Edit tour

Windows Analysis Report
r9RH4Zmt7ycN6yWI.exe

Overview

General Information

Sample name:	r9RH4Zmt7ycN6yWI.exe
Analysis ID:	1528601
MD5:	7819e21421b6342e651bb0e96c5dd6ff
SHA1:	7e6020b11bda2846ca636afd27455a88efcc7d19
SHA256:	d165b9480d7b128168937ba591b070295fe967d831ec055cad5d458e55d3cbbc
Tags:	exeuser-Porcupine
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

.NET source code contains potential unpacker

AI detected suspicious sample

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Detected potential crypto function

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

r9RH4Zmt7ycN6yWI.exe (PID: 6468 cmdline: "C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe" MD5: 7819E21421B6342E651BB0E96C5DD6FF)

WerFault.exe (PID: 1020 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6468 -s 1472 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: r9RH4Zmt7ycN6yWI.exe	ReversingLabs: Detection: 23%
Source: r9RH4Zmt7ycN6yWI.exe	Virustotal: Detection: 32%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: r9RH4Zmt7ycN6yWI.exe

Joe Sandbox ML: detected

Source: r9RH4Zmt7ycN6yWI.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: r9RH4Zmt7ycN6yWI.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: ?oC:\Users\user\Desktop\ilgP.pdbp source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2172412230.0000000000D57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2177098852.0000000008BE0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\ilgP.pdbpdblgP.pdb source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2173309475.00000000011DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ilgP.pdb Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program Files (x86)ProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files owaa source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2177098852.0000000008C28000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2173309475.00000000011DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Accessibility.pdb source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: ilgP.pdb source: r9RH4Zmt7ycN6yWI.exe, WERBEC4.tmp.dmp.5.dr
Source:	Binary string: \??\C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.PDBs source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2177098852.0000000008BE0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ilgP.pdbs\ilgP.pdbpdblgP.pdb source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2172412230.0000000000D57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: !!.pdb source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2172412230.0000000000D57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2173309475.00000000011DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\exe\ilgP.pdb source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2173309475.00000000011DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2173076269.0000000001132000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\ilgP.pdbdb source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2173309475.00000000011DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: System.Core.ni.pdb source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: ilgP.pdb} source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2177098852.0000000008C28000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\ilgP.pdb source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2173309475.00000000011DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2177098852.0000000008C28000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb;( source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: mscorlib.ni.pdb source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: nDC:\Users\user\Desktop\ilgP.pdb :k source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2172412230.0000000000D57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: asic.pdb source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2177098852.0000000008C28000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: uc.pdb source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2172412230.0000000000D57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: @o.pdb source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2172412230.0000000000D57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: ilgP.pdbSHA256 source: r9RH4Zmt7ycN6yWI.exe
Source:	Binary string: symbols\exe\ilgP.pdbo& source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2172412230.0000000000D57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: n(C:\Windows\ilgP.pdb source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2172412230.0000000000D57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.pdb source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: System.Xml.pdb source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: System.pdb source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: ilgP.pdbX source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2172412230.0000000000D57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2173309475.00000000011CF000.00000004.00000020.00020000.00000000.sdmp, r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2173076269.0000000001166000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb(G source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: System.Windows.Forms.pdb source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: System.Drawing.pdb,Waq(( source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdbpq source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2177098852.0000000008BE0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2173309475.00000000011D5000.00000004.00000020.00020000.00000000.sdmp, WERBEC4.tmp.dmp.5.dr
Source:	Binary string: \??\C:\Windows\symbols\exe\ilgP.pdbv source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2177098852.0000000008BE0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.pdb source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdbes source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2177098852.0000000008BE0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: System.Core.pdbMZ source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdbpqT source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2177098852.0000000008BE0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.PDB source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2172412230.0000000000D57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: ualBasic.pdb! source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2177098852.0000000008C28000.00000004.00000020.00020000.00000000.sdmp

Source: unknown

DNS traffic detected: query: 206.23.85.13.in-addr.arpa replaycode: Name error (3)

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa

Source: Amcache.hve.5.dr

String found in binary or memory: http://upx.sf.net

Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Code function: 0_2_010ED55C	0_2_010ED55C
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Code function: 0_2_06FC0040	0_2_06FC0040
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Code function: 0_2_06FC2900	0_2_06FC2900

Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6468 -s 1472

Source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000000.2012705828.00000000009B2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameilgP.exed" vs r9RH4Zmt7ycN6yWI.exe
Source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2173076269.00000000010FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs r9RH4Zmt7ycN6yWI.exe
Source: r9RH4Zmt7ycN6yWI.exe	Binary or memory string: OriginalFilenameilgP.exed" vs r9RH4Zmt7ycN6yWI.exe

Source: r9RH4Zmt7ycN6yWI.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: r9RH4Zmt7ycN6yWI.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2173309475.00000000011CF000.00000004.00000020.00020000.00000000.sdmp, r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2173076269.0000000001166000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb

Source: classification engine

Classification label: mal60.evad.winEXE@2/5@1/0

Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6468

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\43249652-be51-48cf-9755-0e7aea3a716e

Jump to behavior

Source: r9RH4Zmt7ycN6yWI.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: r9RH4Zmt7ycN6yWI.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: r9RH4Zmt7ycN6yWI.exe	ReversingLabs: Detection: 23%
Source: r9RH4Zmt7ycN6yWI.exe	Virustotal: Detection: 32%

Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe

File read: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe:Zone.Identifier

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe "C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe"
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6468 -s 1472

Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Section loaded: propsys.dll	Jump to behavior

Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: r9RH4Zmt7ycN6yWI.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: r9RH4Zmt7ycN6yWI.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: r9RH4Zmt7ycN6yWI.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: ?oC:\Users\user\Desktop\ilgP.pdbp source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2172412230.0000000000D57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2177098852.0000000008BE0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\ilgP.pdbpdblgP.pdb source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2173309475.00000000011DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ilgP.pdb Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program Files (x86)ProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files owaa source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2177098852.0000000008C28000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2173309475.00000000011DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Accessibility.pdb source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: ilgP.pdb source: r9RH4Zmt7ycN6yWI.exe, WERBEC4.tmp.dmp.5.dr
Source:	Binary string: \??\C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.PDBs source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2177098852.0000000008BE0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ilgP.pdbs\ilgP.pdbpdblgP.pdb source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2172412230.0000000000D57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: !!.pdb source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2172412230.0000000000D57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2173309475.00000000011DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\exe\ilgP.pdb source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2173309475.00000000011DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2173076269.0000000001132000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\ilgP.pdbdb source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2173309475.00000000011DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: System.Core.ni.pdb source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: ilgP.pdb} source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2177098852.0000000008C28000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\ilgP.pdb source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2173309475.00000000011DF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2177098852.0000000008C28000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb;( source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: mscorlib.ni.pdb source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: nDC:\Users\user\Desktop\ilgP.pdb :k source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2172412230.0000000000D57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: asic.pdb source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2177098852.0000000008C28000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: uc.pdb source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2172412230.0000000000D57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: @o.pdb source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2172412230.0000000000D57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: ilgP.pdbSHA256 source: r9RH4Zmt7ycN6yWI.exe
Source:	Binary string: symbols\exe\ilgP.pdbo& source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2172412230.0000000000D57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: n(C:\Windows\ilgP.pdb source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2172412230.0000000000D57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.pdb source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: System.Xml.pdb source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: System.pdb source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: ilgP.pdbX source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2172412230.0000000000D57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2173309475.00000000011CF000.00000004.00000020.00020000.00000000.sdmp, r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2173076269.0000000001166000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb(G source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: System.Windows.Forms.pdb source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: System.Drawing.pdb,Waq(( source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdbpq source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2177098852.0000000008BE0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2173309475.00000000011D5000.00000004.00000020.00020000.00000000.sdmp, WERBEC4.tmp.dmp.5.dr
Source:	Binary string: \??\C:\Windows\symbols\exe\ilgP.pdbv source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2177098852.0000000008BE0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.pdb source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdbes source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2177098852.0000000008BE0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: System.Core.pdbMZ source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdbpqT source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2177098852.0000000008BE0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.PDB source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2172412230.0000000000D57000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERBEC4.tmp.dmp.5.dr
Source:	Binary string: ualBasic.pdb! source: r9RH4Zmt7ycN6yWI.exe, 00000000.00000002.2177098852.0000000008C28000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: r9RH4Zmt7ycN6yWI.exe, mainForm.cs	.Net Code: InitializeComponent System.AppDomain.Load(byte[])
Source: r9RH4Zmt7ycN6yWI.exe, mainForm.cs	.Net Code: InitializeComponent contains xor as well as GetObject
Source: 0.2.r9RH4Zmt7ycN6yWI.exe.2ce2c90.1.raw.unpack, RZ.cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.r9RH4Zmt7ycN6yWI.exe.6f80000.5.raw.unpack, RZ.cs	.Net Code: System.Reflection.Assembly.Load(byte[])

Source: r9RH4Zmt7ycN6yWI.exe

Static PE information: 0xACB1A9A7 [Sun Oct 23 20:20:55 2061 UTC]

Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe

Code function: 0_2_06FC6571 push ebx; retf

0_2_06FC6572

Source: r9RH4Zmt7ycN6yWI.exe

Static PE information: section name: .text entropy: 7.961191075094136

Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Memory allocated: 10E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Memory allocated: 2C80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Memory allocated: 4C80000 memory reserve \| memory write watch	Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Queries volume information: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	2 Virtualization/Sandbox Evasion	OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
r9RH4Zmt7ycN6yWI.exe	24%	ReversingLabs
r9RH4Zmt7ycN6yWI.exe	32%	Virustotal	Browse
r9RH4Zmt7ycN6yWI.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
206.23.85.13.in-addr.arpa	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
206.23.85.13.in-addr.arpa	unknown	unknown	false	1%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.5.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528601
Start date and time:	2024-10-08 04:01:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	r9RH4Zmt7ycN6yWI.exe
Detection:	MAL
Classification:	mal60.evad.winEXE@2/5@1/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 42 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, fs.microsoft.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
22:01:56	API Interceptor	1x Sleep call for process: r9RH4Zmt7ycN6yWI.exe modified
22:02:11	API Interceptor	1x Sleep call for process: WerFault.exe modified

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_r9RH4Zmt7ycN6yWI_7077397d61485eeab725ed52e85b8f491a9067_a9578677_09806032-06dd-4c9d-b27a-df0e82bb2810\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1843018697382046
Encrypted:	false
SSDEEP:	192:NlCUBLz7IHkd0BU/qauOJo1ZrtV3zuiFVZ24IO8D:D9PIEeBU/qapW3zuiFVY4IO8D
MD5:	621D22E45AE5184D58102A8571E152FC
SHA1:	746DCCAB7D0D48B045D972E9FB11B2402D8419C5
SHA-256:	DD57508B861CCB75CFB734FDB10F36C75DC735F46AC20844F57CC599E0E2D863
SHA-512:	4EB9D9BD9FB14019C40D0CB8CA1D5D2B9303DBA5FC88A5CD46E24F885A914941DF7D142D46936EB88D58AD32DB0CC6ED7C6AA12DBF71639D4F156D9B3580AE19
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.8.2.6.5.1.7.1.0.5.2.8.9.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.8.2.6.5.1.8.5.2.7.1.5.6.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.9.8.0.6.0.3.2.-.0.6.d.d.-.4.c.9.d.-.b.2.7.a.-.d.f.0.e.8.2.b.b.2.8.1.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.7.f.0.2.4.2.e.-.4.6.f.c.-.4.0.d.7.-.a.d.c.2.-.7.2.5.b.c.a.f.5.9.e.6.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.9.R.H.4.Z.m.t.7.y.c.N.6.y.W.I...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.i.l.g.P...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.4.4.-.0.0.0.1.-.0.0.1.4.-.5.6.3.9.-.5.3.0.d.2.6.1.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.d.2.0.a.0.7.8.5.1.0.9.a.5.a.a.c.3.7.5.d.d.2.8.f.3.e.f.4.7.3.8.0.0.0.0.0.0.0.0.!.0.0.0.0.7.e.6.0.2.0.b.1.1.b.d.a.2.8.4.6.c.a.6.3.6.a.f.d.2.7.4.5.5.a.8.8.e.f.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBEC4.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Tue Oct 8 02:01:57 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	296537
Entropy (8bit):	4.276161738814937
Encrypted:	false
SSDEEP:	3072:3f9uB4uEqo5LTgBKfaYnyxJUKsCKKKJ0CAwRPhyU4NC2o:3I4jTg4fAraJXRpyUT
MD5:	A28C0C29DE6D3F8670BE07FB9B0EEC13
SHA1:	FD187C7D8D23037D80B3E6D0B866A14B8ED855F9
SHA-256:	6D2E937D296F1147FD50566832A5828DD16653580900E6E6176C5C0D4856307C
SHA-512:	5FD8077E9BEF321066CC9BA26AEEE5493C6076CEEFB34C182BAEE71569006F45FA32D7EA32267C3C20425827D40CFB38186B35F1846A98EF707D450B73D80D89
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ..........g....................................$....&......D....P..........`.......8...........T............9..yL...........&...........(..............................................................................eJ......,)......GenuineIntel............T.......D......g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC0AA.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8450
Entropy (8bit):	3.713846056510561
Encrypted:	false
SSDEEP:	192:R6l7wVeJBM6Zl6YEI2SU9xnigmfZkYUmprV89b2gsf0oSm:R6lXJq6Zl6YE5SU9xigmfmYUp2zf1
MD5:	4545694E4E1D784233AF613401C23CFE
SHA1:	FDABB7935AE65FC65A55E230F5EEFB8BDD732A96
SHA-256:	719C739B14C781E00B54A3445E540E9C2CE917540D68E593EDB7D397ABB8C1D8
SHA-512:	82B2BF8889823C752D84A24E78FB3AE42AE5F79254DA8B2DC643F37D6752AD34B13158C164C8C92599E10E29E51C761D9531EEAC9E1016BDA59DC9BFD4AA2C03
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.4.6.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC0CA.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4795
Entropy (8bit):	4.540089773003421
Encrypted:	false
SSDEEP:	48:cvIwWl8zs3/Jg77aI9vkWpW8VYXYm8M4Jsr5I2FPI+q8ve5ISceK36E6eUd:uIjfxI7997V/JC3IKMrHzzrd
MD5:	1BA8108BBFB0EFBE66E216C4D92F35BD
SHA1:	E5E64A45171BC1ACA219BD2219EB23983D6E24C7
SHA-256:	1E0997DDD789F3184A0F73DCDE6F52A9E9C2ED2DA8777F794C141B1E69698524
SHA-512:	B7C4D65E54B2367726C4163EC2CE332D3528F3F9476B98ED80681B3F9BE3D59665ACC28C2B96AA4485DB194C051D8A65D41C432F266C3ACE9617CB45545E438B
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533824" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421800695054357
Encrypted:	false
SSDEEP:	6144:uSvfpi6ceLP/9skLmb0OTdWSPHaJG8nAgeMZMMhA2fX4WABlEnNh0uhiTw6:NvloTdW+EZMM6DFyL03w6
MD5:	40655B7DBB1C68A164A16DCA1D997B3B
SHA1:	CB613330C328D6E9C0151327E6621A4BB43283E8
SHA-256:	6C716D1A3EB18BCFDB98E49D3490FB01342D7BFFFBBBA0DADD93913317D02F5A
SHA-512:	55C19EE25F8115CCD72B5DF019356BA7105BDF783A09546881DE8469CDF3DAC849017B04ED0A3C149E952787C19217649875D995EC6181FAED3AD32A090940CD
Malicious:	false
Reputation:	low
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm....&................................................................................................................................................................................................................................................................................................................................................=.9........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.955650773191121
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	r9RH4Zmt7ycN6yWI.exe
File size:	717'312 bytes
MD5:	7819e21421b6342e651bb0e96c5dd6ff
SHA1:	7e6020b11bda2846ca636afd27455a88efcc7d19
SHA256:	d165b9480d7b128168937ba591b070295fe967d831ec055cad5d458e55d3cbbc
SHA512:	8fd58778b82c73fb4162e0928dd617c37ff65d4bebeab45832ea0b4cf69858652cae2265b387089559d2c97882e7e8b04bc50b25613d7097c7abb2a6e3feb649
SSDEEP:	12288:xD5mU+8zE1NLteB2Cj+hBNmXRJKj6+mLJGAiFrHcynpBUVDTLxEaw:FxfatE5+YJ5JperHcQBUVHL5w
TLSH:	A1E4230547E98336E0BEDE74657159E0C777B52A28B2DB0E6FC1642D0BA7B008E64F53
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.............^.... ... ....@.. .......................`............@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4b075e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xACB1A9A7 [Sun Oct 23 20:20:55 2061 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb070b	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb2000	0x5fc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb4000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xade44	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xae764	0xae800	000098386cd4ef0d9d688fd846d10706	False	0.9658063216332379	data	7.961191075094136	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xb2000	0x5fc	0x600	3bb030a355ebe702b69b74aec884a0f1	False	0.42578125	data	4.175651520059742	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb4000	0xc	0x200	ca88dedc4ae831a387225a4e5dca0aee	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xb2090	0x36c	data			0.4029680365296804
RT_MANIFEST	0xb240c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 04:02:28.464783907 CEST	53	52961	162.159.36.2	192.168.2.5
Oct 8, 2024 04:02:28.965265989 CEST	60127	53	192.168.2.5	1.1.1.1
Oct 8, 2024 04:02:28.972767115 CEST	53	60127	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 8, 2024 04:02:28.965265989 CEST	192.168.2.5	1.1.1.1	0x480	Standard query (0)	206.23.85.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 04:02:28.972767115 CEST	1.1.1.1	192.168.2.5	0x480	Name error (3)	206.23.85.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

Target ID:	0
Start time:	22:01:56
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\r9RH4Zmt7ycN6yWI.exe"
Imagebase:	0x900000
File size:	717'312 bytes
MD5 hash:	7819E21421B6342E651BB0E96C5DD6FF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	22:01:56
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6468 -s 1472
Imagebase:	0xa10000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	39
Total number of Limit Nodes:	1

Executed Functions

Function 06FC2900 Relevance: 6.1, Strings: 4, Instructions: 1105COMMON

Download Yara Rule

Strings

4']q, xrefs: 06FC35E3
4']q, xrefs: 06FC2A2B
(o]q, xrefs: 06FC2FE8
4']q, xrefs: 06FC2924

Memory Dump Source

Source File: 00000000.00000002.2176671502.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fc0000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID:
String ID: (o]q$4']q$4']q$4']q
API String ID: 0-875651895
Opcode ID: 2ccee2712f47a75a02ab9bbd95a2861544fb02f1949cb72b2e473fadbbfd3d6c
Instruction ID: b350565dbbb0c9477c15439fcb21cc0e8ffba9bb39cc2d1b1ee84266d459ae8d
Opcode Fuzzy Hash: 2ccee2712f47a75a02ab9bbd95a2861544fb02f1949cb72b2e473fadbbfd3d6c
Instruction Fuzzy Hash: 22A2A172A0020ADFCB55CF68CA84AAEBBF6FF88360F158569E405DB351D735E941CB90

Function 06FC0040 Relevance: 5.3, Strings: 4, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,aq, xrefs: 06FC01C0
,aq, xrefs: 06FC01B2
(o]q, xrefs: 06FC013A
(o]q, xrefs: 06FC0148

Memory Dump Source

Source File: 00000000.00000002.2176671502.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fc0000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$,aq$,aq
API String ID: 0-1947289240
Opcode ID: 87403dc4d60d75d12b888a5fd4cc8529d64756dcc4bdaccf482ef9b0b739c2aa
Instruction ID: c8aff11d4d7564e4b633910cc86547ee1d071560a1ee89662c50bf544eed6e18
Opcode Fuzzy Hash: 87403dc4d60d75d12b888a5fd4cc8529d64756dcc4bdaccf482ef9b0b739c2aa
Instruction Fuzzy Hash: 9AD14F31E1010ACFDB54CF99CA94AAEBBF6FF88314F558159E405A7360DB32E942CB50

Function 06FC6F9C Relevance: 22.9, Strings: 18, Instructions: 371
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te]q, xrefs: 06FC7170
fbq, xrefs: 06FC740A
XX]q, xrefs: 06FC7071
XX]q, xrefs: 06FC7124
$]q, xrefs: 06FC7211
fbq, xrefs: 06FC741A
$]q, xrefs: 06FC72F7
fbq, xrefs: 06FC72D2
XX]q, xrefs: 06FC7023
$]q, xrefs: 06FC7221
$]q, xrefs: 06FC730D
$]q, xrefs: 06FC73BB
XX]q, xrefs: 06FC7105
Te]q, xrefs: 06FC7164
fbq, xrefs: 06FC72E2
XX]q, xrefs: 06FC7156
$]q, xrefs: 06FC7319
XX]q, xrefs: 06FC7033

Memory Dump Source

Source File: 00000000.00000002.2176671502.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fc0000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID:
String ID: fbq$ fbq$ fbq$ fbq$Te]q$Te]q$XX]q$XX]q$XX]q$XX]q$XX]q$XX]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1214805740
Opcode ID: 960ecfe934d83b113ec6912bc8edf08e18fd258eb3d356410a0a17b0c9d9ee9f
Instruction ID: 5b5ec4120e21590318842f880ce1d7f9a0e70052ceb51d0936138c9d7665169e
Opcode Fuzzy Hash: 960ecfe934d83b113ec6912bc8edf08e18fd258eb3d356410a0a17b0c9d9ee9f
Instruction Fuzzy Hash: 8ED19631F4011ACFDB58AF99CAA57AD77B6BF84720F248419E902AB394C7349D42CF91

Function 06FC0628 Relevance: 10.5, Strings: 8, Instructions: 480
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o]q, xrefs: 06FC0B37
(o]q, xrefs: 06FC0B27
,aq, xrefs: 06FC0AB8
(o]q, xrefs: 06FC07DA
,aq, xrefs: 06FC0AC8
(o]q, xrefs: 06FC0656
(o]q, xrefs: 06FC0711
(o]q, xrefs: 06FC073D

Memory Dump Source

Source File: 00000000.00000002.2176671502.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fc0000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$(o]q$(o]q$(o]q$(o]q$,aq$,aq
API String ID: 0-1435242062
Opcode ID: 89e586b9ab6788eb3a1cabc0acf3340da04ec96e34b4035de9c697e950e24d81
Instruction ID: 2891f3f7b7d89e60d594d5d01ca33409ac9a0eb7eaf405875fdc63fef80c0906
Opcode Fuzzy Hash: 89e586b9ab6788eb3a1cabc0acf3340da04ec96e34b4035de9c697e950e24d81
Instruction Fuzzy Hash: AE124C30A0060ADFCB54CF68DA84A9EBBF6FF88324F148559E449DB261DB31ED46CB50

Function 06FC7139 Relevance: 10.2, Strings: 8, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06FC72F7
fbq, xrefs: 06FC72D2
fbq, xrefs: 06FC740A
$]q, xrefs: 06FC730D
$]q, xrefs: 06FC73BB
$]q, xrefs: 06FC7211
Te]q, xrefs: 06FC7164
XX]q, xrefs: 06FC7156

Memory Dump Source

Source File: 00000000.00000002.2176671502.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fc0000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID:
String ID: fbq$ fbq$Te]q$XX]q$$]q$$]q$$]q$$]q
API String ID: 0-1505870616
Opcode ID: 2248fd922bffa353ea2e3ae2700d0ad0f421cac438cbe5f15222302de79b2166
Instruction ID: 9b8cbe6f655c55b4afa86292ef5d1032f5a071028ad2f61889e9c9e83913e396
Opcode Fuzzy Hash: 2248fd922bffa353ea2e3ae2700d0ad0f421cac438cbe5f15222302de79b2166
Instruction Fuzzy Hash: D6718731E0421ADFEB94EE99D6957ADB7B2FF80720F24441AE502AB294C7309D41CF91

Function 06FC5B50 Relevance: 7.6, Strings: 6, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06FC5C1E
LR]q, xrefs: 06FC5B8A
$]q, xrefs: 06FC5D14
LR]q, xrefs: 06FC5CFB
$]q, xrefs: 06FC5D20
$]q, xrefs: 06FC5C10

Memory Dump Source

Source File: 00000000.00000002.2176671502.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fc0000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID:
String ID: LR]q$LR]q$$]q$$]q$$]q$$]q
API String ID: 0-1969043450
Opcode ID: f9a15ba450e913118198348821e2e5adc406a9d42ebd8680e443fb0349dea5cc
Instruction ID: 2d6bb1403b825f9990625dd6f5f49c4f85fe0c35ccd602af0ce29e362310563a
Opcode Fuzzy Hash: f9a15ba450e913118198348821e2e5adc406a9d42ebd8680e443fb0349dea5cc
Instruction Fuzzy Hash: 5C51F531F4420ACFEB588B69C95477EBBF2FB84720F14842EE102EB281DB74A851C791

Function 06FC061A Relevance: 5.3, Strings: 4, Instructions: 274
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o]q, xrefs: 06FC07DA
(o]q, xrefs: 06FC0656
(o]q, xrefs: 06FC0711
(o]q, xrefs: 06FC073D

Memory Dump Source

Source File: 00000000.00000002.2176671502.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fc0000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$(o]q$(o]q
API String ID: 0-1261621458
Opcode ID: 668cc8065c27a6e4ee988bbf9e6572122665cf64cc6f27d370e49158b4f0086a
Instruction ID: 4bfbc15be96e6c7a5e9a4b7df8ee7bb57c3ff44643df462f048929334f804d39
Opcode Fuzzy Hash: 668cc8065c27a6e4ee988bbf9e6572122665cf64cc6f27d370e49158b4f0086a
Instruction Fuzzy Hash: 0FC14D30E0020ADFCB54CF69CA84A9EBBF6BF48324F148559E455DB261DB36E942CF90

Function 06FC58E0 Relevance: 4.2, Strings: 3, Instructions: 439
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LR]q, xrefs: 06FC5B8A
$]q, xrefs: 06FC5D14
$]q, xrefs: 06FC5C10

Memory Dump Source

Source File: 00000000.00000002.2176671502.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fc0000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID:
String ID: LR]q$$]q$$]q
API String ID: 0-4258901230
Opcode ID: d06a19b01ead93ba7ac0b625ced5baa8b5e8ab52d5b32347664adee2b1f2395b
Instruction ID: 95451981bea37cdcafda04363aece76218eef9ea4c02ef02f9792b3eee388ffa
Opcode Fuzzy Hash: d06a19b01ead93ba7ac0b625ced5baa8b5e8ab52d5b32347664adee2b1f2395b
Instruction Fuzzy Hash: 32412631E04306DFDB548F69CD54BBABBF2FB84721F14846EE141AB281D770A951CB91

Function 06FC3E58 Relevance: 2.9, Strings: 2, Instructions: 370
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o]q, xrefs: 06FC3E91
(o]q, xrefs: 06FC3EB5

Memory Dump Source

Source File: 00000000.00000002.2176671502.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fc0000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID:
String ID: (o]q$(o]q
API String ID: 0-1858875562
Opcode ID: b41a8363846b08d57c0416dfbbc1ab358b83488cc8052f33d305f7892976e958
Instruction ID: 774adbba78a91c5ab71946ee79cc1df7f17b24e21ab38b918ede4930c5ffdcb0
Opcode Fuzzy Hash: b41a8363846b08d57c0416dfbbc1ab358b83488cc8052f33d305f7892976e958
Instruction Fuzzy Hash: 38F14831A0011A9FCB51CF98CAA1DEEBBF6FF88320B15C519E955DB294C734E841CBA0

Function 06FC1BB8 Relevance: 2.8, Strings: 2, Instructions: 336COMMON

Download Yara Rule

Strings

4']q, xrefs: 06FC1BF7
4']q, xrefs: 06FC1BD1

Memory Dump Source

Source File: 00000000.00000002.2176671502.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fc0000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: 183c895d47f2768d665a06907856e9a44a4fc589569972a9436e7d4205af252a
Instruction ID: 2cfcd4bb3e155abf41367c216365f8049d8dba5ed06eb075801adbef36ba95e6
Opcode Fuzzy Hash: 183c895d47f2768d665a06907856e9a44a4fc589569972a9436e7d4205af252a
Instruction Fuzzy Hash: 4FB15231B14103CFEB99DA29CA5473D369AEF85720F14406EF506CB3A2EB29DC62C791

Function 06FC1A18 Relevance: 2.6, Strings: 2, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06FC1AD4
$]q, xrefs: 06FC1AF7

Memory Dump Source

Source File: 00000000.00000002.2176671502.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fc0000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 1043a99f828f8bbe9296da2b12e09d2716f8eda88813446381de27e031af7bbd
Instruction ID: 49abbbb261310e82bc71987f43b3514ff93335103bf98ca44f8fd9fb2325ea14
Opcode Fuzzy Hash: 1043a99f828f8bbe9296da2b12e09d2716f8eda88813446381de27e031af7bbd
Instruction Fuzzy Hash: 6931D830B082438FD756CB64CE9163E7BA5AF85360715449ED016CB353EA28DC55CBA1

Function 010EAD48 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 010EAF9E

Memory Dump Source

Source File: 00000000.00000002.2173047509.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10e0000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: eaa697011210cdb139f9e8236c4726fbe5c658084d067559884d0a1271f21b6a
Instruction ID: 0547f0cb1c01f1f2e25ab553e2236d03707fb0487867b713c8b77e7729eef488
Opcode Fuzzy Hash: eaa697011210cdb139f9e8236c4726fbe5c658084d067559884d0a1271f21b6a
Instruction Fuzzy Hash: 21711170A00B05CFDB65DF2AD44879ABBF5BF88304F00896DE48A97B50DB75E949CB90

Function 010E590D Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 010E59C9

Memory Dump Source

Source File: 00000000.00000002.2173047509.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10e0000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 99ed00c72f90faac01c067f9fc6a7e83f01ef096c68a1b21d71a4f562c9737a2
Instruction ID: 8f7a7d180ebda3f7b687730527eea45a427cc1ca1afc919e575a6fb0ec275ddd
Opcode Fuzzy Hash: 99ed00c72f90faac01c067f9fc6a7e83f01ef096c68a1b21d71a4f562c9737a2
Instruction Fuzzy Hash: 8341E1B5C00319CFDB24CFA9C888A9DBBF5BF44308F24846AD448AB254DB756946CF90

Function 010E44C4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 010E59C9

Memory Dump Source

Source File: 00000000.00000002.2173047509.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10e0000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 00229523873ed8419afb786e3245b20e5b35fb1247c27d426014e4b334250020
Instruction ID: c11814dc75ef2405deabf63886f901bf605ea0780b63ca504135fc87d07bb8da
Opcode Fuzzy Hash: 00229523873ed8419afb786e3245b20e5b35fb1247c27d426014e4b334250020
Instruction Fuzzy Hash: 7B41F1B4C00719CFDB24CFAAC888B8EBBF1BF49304F24846AD448AB251DB755946CF90

Function 010ED21C Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,010ED5F6,?,?,?,?,?), ref: 010ED6B7

Memory Dump Source

Source File: 00000000.00000002.2173047509.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10e0000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a33bc553d1fd691de0c285c30b1b08314a9bc9fca921f7893b26fe3d4c51bd7b
Instruction ID: 2ab54f634c2a63a02fc35c7cfff69d06212a2df857a05ba347aca4814d92a331
Opcode Fuzzy Hash: a33bc553d1fd691de0c285c30b1b08314a9bc9fca921f7893b26fe3d4c51bd7b
Instruction Fuzzy Hash: 8F21E5B5910208AFDB10CF9AD584ADEBFF8EB48320F14841AE958A3310D378A944CFA4

Function 010ED628 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,010ED5F6,?,?,?,?,?), ref: 010ED6B7

Memory Dump Source

Source File: 00000000.00000002.2173047509.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10e0000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 90a284020b5a657471b9cf669923a34344070eafae110f4a2ea97cfa9b22d143
Instruction ID: ccead15a52407fdc45e2f27b554d42190a1eb81d8f6cda4666e3e3d0daf44122
Opcode Fuzzy Hash: 90a284020b5a657471b9cf669923a34344070eafae110f4a2ea97cfa9b22d143
Instruction Fuzzy Hash: A321E6B5900208AFDB10CF9AD984ADEFFF9FB48310F14841AE958A7310D378A944CFA4

Function 010EAF38 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 010EAF9E

Memory Dump Source

Source File: 00000000.00000002.2173047509.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10e0000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 70b82c358f5d736cfacf0d33dba48ee924090b86f90526d44281fc1a8f82716b
Instruction ID: 1394b079de86fca44f274787e5e080712916a100b88efcf730a492eea9f8d4dd
Opcode Fuzzy Hash: 70b82c358f5d736cfacf0d33dba48ee924090b86f90526d44281fc1a8f82716b
Instruction Fuzzy Hash: 4E110FB6D002498FDB20CF9AD448ADEFBF4AB88324F10845AD958A7240C379A545CFA1

Function 06FC50E9 Relevance: 1.4, Strings: 1, Instructions: 163COMMON

Download Yara Rule

Strings

%*&/)(#$^@!~-_, xrefs: 06FC5121

Memory Dump Source

Source File: 00000000.00000002.2176671502.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fc0000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID:
String ID: %*&/)(#$^@!~-_
API String ID: 0-3325533558
Opcode ID: 18835257bf4bebde95c45e7f630d69dd4246b3b52803df7201ba10282e349ed2
Instruction ID: 2a26a65e203a371ae11bbd66992d05c11c94bf560b021315fa9983e26399c75f
Opcode Fuzzy Hash: 18835257bf4bebde95c45e7f630d69dd4246b3b52803df7201ba10282e349ed2
Instruction Fuzzy Hash: 1251C031F002049FC704AB78D955AAEBBB3AF89310F04C4A9E995AB399CF356D49C7D1

Function 06FC50F8 Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

%*&/)(#$^@!~-_, xrefs: 06FC5121

Memory Dump Source

Source File: 00000000.00000002.2176671502.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fc0000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID:
String ID: %*&/)(#$^@!~-_
API String ID: 0-3325533558
Opcode ID: 2539b7b1702cfcd1c5332ce8a733544255d4302a5f022c28bc62aa767782e7bf
Instruction ID: 24bcc99a3145e728a3aa9287d1abf577945093dfa04f46b898947c4ccced4108
Opcode Fuzzy Hash: 2539b7b1702cfcd1c5332ce8a733544255d4302a5f022c28bc62aa767782e7bf
Instruction Fuzzy Hash: D351CD31F002089BC704AB78D545AAEBBB3BF88310F14C4A9E985AB399CF356949C7D1

Function 06FC0BF8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176671502.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fc0000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 447067ce35b3c617ed4d2727243ea0df8861ba44dbd87931836b3192902bb249
Instruction ID: 2f8621a2e44c5d6cccc497e8d06deef7afaaf874c554c8e0d731886df753d15a
Opcode Fuzzy Hash: 447067ce35b3c617ed4d2727243ea0df8861ba44dbd87931836b3192902bb249
Instruction Fuzzy Hash: 30714C34B40206CFDB94DF28C984A6E7BE6AF49260F1540A9E906CB371DF76EC42CB51

Function 06FC3C00 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176671502.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fc0000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1b9e26b8f2ef2f57ba75fb0f5228e511e38c0e89ef7ebebfa625c2ae2849647
Instruction ID: 10b5594e50514ba6a92abb96d733063d9dde6c9d32d1ceb8905c16f45be737ba
Opcode Fuzzy Hash: e1b9e26b8f2ef2f57ba75fb0f5228e511e38c0e89ef7ebebfa625c2ae2849647
Instruction Fuzzy Hash: 5C617D72E0034E9FDF51CFA9C6406DEBBF2AF8A350F248619E845AB241D770A981CF40

Function 06FC3BF1 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176671502.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fc0000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92dee6f1d08768d3e9f4a5449b71578511c1b2abe466eb132e976174fdebb144
Instruction ID: 3f8dd7417b514a19a483bb8500bb739e24c8c2df8540092d09cfc785b47c192f
Opcode Fuzzy Hash: 92dee6f1d08768d3e9f4a5449b71578511c1b2abe466eb132e976174fdebb144
Instruction Fuzzy Hash: EB516B72E0074E9FDF51CFA5C6406DDBBF2AF8A350F24861AE849AB241D770A985CF50

Function 06FC2DD3 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176671502.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fc0000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f42a503e57a93f13a5fe8710054749d4b37b60d070ade0e14a1a9dd551f1b3b8
Instruction ID: e8d2b56825c6c3e1c762a9b5914c340022c7fc2c144d6c9ff8138d54a12d6d70
Opcode Fuzzy Hash: f42a503e57a93f13a5fe8710054749d4b37b60d070ade0e14a1a9dd551f1b3b8
Instruction Fuzzy Hash: 0F41A031A0424ADFDF51CFA8C944ADEBFB2FF49320F048159E815AB291D371EA14DB90

Function 06FC54A8 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176671502.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fc0000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d93dc50efec1237cea2ccebcc7110bc3e308d0255913875bf96d9e918413d7f
Instruction ID: 1ac448d3fa83d70ce9897792d21e5cf558ad90a798e1dabd6529f29ac8d0d828
Opcode Fuzzy Hash: 4d93dc50efec1237cea2ccebcc7110bc3e308d0255913875bf96d9e918413d7f
Instruction Fuzzy Hash: 5F416770D01209DFCB08DFA4C695A5EBBB2FF81700F24C49AC02B6B325D7309A45CB92

Function 06FC4F58 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176671502.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fc0000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e740b56581a755d3d2b2f06abb437d55af6045289d37bf26325e947f03ae45de
Instruction ID: 77ade5bbfdd180063f3fb19d30c406d2533b4805ec0061901a293e9ddd4ee477
Opcode Fuzzy Hash: e740b56581a755d3d2b2f06abb437d55af6045289d37bf26325e947f03ae45de
Instruction Fuzzy Hash: 6131083194410ACFD7449F68E6517AE7BF2EB88325F10086EE106D7340DB75AD58CBD1

Function 06FC531E Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176671502.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fc0000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a254192ed95a0c330b7a3d1d9cbf5d558096864ca7c320e421692727865e9cda
Instruction ID: ab12d47bfaf7771b08dc15382dc16b24b47d14877714a788859f991478d44edc
Opcode Fuzzy Hash: a254192ed95a0c330b7a3d1d9cbf5d558096864ca7c320e421692727865e9cda
Instruction Fuzzy Hash: DF31C52571D3804FD7064778996536A3FF69B46221F1944ABE446CB3D3CE788C19C762

Function 06FC0EA0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176671502.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fc0000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c02675727d434a56a00434c82405566e8b50c8c5692359b03a57ccc9b6d7e01
Instruction ID: 1a565bc6ed0618ed7509b164fcfd1d81ed741e70aa696aca394fe87257b06a26
Opcode Fuzzy Hash: 8c02675727d434a56a00434c82405566e8b50c8c5692359b03a57ccc9b6d7e01
Instruction Fuzzy Hash: 84219231B14212CFDB541A25D55463A369BEFC5668F14803DF506CB398EE2BCC83D385

Function 06FC5360 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176671502.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fc0000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57af013b01dcc592fd6fe7213bc82d57b86ce51304a72f670daef6a2e1c7e5d7
Instruction ID: a6fa778aa7a9c02251f228681ca062ad1e90f972d3c4a67b86c8e45dab5f8329
Opcode Fuzzy Hash: 57af013b01dcc592fd6fe7213bc82d57b86ce51304a72f670daef6a2e1c7e5d7
Instruction Fuzzy Hash: 2821F334B182058FD7445BB8956A32A3FE7EB88221F14847BF50AC7391DE749C1AC791

Function 06FC4EB2 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176671502.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fc0000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97aa3fdb7eeb35b87c6975e774baebf15c4801a35a1b07ea5a182a100fb88bc2
Instruction ID: 17079f49515bdf80a75fd4cf352bf78bdfab6d8b75a660be62f5dc34604eabae
Opcode Fuzzy Hash: 97aa3fdb7eeb35b87c6975e774baebf15c4801a35a1b07ea5a182a100fb88bc2
Instruction Fuzzy Hash: E5218E71E002199FCB45EFA8CA9199E7FF5FF44701B1045AAE016DB361EB349E45CB80

Function 00F6D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2172683647.0000000000F6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f6d000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a253cae11d6f08524d886bfebb8af82313139bd19e14742315a2de832f5413a9
Instruction ID: 882ea337f07d46bf3aad1f9b840d4700f99e589ed844fec4f8b931753b61982d
Opcode Fuzzy Hash: a253cae11d6f08524d886bfebb8af82313139bd19e14742315a2de832f5413a9
Instruction Fuzzy Hash: 00213A72A00244DFDB05DF14D9C0F16BF65FB98324F24C569D9090B256C73AEC56E7A2

Function 0108D1EC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2172824377.000000000108D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_108d000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74976f866da8fe9cacbdb11471d8ed34eac72ffcd2199168567756ac149014ab
Instruction ID: b9695161869414562934a897b2fdcab9a169fa2803070f310c2aec36a27588c9
Opcode Fuzzy Hash: 74976f866da8fe9cacbdb11471d8ed34eac72ffcd2199168567756ac149014ab
Instruction Fuzzy Hash: 2121F871548204DFDB05EF98D5C0B1ABFA5FB64324F20C6ADD9894B396C37AD406CBA1

Function 0108D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2172824377.000000000108D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_108d000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 630fdb4d729e5fe0f464b0ac88c7c1f03b972ba69d677789ce7c554fc0decb00
Instruction ID: 07c588fe785d588dccdb2d089baaa6054a8973afc15624a399ef5a29bce41cb7
Opcode Fuzzy Hash: 630fdb4d729e5fe0f464b0ac88c7c1f03b972ba69d677789ce7c554fc0decb00
Instruction Fuzzy Hash: 4821D371508204DFDB15EFA8D984B16BFA5EB84354F20C6A9E9C94B396C33AD407CB61

Function 06FC2EB8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176671502.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fc0000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87f5dd8a19e6081bd379af1f916ee4fd8d6d8f58c62c5cfb083ee71c5d2ad3e8
Instruction ID: acd77978fdb0e92946a63413a7cbe039268e99be7d43c2685900af41f6e42c4a
Opcode Fuzzy Hash: 87f5dd8a19e6081bd379af1f916ee4fd8d6d8f58c62c5cfb083ee71c5d2ad3e8
Instruction Fuzzy Hash: FA119632B0024ADFDB54CFACC945B5FBBA2EF85320F048559E8546B295D371E910C795

Function 06FC7F66 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176671502.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fc0000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dfcfe792ddd0f6a9b2890da633a5729bf9ad21045c6dac1d5bef3d2b833bfdb
Instruction ID: b16cde59f76c1e16e84f3786fb1788ce08abb3fc34bacb60c290e198cd64d3fa
Opcode Fuzzy Hash: 8dfcfe792ddd0f6a9b2890da633a5729bf9ad21045c6dac1d5bef3d2b833bfdb
Instruction Fuzzy Hash: 8511B231E0810ACFDB409F58D6C0ABEB7F1AB44321F11846AE115DB282DB34C805CFD1

Function 00F6D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2172683647.0000000000F6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f6d000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 665d23af2323171d5df781a37b818eda0d21559a3aaed1dd021ab77e4e8704d3
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: EE112672904240CFCB06CF00D5C4B16BF71FB98324F24C6A9D9090B257C33AE85ADBA2

Function 0108D1E7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2172824377.000000000108D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_108d000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: d254b8d34349b0749836ef2524f73da337d21f2d7038282ccb3e9c7859af6395
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: C711D075508240DFDB02DF54D5C4B15BFA1FB44324F24C6A9D8894B696C33AD40ACBA1

Function 0108D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2172824377.000000000108D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_108d000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: baf7b6da5eb13098359fce744d2c2efd953930ca279e52789d63e28ca9dcbc7f
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: B611BE75508280CFDB12DF54D5C4B15BFA2FB44314F24C6AAE8894B696C33AD40BCF62

Function 06FC5698 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176671502.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fc0000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f40a6f387ac392d1f74506c75f66a4a2c0e318ec4523af8cec8fc00b8ab77ba7
Instruction ID: c40994a90b0d6b1044c63c5529cb2b9c15846dfa703c71f2a4854ae4e02ac1b9
Opcode Fuzzy Hash: f40a6f387ac392d1f74506c75f66a4a2c0e318ec4523af8cec8fc00b8ab77ba7
Instruction Fuzzy Hash: 44F0F6326195398FE350866CD94067BB6E9FB4A230F05862BF55AC7381D674E8A0A2D0

Function 06FC4EC0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176671502.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fc0000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 071d11d4fc730864f4c93d31e55ba34607250ca745ee37c3402975577e915d88
Instruction ID: 3c82ba2c437710cadfce1801151498c3f7e231effce6a7d9ff233ba24610df63
Opcode Fuzzy Hash: 071d11d4fc730864f4c93d31e55ba34607250ca745ee37c3402975577e915d88
Instruction Fuzzy Hash: 4B012570D0020D9FCB45EFE8C991A9EBBF6FF44300F5085AAD115A7355EB345A099B80

Function 06FC6C68 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176671502.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fc0000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8071852598f8b79b5b69c7c22041daa4a1e49e803ccdc316c24f4e045ac65bbb
Instruction ID: 7542f81c0e4ef7e69f78b829092ba772d66d1bbbf545561cb477ac8a8005dd7b
Opcode Fuzzy Hash: 8071852598f8b79b5b69c7c22041daa4a1e49e803ccdc316c24f4e045ac65bbb
Instruction Fuzzy Hash: A6E0C260FA830D6FEFA489656D02F32364EF7C0B12F108029B209D92C4CE625801CB24

Function 06FC6C59 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176671502.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fc0000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33ac128cb8c041f01395bc8f88b707abb6f3e92bc156da2785423893232990e5
Instruction ID: aae8739c78cd8b7669ceefb9fe1836572e14bd5af605b1c256a3261cd13f9587
Opcode Fuzzy Hash: 33ac128cb8c041f01395bc8f88b707abb6f3e92bc156da2785423893232990e5
Instruction Fuzzy Hash: 6BE026E1E5D3895FEB428620AE097223F16DB91222F0984FFA057CF0C2DA685800C725

Function 06FC2410 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176671502.0000000006FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fc0000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 655ba5abb96ff962ce6ad61371b6a59d23275c14562dc64d3a44b19c78004c5e
Instruction ID: a67bcbb0abca271f3b98fdbff0b7545a196f644add0afd3f54e1324f951f0eed
Opcode Fuzzy Hash: 655ba5abb96ff962ce6ad61371b6a59d23275c14562dc64d3a44b19c78004c5e
Instruction Fuzzy Hash: B4C04C6518B3805FCA0612A068555D33B2ACB8714971544CBE28A8719346254A2ACE72

Non-executed Functions

Function 010ED55C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173047509.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10e0000_r9RH4Zmt7ycN6yWI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2614690f5395b3d82674ad48cf1302da0ad2a46fc31bc99cc5ea42c3face4e4e
Instruction ID: f4e6fc555cf4003b57f03b2b7baee9789de95c16cb67b34d097631424d0c26b7
Opcode Fuzzy Hash: 2614690f5395b3d82674ad48cf1302da0ad2a46fc31bc99cc5ea42c3face4e4e
Instruction Fuzzy Hash: A6A19032E0021A8FCF19DFB5C9484DEBBF2FF85300B1585AAE946AB265DB31D905CB40

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report r9RH4Zmt7ycN6yWI.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_r9RH4Zmt7ycN6yWI_7077397d61485eeab725ed52e85b8f491a9067_a9578677_09806032-06dd-4c9d-b27a-df0e82bb2810\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBEC4.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC0AA.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC0CA.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

UDP Packets

DNS Queries

DNS Answers

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

Windows Analysis Report
r9RH4Zmt7ycN6yWI.exe

Function 06FC0040 Relevance: 5.3, Strings: 4, Instructions: 329
COMMON

Function 06FC6F9C Relevance: 22.9, Strings: 18, Instructions: 371
COMMON

Function 06FC0628 Relevance: 10.5, Strings: 8, Instructions: 480
COMMON

Function 06FC7139 Relevance: 10.2, Strings: 8, Instructions: 197
COMMON

Function 06FC5B50 Relevance: 7.6, Strings: 6, Instructions: 144
COMMON

Function 06FC061A Relevance: 5.3, Strings: 4, Instructions: 274
COMMON

Function 06FC58E0 Relevance: 4.2, Strings: 3, Instructions: 439
COMMON

Function 06FC3E58 Relevance: 2.9, Strings: 2, Instructions: 370
COMMON

Function 06FC1A18 Relevance: 2.6, Strings: 2, Instructions: 113
COMMON

Function 010EAD48 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Function 010E590D Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Function 010E44C4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON