bfe3e968ce52f363393d2
Instruction Fuzzy Hash: B6110470A20228DFCB54DF58DD94EADB7F1BF84324F150059E902AB3A2CB349C41DB50

Function 07C89970 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94d4be09a13b99aa3f9e88c43ef906bee6c7360f7ab91753a5b129378c887e01
Instruction ID: c8a6f67344b4aad6c911b660b2eade4fee55dff03099033529c0bf15ebb551f1
Opcode Fuzzy Hash: 94d4be09a13b99aa3f9e88c43ef906bee6c7360f7ab91753a5b129378c887e01
Instruction Fuzzy Hash: 9111C8B5D00609EFC751DFA9D9049EDBBF4EF8A310B00855AE159E7210EB30AA05CB61

Function 07C88B6B Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6905f2743cfdfa871c2edc7b2dd6de02e2c21c259a4aeeba91bcb1db2420827
Instruction ID: dc5a57213ce5b2b5054ed190c7520494aeecc694c97801fe2958398b407d3944
Opcode Fuzzy Hash: f6905f2743cfdfa871c2edc7b2dd6de02e2c21c259a4aeeba91bcb1db2420827
Instruction Fuzzy Hash: 6A112A70A21228DFCB55DB58DC94EADBBF1BF88324F154159F912AB3A2CB749C41CB50

Function 07C81470 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4128a3e148d56cee10c9a4ed3856824c56500344eff05fcd5c7199f9b2fffa2
Instruction ID: f54a7b64c34fb1d6b653ee60b93a0f147afd1918f43368c2c426772ff9fd8410
Opcode Fuzzy Hash: c4128a3e148d56cee10c9a4ed3856824c56500344eff05fcd5c7199f9b2fffa2
Instruction Fuzzy Hash: 43019E753002088FD764AA25C884A2A77E2ABC9315F18896CE8664B694DB75EC43CB80

Function 0150D603 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2921240406.000000000150D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0150D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_150d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d45d7c36c762ece40c24740b89d027499b5b017244792530611c6919e884e16d
Instruction ID: ffcb888e17fde21c3a38169124d0995530e477316d6b96e82e7481b3e5bc35a9
Opcode Fuzzy Hash: d45d7c36c762ece40c24740b89d027499b5b017244792530611c6919e884e16d
Instruction Fuzzy Hash: 71F04976200A40AFD3208F4ACD84C27FBB9FBC4634319C59AEC4A5B651C631EC42CEA0

Function 0150D5F4 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2921240406.000000000150D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0150D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_150d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 522aa6a7c379a3bf7e85dc3440b748af933bb2e54638cb0dba3e7d7d048e0965
Instruction ID: 61e536267bac5314e1a8556215d419e3bf6114d7a496aedfadc5b5ab99f080c7
Opcode Fuzzy Hash: 522aa6a7c379a3bf7e85dc3440b748af933bb2e54638cb0dba3e7d7d048e0965
Instruction Fuzzy Hash: 23F03775104A80AFD326CF56CD84C22BFB9FF8566071A8489EC4A9B362C634FC42CF60

Function 07C8170F Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d16d5906f26f5dbfd528bb65160ce5ef5c1858e06fd2b1445011e7075b766aac
Instruction ID: 299bc3140fff17e8603b6c94521add800eb8de4f687cc72e84a7001a27ea932f
Opcode Fuzzy Hash: d16d5906f26f5dbfd528bb65160ce5ef5c1858e06fd2b1445011e7075b766aac
Instruction Fuzzy Hash: 74E04F3144E2C59FCB478F70ECE56C87F709F13250B1980EBE8989A0B3C62544AAC722

Function 07C88CC0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 831c50884b209392aa5b8207b79763f68eb5d40a3bb4de92d8e5ce1fd16a71e7
Instruction ID: f485887c40021d4b04ab9e96724c580b71826cfaecd9f7299b58c071c9595a8a
Opcode Fuzzy Hash: 831c50884b209392aa5b8207b79763f68eb5d40a3bb4de92d8e5ce1fd16a71e7
Instruction Fuzzy Hash: 7DE086A16462800BC745E3B459741F96F938B8651031580D7D04ACB759C8704C468766

Function 07C88CD0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6c764a8d9f48b971ad540cb25d8a8f153de2648cfa06d33a0f698d319e56826
Instruction ID: f1b63b70e71eccb87801cfcba02191cf6def6bb4883cb99d3f0560e7fd412a6e
Opcode Fuzzy Hash: c6c764a8d9f48b971ad540cb25d8a8f153de2648cfa06d33a0f698d319e56826
Instruction Fuzzy Hash: CDD0C97570021857CB08E6BAA42057FB6DF9BC9A50B05806ADA0AC3744CDB59C014AAA

Function 07C892A0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0517a0be6a414d4e8f5e70e243f5ed2176308ab4ae07ce465eec3fda36e79a12
Instruction ID: c12b2347baa4506d4b9b0775252a941ea42cb00b0745f27be9e95f8055e2471b
Opcode Fuzzy Hash: 0517a0be6a414d4e8f5e70e243f5ed2176308ab4ae07ce465eec3fda36e79a12
Instruction Fuzzy Hash: F0C0023B3500149F87009B6DF884C99B7B9EBD9675320816BF209CB230C67298159B50

Function 07C81740 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acce728a79ab3cf2058b5511c4904abd6a7374fdb9943cf90738fee5a5c3801e
Instruction ID: 785416983ea2a8f4845e871ff155bb8cb76107ad861914675e4a963c4bfc910d
Opcode Fuzzy Hash: acce728a79ab3cf2058b5511c4904abd6a7374fdb9943cf90738fee5a5c3801e
Instruction Fuzzy Hash: 62B0923600020CAB87009A84EC04895BB69AB98611700C025BA09061258B72A862DB98

Non-executed Functions

Function 02F4F03C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2921587900.0000000002F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2f40000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31711ae56094709f1c4b2e0ab9bfe89965babd2c8c581a3ca7d289da28d29648
Instruction ID: 13a0342216b19f200c2fbf2a664318bf4ac259e037baca9e111c321875b45489
Opcode Fuzzy Hash: 31711ae56094709f1c4b2e0ab9bfe89965babd2c8c581a3ca7d289da28d29648
Instruction Fuzzy Hash: 16A16032E002058FCF15DFB4C8445AEBBB2FF89744B15466AEA06AB225DFB1E955CF40

Function 07C860E8 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2936650417.0000000007C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7c80000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1743a811a3a722c885dae5df6c93cb63305b9875a6834a1fb79e5bca741f1383
Instruction ID: 8ff645b97d446fb41d9407653c419c860eb345557574ad3055ceb6d672588b9f
Opcode Fuzzy Hash: 1743a811a3a722c885dae5df6c93cb63305b9875a6834a1fb79e5bca741f1383
Instruction Fuzzy Hash: 1B913A743402058FDB44EF39D990A6A77A6EFC9740F1080A8EA11CF3B9DA35EC42CB90

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report STlUEqhwpx.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Quasar

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\STlUEqhwpx.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
STlUEqhwpx.exe

Function 02570CD1 Relevance: 3.4, APIs: 2, Instructions: 359
memorythreadCOMMON

Function 0257120C Relevance: 1.6, APIs: 1, Instructions: 142
processCOMMON

Function 02570548 Relevance: 1.6, APIs: 1, Instructions: 140
processCOMMON

Function 0257056C Relevance: 1.6, APIs: 1, Instructions: 63
injectionCOMMON

Function 025715B9 Relevance: 1.6, APIs: 1, Instructions: 61
injectionCOMMON

Function 025714F8 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Function 02570560 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Function 02570554 Relevance: 1.6, APIs: 1, Instructions: 57
threadCOMMON

Function 02570578 Relevance: 1.6, APIs: 1, Instructions: 57
threadCOMMON

Function 02571441 Relevance: 1.6, APIs: 1, Instructions: 56
threadCOMMON

Function 07C89980 Relevance: 3.2, Strings: 2, Instructions: 711
COMMON

Function 02F46518 Relevance: 6.1, APIs: 4, Instructions: 142
threadCOMMON

Function 02F44E90 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Function 07C871E0 Relevance: 4.3, Strings: 3, Instructions: 529
COMMON

Function 07C80730 Relevance: 4.1, Strings: 3, Instructions: 367
COMMON

Function 07C85BB0 Relevance: 2.8, Strings: 2, Instructions: 312
COMMON

Function 07C85BC0 Relevance: 2.8, Strings: 2, Instructions: 295
COMMON

Function 02F4BFF0 Relevance: 1.7, APIs: 1, Instructions: 201
COMMON

Function 02F46414 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 02F47364 Relevance: 1.6, APIs: 1, Instructions: 95
COMMON