Windows
Analysis Report
is65NMeWkV.exe
Overview
General Information
Sample name: | is65NMeWkV.exerenamed because original name is a hash value |
Original sample name: | 5d0d37171e8ed9fc0b97e8f858133802.exe |
Analysis ID: | 1541240 |
MD5: | 5d0d37171e8ed9fc0b97e8f858133802 |
SHA1: | f0b9f7060cd7e857d53a740e7e025d4d75f7ab27 |
SHA256: | 0d90d3771d5a6c15760e18a6f2a542076d7c7c73c02d31c33dfee2f6f7bed61c |
Tags: | exeStealcuser-abuse_ch |
Infos: | |
Detection
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Classification
- System is w10x64
- is65NMeWkV.exe (PID: 8 cmdline:
"C:\Users\ user\Deskt op\is65NMe WkV.exe" MD5: 5D0D37171E8ED9FC0B97E8F858133802) - WerFault.exe (PID: 3260 cmdline:
C:\Windows \SysWOW64\ WerFault.e xe -u -p 8 -s 1220 MD5: C31336C1EFC2CCB44B4326EA793040F2)
- cleanup
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
Stealc | Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests. | No Attribution |
{"C2 url": "http://109.107.157.208/49aaa1bd4c594849.php", "Botnet": "LogsDiller"}
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Stealc_1 | Yara detected Stealc | Joe Security |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
Windows_Trojan_RedLineStealer_ed346e4c | unknown | unknown |
| |
JoeSecurity_Stealc | Yara detected Stealc | Joe Security | ||
JoeSecurity_Stealc | Yara detected Stealc | Joe Security | ||
JoeSecurity_Stealc | Yara detected Stealc | Joe Security | ||
JoeSecurity_Stealc | Yara detected Stealc | Joe Security | ||
Click to see the 3 entries |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Stealc | Yara detected Stealc | Joe Security | ||
JoeSecurity_Stealc | Yara detected Stealc | Joe Security | ||
JoeSecurity_Stealc | Yara detected Stealc | Joe Security | ||
JoeSecurity_Stealc | Yara detected Stealc | Joe Security | ||
JoeSecurity_Stealc | Yara detected Stealc | Joe Security | ||
Click to see the 1 entries |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-10-24T15:57:02.114246+0200 | 2044243 | 1 | Malware Command and Control Activity Detected | 192.168.2.4 | 49730 | 109.107.157.208 | 80 | TCP |
Click to jump to signature section
AV Detection |
---|
Source: | Avira: |
Source: | Malware Configuration Extractor: |
Source: | Integrated Neural Analysis Model: |
Source: | Joe Sandbox ML: |
Source: | Code function: | 0_2_0040C820 | |
Source: | Code function: | 0_2_00407240 | |
Source: | Code function: | 0_2_00409AC0 | |
Source: | Code function: | 0_2_00418EA0 | |
Source: | Code function: | 0_2_00409B60 | |
Source: | Code function: | 0_2_0230CA87 | |
Source: | Code function: | 0_2_02319107 | |
Source: | Code function: | 0_2_023074A7 | |
Source: | Code function: | 0_2_02309D27 | |
Source: | Code function: | 0_2_02309DC7 |
Compliance |
---|
Source: | Unpacked PE file: |
Source: | Static PE information: |
Source: | File opened: | Jump to behavior |
Source: | Code function: | 0_2_0040E430 | |
Source: | Code function: | 0_2_004138B0 | |
Source: | Code function: | 0_2_00414570 | |
Source: | Code function: | 0_2_00414910 | |
Source: | Code function: | 0_2_0040ED20 | |
Source: | Code function: | 0_2_0040BE70 | |
Source: | Code function: | 0_2_0040DE10 | |
Source: | Code function: | 0_2_004016D0 | |
Source: | Code function: | 0_2_0040DA80 | |
Source: | Code function: | 0_2_00413EA0 | |
Source: | Code function: | 0_2_0040F6B0 | |
Source: | Code function: | 0_2_02313B17 | |
Source: | Code function: | 0_2_02314B77 | |
Source: | Code function: | 0_2_0230E077 | |
Source: | Code function: | 0_2_0230C0D7 | |
Source: | Code function: | 0_2_02301937 | |
Source: | Code function: | 0_2_0230F917 | |
Source: | Code function: | 0_2_02314107 | |
Source: | Code function: | 0_2_0230E697 | |
Source: | Code function: | 0_2_0230EF87 | |
Source: | Code function: | 0_2_023147D7 | |
Source: | Code function: | 0_2_0230DCE7 |
Networking |
---|
Source: | Suricata IDS: |
Source: | URLs: |
Source: | HTTP traffic detected: | ||
Source: | HTTP traffic detected: |
Source: | ASN Name: |
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: |
Source: | Code function: | 0_2_00404880 |
Source: | HTTP traffic detected: |
Source: | HTTP traffic detected: |
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: |
System Summary |
---|
Source: | Matched rule: | ||
Source: | Matched rule: |
Source: | Code function: | 0_2_0232D257 | |
Source: | Code function: | 0_2_0232CEFF | |
Source: | Code function: | 0_2_0233370B |
Source: | Code function: |
Source: | Process created: |
Source: | Static PE information: |
Source: | Matched rule: | ||
Source: | Matched rule: |
Source: | Static PE information: |
Source: | Classification label: |
Source: | Code function: | 0_2_00419600 |
Source: | Code function: | 0_2_00413720 |
Source: | File created: | Jump to behavior |
Source: | Mutant created: |
Source: | File created: | Jump to behavior |
Source: | Static PE information: |
Source: | Key opened: | Jump to behavior |
Source: | Process created: | ||
Source: | Process created: |
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior |
Source: | Key value queried: | Jump to behavior |
Source: | File opened: | Jump to behavior |
Data Obfuscation |
---|
Source: | Unpacked PE file: |
Source: | Unpacked PE file: |
Source: | Code function: | 0_2_00419860 |
Source: | Code function: | 0_2_0041B048 | |
Source: | Code function: | 0_2_007F5E91 | |
Source: | Code function: | 0_2_007F2EB3 | |
Source: | Code function: | 0_2_007F5E91 | |
Source: | Code function: | 0_2_0231B2AF |
Source: | Static PE information: |
Source: | Code function: | 0_2_00419860 |
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior |
Malware Analysis System Evasion |
---|
Source: | Evasive API call chain: | graph_0-28979 |
Source: | Evaded block: | graph_0-30140 |
Source: | API coverage: |
Source: | Code function: | 0_2_0040E430 | |
Source: | Code function: | 0_2_004138B0 | |
Source: | Code function: | 0_2_00414570 | |
Source: | Code function: | 0_2_00414910 | |
Source: | Code function: | 0_2_0040ED20 | |
Source: | Code function: | 0_2_0040BE70 | |
Source: | Code function: | 0_2_0040DE10 | |
Source: | Code function: | 0_2_004016D0 | |
Source: | Code function: | 0_2_0040DA80 | |
Source: | Code function: | 0_2_00413EA0 | |
Source: | Code function: | 0_2_0040F6B0 | |
Source: | Code function: | 0_2_02313B17 | |
Source: | Code function: | 0_2_02314B77 | |
Source: | Code function: | 0_2_0230E077 | |
Source: | Code function: | 0_2_0230C0D7 | |
Source: | Code function: | 0_2_02301937 | |
Source: | Code function: | 0_2_0230F917 | |
Source: | Code function: | 0_2_02314107 | |
Source: | Code function: | 0_2_0230E697 | |
Source: | Code function: | 0_2_0230EF87 | |
Source: | Code function: | 0_2_023147D7 | |
Source: | Code function: | 0_2_0230DCE7 |
Source: | Code function: | 0_2_00401160 |
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: |
Source: | API call chain: | graph_0-28977 | ||
Source: | API call chain: | graph_0-28964 | ||
Source: | API call chain: | graph_0-28967 | ||
Source: | API call chain: | graph_0-30399 | ||
Source: | API call chain: | graph_0-28986 | ||
Source: | API call chain: | graph_0-29007 | ||
Source: | API call chain: | graph_0-28806 | ||
Source: | API call chain: | graph_0-28852 |
Source: | Code function: | 0_2_0041AD48 |
Source: | Code function: | 0_2_004045C0 |
Source: | Code function: | 0_2_00419860 |
Source: | Code function: | 0_2_00419750 | |
Source: | Code function: | 0_2_007F1171 | |
Source: | Code function: | 0_2_0230092B | |
Source: | Code function: | 0_2_023199B7 | |
Source: | Code function: | 0_2_02300D90 |
Source: | Code function: | 0_2_00417850 |
Source: | Code function: | 0_2_0041AD48 | |
Source: | Code function: | 0_2_0041CEEA | |
Source: | Code function: | 0_2_0041B33A | |
Source: | Code function: | 0_2_0231D151 | |
Source: | Code function: | 0_2_0231AFAF | |
Source: | Code function: | 0_2_0231B5A1 |
Source: | Memory protected: | Jump to behavior |
HIPS / PFW / Operating System Protection Evasion |
---|
Source: | File source: |
Source: | Code function: | 0_2_00419600 | |
Source: | Code function: | 0_2_02319867 |
Source: | Code function: | 0_2_00417B90 | |
Source: | Code function: | 0_2_02317DF7 |
Source: | Queries volume information: | Jump to behavior |
Source: | Code function: | 0_2_00416920 |
Source: | Code function: | 0_2_00417850 |
Source: | Code function: | 0_2_00417A30 |
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: |
Stealing of Sensitive Information |
---|
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: |
Remote Access Functionality |
---|
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: |
Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 12 Native API | 1 DLL Side-Loading | 11 Process Injection | 1 Masquerading | OS Credential Dumping | 2 System Time Discovery | Remote Services | 1 Archive Collected Data | 2 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | 1 DLL Side-Loading | 1 Virtualization/Sandbox Evasion | LSASS Memory | 31 Security Software Discovery | Remote Desktop Protocol | Data from Removable Media | 2 Ingress Tool Transfer | Exfiltration Over Bluetooth | Network Denial of Service |
Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 11 Disable or Modify Tools | Security Account Manager | 1 Virtualization/Sandbox Evasion | SMB/Windows Admin Shares | Data from Network Shared Drive | 2 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 11 Process Injection | NTDS | 11 Process Discovery | Distributed Component Object Model | Input Capture | 12 Application Layer Protocol | Traffic Duplication | Data Destruction |
Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 1 Deobfuscate/Decode Files or Information | LSA Secrets | 1 Account Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 3 Obfuscated Files or Information | Cached Domain Credentials | 1 System Owner/User Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 22 Software Packing | DCSync | 1 File and Directory Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
Network Trust Dependencies | Serverless | Drive-by Compromise | Container Orchestration Job | Scheduled Task/Job | Scheduled Task/Job | 1 DLL Side-Loading | Proc Filesystem | 123 System Information Discovery | Cloud Services | Credential API Hooking | Application Layer Protocol | Exfiltration Over Alternative Protocol | Defacement |
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
100% | Avira | HEUR/AGEN.1306978 | ||
100% | Joe Sandbox ML |
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
0% | URL Reputation | safe |
Name | Malicious | Antivirus Detection | Reputation |
---|---|---|---|
true | unknown | ||
true | unknown |
Name | Source | Malicious | Antivirus Detection | Reputation |
---|---|---|---|---|
false | unknown | |||
false |
| unknown | ||
true | unknown | |||
false | unknown | |||
false | unknown | |||
false | unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
---|---|---|---|---|---|---|
109.107.157.208 | unknown | unknown | 29314 | VECTRANET-ASAlZwyciestwa25381-525GdyniaPolandPL | true |
Joe Sandbox version: | 41.0.0 Charoite |
Analysis ID: | 1541240 |
Start date and time: | 2024-10-24 15:56:05 +02:00 |
Joe Sandbox product: | CloudBasic |
Overall analysis duration: | 0h 4m 29s |
Hypervisor based Inspection enabled: | false |
Report type: | full |
Cookbook file name: | default.jbs |
Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
Number of analysed new started processes analysed: | 8 |
Number of new started drivers analysed: | 0 |
Number of existing processes analysed: | 0 |
Number of existing drivers analysed: | 0 |
Number of injected processes analysed: | 0 |
Technologies: |
|
Analysis Mode: | default |
Analysis stop reason: | Timeout |
Sample name: | is65NMeWkV.exerenamed because original name is a hash value |
Original Sample Name: | 5d0d37171e8ed9fc0b97e8f858133802.exe |
Detection: | MAL |
Classification: | mal100.troj.evad.winEXE@2/5@0/1 |
EGA Information: |
|
HCA Information: |
|
Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
- Excluded IPs from analysis (whitelisted): 52.182.143.212
- Excluded domains from analysis (whitelisted): ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
- Not all processes where analyzed, report is missing behavior information
- VT rate limit hit for: is65NMeWkV.exe
Time | Type | Description |
---|---|---|
09:57:19 | API Interceptor |
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
109.107.157.208 | Get hash | malicious | Stealc, Vidar | Browse |
|
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
VECTRANET-ASAlZwyciestwa25381-525GdyniaPolandPL | Get hash | malicious | Stealc, Vidar | Browse |
| |
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Mirai | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Unknown | Browse |
| ||
Get hash | malicious | Mirai | Browse |
| ||
Get hash | malicious | Unknown | Browse |
|
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_is65NMeWkV.exe_e78efff241704b9fd5957bfe9487f9d517df_310101f6_2347bed7-3964-4883-856a-43aa24a4bfda\Report.wer
Download File
Process: | C:\Windows\SysWOW64\WerFault.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 65536 |
Entropy (8bit): | 0.9711660713636462 |
Encrypted: | false |
SSDEEP: | 96:nv/49EeKZbn7sFChsow7Rr6tQXIDcQnc6MHcE0cw3w+HbHg/PB6HeaOy1EaGHh4B:vhVb7q0JC+NjGcZrP2izuiF6Z24IO8C |
MD5: | 4BACBEC4411EFCECD84120FBB3A98DAA |
SHA1: | 519EFD6DEBD96B1D9574295DFDE5938B4AF6B165 |
SHA-256: | 73655ACB3D61F59044F0E3029441476B45A17DE44A445F1883C4A41496E561D1 |
SHA-512: | 4257227EF0470CA7C70C54F18A27EF926447356E6C9D32BA61179BCBB741AACD665CB45DF7DC7536F14AE5E49C6CA7E0AFF787B694E37BEED7B702B128DEF844 |
Malicious: | true |
Reputation: | low |
Preview: |
Process: | C:\Windows\SysWOW64\WerFault.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 63484 |
Entropy (8bit): | 1.8882490483185832 |
Encrypted: | false |
SSDEEP: | 192:du9cwXMnHR9XtOQOJwLzM8uR1Ec1+NHtd19UWu4jqJbcBc3GkfKdW3njzbZY1N8b:8WnHRaQEOMDRX+dEnDG5o3jq1Krf |
MD5: | 26BE34AFEC5462A9B9F71E5262BB44A2 |
SHA1: | 4B56B64BE1C7A42C9D7393E2D6B88CF99E3902F5 |
SHA-256: | C3EBC87FF978F62384EEF7A551FDEAF538B2205A7C37C6BF04DF89EA743754E4 |
SHA-512: | AEF508B83C979203C3F52C11CCBBD7A904B7A97BF2F655AAF40B610C093428EEF4EECE629030FF020046F96EE04A0B0022D8D1BDBCECEA2DA101750E01FD2CF3 |
Malicious: | false |
Reputation: | low |
Preview: |
Process: | C:\Windows\SysWOW64\WerFault.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 8432 |
Entropy (8bit): | 3.6988034988737195 |
Encrypted: | false |
SSDEEP: | 192:R6l7wVeJkz6Vs6Y9fSUXCiDgmfcwpD089bzKsf9xm:R6lXJA6Vs6YlSUXCegmfcMzpfi |
MD5: | B5052E5874E09AE2FFEC446E4ED1C2D8 |
SHA1: | 5DF8E3D2522B9758266F899BAE208FA33E048C68 |
SHA-256: | C980724D11A6B31F6986398FB6E0CFE36392BBADF6E22F0E3DFEC70F6C9FA2D9 |
SHA-512: | 8EBD8A038F2383562D177B3B585D4A0452E7DF79D07E82857765461B86D855FA56A3A7C602BE2752FD99CA61AA083FDF00E08B6710FFE5F41BFEDF1F285DA41B |
Malicious: | false |
Reputation: | low |
Preview: |
Process: | C:\Windows\SysWOW64\WerFault.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 4724 |
Entropy (8bit): | 4.483742601969905 |
Encrypted: | false |
SSDEEP: | 48:cvIwWl8zsoJg77aI9J2WpW8VYcYm8M4JwkCO3FT+q8vqkCOw2xQkSad:uIjfuI7DX7V4J0mKWExPSad |
MD5: | 29D91479A7CBA0F431FF5DD830A899EC |
SHA1: | 8C825FD5AAFFA0D0EC2E4798077183CBE0AA8023 |
SHA-256: | A1DE463908353A5AD5A4A022EF8300CFFCCA1E6711408BB316BDEFBA600B06E3 |
SHA-512: | BEADAE37C80551EF2AAFC30641F264BE868BC50BC335EEB12A0CEF9DC165BE0FBE4E80A2D72DE76DCD4D8B9C53C1889A284ED04D9A668FB5E6AB85B45BBB15C5 |
Malicious: | false |
Reputation: | low |
Preview: |
Process: | C:\Windows\SysWOW64\WerFault.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 1835008 |
Entropy (8bit): | 4.465440078752722 |
Encrypted: | false |
SSDEEP: | 6144:5IXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNXdwBCswSbk:KXD94+WlLZMM6YFHB+k |
MD5: | 846BD9A4A292F1BE5FCCDC3CF9305EC5 |
SHA1: | E515783AB9766F02FA0F96D4A8D433A290DB244B |
SHA-256: | 83A2DC0617DCE8D32F8B62E771A82B8B53E7F4EC81CF03847ABD0220C763EB21 |
SHA-512: | 596D7C5881D41F40234F199D27AF64E16B5FF6B971E3F8C1762CBBAF7BD91697B5B6C74DD8A8B574A42FC05EB09398E1753448A152F6CFB6F12C233C981B4EEE |
Malicious: | false |
Reputation: | low |
Preview: |
File type: | |
Entropy (8bit): | 6.4431888700013955 |
TrID: |
|
File name: | is65NMeWkV.exe |
File size: | 399'360 bytes |
MD5: | 5d0d37171e8ed9fc0b97e8f858133802 |
SHA1: | f0b9f7060cd7e857d53a740e7e025d4d75f7ab27 |
SHA256: | 0d90d3771d5a6c15760e18a6f2a542076d7c7c73c02d31c33dfee2f6f7bed61c |
SHA512: | fd1b7e887f9c27394d365f01be42132ecfb94970e8daf732fba249b2371123adfc718c6e277f34c759cac8c8ab08dd093ec396cedaad18d290cac2b1477b0e14 |
SSDEEP: | 6144:e9LX/SNfdnuHt939e/pA6NoQmdbZKYJncY4dlxnc0rjuVH/kWTW:GEfRuN934//oQmBZf5Qldc8juJj |
TLSH: | C984F15436A0F471C5520D304C28C7F8A93FB832DA69994B771C7F5F3D3A392AA66706 |
File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Z...Z...Z...D...z...D...B...D.......}3.._...Z...'...D...[...D...[...D...[...RichZ...................PE..L......e........... |
Icon Hash: | 63796de971636e0f |
Entrypoint: | 0x403a18 |
Entrypoint Section: | .text |
Digitally signed: | false |
Imagebase: | 0x400000 |
Subsystem: | windows gui |
Image File Characteristics: | EXECUTABLE_IMAGE, 32BIT_MACHINE |
DLL Characteristics: | NX_COMPAT, TERMINAL_SERVER_AWARE |
Time Stamp: | 0x65DDD6F9 [Tue Feb 27 12:35:05 2024 UTC] |
TLS Callbacks: | |
CLR (.Net) Version: | |
OS Version Major: | 5 |
OS Version Minor: | 0 |
File Version Major: | 5 |
File Version Minor: | 0 |
Subsystem Version Major: | 5 |
Subsystem Version Minor: | 0 |
Import Hash: | 60292dd185c67d0ddd8dc10e8ecfb2bb |
Instruction |
---|
call 00007FEBA4943B79h |
jmp 00007FEBA493F39Eh |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
call 00007FEBA493F55Ch |
xchg cl, ch |
jmp 00007FEBA493F544h |
call 00007FEBA493F553h |
fxch st(0), st(1) |
jmp 00007FEBA493F53Bh |
fabs |
fld1 |
mov ch, cl |
xor cl, cl |
jmp 00007FEBA493F531h |
mov byte ptr [ebp-00000090h], FFFFFFFEh |
fabs |
fxch st(0), st(1) |
fabs |
fxch st(0), st(1) |
fpatan |
or cl, cl |
je 00007FEBA493F526h |
fldpi |
fsubrp st(1), st(0) |
or ch, ch |
je 00007FEBA493F524h |
fchs |
ret |
fabs |
fld st(0), st(0) |
fld st(0), st(0) |
fld1 |
fsubrp st(1), st(0) |
fxch st(0), st(1) |
fld1 |
faddp st(1), st(0) |
fmulp st(1), st(0) |
ftst |
wait |
fstsw word ptr [ebp-000000A0h] |
wait |
test byte ptr [ebp-0000009Fh], 00000001h |
jne 00007FEBA493F527h |
xor ch, ch |
fsqrt |
ret |
pop eax |
jmp 00007FEBA4943D3Fh |
fstp st(0) |
fld tbyte ptr [004497EAh] |
ret |
fstp st(0) |
or cl, cl |
je 00007FEBA493F52Dh |
fstp st(0) |
fldpi |
or ch, ch |
je 00007FEBA493F524h |
fchs |
ret |
fstp st(0) |
fldz |
or ch, ch |
je 00007FEBA493F519h |
fchs |
ret |
fstp st(0) |
jmp 00007FEBA4943D15h |
fstp st(0) |
mov cl, ch |
jmp 00007FEBA493F522h |
call 00007FEBA493F4EEh |
jmp 00007FEBA4943D20h |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
int3 |
Programming Language: |
|
Name | Virtual Address | Virtual Size | Is in Section |
---|---|---|---|
IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_IMPORT | 0x4772c | 0x3c | .text |
IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x5b000 | 0x12b58 | .rsrc |
IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x25f000 | 0xa48 | .reloc |
IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x2690 | 0x40 | .text |
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_IAT | 0x1000 | 0x19c | .text |
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
---|---|---|---|---|---|---|---|---|---|
.text | 0x1000 | 0x4708c | 0x47200 | 372844af899a298d533027599ff622cf | False | 0.7336816234622144 | data | 7.012763407505116 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
.data | 0x49000 | 0x1185c | 0x6000 | 658aeadd60814ab08f977223f9ee6724 | False | 0.0777587890625 | Matlab v4 mat-file (little endian) n2, sparse, rows 0, columns 0 | 0.9052237577489807 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
.rsrc | 0x5b000 | 0x203b58 | 0x12c00 | 5925f1e123334200b740411e63c143d8 | unknown | unknown | unknown | unknown | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
.reloc | 0x25f000 | 0x14be | 0x1600 | d7eeaff98ac8f72dfe52e310f9c3ae34 | False | 0.4055397727272727 | data | 3.973364894187828 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ |
Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
---|---|---|---|---|---|---|
XUBONAVEGUCIZAKUFAMABAWADUJATA | 0x65130 | 0x1e31 | ASCII text, with very long lines (7729), with no line terminators | Tamil | India | 0.5879156423858196 |
XUBONAVEGUCIZAKUFAMABAWADUJATA | 0x65130 | 0x1e31 | ASCII text, with very long lines (7729), with no line terminators | Tamil | Sri Lanka | 0.5879156423858196 |
RT_CURSOR | 0x66fc0 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 0 | 0.2953091684434968 | ||
RT_CURSOR | 0x67e68 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 0 | 0.46705776173285196 | ||
RT_CURSOR | 0x68710 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 0 | 0.5361271676300579 | ||
RT_CURSOR | 0x68ca8 | 0x130 | Device independent bitmap graphic, 32 x 64 x 1, image size 0 | 0.4375 | ||
RT_CURSOR | 0x68dd8 | 0xb0 | Device independent bitmap graphic, 16 x 32 x 1, image size 0 | 0.44886363636363635 | ||
RT_CURSOR | 0x68eb0 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 0 | 0.27238805970149255 | ||
RT_CURSOR | 0x69d58 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 0 | 0.375 | ||
RT_CURSOR | 0x6a600 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 0 | 0.5057803468208093 | ||
RT_CURSOR | 0x6ab98 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 0 | 0.30943496801705755 | ||
RT_CURSOR | 0x6ba40 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 0 | 0.427797833935018 | ||
RT_CURSOR | 0x6c2e8 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 0 | 0.5469653179190751 | ||
RT_ICON | 0x5b7f0 | 0x6c8 | Device independent bitmap graphic, 24 x 48 x 8, image size 0 | Tamil | India | 0.532258064516129 |
RT_ICON | 0x5b7f0 | 0x6c8 | Device independent bitmap graphic, 24 x 48 x 8, image size 0 | Tamil | Sri Lanka | 0.532258064516129 |
RT_ICON | 0x5beb8 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 0 | Tamil | India | 0.4107883817427386 |
RT_ICON | 0x5beb8 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 0 | Tamil | Sri Lanka | 0.4107883817427386 |
RT_ICON | 0x5e460 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 0 | Tamil | India | 0.4441489361702128 |
RT_ICON | 0x5e460 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 0 | Tamil | Sri Lanka | 0.4441489361702128 |
RT_ICON | 0x5e8f8 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors | Tamil | India | 0.36886993603411516 |
RT_ICON | 0x5e8f8 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors | Tamil | Sri Lanka | 0.36886993603411516 |
RT_ICON | 0x5f7a0 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors | Tamil | India | 0.5130866425992779 |
RT_ICON | 0x5f7a0 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors | Tamil | Sri Lanka | 0.5130866425992779 |
RT_ICON | 0x60048 | 0x6c8 | Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors | Tamil | India | 0.5841013824884793 |
RT_ICON | 0x60048 | 0x6c8 | Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors | Tamil | Sri Lanka | 0.5841013824884793 |
RT_ICON | 0x60710 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors | Tamil | India | 0.6502890173410405 |
RT_ICON | 0x60710 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors | Tamil | Sri Lanka | 0.6502890173410405 |
RT_ICON | 0x60c78 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 9600 | Tamil | India | 0.462448132780083 |
RT_ICON | 0x60c78 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 9600 | Tamil | Sri Lanka | 0.462448132780083 |
RT_ICON | 0x63220 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 4224 | Tamil | India | 0.475375234521576 |
RT_ICON | 0x63220 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 4224 | Tamil | Sri Lanka | 0.475375234521576 |
RT_ICON | 0x642c8 | 0x988 | Device independent bitmap graphic, 24 x 48 x 32, image size 2400 | Tamil | India | 0.45778688524590166 |
RT_ICON | 0x642c8 | 0x988 | Device independent bitmap graphic, 24 x 48 x 32, image size 2400 | Tamil | Sri Lanka | 0.45778688524590166 |
RT_ICON | 0x64c50 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 1088 | Tamil | India | 0.5106382978723404 |
RT_ICON | 0x64c50 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 1088 | Tamil | Sri Lanka | 0.5106382978723404 |
RT_DIALOG | 0x6cad8 | 0x58 | data | 0.8977272727272727 | ||
RT_STRING | 0x6cb30 | 0x374 | data | Tamil | India | 0.46945701357466063 |
RT_STRING | 0x6cb30 | 0x374 | data | Tamil | Sri Lanka | 0.46945701357466063 |
RT_STRING | 0x6cea8 | 0x2ae | data | Tamil | India | 0.478134110787172 |
RT_STRING | 0x6cea8 | 0x2ae | data | Tamil | Sri Lanka | 0.478134110787172 |
RT_STRING | 0x6d158 | 0x4e8 | data | Tamil | India | 0.4434713375796178 |
RT_STRING | 0x6d158 | 0x4e8 | data | Tamil | Sri Lanka | 0.4434713375796178 |
RT_STRING | 0x6d640 | 0x514 | data | Tamil | India | 0.4276923076923077 |
RT_STRING | 0x6d640 | 0x514 | data | Tamil | Sri Lanka | 0.4276923076923077 |
RT_ACCELERATOR | 0x66f68 | 0x58 | data | Tamil | India | 0.7954545454545454 |
RT_ACCELERATOR | 0x66f68 | 0x58 | data | Tamil | Sri Lanka | 0.7954545454545454 |
RT_GROUP_CURSOR | 0x68c78 | 0x30 | data | 0.9375 | ||
RT_GROUP_CURSOR | 0x68e88 | 0x22 | data | 1.0588235294117647 | ||
RT_GROUP_CURSOR | 0x6ab68 | 0x30 | data | 0.9375 | ||
RT_GROUP_CURSOR | 0x6c850 | 0x30 | data | 0.9375 | ||
RT_GROUP_ICON | 0x5e8c8 | 0x30 | data | Tamil | India | 0.9375 |
RT_GROUP_ICON | 0x5e8c8 | 0x30 | data | Tamil | Sri Lanka | 0.9375 |
RT_GROUP_ICON | 0x650b8 | 0x76 | data | Tamil | India | 0.6694915254237288 |
RT_GROUP_ICON | 0x650b8 | 0x76 | data | Tamil | Sri Lanka | 0.6694915254237288 |
RT_VERSION | 0x6c880 | 0x254 | data | 0.535234899328859 |
DLL | Import |
---|---|
KERNEL32.dll | GlobalCompact, CreateProcessW, InterlockedIncrement, GetCurrentProcess, GetLogicalDriveStringsW, CreateJobObjectW, SetComputerNameW, SetVolumeMountPointW, GetComputerNameW, GetTickCount, GetCommConfig, ClearCommBreak, GetConsoleAliasExesW, EnumTimeFormatsW, TlsSetValue, GetEnvironmentStrings, SetFileShortNameW, ReadConsoleInputA, GetVersionExW, GetFileAttributesA, GlobalMemoryStatus, GetModuleFileNameW, GetShortPathNameA, VerifyVersionInfoW, InterlockedExchange, GetLastError, SetLastError, GetProcAddress, VirtualAlloc, DefineDosDeviceW, CreateNamedPipeA, SetFileAttributesA, LoadLibraryA, GetNumberFormatW, OpenJobObjectW, SetEnvironmentVariableA, GetCurrentDirectoryA, OpenEventW, LCMapStringW, CommConfigDialogW, GetTimeFormatW, GetTempFileNameW, HeapAlloc, HeapReAlloc, GetStartupInfoW, RaiseException, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, HeapFree, VirtualFree, HeapCreate, GetModuleHandleW, Sleep, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, SetHandleCount, GetFileType, GetStartupInfoA, TlsGetValue, TlsAlloc, TlsFree, GetCurrentThreadId, InterlockedDecrement, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetModuleHandleA, InitializeCriticalSectionAndSpinCount, RtlUnwind, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, WideCharToMultiByte, HeapSize, GetLocaleInfoA, LCMapStringA, MultiByteToWideChar, GetStringTypeA, GetStringTypeW, GetConsoleCP, GetConsoleMode, FlushFileBuffers, SetFilePointer, CloseHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, SetStdHandle, CreateFileA |
GDI32.dll | GetCharWidth32A |
Language of compilation system | Country where language is spoken | Map |
---|---|---|
Tamil | India | |
Tamil | Sri Lanka |
Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-10-24T15:57:02.114246+0200 | 2044243 | ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in | 1 | 192.168.2.4 | 49730 | 109.107.157.208 | 80 | TCP |
Timestamp | Source Port | Dest Port | Source IP | Dest IP |
---|---|---|---|---|
Oct 24, 2024 15:57:01.002331972 CEST | 49730 | 80 | 192.168.2.4 | 109.107.157.208 |
Oct 24, 2024 15:57:01.008313894 CEST | 80 | 49730 | 109.107.157.208 | 192.168.2.4 |
Oct 24, 2024 15:57:01.008466959 CEST | 49730 | 80 | 192.168.2.4 | 109.107.157.208 |
Oct 24, 2024 15:57:01.008663893 CEST | 49730 | 80 | 192.168.2.4 | 109.107.157.208 |
Oct 24, 2024 15:57:01.015043020 CEST | 80 | 49730 | 109.107.157.208 | 192.168.2.4 |
Oct 24, 2024 15:57:01.837510109 CEST | 80 | 49730 | 109.107.157.208 | 192.168.2.4 |
Oct 24, 2024 15:57:01.837606907 CEST | 49730 | 80 | 192.168.2.4 | 109.107.157.208 |
Oct 24, 2024 15:57:01.869196892 CEST | 49730 | 80 | 192.168.2.4 | 109.107.157.208 |
Oct 24, 2024 15:57:01.874923944 CEST | 80 | 49730 | 109.107.157.208 | 192.168.2.4 |
Oct 24, 2024 15:57:02.114142895 CEST | 80 | 49730 | 109.107.157.208 | 192.168.2.4 |
Oct 24, 2024 15:57:02.114245892 CEST | 49730 | 80 | 192.168.2.4 | 109.107.157.208 |
Oct 24, 2024 15:57:07.489281893 CEST | 80 | 49730 | 109.107.157.208 | 192.168.2.4 |
Oct 24, 2024 15:57:07.489382029 CEST | 80 | 49730 | 109.107.157.208 | 192.168.2.4 |
Oct 24, 2024 15:57:07.489474058 CEST | 49730 | 80 | 192.168.2.4 | 109.107.157.208 |
Oct 24, 2024 15:57:07.489475012 CEST | 49730 | 80 | 192.168.2.4 | 109.107.157.208 |
Oct 24, 2024 15:57:21.535186052 CEST | 49730 | 80 | 192.168.2.4 | 109.107.157.208 |
|
Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
---|---|---|---|---|---|---|
0 | 192.168.2.4 | 49730 | 109.107.157.208 | 80 | 8 | C:\Users\user\Desktop\is65NMeWkV.exe |
Timestamp | Bytes transferred | Direction | Data |
---|---|---|---|
Oct 24, 2024 15:57:01.008663893 CEST | 90 | OUT | |
Oct 24, 2024 15:57:01.837510109 CEST | 203 | IN | |
Oct 24, 2024 15:57:01.869196892 CEST | 419 | OUT | |
Oct 24, 2024 15:57:02.114142895 CEST | 210 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
Target ID: | 0 |
Start time: | 09:56:59 |
Start date: | 24/10/2024 |
Path: | C:\Users\user\Desktop\is65NMeWkV.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0x400000 |
File size: | 399'360 bytes |
MD5 hash: | 5D0D37171E8ED9FC0B97E8F858133802 |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Yara matches: |
|
Reputation: | low |
Has exited: | true |
Target ID: | 3 |
Start time: | 09:57:01 |
Start date: | 24/10/2024 |
Path: | C:\Windows\SysWOW64\WerFault.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0x60000 |
File size: | 483'680 bytes |
MD5 hash: | C31336C1EFC2CCB44B4326EA793040F2 |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | true |
Execution Graph
Execution Coverage: | 5.7% |
Dynamic/Decrypted Code Coverage: | 68.5% |
Signature Coverage: | 12.2% |
Total number of Nodes: | 1416 |
Total number of Limit Nodes: | 28 |
Graph
Function 004045C0 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114stringmemoryCOMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00419860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212libraryloaderCOMMON
Control-flow Graph
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00404880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479networkstringfileCOMMON
Control-flow Graph
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00417850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00401160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00419C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684libraryloaderCOMMON
Control-flow Graph
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00406280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON
Control-flow Graph
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 004117A0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 160stringCOMMON
Control-flow Graph
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00415510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON
Control-flow Graph
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00417500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON
Control-flow Graph
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 0230003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515memoryCOMMON
Control-flow Graph
APIs |
|
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 004169F0 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON
Control-flow Graph
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 004047B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON
Control-flow Graph
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Control-flow Graph
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00416AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON
Control-flow Graph
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 004178E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00401110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 007F1894 Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON
APIs |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 02300E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON
APIs |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 004010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00401190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 007F1553 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 004138B0 Relevance: 47.5, APIs: 21, Strings: 6, Instructions: 250filestringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 0040BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00414910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00414570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 02314B77 Relevance: 27.2, APIs: 18, Instructions: 172fileCOMMON
APIs |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 0230C0D7 Relevance: 26.2, APIs: 17, Instructions: 675fileCOMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00413EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 023147D7 Relevance: 22.6, APIs: 15, Instructions: 137stringmemoryfileCOMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 02314107 Relevance: 18.1, APIs: 12, Instructions: 133fileCOMMON
APIs |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 0040ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 0040DE10 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 370fileCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 0040F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 004016D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 0230EF87 Relevance: 13.9, APIs: 9, Instructions: 369fileCOMMON
APIs |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 0040DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 0230DCE7 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 0230F917 Relevance: 12.3, APIs: 8, Instructions: 275fileCOMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 0040E430 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 514fileCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 02301937 Relevance: 11.0, APIs: 7, Instructions: 492fileCOMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 0230E077 Relevance: 10.9, APIs: 7, Instructions: 370fileCOMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00417B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 0040C820 Relevance: 10.6, APIs: 7, Instructions: 93stringencryptionCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 0230CA87 Relevance: 10.6, APIs: 7, Instructions: 93stringencryptionCOMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00416920 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 67timeCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00409AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 02317DF7 Relevance: 7.6, APIs: 5, Instructions: 114memoryCOMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00419600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 02319867 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON
APIs |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 0230E697 Relevance: 6.5, APIs: 4, Instructions: 514fileCOMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00413720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 0230092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 0041CEEA Relevance: 1.5, APIs: 1, Instructions: 4COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 0231D151 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 0232D257 Relevance: .4, Instructions: 439COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 0232CEFF Relevance: .3, Instructions: 298COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 0233370B Relevance: .2, Instructions: 219COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 007F1171 Relevance: .1, Instructions: 61COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 02300D90 Relevance: .0, Instructions: 43COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00419750 Relevance: .0, Instructions: 15COMMON
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 023199B7 Relevance: .0, Instructions: 15COMMON
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00410250 Relevance: 77.4, APIs: 32, Strings: 12, Instructions: 363stringmemoryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00405960 Relevance: 42.5, APIs: 19, Strings: 5, Instructions: 493networkstringmemoryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00414D70 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 119stringCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 0040CEF0 Relevance: 31.9, APIs: 21, Instructions: 374stringmemoryfileCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 0230D157 Relevance: 31.9, APIs: 21, Instructions: 374stringmemoryfileCOMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 02305BC7 Relevance: 29.0, APIs: 19, Instructions: 493networkstringmemoryCOMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 0040C990 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 383filestringCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 0230CBF7 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 383filestringCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00418320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00410A60 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 205stringprocesssynchronizationCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00401310 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 004152C0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 138stringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 004060A0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 133networkfileCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 02310CC7 Relevance: 18.2, APIs: 12, Instructions: 205stringprocesssynchronizationCOMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 02310CB6 Relevance: 18.2, APIs: 12, Instructions: 185stringprocesssynchronizationCOMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 02304AE7 Relevance: 17.0, APIs: 11, Instructions: 479networkstringfileCOMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 02319277 Relevance: 16.7, APIs: 11, Instructions: 184COMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 02317767 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106memoryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 004075D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 004072D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00414780 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 101stringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00418100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 02318367 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 67memoryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 0040BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00409E10 Relevance: 12.2, APIs: 4, Strings: 4, Instructions: 167memoryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 02307837 Relevance: 12.1, APIs: 8, Instructions: 91stringCOMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00404FB0 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 02305217 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 02315777 Relevance: 10.9, APIs: 7, Instructions: 383sleepCOMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 004183DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 02304A17 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00417690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 023178F7 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00417720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 004192E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 02315527 Relevance: 9.1, APIs: 6, Instructions: 138stringCOMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 02317337 Relevance: 9.1, APIs: 6, Instructions: 136COMMON
APIs |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00413560 Relevance: 9.1, APIs: 6, Instructions: 122stringCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 02316C57 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00416F00 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 02317167 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 004069B0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 155libraryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 023149E7 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
Strings |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 0230A077 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 167memoryCOMMON
APIs |
|
Strings |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00410D90 Relevance: 7.6, APIs: 5, Instructions: 120stringCOMMON
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 0231CDA0 Relevance: 7.6, APIs: 5, Instructions: 94COMMON
APIs |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 02316B87 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON
APIs |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00419260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Strings |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00406BE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66memoryCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 0041A920 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47stringCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00418D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 0040F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 0232E553 Relevance: 6.1, APIs: 4, Instructions: 126COMMON
APIs |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 004194D0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 02319737 Relevance: 6.1, APIs: 4, Instructions: 89COMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00418680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 023188E7 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00414F40 Relevance: 6.1, APIs: 4, Instructions: 70stringCOMMON
APIs |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 004187C0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 02311A07 Relevance: 6.1, APIs: 4, Instructions: 53stringCOMMON
APIs |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 02313880 Relevance: 6.0, APIs: 4, Instructions: 45stringCOMMON
APIs |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 02319547 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON
APIs |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 02316D5A Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00414BB0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118stringCOMMON
APIs |
|
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00415050 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48stringCOMMON
APIs |
Strings |
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 0230BCE7 Relevance: 5.3, APIs: 4, Instructions: 284stringCOMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 00413BDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16filestringCOMMON
APIs |
Strings |
|
Memory Dump Source |
|
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 023151A7 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON
APIs |
|
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|
Function 023194C7 Relevance: 5.0, APIs: 4, Instructions: 41stringCOMMON
APIs |
Memory Dump Source |
|
Joe Sandbox IDA Plugin |
|
Yara matches |
Similarity |
|