Edit tour

Windows Analysis Report
UemxXC3jyR.exe

Overview

General Information

Sample name:	UemxXC3jyR.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original sample name:	a541aab0fa72cab0ec779e8723d8353d66bdf31e
Analysis ID:	1532987
MD5:	880dd88211726b1862495b9482e348ef
SHA1:	a541aab0fa72cab0ec779e8723d8353d66bdf31e
SHA256:	51d0e120e55826acc35dfb80f57b4bf33043e99b7a23f4c68ede601d4066c989

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Classification

Process Tree

System is w10x64

UemxXC3jyR.exe (PID: 6760 cmdline: "C:\Users\user\Desktop\UemxXC3jyR.exe" MD5: 880DD88211726B1862495B9482E348EF)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: UemxXC3jyR.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: UemxXC3jyR.exe	String found in binary or memory: http://IasWS.samur.sgicntt
Source: UemxXC3jyR.exe	String found in binary or memory: http://correo.ws.emergencias.munimadrid.es/
Source: UemxXC3jyR.exe	String found in binary or memory: http://dgegis.emergencias.munimadrid.es/intervencionesencurso/inicio.html?colectivo=samur&intervenci
Source: UemxXC3jyR.exe	String found in binary or memory: http://maps.googleapis.com/maps/api/distancematrix/xml?origins=
Source: UemxXC3jyR.exe	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: UemxXC3jyR.exe	String found in binary or memory: http://www.madrid.es/UnidadesDescentralizadas/Emergencias/Samur/aqui.html?li=
Source: UemxXC3jyR.exe	String found in binary or memory: https://cardiomad.desarrollo.emtmadrid.es/cardioapi/v1/alarms/pcr/
Source: UemxXC3jyR.exe	String found in binary or memory: https://cardiomad.desarrollo.emtmadrid.es/visor/Nhttps://encuesta.com/survey/P6gm6cW1J4/
Source: UemxXC3jyR.exe	String found in binary or memory: https://maps.google.com/maps?saddr=

Source: UemxXC3jyR.exe, 00000000.00000000.1726937098.0000000000AE5000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameNUEVO STE.EXE vs UemxXC3jyR.exe
Source: UemxXC3jyR.exe	Binary or memory string: OriginalFilenameNUEVO STE.EXE vs UemxXC3jyR.exe

Source: UemxXC3jyR.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: clean1.winEXE@1/1@0/0

Source: C:\Users\user\Desktop\UemxXC3jyR.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\UemxXC3jyR.exe

File created: C:\Users\user\AppData\Local\Temp\~DF8E8EEF2E32582658.TMP

Jump to behavior

Source: UemxXC3jyR.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\UemxXC3jyR.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: UemxXC3jyR.exe	String found in binary or memory: chrome.exe -start-maximized -url https://maps.google.com/maps?saddr=
Source: UemxXC3jyR.exe	String found in binary or memory: chrome.exe -start -maximized -url https://maps.google.com/maps?saddr= ImgRuta_DragDrop\UPDATE PROTOCOLO SET COD_PDI = 2 WHERE PKID = FUPDATE PROTOCOLO SET COD_ESQUINA = NUPDATE PROTOCOLO_2_1 SET COD_ESQUINA =
Source: UemxXC3jyR.exe	String found in binary or memory: chrome.exe --start-maximized -url https://maps.google.com/maps?saddr=
Source: UemxXC3jyR.exe	String found in binary or memory: respuestaDchrome.exe --start-maximized -url VEleja hora de entrada o quitarsela para la

Source: C:\Users\user\Desktop\UemxXC3jyR.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UemxXC3jyR.exe	Section loaded: msvbvm60.dll	Jump to behavior
Source: C:\Users\user\Desktop\UemxXC3jyR.exe	Section loaded: vb6zz.dll	Jump to behavior
Source: C:\Users\user\Desktop\UemxXC3jyR.exe	Section loaded: vb6es.dll	Jump to behavior
Source: C:\Users\user\Desktop\UemxXC3jyR.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\UemxXC3jyR.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\UemxXC3jyR.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\UemxXC3jyR.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\UemxXC3jyR.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\UemxXC3jyR.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\UemxXC3jyR.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\UemxXC3jyR.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\UemxXC3jyR.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\UemxXC3jyR.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\UemxXC3jyR.exe	Section loaded: wintypes.dll	Jump to behavior

Source: UemxXC3jyR.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: UemxXC3jyR.exe

Static file information: File size 7110656 > 1048576

Source: UemxXC3jyR.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x6c5000

Source: C:\Users\user\Desktop\UemxXC3jyR.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 DLL Side-Loading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

URLs

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
https://maps.google.com/maps?saddr=	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
https://cardiomad.desarrollo.emtmadrid.es/visor/Nhttps://encuesta.com/survey/P6gm6cW1J4/	UemxXC3jyR.exe	false		unknown
http://www.madrid.es/UnidadesDescentralizadas/Emergencias/Samur/aqui.html?li=	UemxXC3jyR.exe	false		unknown
http://correo.ws.emergencias.munimadrid.es/	UemxXC3jyR.exe	false		unknown
https://cardiomad.desarrollo.emtmadrid.es/cardioapi/v1/alarms/pcr/	UemxXC3jyR.exe	false		unknown
http://IasWS.samur.sgicntt	UemxXC3jyR.exe	false		unknown
http://dgegis.emergencias.munimadrid.es/intervencionesencurso/inicio.html?colectivo=samur&intervenci	UemxXC3jyR.exe	false		unknown
http://schemas.xmlsoap.org/soap/envelope/	UemxXC3jyR.exe	false	URL Reputation: safe	unknown
https://maps.google.com/maps?saddr=	UemxXC3jyR.exe	false	0%, Virustotal, Browse	unknown

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532987
Start date and time:	2024-10-14 09:07:01 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	UemxXC3jyR.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original Sample Name:	a541aab0fa72cab0ec779e8723d8353d66bdf31e
Detection:	CLEAN
Classification:	clean1.winEXE@1/1@0/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Stop behavior analysis, all processes terminated

Joe Sandbox View / Context

Created / dropped Files

C:\Users\user\AppData\Local\Temp\~DF8E8EEF2E32582658.TMP

Download File

Process:	C:\Users\user\Desktop\UemxXC3jyR.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	1.9395333261195102
Encrypted:	false
SSDEEP:	12:rl3b/+PFQTBG7ONei7rVanHSKhoRaniaguQQHRa81oHb:rn/ei7rQnHhQaqQN1oH
MD5:	19657C7B39D695A0D595C0ACA4201677
SHA1:	F4CDF8DA44DF87B543EAA4923B6D2815897CADB0
SHA-256:	AAE773E562BD27CE2EC6C3485521C140B15F3482F1C338D4B8FE7EAF34FF796B
SHA-512:	06A249F1912F552D9729CAD79C3EA498596D55C647BFF86ACFAE044C83589EB38D154C6E6AEE046F1CA000D5765407D2047B83C048B98643D515F680E94A9464
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Instruction
push 0041B9A4h
call 00007F3A10E10345h
add byte ptr [eax], al
push eax
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax+00h], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
loopne 00007F3A10E102D6h
jle 00007F3A10E1033Ah
clc
out dx, al
loop 00007F3A10E1039Bh
xchg eax, edx
sub al, 84h
adc dl, byte ptr [esp+ebx-16h]
adc eax, dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [edi+20h], ch
jo 00007F3A10E103C4h
outsd
js 00007F3A10E103A2h
jc 00007F3A10E103C1h
jns 00007F3A10E103B7h
arpl word ptr [edi+ebp*2+53h], si
push esp
inc ebp
inc ebp
js 00007F3A10E103C2h
popad
outsb
imul esp, dword ptr fs:[edi+ebp*2+00h], 00616C75h
imul ebp, dword ptr [edi+20h], 61657250h
add byte ptr [eax], al
add byte ptr [eax], al
cwde
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi-547E346Dh], dh
mov eax, 998E457Bh
rcr byte ptr [03837125h], cl
add dword ptr [eax], eax
add byte ptr [eax], al
test al, 00h
add byte ptr [eax], al
mov eax, 01000000h
add byte ptr [eax], al
add byte ptr [esi+eax*2+6Fh], bl
jc 00007F3A10E10353h
and byte ptr [ecx+72h], ch
imul eax, dword ptr [eax], 65725000h
jne 00007F3A10E103C1h
je 00007F3A10E103B3h
dec ebp
outsd
jne 00007F3A10E103C5h
push edi
push 006C6565h
jnc 00007F3A10E103C5h
cmp eax, 32635348h
int 35h
fcomp st(0), st(0)
mov bl, 4Fh
mov cl, EDh
add dword ptr [ebx+3FAA6F81h], edx
pop ebx
in al, dx
mov esp, 000000DBh

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6c4474	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6e5000	0x628	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x238	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x40c	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6c453c	0x6c5000	cf4f7cfc16f69fca38489e764aef163d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x6c6000	0x1e8c0	0x1000	620f0b67a91f7f74151bc5be745b7110	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x6e5000	0x628	0x1000	ce7bdd447b5eb7cc9c232d50217476cd	False	0.148193359375	data	1.7142583727243874	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x6e5340	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	0.30510752688172044
RT_GROUP_ICON	0x6e532c	0x14	data	1.25
RT_VERSION	0x6e50f0	0x23c	data	0.5

DLL	Import
MSVBVM60.DLL	EVENT_SINK_GetIDsOfNames, __vbaVarSub, __vbaVarTstGt, __vbaStrI2, _CIcos, _adj_fptan, __vbaVarMove, __vbaStrI4, __vbaVarVargNofree, __vbaAryMove, __vbaFreeVar, __vbaLineInputStr, __vbaLateIdCall, __vbaStrVarMove, __vbaLenBstr, __vbaVarIdiv, __vbaEnd, __vbaFreeVarList, _adj_fdiv_m64, __vbaAryRecMove, EVENT_SINK_Invoke, __vbaRaiseEvent, __vbaFreeObjList, __vbaR8Sgn, __vbaStrErrVarCopy, _adj_fprem1, __vbaRecAnsiToUni, __vbaCopyBytes, __vbaResume, __vbaVarCmpNe, __vbaStrCat, __vbaLsetFixstr, __vbaWriteFile, __vbaRecDestruct, __vbaSetSystemError, __vbaHresultCheckObj, __vbaLenVar, _adj_fdiv_m32, __vbaVarTstLe, Zombie_GetTypeInfo, __vbaVarCmpGe, __vbaAryDestruct, __vbaVarIndexLoadRefLock, __vbaLateMemSt, __vbaStrBool, __vbaBoolStr, __vbaVarForInit, __vbaVarPow, __vbaForEachCollObj, __vbaExitProc, __vbaCyAdd, __vbaObjSet, __vbaOnError, __vbaVargObj, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaVarIndexLoad, __vbaFpR4, __vbaForEachCollVar, __vbaBoolVar, __vbaFPFix, __vbaVargVar, __vbaVarTstLt, __vbaFpR8, __vbaBoolVarNull, _CIsin, __vbaErase, __vbaVarCmpGt, __vbaNextEachCollObj, __vbaChkstk, __vbaFileClose, EVENT_SINK_AddRef, __vbaVarAbs, __vbaGenerateBoundsError, __vbaStrCmp, __vbaAryConstruct2, __vbaVarTstEq, __vbaCyI4, __vbaR4Str, __vbaNextEachCollVar, __vbaPrintObj, __vbaObjVar, __vbaI2I4, DllFunctionCall, __vbaVarLateMemSt, __vbaVarOr, __vbaFpUI1, __vbaCastObjVar, __vbaLbound, __vbaStrR4, __vbaRedimPreserve, _adj_fpatan, __vbaR4Var, __vbaLateIdCallLd, Zombie_GetTypeInfoCount, __vbaR8Cy, __vbaStrR8, __vbaRedim, __vbaRecUniToAnsi, EVENT_SINK_Release, __vbaNew, __vbaUI1I2, _CIsqrt, __vbaObjIs, __vbaVarAnd, __vbaLateIdCallSt, EVENT_SINK_QueryInterface, __vbaUI1I4, __vbaStrUI1, __vbaVarMul, __vbaExceptHandler, __vbaPrintFile, __vbaStrToUnicode, __vbaDateStr, _adj_fprem, _adj_fdivr_m64, __vbaLateIdStAd, __vbaVarDiv, __vbaR8ErrVar, __vbaI2Str, __vbaVarCmpLe, __vbaFPException, __vbaInStrVar, __vbaStrVarVal, __vbaUbound, __vbaVarCat, __vbaDateVar, __vbaCheckType, __vbaI2Var, _CIlog, __vbaErrorOverflow, __vbaFileOpen, __vbaVarLateMemCallLdRf, __vbaInStr, __vbaR8Str, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaI4Str, __vbaVarCmpLt, __vbaVarNot, __vbaFreeStrList, _adj_fdivr_m32, __vbaPowerR8, __vbaR8Var, _adj_fdiv_r, __vbaVarTstNe, __vbaVarSetVar, __vbaI4Var, __vbaVarCmpEq, __vbaFpCy, __vbaLateMemCall, __vbaVarAdd, __vbaAryLock, __vbaFreeVarg, __vbaVarDup, __vbaStrToAnsi, __vbaVerifyVarObj, __vbaFpI2, __vbaVarMod, __vbaVarCopy, __vbaVarTstGe, __vbaFpI4, __vbaVarLateMemCallLd, __vbaVarSetObjAddref, __vbaR8IntI2, __vbaLateMemCallLd, _CIatan, __vbaAryCopy, __vbaI2ErrVar, __vbaCastObj, __vbaStrMove, __vbaStrVarCopy, __vbaVarNeg, _allmul, __vbaLateIdSt, __vbaAryRecCopy, __vbaLateMemCallSt, _CItan, __vbaUI1Var, __vbaFPInt, __vbaAryUnlock, __vbaVarForNext, _CIexp, __vbaMidStmtBstr, __vbaR8FixI2, __vbaRecAssign, __vbaI4ErrVar, __vbaFreeObj, __vbaFreeStr

EVENT_SINK_GetIDsOfNames, __vbaVarSub, __vbaVarTstGt, __vbaStrI2, _CIcos, _adj_fptan, __vbaVarMove, __vbaStrI4, __vbaVarVargNofree, __vbaAryMove, __vbaFreeVar, __vbaLineInputStr, __vbaLateIdCall, __vbaStrVarMove, __vbaLenBstr, __vbaVarIdiv, __vbaEnd, __vbaFreeVarList, _adj_fdiv_m64, __vbaAryRecMove, EVENT_SINK_Invoke, __vbaRaiseEvent, __vbaFreeObjList, __vbaR8Sgn, __vbaStrErrVarCopy, _adj_fprem1, __vbaRecAnsiToUni, __vbaCopyBytes, __vbaResume, __vbaVarCmpNe, __vbaStrCat, __vbaLsetFixstr, __vbaWriteFile, __vbaRecDestruct, __vbaSetSystemError, __vbaHresultCheckObj, __vbaLenVar, _adj_fdiv_m32, __vbaVarTstLe, Zombie_GetTypeInfo, __vbaVarCmpGe, __vbaAryDestruct, __vbaVarIndexLoadRefLock, __vbaLateMemSt, __vbaStrBool, __vbaBoolStr, __vbaVarForInit, __vbaVarPow, __vbaForEachCollObj, __vbaExitProc, __vbaCyAdd, __vbaObjSet, __vbaOnError, __vbaVargObj, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaVarIndexLoad, __vbaFpR4, __vbaForEachCollVar, __vbaBoolVar, __vbaFPFix, __vbaVargVar, __vbaVarTstLt, __vbaFpR8, __vbaBoolVarNull, _CIsin, __vbaErase, __vbaVarCmpGt, __vbaNextEachCollObj, __vbaChkstk, __vbaFileClose, EVENT_SINK_AddRef, __vbaVarAbs, __vbaGenerateBoundsError, __vbaStrCmp, __vbaAryConstruct2, __vbaVarTstEq, __vbaCyI4, __vbaR4Str, __vbaNextEachCollVar, __vbaPrintObj, __vbaObjVar, __vbaI2I4, DllFunctionCall, __vbaVarLateMemSt, __vbaVarOr, __vbaFpUI1, __vbaCastObjVar, __vbaLbound, __vbaStrR4, __vbaRedimPreserve, _adj_fpatan, __vbaR4Var, __vbaLateIdCallLd, Zombie_GetTypeInfoCount, __vbaR8Cy, __vbaStrR8, __vbaRedim, __vbaRecUniToAnsi, EVENT_SINK_Release, __vbaNew, __vbaUI1I2, _CIsqrt, __vbaObjIs, __vbaVarAnd, __vbaLateIdCallSt, EVENT_SINK_QueryInterface, __vbaUI1I4, __vbaStrUI1, __vbaVarMul, __vbaExceptHandler, __vbaPrintFile, __vbaStrToUnicode, __vbaDateStr, _adj_fprem, _adj_fdivr_m64, __vbaLateIdStAd, __vbaVarDiv, __vbaR8ErrVar, __vbaI2Str, __vbaVarCmpLe, __vbaFPException, __vbaInStrVar, __vbaStrVarVal, __vbaUbound, __vbaVarCat, __vbaDateVar, __vbaCheckType, __vbaI2Var, _CIlog, __vbaErrorOverflow, __vbaFileOpen, __vbaVarLateMemCallLdRf, __vbaInStr, __vbaR8Str, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaI4Str, __vbaVarCmpLt, __vbaVarNot, __vbaFreeStrList, _adj_fdivr_m32, __vbaPowerR8, __vbaR8Var, _adj_fdiv_r, __vbaVarTstNe, __vbaVarSetVar, __vbaI4Var, __vbaVarCmpEq, __vbaFpCy, __vbaLateMemCall, __vbaVarAdd, __vbaAryLock, __vbaFreeVarg, __vbaVarDup, __vbaStrToAnsi, __vbaVerifyVarObj, __vbaFpI2, __vbaVarMod, __vbaVarCopy, __vbaVarTstGe, __vbaFpI4, __vbaVarLateMemCallLd, __vbaVarSetObjAddref, __vbaR8IntI2, __vbaLateMemCallLd, _CIatan, __vbaAryCopy, __vbaI2ErrVar, __vbaCastObj, __vbaStrMove, __vbaStrVarCopy, __vbaVarNeg, _allmul, __vbaLateIdSt, __vbaAryRecCopy, __vbaLateMemCallSt, _CItan, __vbaUI1Var, __vbaFPInt, __vbaAryUnlock, __vbaVarForNext, _CIexp, __vbaMidStmtBstr, __vbaR8FixI2, __vbaRecAssign, __vbaI4ErrVar, __vbaFreeObj, __vbaFreeStr

Target ID:	0
Start time:	03:07:58
Start date:	14/10/2024
Path:	C:\Users\user\Desktop\UemxXC3jyR.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\UemxXC3jyR.exe"
Imagebase:	0x400000
File size:	7'110'656 bytes
MD5 hash:	880DD88211726B1862495B9482E348EF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.541898697277408
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	UemxXC3jyR.exe
File size:	7'110'656 bytes
MD5:	880dd88211726b1862495b9482e348ef
SHA1:	a541aab0fa72cab0ec779e8723d8353d66bdf31e
SHA256:	51d0e120e55826acc35dfb80f57b4bf33043e99b7a23f4c68ede601d4066c989
SHA512:	c9f29c9ddac0b7eee292e021e419b82544af5907c7e8ac7f081e93c2268a1fc1e319558e8f916935a60899ef60301d3690efd20360fade3d44cf800199e6ed74
SSDEEP:	196608:Cbt/Oc1gqmxVZPNKaR9usdExaqxwlXJil89vA9TH:CbLgqmxR9dExaqxwlXJil8+9TH
TLSH:	B066322EFF41B44AD24284746F84D2D926182CF2E0456407ABB63F46E2765D3AFBC71B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........I....................................Rich............................PE..L....<.f.................Pl..........g.......`l...@

Entrypoint:	0x4167dc
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x66F53CC0 [Thu Sep 26 10:51:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	4709d43964200bef2b0945636ce6e09c

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre


Icon Hash:	675399997969cab4

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report UemxXC3jyR.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\~DF8E8EEF2E32582658.TMP

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: UemxXC3jyR.exePID: 6760, Parent PID: 2580

General

Chronological Activities

Disassembly

Windows Analysis Report
UemxXC3jyR.exe