Edit tour

Windows Analysis Report
oLiA3yj6Cq.dll

Overview

General Information

Sample name:	oLiA3yj6Cq.dll (renamed file extension from exe to dll, renamed because original name is a hash value)
Original sample name:	e43d6309199e04b80a93fb0ccc44545c42fca0627d50496f356d01cd552061ec.exe
Analysis ID:	1542739
MD5:	4886943161951b6be845188a19c82de5
SHA1:	f8bd367eb8cc58e05f10697ae4e27c190bd7662d
SHA256:	e43d6309199e04b80a93fb0ccc44545c42fca0627d50496f356d01cd552061ec
Tags:	20-25-126-96exeuser-JAMESWT_MHT
Infos:

Detection

CobaltStrike

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected CobaltStrike

Yara detected Powershell download and execute

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to detect sleep reduction / modifications

Found direct / indirect Syscall (likely to bypass EDR)

AV process strings found (often used to terminate AV products)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found large amount of non-executed APIs

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains more sections than normal

PE file contains sections with non-standard names

Registers a DLL

Sample execution stops while process was sleeping (likely an evasion)

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 1912 cmdline: loaddll64.exe "C:\Users\user\Desktop\oLiA3yj6Cq.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)

conhost.exe (PID: 3728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6248 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\oLiA3yj6Cq.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

rundll32.exe (PID: 2120 cmdline: rundll32.exe "C:\Users\user\Desktop\oLiA3yj6Cq.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)

regsvr32.exe (PID: 2784 cmdline: regsvr32.exe /s C:\Users\user\Desktop\oLiA3yj6Cq.dll MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

WerFault.exe (PID: 2096 cmdline: C:\Windows\system32\WerFault.exe -u -p 2784 -s 412 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 3060 cmdline: rundll32.exe C:\Users\user\Desktop\oLiA3yj6Cq.dll,DllGetClassObject MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 5676 cmdline: rundll32.exe C:\Users\user\Desktop\oLiA3yj6Cq.dll,DllMain MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 4948 cmdline: rundll32.exe C:\Users\user\Desktop\oLiA3yj6Cq.dll,DllRegisterServer MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Cobalt Strike, CobaltStrike	Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit.The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written, stable, and highly customizable.	APT 29 APT32 APT41 AQUATIC PANDA Anunak Cobalt Codoso CopyKittens DarkHydrus Earth Baxia FIN6 FIN7 Leviathan Mustang Panda Shell Crew Stone Panda TianWu UNC1878 UNC2452 Winnti Umbrella	http://blog.morphisec.com/new-global-attack-on-point-of-sale-systems http://blog.nsfocus.net/murenshark http://stillu.cc/assets/slides/2023-08-Unmasking%20CamoFei.pdf http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa http://www.secureworks.com/research/threat-profiles/gold-drake	https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike

Malware Configuration

Threatname: CobaltStrike

{"BeaconType": ["HTTPS"], "Port": 443, "SleepTime": 60000, "MaxGetSize": 1048576, "Jitter": 0, "C2Server": "20.25.126.96,/pixel", "HttpPostUri": "/submit.php", "Malleable_C2_Instructions": [], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\rundll32.exe", "Spawnto_x64": "%windir%\\sysnative\\rundll32.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 987654321, "bStageCleanup": "False", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "True", "bProcInject_UseRWX": "True", "bProcInject_MinAllocSize": 0, "ProcInject_PrependAppend_x86": "Empty", "ProcInject_PrependAppend_x64": "Empty", "ProcInject_Execute": ["CreateThread", "SetThreadContext", "CreateRemoteThread", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "VirtualAllocEx", "bUsesCookies": "True", "HostHeader": ""}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x30fa3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31780:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x31ab2:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31a44:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x31ab2:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x3107e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3120f:$a7: could not run command (w/ token) because of its length of %d bytes! 0x310c4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31afc:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x3136a:$a11: Could not open service control manager on %s: %d 0x3189c:$a12: %d is an x64 process (can't inject x86 content) 0x318cc:$a13: %d is an x86 process (can't inject x64 content) 0x31bed:$a14: Failed to impersonate logged on user %d (%u) 0x31855:$a15: could not create remote thread in %d: %d 0x31138:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31803:$a17: could not write to process memory: %d 0x3139b:$a18: Could not create service %s on %s: %d 0x31424:$a19: Could not delete service %s on %s: %d 0x31289:$a20: Could not open process token: %d (%u)
00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1cd3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x31ab2:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31afc:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x3: %d is an x86 process (can't inject x64 content) 0x31289:$s1: Could not open process token: %d (%u) 0x30fa3:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s4: Could not connect to pipe (%s): %d
00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x401f1:$loader_export: ReflectiveLoader 0x30f60:$exportname: beacon.dll
00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x3189c:$x2: %d is an x64 process (can't inject x86 content) 0x31bed:$x3: Failed to impersonate logged on user %d (%u) 0x31afc:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x31ab2:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x3120f:$s3: could not run command (w/ token) because of its length of %d bytes! 0x31803:$s4: could not write to process memory: %d 0x30fa3:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s6: Could not connect to pipe (%s): %d
00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x31f70:$str1: %s (admin) 0x30f60:$str2: beacon.dll
00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x31afc:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x2: %d is an x86 process (can't inject x64 content) 0x31ab2:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31b96:$x4: Failed to impersonate token from %d (%u) 0x31bed:$x5: Failed to impersonate logged on user %d (%u) 0x30fa3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen
00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x31a8a:$s1: %%IMPORT%% 0x30f87:$s2: www6.%x%x.%s 0x30f7b:$s3: cdn.%x%x.%s 0x31203:$s4: api.%x%x.%s 0x31f70:$s5: %s (admin) 0x31272:$s6: could not spawn %s: %d 0x31b2e:$s7: Could not kill %d: %d 0x31347:$s8: Could not connect to pipe (%s): %d 0x30f94:$s9: %s.1%x.%x%x.%s 0x30fa3:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3107e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x310c4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31138:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31161:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31186:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x311a7:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x311c4:$s9: %s.1%08x%08x%08x.%x%x.%s 0x311dd:$s9: %s.1%08x%08x.%x%x.%s 0x311f2:$s9: %s.1%08x.%x%x.%s
0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x30fa3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31780:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x31ab2:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31a44:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x31ab2:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x3107e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3120f:$a7: could not run command (w/ token) because of its length of %d bytes! 0x310c4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31afc:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x3136a:$a11: Could not open service control manager on %s: %d 0x3189c:$a12: %d is an x64 process (can't inject x86 content) 0x318cc:$a13: %d is an x86 process (can't inject x64 content) 0x31bed:$a14: Failed to impersonate logged on user %d (%u) 0x31855:$a15: could not create remote thread in %d: %d 0x31138:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31803:$a17: could not write to process memory: %d 0x3139b:$a18: Could not create service %s on %s: %d 0x31424:$a19: Could not delete service %s on %s: %d 0x31289:$a20: Could not open process token: %d (%u)
0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1cd3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x31ab2:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31afc:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x3: %d is an x86 process (can't inject x64 content) 0x31289:$s1: Could not open process token: %d (%u) 0x30fa3:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s4: Could not connect to pipe (%s): %d
0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x401f1:$loader_export: ReflectiveLoader 0x30f60:$exportname: beacon.dll
0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x3189c:$x2: %d is an x64 process (can't inject x86 content) 0x31bed:$x3: Failed to impersonate logged on user %d (%u) 0x31afc:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x31ab2:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x3120f:$s3: could not run command (w/ token) because of its length of %d bytes! 0x31803:$s4: could not write to process memory: %d 0x30fa3:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s6: Could not connect to pipe (%s): %d
0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x31f70:$str1: %s (admin) 0x30f60:$str2: beacon.dll
0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x31afc:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x2: %d is an x86 process (can't inject x64 content) 0x31ab2:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31b96:$x4: Failed to impersonate token from %d (%u) 0x31bed:$x5: Failed to impersonate logged on user %d (%u) 0x30fa3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen
0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x31a8a:$s1: %%IMPORT%% 0x30f87:$s2: www6.%x%x.%s 0x30f7b:$s3: cdn.%x%x.%s 0x31203:$s4: api.%x%x.%s 0x31f70:$s5: %s (admin) 0x31272:$s6: could not spawn %s: %d 0x31b2e:$s7: Could not kill %d: %d 0x31347:$s8: Could not connect to pipe (%s): %d 0x30f94:$s9: %s.1%x.%x%x.%s 0x30fa3:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3107e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x310c4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31138:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31161:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31186:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x311a7:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x311c4:$s9: %s.1%08x%08x%08x.%x%x.%s 0x311dd:$s9: %s.1%08x%08x.%x%x.%s 0x311f2:$s9: %s.1%08x.%x%x.%s
0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x30fa3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31780:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x31ab2:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31a44:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x31ab2:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x3107e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3120f:$a7: could not run command (w/ token) because of its length of %d bytes! 0x310c4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31afc:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x3136a:$a11: Could not open service control manager on %s: %d 0x3189c:$a12: %d is an x64 process (can't inject x86 content) 0x318cc:$a13: %d is an x86 process (can't inject x64 content) 0x31bed:$a14: Failed to impersonate logged on user %d (%u) 0x31855:$a15: could not create remote thread in %d: %d 0x31138:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31803:$a17: could not write to process memory: %d 0x3139b:$a18: Could not create service %s on %s: %d 0x31424:$a19: Could not delete service %s on %s: %d 0x31289:$a20: Could not open process token: %d (%u)
0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1cd3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x31ab2:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31afc:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x3: %d is an x86 process (can't inject x64 content) 0x31289:$s1: Could not open process token: %d (%u) 0x30fa3:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s4: Could not connect to pipe (%s): %d
0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x401f1:$loader_export: ReflectiveLoader 0x30f60:$exportname: beacon.dll
0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x3189c:$x2: %d is an x64 process (can't inject x86 content) 0x31bed:$x3: Failed to impersonate logged on user %d (%u) 0x31afc:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x31ab2:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x3120f:$s3: could not run command (w/ token) because of its length of %d bytes! 0x31803:$s4: could not write to process memory: %d 0x30fa3:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s6: Could not connect to pipe (%s): %d
0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x31f70:$str1: %s (admin) 0x30f60:$str2: beacon.dll
0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x31afc:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x2: %d is an x86 process (can't inject x64 content) 0x31ab2:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31b96:$x4: Failed to impersonate token from %d (%u) 0x31bed:$x5: Failed to impersonate logged on user %d (%u) 0x30fa3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen
0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x31a8a:$s1: %%IMPORT%% 0x30f87:$s2: www6.%x%x.%s 0x30f7b:$s3: cdn.%x%x.%s 0x31203:$s4: api.%x%x.%s 0x31f70:$s5: %s (admin) 0x31272:$s6: could not spawn %s: %d 0x31b2e:$s7: Could not kill %d: %d 0x31347:$s8: Could not connect to pipe (%s): %d 0x30f94:$s9: %s.1%x.%x%x.%s 0x30fa3:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3107e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x310c4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31138:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31161:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31186:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x311a7:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x311c4:$s9: %s.1%08x%08x%08x.%x%x.%s 0x311dd:$s9: %s.1%08x%08x.%x%x.%s 0x311f2:$s9: %s.1%08x.%x%x.%s
00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x30fa3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31780:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x31ab2:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31a44:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x31ab2:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x3107e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3120f:$a7: could not run command (w/ token) because of its length of %d bytes! 0x310c4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31afc:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x3136a:$a11: Could not open service control manager on %s: %d 0x3189c:$a12: %d is an x64 process (can't inject x86 content) 0x318cc:$a13: %d is an x86 process (can't inject x64 content) 0x31bed:$a14: Failed to impersonate logged on user %d (%u) 0x31855:$a15: could not create remote thread in %d: %d 0x31138:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31803:$a17: could not write to process memory: %d 0x3139b:$a18: Could not create service %s on %s: %d 0x31424:$a19: Could not delete service %s on %s: %d 0x31289:$a20: Could not open process token: %d (%u)
00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1cd3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x31ab2:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31afc:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x3: %d is an x86 process (can't inject x64 content) 0x31289:$s1: Could not open process token: %d (%u) 0x30fa3:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s4: Could not connect to pipe (%s): %d
00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x401f1:$loader_export: ReflectiveLoader 0x30f60:$exportname: beacon.dll
00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x3189c:$x2: %d is an x64 process (can't inject x86 content) 0x31bed:$x3: Failed to impersonate logged on user %d (%u) 0x31afc:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x31ab2:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x3120f:$s3: could not run command (w/ token) because of its length of %d bytes! 0x31803:$s4: could not write to process memory: %d 0x30fa3:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s6: Could not connect to pipe (%s): %d
00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x31f70:$str1: %s (admin) 0x30f60:$str2: beacon.dll
00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x31afc:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x2: %d is an x86 process (can't inject x64 content) 0x31ab2:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31b96:$x4: Failed to impersonate token from %d (%u) 0x31bed:$x5: Failed to impersonate logged on user %d (%u) 0x30fa3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen
00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x31a8a:$s1: %%IMPORT%% 0x30f87:$s2: www6.%x%x.%s 0x30f7b:$s3: cdn.%x%x.%s 0x31203:$s4: api.%x%x.%s 0x31f70:$s5: %s (admin) 0x31272:$s6: could not spawn %s: %d 0x31b2e:$s7: Could not kill %d: %d 0x31347:$s8: Could not connect to pipe (%s): %d 0x30f94:$s9: %s.1%x.%x%x.%s 0x30fa3:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3107e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x310c4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31138:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31161:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31186:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x311a7:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x311c4:$s9: %s.1%08x%08x%08x.%x%x.%s 0x311dd:$s9: %s.1%08x%08x.%x%x.%s 0x311f2:$s9: %s.1%08x.%x%x.%s
0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x329a3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32a1b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x33180:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x334b2:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x33444:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x334b2:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x32a7e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32c0f:$a7: could not run command (w/ token) because of its length of %d bytes! 0x32ac4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b02:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x334fc:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x32d6a:$a11: Could not open service control manager on %s: %d 0x3329c:$a12: %d is an x64 process (can't inject x86 content) 0x332cc:$a13: %d is an x86 process (can't inject x64 content) 0x335ed:$a14: Failed to impersonate logged on user %d (%u) 0x33255:$a15: could not create remote thread in %d: %d 0x32b38:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x33203:$a17: could not write to process memory: %d 0x32d9b:$a18: Could not create service %s on %s: %d 0x32e24:$a19: Could not delete service %s on %s: %d 0x32c89:$a20: Could not open process token: %d (%u)
0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1d93c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x334b2:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x334fc:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x332cc:$x3: %d is an x86 process (can't inject x64 content) 0x32c89:$s1: Could not open process token: %d (%u) 0x329a3:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32d47:$s4: Could not connect to pipe (%s): %d
0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x41bf1:$loader_export: ReflectiveLoader 0x32960:$exportname: beacon.dll
0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x3329c:$x2: %d is an x64 process (can't inject x86 content) 0x335ed:$x3: Failed to impersonate logged on user %d (%u) 0x334fc:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x334b2:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x32c0f:$s3: could not run command (w/ token) because of its length of %d bytes! 0x33203:$s4: could not write to process memory: %d 0x329a3:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32d47:$s6: Could not connect to pipe (%s): %d
0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x33970:$str1: %s (admin) 0x32960:$str2: beacon.dll
0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x334fc:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x332cc:$x2: %d is an x86 process (can't inject x64 content) 0x334b2:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x33596:$x4: Failed to impersonate token from %d (%u) 0x335ed:$x5: Failed to impersonate logged on user %d (%u) 0x329a3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x3348a:$s1: %%IMPORT%% 0x32987:$s2: www6.%x%x.%s 0x3297b:$s3: cdn.%x%x.%s 0x32c03:$s4: api.%x%x.%s 0x33970:$s5: %s (admin) 0x32c72:$s6: could not spawn %s: %d 0x3352e:$s7: Could not kill %d: %d 0x32d47:$s8: Could not connect to pipe (%s): %d 0x32994:$s9: %s.1%x.%x%x.%s 0x329a3:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32a1b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32a7e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32ac4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b02:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x32b38:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b61:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b86:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x32ba7:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x32bc4:$s9: %s.1%08x%08x%08x.%x%x.%s 0x32bdd:$s9: %s.1%08x%08x.%x%x.%s 0x32bf2:$s9: %s.1%08x.%x%x.%s
00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x30fa3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31780:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x31ab2:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31a44:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x31ab2:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x3107e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3120f:$a7: could not run command (w/ token) because of its length of %d bytes! 0x310c4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31afc:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x3136a:$a11: Could not open service control manager on %s: %d 0x3189c:$a12: %d is an x64 process (can't inject x86 content) 0x318cc:$a13: %d is an x86 process (can't inject x64 content) 0x31bed:$a14: Failed to impersonate logged on user %d (%u) 0x31855:$a15: could not create remote thread in %d: %d 0x31138:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31803:$a17: could not write to process memory: %d 0x3139b:$a18: Could not create service %s on %s: %d 0x31424:$a19: Could not delete service %s on %s: %d 0x31289:$a20: Could not open process token: %d (%u)
00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1cd3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x31ab2:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31afc:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x3: %d is an x86 process (can't inject x64 content) 0x31289:$s1: Could not open process token: %d (%u) 0x30fa3:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s4: Could not connect to pipe (%s): %d
00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x401f1:$loader_export: ReflectiveLoader 0x30f60:$exportname: beacon.dll
00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x3189c:$x2: %d is an x64 process (can't inject x86 content) 0x31bed:$x3: Failed to impersonate logged on user %d (%u) 0x31afc:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x31ab2:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x3120f:$s3: could not run command (w/ token) because of its length of %d bytes! 0x31803:$s4: could not write to process memory: %d 0x30fa3:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s6: Could not connect to pipe (%s): %d
00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x31f70:$str1: %s (admin) 0x30f60:$str2: beacon.dll
00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x31afc:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x2: %d is an x86 process (can't inject x64 content) 0x31ab2:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31b96:$x4: Failed to impersonate token from %d (%u) 0x31bed:$x5: Failed to impersonate logged on user %d (%u) 0x30fa3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen
00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x31a8a:$s1: %%IMPORT%% 0x30f87:$s2: www6.%x%x.%s 0x30f7b:$s3: cdn.%x%x.%s 0x31203:$s4: api.%x%x.%s 0x31f70:$s5: %s (admin) 0x31272:$s6: could not spawn %s: %d 0x31b2e:$s7: Could not kill %d: %d 0x31347:$s8: Could not connect to pipe (%s): %d 0x30f94:$s9: %s.1%x.%x%x.%s 0x30fa3:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3107e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x310c4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31138:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31161:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31186:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x311a7:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x311c4:$s9: %s.1%08x%08x%08x.%x%x.%s 0x311dd:$s9: %s.1%08x%08x.%x%x.%s 0x311f2:$s9: %s.1%08x.%x%x.%s
00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x329a3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32a1b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x33180:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x334b2:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x33444:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x334b2:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x32a7e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32c0f:$a7: could not run command (w/ token) because of its length of %d bytes! 0x32ac4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b02:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x334fc:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x32d6a:$a11: Could not open service control manager on %s: %d 0x3329c:$a12: %d is an x64 process (can't inject x86 content) 0x332cc:$a13: %d is an x86 process (can't inject x64 content) 0x335ed:$a14: Failed to impersonate logged on user %d (%u) 0x33255:$a15: could not create remote thread in %d: %d 0x32b38:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x33203:$a17: could not write to process memory: %d 0x32d9b:$a18: Could not create service %s on %s: %d 0x32e24:$a19: Could not delete service %s on %s: %d 0x32c89:$a20: Could not open process token: %d (%u)
00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1d93c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x334b2:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x334fc:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x332cc:$x3: %d is an x86 process (can't inject x64 content) 0x32c89:$s1: Could not open process token: %d (%u) 0x329a3:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32d47:$s4: Could not connect to pipe (%s): %d
00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x41bf1:$loader_export: ReflectiveLoader 0x32960:$exportname: beacon.dll
00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x3329c:$x2: %d is an x64 process (can't inject x86 content) 0x335ed:$x3: Failed to impersonate logged on user %d (%u) 0x334fc:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x334b2:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x32c0f:$s3: could not run command (w/ token) because of its length of %d bytes! 0x33203:$s4: could not write to process memory: %d 0x329a3:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32d47:$s6: Could not connect to pipe (%s): %d
00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x33970:$str1: %s (admin) 0x32960:$str2: beacon.dll
00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x334fc:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x332cc:$x2: %d is an x86 process (can't inject x64 content) 0x334b2:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x33596:$x4: Failed to impersonate token from %d (%u) 0x335ed:$x5: Failed to impersonate logged on user %d (%u) 0x329a3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x3348a:$s1: %%IMPORT%% 0x32987:$s2: www6.%x%x.%s 0x3297b:$s3: cdn.%x%x.%s 0x32c03:$s4: api.%x%x.%s 0x33970:$s5: %s (admin) 0x32c72:$s6: could not spawn %s: %d 0x3352e:$s7: Could not kill %d: %d 0x32d47:$s8: Could not connect to pipe (%s): %d 0x32994:$s9: %s.1%x.%x%x.%s 0x329a3:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32a1b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32a7e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32ac4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b02:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x32b38:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b61:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b86:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x32ba7:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x32bc4:$s9: %s.1%08x%08x%08x.%x%x.%s 0x32bdd:$s9: %s.1%08x%08x.%x%x.%s 0x32bf2:$s9: %s.1%08x.%x%x.%s
Process Memory Space: loaddll64.exe PID: 1912	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
Process Memory Space: loaddll64.exe PID: 1912	JoeSecurity_CobaltStrike_1	Yara detected CobaltStrike	Joe Security
Process Memory Space: loaddll64.exe PID: 1912	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: loaddll64.exe PID: 1912	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
Process Memory Space: loaddll64.exe PID: 1912	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Process Memory Space: loaddll64.exe PID: 1912	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x3e70:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0xbad0:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3ee8:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0xbb48:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x464d:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0xc2ad:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x4975:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0xc5d5:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x4907:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x4975:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0xc567:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0xc5d5:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x3f4b:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0xbbab:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x40dc:$a7: could not run command (w/ token) because of its length of %d bytes! 0xbd3c:$a7: could not run command (w/ token) because of its length of %d bytes! 0x3f91:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0xbbf1:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3fcf:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0xbc2f:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x49bf:$a10: powershell -nop -exec bypass -EncodedCommand "%s"
Process Memory Space: loaddll64.exe PID: 1912	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x90fc:$loader_export: ReflectiveLoader 0x911b:$loader_export: ReflectiveLoader 0x10c13:$loader_export: ReflectiveLoader 0x10c32:$loader_export: ReflectiveLoader 0x3cae:$exportname: beacon.dll 0x3e37:$exportname: beacon.dll 0xb90e:$exportname: beacon.dll 0xba97:$exportname: beacon.dll
Process Memory Space: loaddll64.exe PID: 1912	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x49bf:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0xc61f:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x4799:$x2: %d is an x86 process (can't inject x64 content) 0xc3f9:$x2: %d is an x86 process (can't inject x64 content) 0x4975:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0xc5d5:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x4a59:$x4: Failed to impersonate token from %d (%u) 0xc6b9:$x4: Failed to impersonate token from %d (%u) 0x4ab0:$x5: Failed to impersonate logged on user %d (%u) 0xc710:$x5: Failed to impersonate logged on user %d (%u) 0x3e70:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0xbad0:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
Process Memory Space: rundll32.exe PID: 2120	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
Process Memory Space: rundll32.exe PID: 2120	JoeSecurity_CobaltStrike_1	Yara detected CobaltStrike	Joe Security
Process Memory Space: rundll32.exe PID: 2120	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: rundll32.exe PID: 2120	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
Process Memory Space: rundll32.exe PID: 2120	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Process Memory Space: rundll32.exe PID: 2120	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x1bff:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x1c77:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x23dc:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x2704:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2696:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x2704:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x1cda:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x1e6b:$a7: could not run command (w/ token) because of its length of %d bytes! 0x1d20:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x1d5e:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x274e:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x1fc6:$a11: Could not open service control manager on %s: %d 0x24f8:$a12: %d is an x64 process (can't inject x86 content) 0x2528:$a13: %d is an x86 process (can't inject x64 content) 0x283f:$a14: Failed to impersonate logged on user %d (%u) 0x24b1:$a15: could not create remote thread in %d: %d 0x1d94:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x245f:$a17: could not write to process memory: %d 0x1ff7:$a18: Could not create service %s on %s: %d 0x2080:$a19: Could not delete service %s on %s: %d 0x1ee5:$a20: Could not open process token: %d (%u)
Process Memory Space: rundll32.exe PID: 2120	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x6d42:$loader_export: ReflectiveLoader 0x6d61:$loader_export: ReflectiveLoader 0x1a3d:$exportname: beacon.dll 0x1bc6:$exportname: beacon.dll
Process Memory Space: rundll32.exe PID: 2120	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x274e:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x2528:$x2: %d is an x86 process (can't inject x64 content) 0x2704:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x27e8:$x4: Failed to impersonate token from %d (%u) 0x283f:$x5: Failed to impersonate logged on user %d (%u) 0x1bff:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
Process Memory Space: rundll32.exe PID: 3060	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
Process Memory Space: rundll32.exe PID: 3060	JoeSecurity_CobaltStrike_1	Yara detected CobaltStrike	Joe Security
Process Memory Space: rundll32.exe PID: 3060	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: rundll32.exe PID: 3060	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
Process Memory Space: rundll32.exe PID: 3060	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Process Memory Space: rundll32.exe PID: 3060	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x26c9:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2741:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2ea6:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x31ce:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x3160:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x31ce:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x27a4:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2935:$a7: could not run command (w/ token) because of its length of %d bytes! 0x27ea:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2828:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x3218:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x2a90:$a11: Could not open service control manager on %s: %d 0x2fc2:$a12: %d is an x64 process (can't inject x86 content) 0x2ff2:$a13: %d is an x86 process (can't inject x64 content) 0x3309:$a14: Failed to impersonate logged on user %d (%u) 0x2f7b:$a15: could not create remote thread in %d: %d 0x285e:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2f29:$a17: could not write to process memory: %d 0x2ac1:$a18: Could not create service %s on %s: %d 0x2b4a:$a19: Could not delete service %s on %s: %d 0x29af:$a20: Could not open process token: %d (%u)
Process Memory Space: rundll32.exe PID: 3060	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x780c:$loader_export: ReflectiveLoader 0x782b:$loader_export: ReflectiveLoader 0x2507:$exportname: beacon.dll 0x2690:$exportname: beacon.dll
Process Memory Space: rundll32.exe PID: 3060	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x3218:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x2ff2:$x2: %d is an x86 process (can't inject x64 content) 0x31ce:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x32b2:$x4: Failed to impersonate token from %d (%u) 0x3309:$x5: Failed to impersonate logged on user %d (%u) 0x26c9:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
Process Memory Space: rundll32.exe PID: 5676	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
Process Memory Space: rundll32.exe PID: 5676	JoeSecurity_CobaltStrike_1	Yara detected CobaltStrike	Joe Security
Process Memory Space: rundll32.exe PID: 5676	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: rundll32.exe PID: 5676	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
Process Memory Space: rundll32.exe PID: 5676	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Process Memory Space: rundll32.exe PID: 5676	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x367d:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x36f5:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3e5a:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x4182:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x4114:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x4182:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x3758:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x38e9:$a7: could not run command (w/ token) because of its length of %d bytes! 0x379e:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x37dc:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x41cc:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x3a44:$a11: Could not open service control manager on %s: %d 0x3f76:$a12: %d is an x64 process (can't inject x86 content) 0x3fa6:$a13: %d is an x86 process (can't inject x64 content) 0x42bd:$a14: Failed to impersonate logged on user %d (%u) 0x3f2f:$a15: could not create remote thread in %d: %d 0x3812:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3edd:$a17: could not write to process memory: %d 0x3a75:$a18: Could not create service %s on %s: %d 0x3afe:$a19: Could not delete service %s on %s: %d 0x3963:$a20: Could not open process token: %d (%u)
Process Memory Space: rundll32.exe PID: 5676	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x87c0:$loader_export: ReflectiveLoader 0x87df:$loader_export: ReflectiveLoader 0x34bb:$exportname: beacon.dll 0x3644:$exportname: beacon.dll
Process Memory Space: rundll32.exe PID: 5676	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x41cc:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x3fa6:$x2: %d is an x86 process (can't inject x64 content) 0x4182:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x4266:$x4: Failed to impersonate token from %d (%u) 0x42bd:$x5: Failed to impersonate logged on user %d (%u) 0x367d:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
Process Memory Space: rundll32.exe PID: 4948	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
Process Memory Space: rundll32.exe PID: 4948	JoeSecurity_CobaltStrike_1	Yara detected CobaltStrike	Joe Security
Process Memory Space: rundll32.exe PID: 4948	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: rundll32.exe PID: 4948	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
Process Memory Space: rundll32.exe PID: 4948	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Process Memory Space: rundll32.exe PID: 4948	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x43d7:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0xd4ba:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x444f:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0xd532:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x4bb4:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0xdc97:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x4edc:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0xdfbf:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x4e6e:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x4edc:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0xdf51:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0xdfbf:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x44b2:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0xd595:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x4643:$a7: could not run command (w/ token) because of its length of %d bytes! 0xd726:$a7: could not run command (w/ token) because of its length of %d bytes! 0x44f8:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0xd5db:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x4536:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0xd619:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x4f26:$a10: powershell -nop -exec bypass -EncodedCommand "%s"
Process Memory Space: rundll32.exe PID: 4948	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x951a:$loader_export: ReflectiveLoader 0x9539:$loader_export: ReflectiveLoader 0x125fd:$loader_export: ReflectiveLoader 0x1261c:$loader_export: ReflectiveLoader 0x4215:$exportname: beacon.dll 0x439e:$exportname: beacon.dll 0xd2f8:$exportname: beacon.dll 0xd481:$exportname: beacon.dll
Process Memory Space: rundll32.exe PID: 4948	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x4f26:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0xe009:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x4d00:$x2: %d is an x86 process (can't inject x64 content) 0xdde3:$x2: %d is an x86 process (can't inject x64 content) 0x4edc:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0xdfbf:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x4fc0:$x4: Failed to impersonate token from %d (%u) 0xe0a3:$x4: Failed to impersonate token from %d (%u) 0x5017:$x5: Failed to impersonate logged on user %d (%u) 0xe0fa:$x5: Failed to impersonate logged on user %d (%u) 0x43d7:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0xd4ba:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
Click to see the 122 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.rundll32.exe.1e583ce0000.0.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
5.2.rundll32.exe.1e583ce0000.0.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
5.2.rundll32.exe.1e583ce0000.0.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
5.2.rundll32.exe.1e583ce0000.0.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x303a3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3041b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3047e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x304c4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30502:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x30538:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30160:$a39: %s as %s\%s: %d 0x30394:$a40: %s.1%x.%x%x.%s 0x3e7e2:$a41: beacon.x64.dll 0x30387:$a43: www6.%x%x.%s 0x3037b:$a44: cdn.%x%x.%s 0x30360:$a47: beacon.dll 0x302d8:$a48: %s%s: %s 0x3018c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x301b8:$a50: %02d/%02d/%02d %02d:%02d:%02d
5.2.rundll32.exe.1e583ce0000.0.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1c13c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
5.2.rundll32.exe.1e583ce0000.0.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x3e7f1:$loader_export: ReflectiveLoader 0x30360:$exportname: beacon.dll
5.2.rundll32.exe.1e583ce0000.0.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x303a3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
0.2.loaddll64.exe.1bf693b0000.0.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.loaddll64.exe.1bf693b0000.0.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
0.2.loaddll64.exe.1bf693b0000.0.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.2.loaddll64.exe.1bf693b0000.0.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x303a3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3041b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3047e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x304c4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30502:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x30538:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30160:$a39: %s as %s\%s: %d 0x30394:$a40: %s.1%x.%x%x.%s 0x3e7e2:$a41: beacon.x64.dll 0x30387:$a43: www6.%x%x.%s 0x3037b:$a44: cdn.%x%x.%s 0x30360:$a47: beacon.dll 0x302d8:$a48: %s%s: %s 0x3018c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x301b8:$a50: %02d/%02d/%02d %02d:%02d:%02d
0.2.loaddll64.exe.1bf693b0000.0.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1c13c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.loaddll64.exe.1bf693b0000.0.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x3e7f1:$loader_export: ReflectiveLoader 0x30360:$exportname: beacon.dll
0.2.loaddll64.exe.1bf693b0000.0.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x303a3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
0.2.loaddll64.exe.1bf69420000.1.raw.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.loaddll64.exe.1bf69420000.1.raw.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.2.loaddll64.exe.1bf69420000.1.raw.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x329a3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32a1b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x33180:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x334b2:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x33444:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x334b2:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x32a7e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32c0f:$a7: could not run command (w/ token) because of its length of %d bytes! 0x32ac4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b02:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x334fc:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x32d6a:$a11: Could not open service control manager on %s: %d 0x3329c:$a12: %d is an x64 process (can't inject x86 content) 0x332cc:$a13: %d is an x86 process (can't inject x64 content) 0x335ed:$a14: Failed to impersonate logged on user %d (%u) 0x33255:$a15: could not create remote thread in %d: %d 0x32b38:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x33203:$a17: could not write to process memory: %d 0x32d9b:$a18: Could not create service %s on %s: %d 0x32e24:$a19: Could not delete service %s on %s: %d 0x32c89:$a20: Could not open process token: %d (%u)
0.2.loaddll64.exe.1bf69420000.1.raw.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1d93c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.loaddll64.exe.1bf69420000.1.raw.unpack	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x334b2:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x334fc:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x332cc:$x3: %d is an x86 process (can't inject x64 content) 0x32c89:$s1: Could not open process token: %d (%u) 0x329a3:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32d47:$s4: Could not connect to pipe (%s): %d
0.2.loaddll64.exe.1bf69420000.1.raw.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x41bf1:$loader_export: ReflectiveLoader 0x32960:$exportname: beacon.dll
0.2.loaddll64.exe.1bf69420000.1.raw.unpack	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x3329c:$x2: %d is an x64 process (can't inject x86 content) 0x335ed:$x3: Failed to impersonate logged on user %d (%u) 0x334fc:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x334b2:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x32c0f:$s3: could not run command (w/ token) because of its length of %d bytes! 0x33203:$s4: could not write to process memory: %d 0x329a3:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32d47:$s6: Could not connect to pipe (%s): %d
0.2.loaddll64.exe.1bf69420000.1.raw.unpack	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x33970:$str1: %s (admin) 0x32960:$str2: beacon.dll
0.2.loaddll64.exe.1bf69420000.1.raw.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x334fc:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x332cc:$x2: %d is an x86 process (can't inject x64 content) 0x334b2:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x33596:$x4: Failed to impersonate token from %d (%u) 0x335ed:$x5: Failed to impersonate logged on user %d (%u) 0x329a3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
0.2.loaddll64.exe.1bf69420000.1.raw.unpack	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x3348a:$s1: %%IMPORT%% 0x32987:$s2: www6.%x%x.%s 0x3297b:$s3: cdn.%x%x.%s 0x32c03:$s4: api.%x%x.%s 0x33970:$s5: %s (admin) 0x32c72:$s6: could not spawn %s: %d 0x3352e:$s7: Could not kill %d: %d 0x32d47:$s8: Could not connect to pipe (%s): %d 0x32994:$s9: %s.1%x.%x%x.%s 0x329a3:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32a1b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32a7e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32ac4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b02:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x32b38:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b61:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b86:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x32ba7:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x32bc4:$s9: %s.1%08x%08x%08x.%x%x.%s 0x32bdd:$s9: %s.1%08x%08x.%x%x.%s 0x32bf2:$s9: %s.1%08x.%x%x.%s
6.2.rundll32.exe.29e27c60000.0.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
6.2.rundll32.exe.29e27c60000.0.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
6.2.rundll32.exe.29e27c60000.0.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
6.2.rundll32.exe.29e27c60000.0.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x303a3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3041b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3047e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x304c4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30502:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x30538:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30160:$a39: %s as %s\%s: %d 0x30394:$a40: %s.1%x.%x%x.%s 0x3e7e2:$a41: beacon.x64.dll 0x30387:$a43: www6.%x%x.%s 0x3037b:$a44: cdn.%x%x.%s 0x30360:$a47: beacon.dll 0x302d8:$a48: %s%s: %s 0x3018c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x301b8:$a50: %02d/%02d/%02d %02d:%02d:%02d
6.2.rundll32.exe.29e27c60000.0.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1c13c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
6.2.rundll32.exe.29e27c60000.0.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x3e7f1:$loader_export: ReflectiveLoader 0x30360:$exportname: beacon.dll
6.2.rundll32.exe.29e27c60000.0.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x303a3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
5.2.rundll32.exe.1e583ce0000.0.raw.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
5.2.rundll32.exe.1e583ce0000.0.raw.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
5.2.rundll32.exe.1e583ce0000.0.raw.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
5.2.rundll32.exe.1e583ce0000.0.raw.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
5.2.rundll32.exe.1e583ce0000.0.raw.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x30fa3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31780:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x31ab2:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31a44:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x31ab2:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x3107e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3120f:$a7: could not run command (w/ token) because of its length of %d bytes! 0x310c4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31afc:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x3136a:$a11: Could not open service control manager on %s: %d 0x3189c:$a12: %d is an x64 process (can't inject x86 content) 0x318cc:$a13: %d is an x86 process (can't inject x64 content) 0x31bed:$a14: Failed to impersonate logged on user %d (%u) 0x31855:$a15: could not create remote thread in %d: %d 0x31138:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31803:$a17: could not write to process memory: %d 0x3139b:$a18: Could not create service %s on %s: %d 0x31424:$a19: Could not delete service %s on %s: %d 0x31289:$a20: Could not open process token: %d (%u)
5.2.rundll32.exe.1e583ce0000.0.raw.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1cd3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
5.2.rundll32.exe.1e583ce0000.0.raw.unpack	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x31ab2:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31afc:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x3: %d is an x86 process (can't inject x64 content) 0x31289:$s1: Could not open process token: %d (%u) 0x30fa3:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s4: Could not connect to pipe (%s): %d
5.2.rundll32.exe.1e583ce0000.0.raw.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x401f1:$loader_export: ReflectiveLoader 0x30f60:$exportname: beacon.dll
5.2.rundll32.exe.1e583ce0000.0.raw.unpack	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x3189c:$x2: %d is an x64 process (can't inject x86 content) 0x31bed:$x3: Failed to impersonate logged on user %d (%u) 0x31afc:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x31ab2:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x3120f:$s3: could not run command (w/ token) because of its length of %d bytes! 0x31803:$s4: could not write to process memory: %d 0x30fa3:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s6: Could not connect to pipe (%s): %d
5.2.rundll32.exe.1e583ce0000.0.raw.unpack	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x31f70:$str1: %s (admin) 0x30f60:$str2: beacon.dll
5.2.rundll32.exe.1e583ce0000.0.raw.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x31afc:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x2: %d is an x86 process (can't inject x64 content) 0x31ab2:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31b96:$x4: Failed to impersonate token from %d (%u) 0x31bed:$x5: Failed to impersonate logged on user %d (%u) 0x30fa3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
5.2.rundll32.exe.1e583ce0000.0.raw.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen
5.2.rundll32.exe.1e583ce0000.0.raw.unpack	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x31a8a:$s1: %%IMPORT%% 0x30f87:$s2: www6.%x%x.%s 0x30f7b:$s3: cdn.%x%x.%s 0x31203:$s4: api.%x%x.%s 0x31f70:$s5: %s (admin) 0x31272:$s6: could not spawn %s: %d 0x31b2e:$s7: Could not kill %d: %d 0x31347:$s8: Could not connect to pipe (%s): %d 0x30f94:$s9: %s.1%x.%x%x.%s 0x30fa3:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3107e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x310c4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31138:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31161:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31186:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x311a7:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x311c4:$s9: %s.1%08x%08x%08x.%x%x.%s 0x311dd:$s9: %s.1%08x%08x.%x%x.%s 0x311f2:$s9: %s.1%08x.%x%x.%s
0.2.loaddll64.exe.1bf693b0000.0.raw.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
0.2.loaddll64.exe.1bf693b0000.0.raw.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.loaddll64.exe.1bf693b0000.0.raw.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
0.2.loaddll64.exe.1bf693b0000.0.raw.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.2.loaddll64.exe.1bf693b0000.0.raw.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x30fa3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31780:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x31ab2:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31a44:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x31ab2:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x3107e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3120f:$a7: could not run command (w/ token) because of its length of %d bytes! 0x310c4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31afc:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x3136a:$a11: Could not open service control manager on %s: %d 0x3189c:$a12: %d is an x64 process (can't inject x86 content) 0x318cc:$a13: %d is an x86 process (can't inject x64 content) 0x31bed:$a14: Failed to impersonate logged on user %d (%u) 0x31855:$a15: could not create remote thread in %d: %d 0x31138:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31803:$a17: could not write to process memory: %d 0x3139b:$a18: Could not create service %s on %s: %d 0x31424:$a19: Could not delete service %s on %s: %d 0x31289:$a20: Could not open process token: %d (%u)
0.2.loaddll64.exe.1bf693b0000.0.raw.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1cd3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.loaddll64.exe.1bf693b0000.0.raw.unpack	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x31ab2:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31afc:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x3: %d is an x86 process (can't inject x64 content) 0x31289:$s1: Could not open process token: %d (%u) 0x30fa3:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s4: Could not connect to pipe (%s): %d
0.2.loaddll64.exe.1bf693b0000.0.raw.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x401f1:$loader_export: ReflectiveLoader 0x30f60:$exportname: beacon.dll
0.2.loaddll64.exe.1bf693b0000.0.raw.unpack	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x3189c:$x2: %d is an x64 process (can't inject x86 content) 0x31bed:$x3: Failed to impersonate logged on user %d (%u) 0x31afc:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x31ab2:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x3120f:$s3: could not run command (w/ token) because of its length of %d bytes! 0x31803:$s4: could not write to process memory: %d 0x30fa3:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s6: Could not connect to pipe (%s): %d
0.2.loaddll64.exe.1bf693b0000.0.raw.unpack	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x31f70:$str1: %s (admin) 0x30f60:$str2: beacon.dll
0.2.loaddll64.exe.1bf693b0000.0.raw.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x31afc:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x2: %d is an x86 process (can't inject x64 content) 0x31ab2:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31b96:$x4: Failed to impersonate token from %d (%u) 0x31bed:$x5: Failed to impersonate logged on user %d (%u) 0x30fa3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
0.2.loaddll64.exe.1bf693b0000.0.raw.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen
0.2.loaddll64.exe.1bf693b0000.0.raw.unpack	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x31a8a:$s1: %%IMPORT%% 0x30f87:$s2: www6.%x%x.%s 0x30f7b:$s3: cdn.%x%x.%s 0x31203:$s4: api.%x%x.%s 0x31f70:$s5: %s (admin) 0x31272:$s6: could not spawn %s: %d 0x31b2e:$s7: Could not kill %d: %d 0x31347:$s8: Could not connect to pipe (%s): %d 0x30f94:$s9: %s.1%x.%x%x.%s 0x30fa3:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3107e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x310c4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31138:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31161:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31186:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x311a7:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x311c4:$s9: %s.1%08x%08x%08x.%x%x.%s 0x311dd:$s9: %s.1%08x%08x.%x%x.%s 0x311f2:$s9: %s.1%08x.%x%x.%s
0.2.loaddll64.exe.1bf69420000.1.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.2.loaddll64.exe.1bf69420000.1.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.2.loaddll64.exe.1bf69420000.1.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x30fa3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31780:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x31ab2:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31a44:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x31ab2:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x3107e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3120f:$a7: could not run command (w/ token) because of its length of %d bytes! 0x310c4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31afc:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x3136a:$a11: Could not open service control manager on %s: %d 0x3189c:$a12: %d is an x64 process (can't inject x86 content) 0x318cc:$a13: %d is an x86 process (can't inject x64 content) 0x31bed:$a14: Failed to impersonate logged on user %d (%u) 0x31855:$a15: could not create remote thread in %d: %d 0x31138:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31803:$a17: could not write to process memory: %d 0x3139b:$a18: Could not create service %s on %s: %d 0x31424:$a19: Could not delete service %s on %s: %d 0x31289:$a20: Could not open process token: %d (%u)
0.2.loaddll64.exe.1bf69420000.1.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1cd3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.2.loaddll64.exe.1bf69420000.1.unpack	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x31ab2:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31afc:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x3: %d is an x86 process (can't inject x64 content) 0x31289:$s1: Could not open process token: %d (%u) 0x30fa3:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s4: Could not connect to pipe (%s): %d
0.2.loaddll64.exe.1bf69420000.1.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x401f1:$loader_export: ReflectiveLoader 0x30f60:$exportname: beacon.dll
0.2.loaddll64.exe.1bf69420000.1.unpack	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x3189c:$x2: %d is an x64 process (can't inject x86 content) 0x31bed:$x3: Failed to impersonate logged on user %d (%u) 0x31afc:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x31ab2:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x3120f:$s3: could not run command (w/ token) because of its length of %d bytes! 0x31803:$s4: could not write to process memory: %d 0x30fa3:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s6: Could not connect to pipe (%s): %d
0.2.loaddll64.exe.1bf69420000.1.unpack	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x31f70:$str1: %s (admin) 0x30f60:$str2: beacon.dll
0.2.loaddll64.exe.1bf69420000.1.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x31afc:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x2: %d is an x86 process (can't inject x64 content) 0x31ab2:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31b96:$x4: Failed to impersonate token from %d (%u) 0x31bed:$x5: Failed to impersonate logged on user %d (%u) 0x30fa3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
0.2.loaddll64.exe.1bf69420000.1.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen
0.2.loaddll64.exe.1bf69420000.1.unpack	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x31a8a:$s1: %%IMPORT%% 0x30f87:$s2: www6.%x%x.%s 0x30f7b:$s3: cdn.%x%x.%s 0x31203:$s4: api.%x%x.%s 0x31f70:$s5: %s (admin) 0x31272:$s6: could not spawn %s: %d 0x31b2e:$s7: Could not kill %d: %d 0x31347:$s8: Could not connect to pipe (%s): %d 0x30f94:$s9: %s.1%x.%x%x.%s 0x30fa3:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3107e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x310c4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31138:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31161:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31186:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x311a7:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x311c4:$s9: %s.1%08x%08x%08x.%x%x.%s 0x311dd:$s9: %s.1%08x%08x.%x%x.%s 0x311f2:$s9: %s.1%08x.%x%x.%s
10.2.rundll32.exe.20650830000.0.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
10.2.rundll32.exe.20650830000.0.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
10.2.rundll32.exe.20650830000.0.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
10.2.rundll32.exe.20650830000.0.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x303a3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3041b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3047e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x304c4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30502:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x30538:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30160:$a39: %s as %s\%s: %d 0x30394:$a40: %s.1%x.%x%x.%s 0x3e7e2:$a41: beacon.x64.dll 0x30387:$a43: www6.%x%x.%s 0x3037b:$a44: cdn.%x%x.%s 0x30360:$a47: beacon.dll 0x302d8:$a48: %s%s: %s 0x3018c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x301b8:$a50: %02d/%02d/%02d %02d:%02d:%02d
10.2.rundll32.exe.20650830000.0.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1c13c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
10.2.rundll32.exe.20650830000.0.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x3e7f1:$loader_export: ReflectiveLoader 0x30360:$exportname: beacon.dll
10.2.rundll32.exe.20650830000.0.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x303a3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
11.2.rundll32.exe.16e0d720000.1.raw.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
11.2.rundll32.exe.16e0d720000.1.raw.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
11.2.rundll32.exe.16e0d720000.1.raw.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
11.2.rundll32.exe.16e0d720000.1.raw.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
11.2.rundll32.exe.16e0d720000.1.raw.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x329a3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32a1b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x33180:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x334b2:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x33444:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x334b2:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x32a7e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32c0f:$a7: could not run command (w/ token) because of its length of %d bytes! 0x32ac4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b02:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x334fc:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x32d6a:$a11: Could not open service control manager on %s: %d 0x3329c:$a12: %d is an x64 process (can't inject x86 content) 0x332cc:$a13: %d is an x86 process (can't inject x64 content) 0x335ed:$a14: Failed to impersonate logged on user %d (%u) 0x33255:$a15: could not create remote thread in %d: %d 0x32b38:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x33203:$a17: could not write to process memory: %d 0x32d9b:$a18: Could not create service %s on %s: %d 0x32e24:$a19: Could not delete service %s on %s: %d 0x32c89:$a20: Could not open process token: %d (%u)
11.2.rundll32.exe.16e0d720000.1.raw.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1d93c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
11.2.rundll32.exe.16e0d720000.1.raw.unpack	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x334b2:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x334fc:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x332cc:$x3: %d is an x86 process (can't inject x64 content) 0x32c89:$s1: Could not open process token: %d (%u) 0x329a3:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32d47:$s4: Could not connect to pipe (%s): %d
11.2.rundll32.exe.16e0d720000.1.raw.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x41bf1:$loader_export: ReflectiveLoader 0x32960:$exportname: beacon.dll
11.2.rundll32.exe.16e0d720000.1.raw.unpack	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x3329c:$x2: %d is an x64 process (can't inject x86 content) 0x335ed:$x3: Failed to impersonate logged on user %d (%u) 0x334fc:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x334b2:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x32c0f:$s3: could not run command (w/ token) because of its length of %d bytes! 0x33203:$s4: could not write to process memory: %d 0x329a3:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32d47:$s6: Could not connect to pipe (%s): %d
11.2.rundll32.exe.16e0d720000.1.raw.unpack	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x33970:$str1: %s (admin) 0x32960:$str2: beacon.dll
11.2.rundll32.exe.16e0d720000.1.raw.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x334fc:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x332cc:$x2: %d is an x86 process (can't inject x64 content) 0x334b2:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x33596:$x4: Failed to impersonate token from %d (%u) 0x335ed:$x5: Failed to impersonate logged on user %d (%u) 0x329a3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
11.2.rundll32.exe.16e0d720000.1.raw.unpack	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x3348a:$s1: %%IMPORT%% 0x32987:$s2: www6.%x%x.%s 0x3297b:$s3: cdn.%x%x.%s 0x32c03:$s4: api.%x%x.%s 0x33970:$s5: %s (admin) 0x32c72:$s6: could not spawn %s: %d 0x3352e:$s7: Could not kill %d: %d 0x32d47:$s8: Could not connect to pipe (%s): %d 0x32994:$s9: %s.1%x.%x%x.%s 0x329a3:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32a1b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32a7e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32ac4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b02:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x32b38:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b61:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x32b86:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x32ba7:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x32bc4:$s9: %s.1%08x%08x%08x.%x%x.%s 0x32bdd:$s9: %s.1%08x%08x.%x%x.%s 0x32bf2:$s9: %s.1%08x.%x%x.%s
10.2.rundll32.exe.20650830000.0.raw.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
10.2.rundll32.exe.20650830000.0.raw.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
10.2.rundll32.exe.20650830000.0.raw.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
10.2.rundll32.exe.20650830000.0.raw.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
10.2.rundll32.exe.20650830000.0.raw.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x30fa3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31780:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x31ab2:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31a44:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x31ab2:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x3107e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3120f:$a7: could not run command (w/ token) because of its length of %d bytes! 0x310c4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31afc:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x3136a:$a11: Could not open service control manager on %s: %d 0x3189c:$a12: %d is an x64 process (can't inject x86 content) 0x318cc:$a13: %d is an x86 process (can't inject x64 content) 0x31bed:$a14: Failed to impersonate logged on user %d (%u) 0x31855:$a15: could not create remote thread in %d: %d 0x31138:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31803:$a17: could not write to process memory: %d 0x3139b:$a18: Could not create service %s on %s: %d 0x31424:$a19: Could not delete service %s on %s: %d 0x31289:$a20: Could not open process token: %d (%u)
10.2.rundll32.exe.20650830000.0.raw.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1cd3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
10.2.rundll32.exe.20650830000.0.raw.unpack	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x31ab2:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31afc:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x3: %d is an x86 process (can't inject x64 content) 0x31289:$s1: Could not open process token: %d (%u) 0x30fa3:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s4: Could not connect to pipe (%s): %d
10.2.rundll32.exe.20650830000.0.raw.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x401f1:$loader_export: ReflectiveLoader 0x30f60:$exportname: beacon.dll
10.2.rundll32.exe.20650830000.0.raw.unpack	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x3189c:$x2: %d is an x64 process (can't inject x86 content) 0x31bed:$x3: Failed to impersonate logged on user %d (%u) 0x31afc:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x31ab2:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x3120f:$s3: could not run command (w/ token) because of its length of %d bytes! 0x31803:$s4: could not write to process memory: %d 0x30fa3:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s6: Could not connect to pipe (%s): %d
10.2.rundll32.exe.20650830000.0.raw.unpack	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x31f70:$str1: %s (admin) 0x30f60:$str2: beacon.dll
10.2.rundll32.exe.20650830000.0.raw.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x31afc:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x2: %d is an x86 process (can't inject x64 content) 0x31ab2:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31b96:$x4: Failed to impersonate token from %d (%u) 0x31bed:$x5: Failed to impersonate logged on user %d (%u) 0x30fa3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
10.2.rundll32.exe.20650830000.0.raw.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen
10.2.rundll32.exe.20650830000.0.raw.unpack	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x31a8a:$s1: %%IMPORT%% 0x30f87:$s2: www6.%x%x.%s 0x30f7b:$s3: cdn.%x%x.%s 0x31203:$s4: api.%x%x.%s 0x31f70:$s5: %s (admin) 0x31272:$s6: could not spawn %s: %d 0x31b2e:$s7: Could not kill %d: %d 0x31347:$s8: Could not connect to pipe (%s): %d 0x30f94:$s9: %s.1%x.%x%x.%s 0x30fa3:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3107e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x310c4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31138:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31161:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31186:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x311a7:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x311c4:$s9: %s.1%08x%08x%08x.%x%x.%s 0x311dd:$s9: %s.1%08x%08x.%x%x.%s 0x311f2:$s9: %s.1%08x.%x%x.%s
11.2.rundll32.exe.16e0d6d0000.0.raw.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
11.2.rundll32.exe.16e0d6d0000.0.raw.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
11.2.rundll32.exe.16e0d6d0000.0.raw.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
11.2.rundll32.exe.16e0d6d0000.0.raw.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
11.2.rundll32.exe.16e0d6d0000.0.raw.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x30fa3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31780:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x31ab2:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31a44:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x31ab2:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x3107e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3120f:$a7: could not run command (w/ token) because of its length of %d bytes! 0x310c4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31afc:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x3136a:$a11: Could not open service control manager on %s: %d 0x3189c:$a12: %d is an x64 process (can't inject x86 content) 0x318cc:$a13: %d is an x86 process (can't inject x64 content) 0x31bed:$a14: Failed to impersonate logged on user %d (%u) 0x31855:$a15: could not create remote thread in %d: %d 0x31138:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31803:$a17: could not write to process memory: %d 0x3139b:$a18: Could not create service %s on %s: %d 0x31424:$a19: Could not delete service %s on %s: %d 0x31289:$a20: Could not open process token: %d (%u)
11.2.rundll32.exe.16e0d6d0000.0.raw.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1cd3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
11.2.rundll32.exe.16e0d6d0000.0.raw.unpack	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x31ab2:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31afc:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x3: %d is an x86 process (can't inject x64 content) 0x31289:$s1: Could not open process token: %d (%u) 0x30fa3:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s4: Could not connect to pipe (%s): %d
11.2.rundll32.exe.16e0d6d0000.0.raw.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x401f1:$loader_export: ReflectiveLoader 0x30f60:$exportname: beacon.dll
11.2.rundll32.exe.16e0d6d0000.0.raw.unpack	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x3189c:$x2: %d is an x64 process (can't inject x86 content) 0x31bed:$x3: Failed to impersonate logged on user %d (%u) 0x31afc:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x31ab2:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x3120f:$s3: could not run command (w/ token) because of its length of %d bytes! 0x31803:$s4: could not write to process memory: %d 0x30fa3:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s6: Could not connect to pipe (%s): %d
11.2.rundll32.exe.16e0d6d0000.0.raw.unpack	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x31f70:$str1: %s (admin) 0x30f60:$str2: beacon.dll
11.2.rundll32.exe.16e0d6d0000.0.raw.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x31afc:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x2: %d is an x86 process (can't inject x64 content) 0x31ab2:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31b96:$x4: Failed to impersonate token from %d (%u) 0x31bed:$x5: Failed to impersonate logged on user %d (%u) 0x30fa3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
11.2.rundll32.exe.16e0d6d0000.0.raw.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen
11.2.rundll32.exe.16e0d6d0000.0.raw.unpack	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x31a8a:$s1: %%IMPORT%% 0x30f87:$s2: www6.%x%x.%s 0x30f7b:$s3: cdn.%x%x.%s 0x31203:$s4: api.%x%x.%s 0x31f70:$s5: %s (admin) 0x31272:$s6: could not spawn %s: %d 0x31b2e:$s7: Could not kill %d: %d 0x31347:$s8: Could not connect to pipe (%s): %d 0x30f94:$s9: %s.1%x.%x%x.%s 0x30fa3:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3107e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x310c4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31138:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31161:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31186:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x311a7:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x311c4:$s9: %s.1%08x%08x%08x.%x%x.%s 0x311dd:$s9: %s.1%08x%08x.%x%x.%s 0x311f2:$s9: %s.1%08x.%x%x.%s
11.2.rundll32.exe.16e0d6d0000.0.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
11.2.rundll32.exe.16e0d6d0000.0.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
11.2.rundll32.exe.16e0d6d0000.0.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
11.2.rundll32.exe.16e0d6d0000.0.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x303a3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3041b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3047e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x304c4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30502:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x30538:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x30160:$a39: %s as %s\%s: %d 0x30394:$a40: %s.1%x.%x%x.%s 0x3e7e2:$a41: beacon.x64.dll 0x30387:$a43: www6.%x%x.%s 0x3037b:$a44: cdn.%x%x.%s 0x30360:$a47: beacon.dll 0x302d8:$a48: %s%s: %s 0x3018c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x301b8:$a50: %02d/%02d/%02d %02d:%02d:%02d
11.2.rundll32.exe.16e0d6d0000.0.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1c13c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
11.2.rundll32.exe.16e0d6d0000.0.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x3e7f1:$loader_export: ReflectiveLoader 0x30360:$exportname: beacon.dll
11.2.rundll32.exe.16e0d6d0000.0.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x303a3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
11.2.rundll32.exe.16e0d720000.1.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
11.2.rundll32.exe.16e0d720000.1.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
11.2.rundll32.exe.16e0d720000.1.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
11.2.rundll32.exe.16e0d720000.1.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
11.2.rundll32.exe.16e0d720000.1.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x30fa3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31780:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x31ab2:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31a44:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x31ab2:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x3107e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3120f:$a7: could not run command (w/ token) because of its length of %d bytes! 0x310c4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31afc:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x3136a:$a11: Could not open service control manager on %s: %d 0x3189c:$a12: %d is an x64 process (can't inject x86 content) 0x318cc:$a13: %d is an x86 process (can't inject x64 content) 0x31bed:$a14: Failed to impersonate logged on user %d (%u) 0x31855:$a15: could not create remote thread in %d: %d 0x31138:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31803:$a17: could not write to process memory: %d 0x3139b:$a18: Could not create service %s on %s: %d 0x31424:$a19: Could not delete service %s on %s: %d 0x31289:$a20: Could not open process token: %d (%u)
11.2.rundll32.exe.16e0d720000.1.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1cd3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
11.2.rundll32.exe.16e0d720000.1.unpack	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x31ab2:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31afc:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x3: %d is an x86 process (can't inject x64 content) 0x31289:$s1: Could not open process token: %d (%u) 0x30fa3:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s4: Could not connect to pipe (%s): %d
11.2.rundll32.exe.16e0d720000.1.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x401f1:$loader_export: ReflectiveLoader 0x30f60:$exportname: beacon.dll
11.2.rundll32.exe.16e0d720000.1.unpack	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x3189c:$x2: %d is an x64 process (can't inject x86 content) 0x31bed:$x3: Failed to impersonate logged on user %d (%u) 0x31afc:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x31ab2:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x3120f:$s3: could not run command (w/ token) because of its length of %d bytes! 0x31803:$s4: could not write to process memory: %d 0x30fa3:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s6: Could not connect to pipe (%s): %d
11.2.rundll32.exe.16e0d720000.1.unpack	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x31f70:$str1: %s (admin) 0x30f60:$str2: beacon.dll
11.2.rundll32.exe.16e0d720000.1.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x31afc:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x2: %d is an x86 process (can't inject x64 content) 0x31ab2:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31b96:$x4: Failed to impersonate token from %d (%u) 0x31bed:$x5: Failed to impersonate logged on user %d (%u) 0x30fa3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
11.2.rundll32.exe.16e0d720000.1.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen
11.2.rundll32.exe.16e0d720000.1.unpack	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x31a8a:$s1: %%IMPORT%% 0x30f87:$s2: www6.%x%x.%s 0x30f7b:$s3: cdn.%x%x.%s 0x31203:$s4: api.%x%x.%s 0x31f70:$s5: %s (admin) 0x31272:$s6: could not spawn %s: %d 0x31b2e:$s7: Could not kill %d: %d 0x31347:$s8: Could not connect to pipe (%s): %d 0x30f94:$s9: %s.1%x.%x%x.%s 0x30fa3:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3107e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x310c4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31138:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31161:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31186:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x311a7:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x311c4:$s9: %s.1%08x%08x%08x.%x%x.%s 0x311dd:$s9: %s.1%08x%08x.%x%x.%s 0x311f2:$s9: %s.1%08x.%x%x.%s
6.2.rundll32.exe.29e27c60000.0.raw.unpack	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
6.2.rundll32.exe.29e27c60000.0.raw.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
6.2.rundll32.exe.29e27c60000.0.raw.unpack	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
6.2.rundll32.exe.29e27c60000.0.raw.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
6.2.rundll32.exe.29e27c60000.0.raw.unpack	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x30fa3:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31780:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x31ab2:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31a44:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x31ab2:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x3107e:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3120f:$a7: could not run command (w/ token) because of its length of %d bytes! 0x310c4:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31afc:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x3136a:$a11: Could not open service control manager on %s: %d 0x3189c:$a12: %d is an x64 process (can't inject x86 content) 0x318cc:$a13: %d is an x86 process (can't inject x64 content) 0x31bed:$a14: Failed to impersonate logged on user %d (%u) 0x31855:$a15: could not create remote thread in %d: %d 0x31138:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31803:$a17: could not write to process memory: %d 0x3139b:$a18: Could not create service %s on %s: %d 0x31424:$a19: Could not delete service %s on %s: %d 0x31289:$a20: Could not open process token: %d (%u)
6.2.rundll32.exe.29e27c60000.0.raw.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x1cd3c:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
6.2.rundll32.exe.29e27c60000.0.raw.unpack	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x31ab2:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31afc:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x3: %d is an x86 process (can't inject x64 content) 0x31289:$s1: Could not open process token: %d (%u) 0x30fa3:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s4: Could not connect to pipe (%s): %d
6.2.rundll32.exe.29e27c60000.0.raw.unpack	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x401f1:$loader_export: ReflectiveLoader 0x30f60:$exportname: beacon.dll
6.2.rundll32.exe.29e27c60000.0.raw.unpack	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x3189c:$x2: %d is an x64 process (can't inject x86 content) 0x31bed:$x3: Failed to impersonate logged on user %d (%u) 0x31afc:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x31ab2:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x3120f:$s3: could not run command (w/ token) because of its length of %d bytes! 0x31803:$s4: could not write to process memory: %d 0x30fa3:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31347:$s6: Could not connect to pipe (%s): %d
6.2.rundll32.exe.29e27c60000.0.raw.unpack	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x31f70:$str1: %s (admin) 0x30f60:$str2: beacon.dll
6.2.rundll32.exe.29e27c60000.0.raw.unpack	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x31afc:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x318cc:$x2: %d is an x86 process (can't inject x64 content) 0x31ab2:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x31b96:$x4: Failed to impersonate token from %d (%u) 0x31bed:$x5: Failed to impersonate logged on user %d (%u) 0x30fa3:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
6.2.rundll32.exe.29e27c60000.0.raw.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen
6.2.rundll32.exe.29e27c60000.0.raw.unpack	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x31a8a:$s1: %%IMPORT%% 0x30f87:$s2: www6.%x%x.%s 0x30f7b:$s3: cdn.%x%x.%s 0x31203:$s4: api.%x%x.%s 0x31f70:$s5: %s (admin) 0x31272:$s6: could not spawn %s: %d 0x31b2e:$s7: Could not kill %d: %d 0x31347:$s8: Could not connect to pipe (%s): %d 0x30f94:$s9: %s.1%x.%x%x.%s 0x30fa3:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3101b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x3107e:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x310c4:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31102:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x31138:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31161:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x31186:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x311a7:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x311c4:$s9: %s.1%08x%08x%08x.%x%x.%s 0x311dd:$s9: %s.1%08x%08x.%x%x.%s 0x311f2:$s9: %s.1%08x.%x%x.%s
Click to see the 141 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp

Malware Configuration Extractor: CobaltStrike {"BeaconType": ["HTTPS"], "Port": 443, "SleepTime": 60000, "MaxGetSize": 1048576, "Jitter": 0, "C2Server": "20.25.126.96,/pixel", "HttpPostUri": "/submit.php", "Malleable_C2_Instructions": [], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\rundll32.exe", "Spawnto_x64": "%windir%\\sysnative\\rundll32.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 987654321, "bStageCleanup": "False", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "True", "bProcInject_UseRWX": "True", "bProcInject_MinAllocSize": 0, "ProcInject_PrependAppend_x86": "Empty", "ProcInject_PrependAppend_x64": "Empty", "ProcInject_Execute": ["CreateThread", "SetThreadContext", "CreateRemoteThread", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "VirtualAllocEx", "bUsesCookies": "True", "HostHeader": ""}

Multi AV Scanner detection for submitted file

Source: oLiA3yj6Cq.dll

ReversingLabs: Detection: 57%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_000001BF69421184 CryptAcquireContextA,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

0_2_000001BF69421184

Source: oLiA3yj6Cq.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF69439220 malloc,_snprintf,FindFirstFileA,free,malloc,_snprintf,free,FindNextFileA,FindClose,		0_2_000001BF69439220
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF69431C30 malloc,GetCurrentDirectoryA,FindFirstFileA,GetLastError,free,free,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FindNextFileA,FindClose,		0_2_000001BF69431C30

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 20.25.126.96

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_000001BF69435BB8 recv,

0_2_000001BF69435BB8

Source: rundll32.exe, 0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:%u/
Source: Amcache.hve.9.dr	String found in binary or memory: http://upx.sf.net

System Summary

Malicious sample detected (through community Yara rule)

Source: 5.2.rundll32.exe.1e583ce0000.0.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 5.2.rundll32.exe.1e583ce0000.0.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 5.2.rundll32.exe.1e583ce0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 5.2.rundll32.exe.1e583ce0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 0.2.loaddll64.exe.1bf693b0000.0.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 0.2.loaddll64.exe.1bf693b0000.0.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.loaddll64.exe.1bf693b0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 0.2.loaddll64.exe.1bf693b0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 0.2.loaddll64.exe.1bf69420000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 0.2.loaddll64.exe.1bf69420000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.loaddll64.exe.1bf69420000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 0.2.loaddll64.exe.1bf69420000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 0.2.loaddll64.exe.1bf69420000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 0.2.loaddll64.exe.1bf69420000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 0.2.loaddll64.exe.1bf69420000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 0.2.loaddll64.exe.1bf69420000.1.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 6.2.rundll32.exe.29e27c60000.0.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 6.2.rundll32.exe.29e27c60000.0.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 6.2.rundll32.exe.29e27c60000.0.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 6.2.rundll32.exe.29e27c60000.0.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 5.2.rundll32.exe.1e583ce0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 5.2.rundll32.exe.1e583ce0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 5.2.rundll32.exe.1e583ce0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 5.2.rundll32.exe.1e583ce0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 5.2.rundll32.exe.1e583ce0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 5.2.rundll32.exe.1e583ce0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 5.2.rundll32.exe.1e583ce0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 5.2.rundll32.exe.1e583ce0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 5.2.rundll32.exe.1e583ce0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 0.2.loaddll64.exe.1bf693b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 0.2.loaddll64.exe.1bf693b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.loaddll64.exe.1bf693b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 0.2.loaddll64.exe.1bf693b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 0.2.loaddll64.exe.1bf693b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 0.2.loaddll64.exe.1bf693b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 0.2.loaddll64.exe.1bf693b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 0.2.loaddll64.exe.1bf693b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 0.2.loaddll64.exe.1bf693b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 0.2.loaddll64.exe.1bf69420000.1.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 0.2.loaddll64.exe.1bf69420000.1.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.2.loaddll64.exe.1bf69420000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 0.2.loaddll64.exe.1bf69420000.1.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 0.2.loaddll64.exe.1bf69420000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 0.2.loaddll64.exe.1bf69420000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 0.2.loaddll64.exe.1bf69420000.1.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 0.2.loaddll64.exe.1bf69420000.1.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 0.2.loaddll64.exe.1bf69420000.1.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 10.2.rundll32.exe.20650830000.0.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 10.2.rundll32.exe.20650830000.0.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 10.2.rundll32.exe.20650830000.0.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 10.2.rundll32.exe.20650830000.0.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 11.2.rundll32.exe.16e0d720000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 11.2.rundll32.exe.16e0d720000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 11.2.rundll32.exe.16e0d720000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 11.2.rundll32.exe.16e0d720000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 11.2.rundll32.exe.16e0d720000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 11.2.rundll32.exe.16e0d720000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 11.2.rundll32.exe.16e0d720000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 11.2.rundll32.exe.16e0d720000.1.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 10.2.rundll32.exe.20650830000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 10.2.rundll32.exe.20650830000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 10.2.rundll32.exe.20650830000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 10.2.rundll32.exe.20650830000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 10.2.rundll32.exe.20650830000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 10.2.rundll32.exe.20650830000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 10.2.rundll32.exe.20650830000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 10.2.rundll32.exe.20650830000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 10.2.rundll32.exe.20650830000.0.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 11.2.rundll32.exe.16e0d6d0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 11.2.rundll32.exe.16e0d6d0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 11.2.rundll32.exe.16e0d6d0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 11.2.rundll32.exe.16e0d6d0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 11.2.rundll32.exe.16e0d6d0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 11.2.rundll32.exe.16e0d6d0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 11.2.rundll32.exe.16e0d6d0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 11.2.rundll32.exe.16e0d6d0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 11.2.rundll32.exe.16e0d6d0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 11.2.rundll32.exe.16e0d6d0000.0.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 11.2.rundll32.exe.16e0d6d0000.0.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 11.2.rundll32.exe.16e0d6d0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 11.2.rundll32.exe.16e0d6d0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 11.2.rundll32.exe.16e0d720000.1.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 11.2.rundll32.exe.16e0d720000.1.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 11.2.rundll32.exe.16e0d720000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 11.2.rundll32.exe.16e0d720000.1.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 11.2.rundll32.exe.16e0d720000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 11.2.rundll32.exe.16e0d720000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 11.2.rundll32.exe.16e0d720000.1.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 11.2.rundll32.exe.16e0d720000.1.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 11.2.rundll32.exe.16e0d720000.1.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 6.2.rundll32.exe.29e27c60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 6.2.rundll32.exe.29e27c60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 6.2.rundll32.exe.29e27c60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 6.2.rundll32.exe.29e27c60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 6.2.rundll32.exe.29e27c60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 6.2.rundll32.exe.29e27c60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 6.2.rundll32.exe.29e27c60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 6.2.rundll32.exe.29e27c60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 6.2.rundll32.exe.29e27c60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike payload Author: ditekSHen
Source: Process Memory Space: loaddll64.exe PID: 1912, type: MEMORYSTR	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: Process Memory Space: loaddll64.exe PID: 1912, type: MEMORYSTR	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: Process Memory Space: loaddll64.exe PID: 1912, type: MEMORYSTR	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: Process Memory Space: rundll32.exe PID: 2120, type: MEMORYSTR	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: Process Memory Space: rundll32.exe PID: 2120, type: MEMORYSTR	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: Process Memory Space: rundll32.exe PID: 2120, type: MEMORYSTR	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: Process Memory Space: rundll32.exe PID: 3060, type: MEMORYSTR	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: Process Memory Space: rundll32.exe PID: 3060, type: MEMORYSTR	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: Process Memory Space: rundll32.exe PID: 3060, type: MEMORYSTR	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: Process Memory Space: rundll32.exe PID: 5676, type: MEMORYSTR	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: Process Memory Space: rundll32.exe PID: 5676, type: MEMORYSTR	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: Process Memory Space: rundll32.exe PID: 5676, type: MEMORYSTR	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: Process Memory Space: rundll32.exe PID: 4948, type: MEMORYSTR	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: Process Memory Space: rundll32.exe PID: 4948, type: MEMORYSTR	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: Process Memory Space: rundll32.exe PID: 4948, type: MEMORYSTR	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_000001BF69431268 CreateProcessWithLogonW,GetLastError,

0_2_000001BF69431268

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF693C0334	0_2_000001BF693C0334
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF693D239C	0_2_000001BF693D239C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF693DC397	0_2_000001BF693DC397
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF693D0374	0_2_000001BF693D0374
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF693D1264	0_2_000001BF693D1264
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF693DAAB0	0_2_000001BF693DAAB0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF693CF5A8	0_2_000001BF693CF5A8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF693C6F38	0_2_000001BF693C6F38
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF693DB7B0	0_2_000001BF693DB7B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF693DE600	0_2_000001BF693DE600
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF693BCE3C	0_2_000001BF693BCE3C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF693B9680	0_2_000001BF693B9680
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF693DC680	0_2_000001BF693DC680
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF693D5914	0_2_000001BF693D5914
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF693D1928	0_2_000001BF693D1928
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF693B916C	0_2_000001BF693B916C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF693DCFF0	0_2_000001BF693DCFF0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF69437B38	0_2_000001BF69437B38
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF6944C3B0	0_2_000001BF6944C3B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF6942DA3C	0_2_000001BF6942DA3C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF6944F200	0_2_000001BF6944F200
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF6942A280	0_2_000001BF6942A280
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF6944D280	0_2_000001BF6944D280
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF69442528	0_2_000001BF69442528
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF69446514	0_2_000001BF69446514
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF69429D6C	0_2_000001BF69429D6C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF6944DBF0	0_2_000001BF6944DBF0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF69430F34	0_2_000001BF69430F34
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF69440F74	0_2_000001BF69440F74
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF69442F9C	0_2_000001BF69442F9C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF6944CF97	0_2_000001BF6944CF97
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF6944B6B0	0_2_000001BF6944B6B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF69441E64	0_2_000001BF69441E64
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF6943867C	0_2_000001BF6943867C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF694401A8	0_2_000001BF694401A8
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000016E0D6F5914	11_2_0000016E0D6F5914
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000016E0D6F1928	11_2_0000016E0D6F1928
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000016E0D6D916C	11_2_0000016E0D6D916C
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000016E0D6FCFF0	11_2_0000016E0D6FCFF0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000016E0D6FB7B0	11_2_0000016E0D6FB7B0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000016E0D6FAAB0	11_2_0000016E0D6FAAB0
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000016E0D6F239C	11_2_0000016E0D6F239C
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000016E0D6FC397	11_2_0000016E0D6FC397
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000016E0D6F0374	11_2_0000016E0D6F0374
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000016E0D6E0334	11_2_0000016E0D6E0334
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000016E0D6F1264	11_2_0000016E0D6F1264
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000016E0D6EF5A8	11_2_0000016E0D6EF5A8
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000016E0D6E6F38	11_2_0000016E0D6E6F38
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000016E0D6FE600	11_2_0000016E0D6FE600
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000016E0D6FC680	11_2_0000016E0D6FC680
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000016E0D6D9680	11_2_0000016E0D6D9680
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000016E0D6DCE3C	11_2_0000016E0D6DCE3C

Source: C:\Windows\System32\regsvr32.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2784 -s 412

Source: oLiA3yj6Cq.dll

Static PE information: Number of sections : 11 > 10

Source: 5.2.rundll32.exe.1e583ce0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 5.2.rundll32.exe.1e583ce0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 5.2.rundll32.exe.1e583ce0000.0.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 5.2.rundll32.exe.1e583ce0000.0.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.loaddll64.exe.1bf693b0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 0.2.loaddll64.exe.1bf693b0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.loaddll64.exe.1bf693b0000.0.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 0.2.loaddll64.exe.1bf693b0000.0.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.loaddll64.exe.1bf69420000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 0.2.loaddll64.exe.1bf69420000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.loaddll64.exe.1bf69420000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.loaddll64.exe.1bf69420000.1.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 0.2.loaddll64.exe.1bf69420000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.loaddll64.exe.1bf69420000.1.raw.unpack, type: UNPACKEDPE	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 0.2.loaddll64.exe.1bf69420000.1.raw.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.loaddll64.exe.1bf69420000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 6.2.rundll32.exe.29e27c60000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 6.2.rundll32.exe.29e27c60000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 6.2.rundll32.exe.29e27c60000.0.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 6.2.rundll32.exe.29e27c60000.0.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.rundll32.exe.1e583ce0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 5.2.rundll32.exe.1e583ce0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 5.2.rundll32.exe.1e583ce0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.rundll32.exe.1e583ce0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 5.2.rundll32.exe.1e583ce0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.rundll32.exe.1e583ce0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 5.2.rundll32.exe.1e583ce0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.rundll32.exe.1e583ce0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 5.2.rundll32.exe.1e583ce0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 0.2.loaddll64.exe.1bf693b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 0.2.loaddll64.exe.1bf693b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.loaddll64.exe.1bf693b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.loaddll64.exe.1bf693b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 0.2.loaddll64.exe.1bf693b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.loaddll64.exe.1bf693b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 0.2.loaddll64.exe.1bf693b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.loaddll64.exe.1bf693b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 0.2.loaddll64.exe.1bf693b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 0.2.loaddll64.exe.1bf69420000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 0.2.loaddll64.exe.1bf69420000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.2.loaddll64.exe.1bf69420000.1.unpack, type: UNPACKEDPE	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.loaddll64.exe.1bf69420000.1.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 0.2.loaddll64.exe.1bf69420000.1.unpack, type: UNPACKEDPE	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.loaddll64.exe.1bf69420000.1.unpack, type: UNPACKEDPE	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 0.2.loaddll64.exe.1bf69420000.1.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.loaddll64.exe.1bf69420000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 0.2.loaddll64.exe.1bf69420000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 10.2.rundll32.exe.20650830000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 10.2.rundll32.exe.20650830000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 10.2.rundll32.exe.20650830000.0.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 10.2.rundll32.exe.20650830000.0.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.2.rundll32.exe.16e0d720000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 11.2.rundll32.exe.16e0d720000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 11.2.rundll32.exe.16e0d720000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.2.rundll32.exe.16e0d720000.1.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 11.2.rundll32.exe.16e0d720000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.2.rundll32.exe.16e0d720000.1.raw.unpack, type: UNPACKEDPE	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 11.2.rundll32.exe.16e0d720000.1.raw.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.2.rundll32.exe.16e0d720000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 10.2.rundll32.exe.20650830000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 10.2.rundll32.exe.20650830000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 10.2.rundll32.exe.20650830000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.rundll32.exe.20650830000.0.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 10.2.rundll32.exe.20650830000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.rundll32.exe.20650830000.0.raw.unpack, type: UNPACKEDPE	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 10.2.rundll32.exe.20650830000.0.raw.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.rundll32.exe.20650830000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 10.2.rundll32.exe.20650830000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 11.2.rundll32.exe.16e0d6d0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 11.2.rundll32.exe.16e0d6d0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 11.2.rundll32.exe.16e0d6d0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.2.rundll32.exe.16e0d6d0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 11.2.rundll32.exe.16e0d6d0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.2.rundll32.exe.16e0d6d0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 11.2.rundll32.exe.16e0d6d0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.2.rundll32.exe.16e0d6d0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 11.2.rundll32.exe.16e0d6d0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 11.2.rundll32.exe.16e0d6d0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 11.2.rundll32.exe.16e0d6d0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 11.2.rundll32.exe.16e0d6d0000.0.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 11.2.rundll32.exe.16e0d6d0000.0.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.2.rundll32.exe.16e0d720000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 11.2.rundll32.exe.16e0d720000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 11.2.rundll32.exe.16e0d720000.1.unpack, type: UNPACKEDPE	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.2.rundll32.exe.16e0d720000.1.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 11.2.rundll32.exe.16e0d720000.1.unpack, type: UNPACKEDPE	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.2.rundll32.exe.16e0d720000.1.unpack, type: UNPACKEDPE	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 11.2.rundll32.exe.16e0d720000.1.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.2.rundll32.exe.16e0d720000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 11.2.rundll32.exe.16e0d720000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 6.2.rundll32.exe.29e27c60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 6.2.rundll32.exe.29e27c60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 6.2.rundll32.exe.29e27c60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 6.2.rundll32.exe.29e27c60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 6.2.rundll32.exe.29e27c60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 6.2.rundll32.exe.29e27c60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 6.2.rundll32.exe.29e27c60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 6.2.rundll32.exe.29e27c60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 6.2.rundll32.exe.29e27c60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: Process Memory Space: loaddll64.exe PID: 1912, type: MEMORYSTR	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: Process Memory Space: loaddll64.exe PID: 1912, type: MEMORYSTR	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: Process Memory Space: loaddll64.exe PID: 1912, type: MEMORYSTR	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Process Memory Space: rundll32.exe PID: 2120, type: MEMORYSTR	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: Process Memory Space: rundll32.exe PID: 2120, type: MEMORYSTR	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: Process Memory Space: rundll32.exe PID: 2120, type: MEMORYSTR	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Process Memory Space: rundll32.exe PID: 3060, type: MEMORYSTR	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: Process Memory Space: rundll32.exe PID: 3060, type: MEMORYSTR	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: Process Memory Space: rundll32.exe PID: 3060, type: MEMORYSTR	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Process Memory Space: rundll32.exe PID: 5676, type: MEMORYSTR	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: Process Memory Space: rundll32.exe PID: 5676, type: MEMORYSTR	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: Process Memory Space: rundll32.exe PID: 5676, type: MEMORYSTR	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Process Memory Space: rundll32.exe PID: 4948, type: MEMORYSTR	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: Process Memory Space: rundll32.exe PID: 4948, type: MEMORYSTR	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: Process Memory Space: rundll32.exe PID: 4948, type: MEMORYSTR	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: classification engine

Classification label: mal100.troj.evad.winDLL@15/5@0/0

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_000001BF69430B70 LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

0_2_000001BF69430B70

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_000001BF69433A64 CreateThread,GetModuleHandleA,GetProcAddress,CreateToolhelp32Snapshot,Thread32Next,Sleep,

0_2_000001BF69433A64

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3728:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2784

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\85427e93-8362-410f-ac2d-6427164523e9

Jump to behavior

Source: oLiA3yj6Cq.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\oLiA3yj6Cq.dll",#1

Source: oLiA3yj6Cq.dll

ReversingLabs: Detection: 57%

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\oLiA3yj6Cq.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\oLiA3yj6Cq.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\oLiA3yj6Cq.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\oLiA3yj6Cq.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\oLiA3yj6Cq.dll,DllGetClassObject
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2784 -s 412
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\oLiA3yj6Cq.dll,DllMain
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\oLiA3yj6Cq.dll,DllRegisterServer
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\oLiA3yj6Cq.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\oLiA3yj6Cq.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\oLiA3yj6Cq.dll,DllGetClassObject	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\oLiA3yj6Cq.dll,DllMain	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\oLiA3yj6Cq.dll,DllRegisterServer	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\oLiA3yj6Cq.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: oLiA3yj6Cq.dll

Static PE information: Image base 0x2fbac0000 > 0x60000000

Source: oLiA3yj6Cq.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_000001BF69449744 EncodePointer,__crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_000001BF69449744

Source: oLiA3yj6Cq.dll

Static PE information: section name: .xdata

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\oLiA3yj6Cq.dll

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF693E1CF0 push rcx; iretd	0_2_000001BF693E1CFE
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF693E776C push 0000006Ah; retf	0_2_000001BF693E7784
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF694536F0 push rcx; iretd	0_2_000001BF694536FE
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF6945916C push 0000006Ah; retf	0_2_000001BF69459184
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000016E0D701CF0 push rcx; iretd	11_2_0000016E0D701CFE
Source: C:\Windows\System32\rundll32.exe	Code function: 11_2_0000016E0D70776C push 0000006Ah; retf	11_2_0000016E0D707784

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_000001BF694401A8 EncodePointer,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_000001BF694401A8

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF6942FA1C		0_2_000001BF6942FA1C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF69435854		0_2_000001BF69435854

Source: C:\Windows\System32\loaddll64.exe

API coverage: 4.2 %

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_000001BF69435854

0_2_000001BF69435854

Source: C:\Windows\System32\loaddll64.exe TID: 2012

Thread sleep time: -120000s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF69439220 malloc,_snprintf,FindFirstFileA,free,malloc,_snprintf,free,FindNextFileA,FindClose,		0_2_000001BF69439220
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF69431C30 malloc,GetCurrentDirectoryA,FindFirstFileA,GetLastError,free,free,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FindNextFileA,FindClose,		0_2_000001BF69431C30

Source: C:\Windows\System32\loaddll64.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: Amcache.hve.9.dr	Binary or memory string: VMware
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.9.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.9.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.9.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: Amcache.hve.9.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.9.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: loaddll64.exe, 00000000.00000002.2230753419.000001BF6919D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.9.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.9.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.9.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.9.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.9.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.9.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.9.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.9.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.9.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.9.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_000001BF69448B30 IsDebuggerPresent,

0_2_000001BF69448B30

Source: C:\Windows\System32\loaddll64.exe

0_2_000001BF69449744

Source: C:\Windows\System32\loaddll64.exe

0_2_000001BF69449744

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_000001BF694503C8 VirtualQuery,GetModuleFileNameW,GetPdbDllFromInstallPath,GetProcAddress,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,

0_2_000001BF694503C8

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF694524C8 DeleteCriticalSection,SetUnhandledExceptionFilter,		0_2_000001BF694524C8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF694524D0 RtlCaptureContext,SetUnhandledExceptionFilter,		0_2_000001BF694524D0

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: loaddll64.exe PID: 1912, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 2120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 3060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 4948, type: MEMORYSTR

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\System32\loaddll64.exe	NtMapViewOfSection: Indirect: 0x7FFDA3581C34	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Indirect: 0x7FFDA35814C3	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtCreateThreadEx: Indirect: 0x7FFDA35816E1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Indirect: 0x7FFDA3581526	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Indirect: 0x7FFDA3581698	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtCreateThreadEx: Indirect: 0x7FFDA3582971	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_000001BF6943DF50 LogonUserA,GetLastError,ImpersonateLoggedOnUser,GetLastError,

0_2_000001BF6943DF50

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\oLiA3yj6Cq.dll",#1

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_000001BF6943DEC8 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_000001BF6943DEC8

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_000001BF69430920 CreateNamedPipeA,

0_2_000001BF69430920

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_000001BF694522F0 GetLocalTime,

0_2_000001BF694522F0

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_000001BF69435E28 GetUserNameA,GetComputerNameA,GetModuleFileNameA,strrchr,GetVersionExA,GetProcAddress,GetModuleHandleA,GetProcAddress,_snprintf,

0_2_000001BF69435E28

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_000001BF69435E28 GetUserNameA,GetComputerNameA,GetModuleFileNameA,strrchr,GetVersionExA,GetProcAddress,GetModuleHandleA,GetProcAddress,_snprintf,

0_2_000001BF69435E28

Source: C:\Windows\System32\loaddll64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.9.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: MsMpEng.exe

Remote Access Functionality

Yara detected CobaltStrike

Source: Yara match	File source: Process Memory Space: loaddll64.exe PID: 1912, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 2120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 3060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 4948, type: MEMORYSTR
Source: Yara match	File source: 5.2.rundll32.exe.1e583ce0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll64.exe.1bf693b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.16e0d720000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rundll32.exe.20650830000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.16e0d6d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.16e0d720000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.29e27c60000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 5.2.rundll32.exe.1e583ce0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll64.exe.1bf693b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll64.exe.1bf69420000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.29e27c60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll64.exe.1bf69420000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rundll32.exe.20650830000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.16e0d6d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF69436A78 socket,htons,ioctlsocket,closesocket,bind,listen,	0_2_000001BF69436A78
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF69436670 htonl,htons,socket,closesocket,bind,ioctlsocket,	0_2_000001BF69436670
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001BF6943EE8C socket,closesocket,htons,bind,listen,	0_2_000001BF6943EE8C

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	2 Valid Accounts	2 Valid Accounts	2 Valid Accounts	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	21 Access Token Manipulation	11 Virtualization/Sandbox Evasion	LSASS Memory	151 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	12 Process Injection	21 Access Token Manipulation	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Abuse Elevation Control Mechanism	12 Process Injection	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Regsvr32	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Rundll32	Proc Filesystem	4 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
oLiA3yj6Cq.dll	58%	ReversingLabs	Win64.Trojan.CobaltStrike

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe

Name	Malicious	Antivirus Detection	Reputation
20.25.126.96	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.9.dr	false	URL Reputation: safe	unknown
http://127.0.0.1:%u/	rundll32.exe, 0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542739
Start date and time:	2024-10-26 09:09:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	oLiA3yj6Cq.dll (renamed file extension from exe to dll, renamed because original name is a hash value)
Original Sample Name:	e43d6309199e04b80a93fb0ccc44545c42fca0627d50496f356d01cd552061ec.exe
Detection:	MAL
Classification:	mal100.troj.evad.winDLL@15/5@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 7 Number of non-executed functions: 190

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.20
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, login.live.com, otelrules.azureedge.net, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus15.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: oLiA3yj6Cq.dll

Simulations

Behavior and APIs

Time	Type	Description
03:10:02	API Interceptor	1x Sleep call for process: WerFault.exe modified
03:10:08	API Interceptor	1x Sleep call for process: loaddll64.exe modified

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_regsvr32.exe_12aa84f81d99ae7eee3b83fc11c16348eb77b7_e29f7403_3efe9483-1171-4cd2-ae68-ab22ee01a16b\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7942221846725064
Encrypted:	false
SSDEEP:	192:RrozcoESjlx0JEb70rjeTozuiFgZ24lO8w:9KcpSjgJEb70rjeczuiFgY4lO8w
MD5:	234B9DDF730C75CA054753B263981FB4
SHA1:	8BEE95B63B69AC4EBEA9C607988591EE7358A8A1
SHA-256:	1B4A1703D849DB7D3133124066F27DD1C2B90C94639B35EAB86691B360E323B1
SHA-512:	FDD93FDB0B4166EC2D076D08091D76D6D88846224E4CCD71D8A033BDEE4C3374BFC2C9D83305625298C53AAFE83FEAFC37EFAA46002CCEE5F700F967B6A34DFE
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.6.4.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.4.0.0.1.9.9.9.3.5.7.5.3.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.4.0.0.2.0.0.1.8.5.7.5.7.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.e.f.e.9.4.8.3.-.1.1.7.1.-.4.c.d.2.-.a.e.6.8.-.a.b.2.2.e.e.0.1.a.1.6.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.b.6.3.d.f.6.0.-.4.b.4.9.-.4.4.8.e.-.8.1.1.b.-.4.2.f.2.8.a.7.e.3.8.2.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.e.g.s.v.r.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.E.G.S.V.R.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.a.e.0.-.0.0.0.1.-.0.0.1.5.-.b.2.c.6.-.c.3.1.1.7.6.2.7.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.d.7.c.2.f.d.3.5.4.3.6.3.d.a.e.e.6.3.e.8.f.5.9.1.e.c.5.2.f.a.5.d.0.e.2.3.f.6.f.!.r.e.g.s.v.r.3.2...e.x.e.....T.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA60A.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sat Oct 26 07:10:00 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	66202
Entropy (8bit):	1.4780462755680313
Encrypted:	false
SSDEEP:	96:5U78ckXhFa56Dds3EiteI8e/Qqoi75BL6GhLw9grx3Q/33l14qa1Nmfkoi+ZWIq4:hlaUa8OQzO50GhLw9grzyfzdWZd5qp
MD5:	7AB8ECCAE4E2946BE455AAC69E887905
SHA1:	11631082A2890D9CCEC1DF1CAEC674E31A5A4797
SHA-256:	51AA4B7DF6A8B71CE0CCB5BC00FF0703C0B5F34CBCACEB3E7833477FBF2338A4
SHA-512:	F97DE757FE4B51F4BD76303F4207E28ACC1362B3C9F241FCC127410971D3E92AF37FE0901B54E23A2A463BCFF943038DDE55BC440BAE63295E26177B16B93969
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........g....................................$...........4....0..........`.......8...........T...........x...".......................................................................................................eJ......\|.......Lw......................T.............g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA669.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8570
Entropy (8bit):	3.6833216891099965
Encrypted:	false
SSDEEP:	192:R6l7wVeJeHb86Ya7lCgmf8UNCXcpDRC89blALfrXm:R6lXJuw6YWlCgmf8UNCXW7lUfS
MD5:	87CC57E39A6692EFC266165DAEB8CDE1
SHA1:	05AB46FECBD027C4FF3FABBF32A93BEF97753EE1
SHA-256:	1BCEFC5D4A15CD6080031C6DF70EB360790D2D6E4650B60CEBD2D5DB0EE2D3FF
SHA-512:	6DB8B5012EAF7C391BD5E30D7F1821C7F5396CBD5675E6039C386AC7ED758A34369B7AAE1F7DF660D9C2BC8C23F3A956256BA299E06757711D00C3439C1B928E
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.7.8.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA699.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4828
Entropy (8bit):	4.43345472258423
Encrypted:	false
SSDEEP:	48:cvIwWl8zsIVrJg771I9ikgWpW8VYoPYm8M4JPNYgFCzyq8vkNYLfs5gd:uIjfUFI7AZ7V5SJPOWkQfs5gd
MD5:	809E7BB5BC439AD3749795C31A65D4D1
SHA1:	39194B32ECE0BA836883DBC021ED2685CC649090
SHA-256:	CFC15BC2A083303BB5B7079D6B5389C36DF092B4CC851445A0DBC51E1C02AC4D
SHA-512:	714B4C1085625DF1DD812773F4444B86844861BAC118099A980DB72A4C86D5BFE9599F0BB29FC3A983C499623273E84951C226EEFF4071A04B1F318541C8EB21
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="560052" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.46943898637942
Encrypted:	false
SSDEEP:	6144:RzZfpi6ceLPx9skLmb0fYZWSP3aJG8nAgeiJRMMhA2zX4WABluuNejDH5S:JZHtYZWOKnMM6bFp0j4
MD5:	AFB01510CC287B17C3900409D7636520
SHA1:	CA8C7B7F2CCED24E97F1E5CBB8BDFC4B75290471
SHA-256:	E45C73F15615BEEAAB69F2FDA0C75B5A292D1573CE23CE959D5E005646F1D401
SHA-512:	7C4E6728B6AF961F94BA48FE1AFA12FC8FA30FB6EF1D6677E898B5FB27697F0DD21DBC1FBA8BF46E82424D1216AFE311445ED9F7B8566AF73E25C3BE569327D0
Malicious:	false
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmNA..v'.................................................................................................................................................................................................................................................................................................................................................%........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.910554120501998
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	oLiA3yj6Cq.dll
File size:	381'952 bytes
MD5:	4886943161951b6be845188a19c82de5
SHA1:	f8bd367eb8cc58e05f10697ae4e27c190bd7662d
SHA256:	e43d6309199e04b80a93fb0ccc44545c42fca0627d50496f356d01cd552061ec
SHA512:	c131e6c33132c8106bc5275464adc20468779e50dcc88914b141810b51aabbab35fafe2a3b5b15d998d769ef504a65ed46aa61f03bfddc40b9642be0b7bbb0fd
SSDEEP:	6144:gih0ZgnQQdQdGP8Ra6YE4nz/l4ekMXLou0t+a4tmOVh1qvROQHz:KgnQ6QdPqE4nzN4ekM7oua+kOVjqvR3
TLSH:	2E84BD83F74301DED6021CF03B62D96BECB4C9D4328EF662D56C877A61BDE11D929688
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......g..........."...+.,......."..0................................................}....`... ............................

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x2fbac1330
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x2fbac0000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6718BD0F [Wed Oct 23 09:08:31 2024 UTC]
TLS Callbacks:	0xfbac2ab0, 0x2, 0xfbac2a80, 0x2
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	9eaa24f9e5d2fd104fe4ac79aa5c044b

Entrypoint Preview

Instruction
dec eax
mov eax, dword ptr [0005BF09h]
mov dword ptr [eax], 00000000h
jmp 00007F71A880D3A3h
nop word ptr [eax+eax+00000000h]
nop dword ptr [eax]
dec eax
mov edx, ecx
dec eax
lea ecx, dword ptr [0005ECA6h]
jmp 00007F71A880F986h
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007F71A880D4F9h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebx
dec eax
sub esp, 20h
dec eax
mov eax, dword ptr [00000020h]
dec eax
mov eax, dword ptr [eax]
mov ebx, dword ptr [eax]
call dword ptr [00062E37h]
dec eax
mov ecx, eax
mov edx, ebx
call dword ptr [00062E9Ch]
dec eax
mov ecx, dword ptr [0005EC7Dh]
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [00062E69h]
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
call dword ptr [00062E13h]
mov dword ptr [0005EC55h], eax
dec eax
mov eax, ebx
dec eax
add esp, 20h
pop ebx
dec eax
jmp eax
dec eax
arpl word ptr [00002C53h], ax
test eax, eax
jle 00007F71A880D538h
cmp dword ptr [00002C4Ch], 00000000h
jle 00007F71A880D52Fh
dec eax
mov edx, dword ptr [00062DFFh]
dec eax
mov dword ptr [ecx+eax], edx
dec eax
mov edx, dword ptr [00000000h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x63000	0xaa	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x64000	0x638	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x5e000	0x420	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x67000	0x60	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x5d040	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x641a8	0x168	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2aa8	0x2c00	80dcabb486ac0320b8107f6fb61a1f46	False	0.5140269886363636	data	6.128075480207132	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x4000	0x582d0	0x58400	f425d425d482c7d0427708254e5c6e54	False	0.5794861012747875	dBase III DBT, version number 0, next free block index 1, 1st item "\310\373H\224!\350iv\310\373H\224!\350iv\310\020K\224Q\350iv\310\373H\224!\350iv\310\333K\224Q\356iv\310\373H\224!\350iv\310\373H\224!\350iv\310\373H\224!\350iv\346\217-\354U\350ivJ\372K\224!\370iv\310\371K\224!\354iv\310\373H\224!\350iv\310\373H\224\001\350i\026\346\211,\365U\211iv\312\007H\224!\310jv\310\005H\224!\356j"	6.95266435819705	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x5d000	0x5d0	0x600	38ece8b89d2607176782f11cbc2aea88	False	0.2265625	data	3.9046999817791903	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pdata	0x5e000	0x420	0x600	09d86492997fabcc3acb4c2f8c4841da	False	0.3483072916666667	data	3.3630058682714674	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xdata	0x5f000	0x2c0	0x400	377742ba7013f102de8668f1fbfd1e13	False	0.267578125	data	2.9261463837859796	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x60000	0x20f0	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x63000	0xaa	0x200	34e6ccc0e0f15540da6c40933543e3f3	False	0.265625	data	1.9876842911409685	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.idata	0x64000	0x638	0x800	5a3c3da5e46c1ce76e4cfec80ed9a5c6	False	0.2919921875	data	3.504409780230131	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x65000	0x58	0x200	76ed0b612acfb49deb9614a76b1b5624	False	0.05859375	data	0.25323120180391656	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x66000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x67000	0x60	0x200	34c130ef3b64e5ff719bd7dcc6db1dda	False	0.197265625	data	1.1005696276589663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	ConvertThreadToFiber, CreateFiber, DeleteCriticalSection, DeleteFiber, EnterCriticalSection, GetCurrentProcess, GetCurrentThreadId, GetLastError, GetModuleFileNameA, GetModuleHandleA, GetProcAddress, InitializeCriticalSection, LeaveCriticalSection, Sleep, SleepEx, SwitchToFiber, TlsGetValue, VirtualProtect, VirtualQuery, WaitForSingleObject
msvcrt.dll	__iob_func, _amsg_exit, _initterm, _lock, _unlock, abort, calloc, fclose, fopen, fread, free, fsetpos, fwrite, malloc, mbstowcs, memcmp, rand, realloc, strlen, strncmp, vfprintf, wcsncat, wcsncpy

Exports

Name	Ordinal	Address
DllGetClassObject	1	0x2fbac2981
DllMain	2	0x2fbac2917
DllRegisterServer	3	0x2fbac297b
DllUnregisterServer	4	0x2fbac297e
StartW	5	0x2fbac298a

Target ID:	0
Start time:	03:09:59
Start date:	26/10/2024
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\oLiA3yj6Cq.dll"
Imagebase:	0x7ff617a50000
File size:	165'888 bytes
MD5 hash:	763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_4, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Author: unknown Rule: Beacon_K5om, Description: Detects Meterpreter Beacon - file K5om.dll, Source: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Author: Florian Roth Rule: CobaltStrike_Unmodifed_Beacon, Description: Detects unmodified CobaltStrike beacon DLL, Source: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Author: yara@s3c.za.net Rule: Leviathan_CobaltStrike_Sample_1, Description: Detects Cobalt Strike sample from Leviathan report, Source: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Author: Florian Roth Rule: crime_win32_csbeacon_1, Description: Detects Cobalt Strike loader, Source: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Author: @VK_Intel Rule: WiltedTulip_ReflectiveLoader, Description: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, Source: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_ReflectiveLoader, Description: detects Reflective DLL injection artifacts, Source: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_CobaltStrike, Description: CobaltStrike payload, Source: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Beacon_K5om, Description: Detects Meterpreter Beacon - file K5om.dll, Source: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: CobaltStrike_Unmodifed_Beacon, Description: Detects unmodified CobaltStrike beacon DLL, Source: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Author: yara@s3c.za.net Rule: Leviathan_CobaltStrike_Sample_1, Description: Detects Cobalt Strike sample from Leviathan report, Source: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: crime_win32_csbeacon_1, Description: Detects Cobalt Strike loader, Source: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Author: @VK_Intel Rule: WiltedTulip_ReflectiveLoader, Description: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, Source: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: MALWARE_Win_CobaltStrike, Description: CobaltStrike payload, Source: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:09:59
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:09:59
Start date:	26/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\oLiA3yj6Cq.dll",#1
Imagebase:	0x7ff75b9f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:09:59
Start date:	26/10/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32.exe /s C:\Users\user\Desktop\oLiA3yj6Cq.dll
Imagebase:	0x7ff791410000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:09:59
Start date:	26/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\oLiA3yj6Cq.dll",#1
Imagebase:	0x7ff6222c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_4, Description: Yara detected CobaltStrike, Source: 00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp, Author: unknown Rule: Beacon_K5om, Description: Detects Meterpreter Beacon - file K5om.dll, Source: 00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp, Author: Florian Roth Rule: CobaltStrike_Unmodifed_Beacon, Description: Detects unmodified CobaltStrike beacon DLL, Source: 00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp, Author: yara@s3c.za.net Rule: Leviathan_CobaltStrike_Sample_1, Description: Detects Cobalt Strike sample from Leviathan report, Source: 00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp, Author: Florian Roth Rule: crime_win32_csbeacon_1, Description: Detects Cobalt Strike loader, Source: 00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp, Author: @VK_Intel Rule: WiltedTulip_ReflectiveLoader, Description: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, Source: 00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_ReflectiveLoader, Description: detects Reflective DLL injection artifacts, Source: 00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_CobaltStrike, Description: CobaltStrike payload, Source: 00000005.00000002.2140499107.000001E583CE0000.00000020.10000000.00040000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:09:59
Start date:	26/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\oLiA3yj6Cq.dll,DllGetClassObject
Imagebase:	0x7ff6222c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_4, Description: Yara detected CobaltStrike, Source: 00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp, Author: unknown Rule: Beacon_K5om, Description: Detects Meterpreter Beacon - file K5om.dll, Source: 00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp, Author: Florian Roth Rule: CobaltStrike_Unmodifed_Beacon, Description: Detects unmodified CobaltStrike beacon DLL, Source: 00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp, Author: yara@s3c.za.net Rule: Leviathan_CobaltStrike_Sample_1, Description: Detects Cobalt Strike sample from Leviathan report, Source: 00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp, Author: Florian Roth Rule: crime_win32_csbeacon_1, Description: Detects Cobalt Strike loader, Source: 00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp, Author: @VK_Intel Rule: WiltedTulip_ReflectiveLoader, Description: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, Source: 00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_ReflectiveLoader, Description: detects Reflective DLL injection artifacts, Source: 00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_CobaltStrike, Description: CobaltStrike payload, Source: 00000006.00000002.2140711176.0000029E27C60000.00000020.10000000.00040000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:09:59
Start date:	26/10/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 2784 -s 412
Imagebase:	0x7ff6cc740000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:10:02
Start date:	26/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\oLiA3yj6Cq.dll,DllMain
Imagebase:	0x7ff6222c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_4, Description: Yara detected CobaltStrike, Source: 0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp, Author: unknown Rule: Beacon_K5om, Description: Detects Meterpreter Beacon - file K5om.dll, Source: 0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp, Author: Florian Roth Rule: CobaltStrike_Unmodifed_Beacon, Description: Detects unmodified CobaltStrike beacon DLL, Source: 0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp, Author: yara@s3c.za.net Rule: Leviathan_CobaltStrike_Sample_1, Description: Detects Cobalt Strike sample from Leviathan report, Source: 0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp, Author: Florian Roth Rule: crime_win32_csbeacon_1, Description: Detects Cobalt Strike loader, Source: 0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp, Author: @VK_Intel Rule: WiltedTulip_ReflectiveLoader, Description: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, Source: 0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_ReflectiveLoader, Description: detects Reflective DLL injection artifacts, Source: 0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_CobaltStrike, Description: CobaltStrike payload, Source: 0000000A.00000002.2170605012.0000020650830000.00000020.10000000.00040000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:10:05
Start date:	26/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\oLiA3yj6Cq.dll,DllRegisterServer
Imagebase:	0x7ff6222c0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_4, Description: Yara detected CobaltStrike, Source: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Author: unknown Rule: Beacon_K5om, Description: Detects Meterpreter Beacon - file K5om.dll, Source: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Author: Florian Roth Rule: CobaltStrike_Unmodifed_Beacon, Description: Detects unmodified CobaltStrike beacon DLL, Source: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Author: yara@s3c.za.net Rule: Leviathan_CobaltStrike_Sample_1, Description: Detects Cobalt Strike sample from Leviathan report, Source: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Author: Florian Roth Rule: crime_win32_csbeacon_1, Description: Detects Cobalt Strike loader, Source: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Author: @VK_Intel Rule: WiltedTulip_ReflectiveLoader, Description: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, Source: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_ReflectiveLoader, Description: detects Reflective DLL injection artifacts, Source: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_CobaltStrike, Description: CobaltStrike payload, Source: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_4, Description: Yara detected CobaltStrike, Source: 0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Beacon_K5om, Description: Detects Meterpreter Beacon - file K5om.dll, Source: 0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: CobaltStrike_Unmodifed_Beacon, Description: Detects unmodified CobaltStrike beacon DLL, Source: 0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp, Author: yara@s3c.za.net Rule: Leviathan_CobaltStrike_Sample_1, Description: Detects Cobalt Strike sample from Leviathan report, Source: 0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: crime_win32_csbeacon_1, Description: Detects Cobalt Strike loader, Source: 0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp, Author: @VK_Intel Rule: WiltedTulip_ReflectiveLoader, Description: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, Source: 0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: MALWARE_Win_CobaltStrike, Description: CobaltStrike payload, Source: 0000000B.00000002.2199778105.0000016E0D720000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	97.1%
Signature Coverage:	5.9%
Total number of Nodes:	204
Total number of Limit Nodes:	4

Executed Functions

Function 000001BF69435E28 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 116
stringCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001BF69435FEC: malloc.LIBCMT ref: 000001BF69436008

GetUserNameA.ADVAPI32 ref: 000001BF69435EAF
GetComputerNameA.KERNEL32 ref: 000001BF69435EC2
GetModuleFileNameA.KERNEL32 ref: 000001BF69435EDB
strrchr.LIBCMT ref: 000001BF69435EED
GetVersionExA.KERNEL32 ref: 000001BF69435F10
_snprintf.LIBCMT ref: 000001BF69435F9B

Strings

%s%s%s, xrefs: 000001BF69435F7F

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: Name$ComputerFileModuleUserVersion_snprintfmallocstrrchr
String ID: %s%s%s
API String ID: 1671524875-1891519693
Opcode ID: 40ae984fd8d1d60e03acc18bee9c81741f4638c9dfd0547d5b2d8a001e524837
Instruction ID: 5a31e36297baae68f8c6e9141f209901a4037372d6cc504b0e6b9d546daa53c5
Opcode Fuzzy Hash: 40ae984fd8d1d60e03acc18bee9c81741f4638c9dfd0547d5b2d8a001e524837
Instruction Fuzzy Hash: CC41583060428146EA04AB62AD556EB7791F78DBD4F48C23DAE5A4B79ACF3CC4438740

Function 000001BF69421184 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39
encryptionCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextA.ADVAPI32 ref: 000001BF694211B8
CryptAcquireContextA.ADVAPI32 ref: 000001BF694211DC
CryptGenRandom.ADVAPI32 ref: 000001BF694211F0
CryptReleaseContext.ADVAPI32 ref: 000001BF69421204

Strings

(, xrefs: 000001BF694211D4
Microsoft Base Cryptographic Provider v1.0, xrefs: 000001BF694211A2, 000001BF694211C6

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: Crypt$Context$Acquire$RandomRelease
String ID: ($Microsoft Base Cryptographic Provider v1.0
API String ID: 685801729-4046902070
Opcode ID: 0f7b575704e2efa4e71594adee21552c9336b074ba1ad3f512173577c0e57d68
Instruction ID: 54f7d7e8b22c05e0104e88c4bad813bdebe69141231262eb70aa1616b0e7e368
Opcode Fuzzy Hash: 0f7b575704e2efa4e71594adee21552c9336b074ba1ad3f512173577c0e57d68
Instruction Fuzzy Hash: F0012D3570064092E750CFA5ED887EAB7A1F7DCB88F84C43ADA4983664DF79C54AC740

Function 000001BF6942EA48 Relevance: 9.1, APIs: 6, Instructions: 109
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001BF6943E0FC: RevertToSelf.ADVAPI32 ref: 000001BF6943E10A

InternetOpenA.WININET ref: 000001BF6942EB0C
InternetSetOptionA.WININET ref: 000001BF6942EB2C
InternetSetOptionA.WININET ref: 000001BF6942EB44
InternetConnectA.WININET ref: 000001BF6942EB7A
InternetSetOptionA.WININET ref: 000001BF6942EBB7
InternetSetOptionA.WININET ref: 000001BF6942EBE2

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: Internet$Option$ConnectOpenRevertSelf
String ID:
API String ID: 1513466045-0
Opcode ID: a9b8b553a89bf16a576f3c9bc92d43a984d256c5d92c920833b48d6b9218c37a
Instruction ID: 956b9e2846d13d86971e5d077a297b56465e7eb8544e2b938c9b475f5cf74fad
Opcode Fuzzy Hash: a9b8b553a89bf16a576f3c9bc92d43a984d256c5d92c920833b48d6b9218c37a
Instruction Fuzzy Hash: 62416B76204B8182EB249B62EC957E97751F798788F04C03DDE5A17B96CF79C507C704

Function 000001BF6942F014 Relevance: 4.6, APIs: 3, Instructions: 66
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001BF6942F118: WSAStartup.WS2_32 ref: 000001BF6942F136

WSASocketA.WS2_32 ref: 000001BF6942F042
WSAIoctl.WS2_32 ref: 000001BF6942F08F
closesocket.WS2_32 ref: 000001BF6942F0EE

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: IoctlSocketStartupclosesocket
String ID:
API String ID: 365704328-0
Opcode ID: 9f6035121241c12ff71e8e552415c275c25b201d0c9d2d3551ffb33b20d91594
Instruction ID: 7dc71e06ce6563295e7a146eb4c79f9f862c61c00f6884efe99bcd39011894ea
Opcode Fuzzy Hash: 9f6035121241c12ff71e8e552415c275c25b201d0c9d2d3551ffb33b20d91594
Instruction Fuzzy Hash: EA21A37260478442E7608F54F9407DAB795F38C7E8F90C679DE9943B85DF39C5468B00

Function 000001BF693C88D4 Relevance: 3.7, APIs: 2, Instructions: 671
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000001BF693C8D73
LoadLibraryA.KERNELBASE ref: 000001BF693C8EBF

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: AllocLibraryLoadVirtual
String ID:
API String ID: 3550616410-0
Opcode ID: e5779a8fec03a52a41f730243e1c668b38c4984dd735e796280ec9111f67fa25
Instruction ID: 97c45bc2f111b1e7e9cb78480c7f89e345e9e9a66d0b304ee569ceaa74c66642
Opcode Fuzzy Hash: e5779a8fec03a52a41f730243e1c668b38c4984dd735e796280ec9111f67fa25
Instruction Fuzzy Hash: 6A62B376601B988EDB50CF6AC88139C37F5F748B9CF11912AEE4D87B68DB38C5918740

Function 000001BF6942F118 Relevance: 3.0, APIs: 2, Instructions: 42
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 000001BF6942F136
WSACleanup.WS2_32 ref: 000001BF6942F1D2

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: CleanupStartup
String ID:
API String ID: 915672949-0
Opcode ID: d22241c7f1bd4084ee50ee5593018a46650914ab47a10bd4edb93220355cbedb
Instruction ID: 709aa66fe42db35619a642fbe5fcc4c95feb92e15f40e2db843477df1d69fafe
Opcode Fuzzy Hash: d22241c7f1bd4084ee50ee5593018a46650914ab47a10bd4edb93220355cbedb
Instruction Fuzzy Hash: EE11D670605B4586FB28AB61EC593E43395E798304F84C03E9E550A2D7DF7A855B9B00

Non-executed Functions

Function 000001BF69446514 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 460
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__doserrno.LIBCMT ref: 000001BF6944656A
_errno.LIBCMT ref: 000001BF69446571
_invalid_parameter_noinfo.LIBCMT ref: 000001BF6944657C

Strings

U, xrefs: 000001BF69446ADE

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_invalid_parameter_noinfo
String ID: U
API String ID: 3902385426-4171548499
Opcode ID: a469b43449293490d86ed3caa32e41753b17625943497404ea198177ea08bf0b
Instruction ID: 24ef45645d55900385cf900b11e27bd27abba5bcf96a519b14e1c7015085f914
Opcode Fuzzy Hash: a469b43449293490d86ed3caa32e41753b17625943497404ea198177ea08bf0b
Instruction Fuzzy Hash: B612C172214A8186EB208F24DC843EA77A1F79DF58F54C13AEE8947A9DDB39C547CB10

Function 000001BF6943867C Relevance: 46.6, APIs: 22, Strings: 4, Instructions: 1078processCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 000001BF69438FA0
CreateToolhelp32Snapshot.KERNEL32 ref: 000001BF69438FD9
Process32First.KERNEL32 ref: 000001BF69438FFB

Strings

x64, xrefs: 000001BF69438FB2, 000001BF69438FC0
x86, xrefs: 000001BF69438FC7, 000001BF694390B0
%s%d%d, xrefs: 000001BF69439046
%s%d%d%s%s%d, xrefs: 000001BF694390E0

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: CreateCurrentFirstProcessProcess32SnapshotToolhelp32
String ID: %s%d%d%s%s%d$%s%d%d$x64$x86
API String ID: 718051232-1833344708
Opcode ID: 44ee8957408f2f3c2d0d1c1155748847862033341b6ca19cb8ca6a6e19bffbea
Instruction ID: efab1268f64c13343b30e001d2f79e3f7905c78bfec4a131984426ff95a91578
Opcode Fuzzy Hash: 44ee8957408f2f3c2d0d1c1155748847862033341b6ca19cb8ca6a6e19bffbea
Instruction Fuzzy Hash: 79827C31B1564182FA68DB379C513E97391E78DB80F94C13E9E0A87BDAEF28C9439700

Function 000001BF69442F9C Relevance: 37.4, APIs: 19, Strings: 2, Instructions: 694COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001BF69442FFD

Part of subcall function 000001BF69441600: _getptd.LIBCMT ref: 000001BF69441616
Part of subcall function 000001BF69441600: __updatetlocinfo.LIBCMT ref: 000001BF6944164B
Part of subcall function 000001BF69441600: __updatetmbcinfo.LIBCMT ref: 000001BF69441672

_errno.LIBCMT ref: 000001BF69443002

Part of subcall function 000001BF69441D18: _getptd_noexit.LIBCMT ref: 000001BF69441D1C

_fileno.LIBCMT ref: 000001BF6944302F

Part of subcall function 000001BF69445A54: _errno.LIBCMT ref: 000001BF69445A5D
Part of subcall function 000001BF69445A54: _invalid_parameter_noinfo.LIBCMT ref: 000001BF69445A68

write_multi_char.LIBCMT ref: 000001BF6944366B
write_string.LIBCMT ref: 000001BF69443688
write_multi_char.LIBCMT ref: 000001BF694436A5
write_string.LIBCMT ref: 000001BF69443704
write_string.LIBCMT ref: 000001BF6944373B
write_multi_char.LIBCMT ref: 000001BF6944375D
free.LIBCMT ref: 000001BF69443771
_isleadbyte_l.LIBCMT ref: 000001BF69443842
write_char.LIBCMT ref: 000001BF69443858
write_char.LIBCMT ref: 000001BF69443879
_errno.LIBCMT ref: 000001BF6944397C
_invalid_parameter_noinfo.LIBCMT ref: 000001BF69443987

Strings

, xrefs: 000001BF6944363F
@, xrefs: 000001BF6944301B

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_charwrite_string$Locale_invalid_parameter_noinfowrite_char$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID: $@
API String ID: 3318157856-1077428164
Opcode ID: 43138757bcee35b18d1a9352f63dda4217664694579bf9df27f2658c9d71e8f1
Instruction ID: 1013b7aae78364f14ec96eb79353f75719655bee00673951f195a051420e881f
Opcode Fuzzy Hash: 43138757bcee35b18d1a9352f63dda4217664694579bf9df27f2658c9d71e8f1
Instruction Fuzzy Hash: 4E52EF7260868586FB798B159E443EE7BA0F749F94F24C12DDE4607ADDEB38C842CB00

Function 000001BF69442528 Relevance: 35.7, APIs: 19, Strings: 1, Instructions: 687COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001BF69442589

Part of subcall function 000001BF69441600: _getptd.LIBCMT ref: 000001BF69441616
Part of subcall function 000001BF69441600: __updatetlocinfo.LIBCMT ref: 000001BF6944164B
Part of subcall function 000001BF69441600: __updatetmbcinfo.LIBCMT ref: 000001BF69441672

_errno.LIBCMT ref: 000001BF6944258E

Part of subcall function 000001BF69441D18: _getptd_noexit.LIBCMT ref: 000001BF69441D1C

_fileno.LIBCMT ref: 000001BF694425BB

Part of subcall function 000001BF69445A54: _errno.LIBCMT ref: 000001BF69445A5D
Part of subcall function 000001BF69445A54: _invalid_parameter_noinfo.LIBCMT ref: 000001BF69445A68

write_multi_char.LIBCMT ref: 000001BF69442BEB
write_string.LIBCMT ref: 000001BF69442C08
write_multi_char.LIBCMT ref: 000001BF69442C25
write_string.LIBCMT ref: 000001BF69442C84
write_string.LIBCMT ref: 000001BF69442CBB
write_multi_char.LIBCMT ref: 000001BF69442CDD
free.LIBCMT ref: 000001BF69442CF1
_isleadbyte_l.LIBCMT ref: 000001BF69442DC2
write_char.LIBCMT ref: 000001BF69442DD8
write_char.LIBCMT ref: 000001BF69442DF9
_errno.LIBCMT ref: 000001BF69442EF3
_invalid_parameter_noinfo.LIBCMT ref: 000001BF69442EFE

Strings

, xrefs: 000001BF69442BBF

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_charwrite_string$Locale_invalid_parameter_noinfowrite_char$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID:
API String ID: 3318157856-3916222277
Opcode ID: fca6f3964dd5be39caa2a1998c64648d50546d36c07ae532eb44751125f6f7d4
Instruction ID: f667d9f93ffd91b5dcbaec883d00bc4f618485db4d895d72b78ec874a3aacb04
Opcode Fuzzy Hash: fca6f3964dd5be39caa2a1998c64648d50546d36c07ae532eb44751125f6f7d4
Instruction Fuzzy Hash: F652DD72618A9486FB648A159D443EE7BA0F749F94F24D12DDE4A97ADCDF38C843CB00

Function 000001BF693D239C Relevance: 32.2, APIs: 16, Strings: 2, Instructions: 694COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001BF693D23FD

Part of subcall function 000001BF693D0A00: _getptd.LIBCMT ref: 000001BF693D0A16
Part of subcall function 000001BF693D0A00: __updatetlocinfo.LIBCMT ref: 000001BF693D0A4B
Part of subcall function 000001BF693D0A00: __updatetmbcinfo.LIBCMT ref: 000001BF693D0A72

_errno.LIBCMT ref: 000001BF693D2402

Part of subcall function 000001BF693D1118: _getptd_noexit.LIBCMT ref: 000001BF693D111C

_fileno.LIBCMT ref: 000001BF693D242F

Part of subcall function 000001BF693D4E54: _errno.LIBCMT ref: 000001BF693D4E5D
Part of subcall function 000001BF693D4E54: _invalid_parameter_noinfo.LIBCMT ref: 000001BF693D4E68

write_multi_char.LIBCMT ref: 000001BF693D2A6B
write_string.LIBCMT ref: 000001BF693D2A88
write_multi_char.LIBCMT ref: 000001BF693D2AA5
write_string.LIBCMT ref: 000001BF693D2B04
write_string.LIBCMT ref: 000001BF693D2B3B
write_multi_char.LIBCMT ref: 000001BF693D2B5D
free.LIBCMT ref: 000001BF693D2B71
_isleadbyte_l.LIBCMT ref: 000001BF693D2C42
write_char.LIBCMT ref: 000001BF693D2C58
write_char.LIBCMT ref: 000001BF693D2C79
_errno.LIBCMT ref: 000001BF693D2D7C
_invalid_parameter_noinfo.LIBCMT ref: 000001BF693D2D87

Strings

@, xrefs: 000001BF693D241B
, xrefs: 000001BF693D2A3F

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errnowrite_multi_charwrite_string$Locale_invalid_parameter_noinfowrite_char$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexit_isleadbyte_lfree
String ID: $@
API String ID: 3318157856-1077428164
Opcode ID: 0917c7b026fa98026fd61c82a9db6b94b013ed73c29c4ccbf17a38093d3ada48
Instruction ID: ecd9a81070ddb6bb92a2915376c29cadb267447661bc3ef2a6f9da67c57656af
Opcode Fuzzy Hash: 0917c7b026fa98026fd61c82a9db6b94b013ed73c29c4ccbf17a38093d3ada48
Instruction Fuzzy Hash: 9B52357220468486FB648B95DE623EE7BA8F7CD740F14A22DDE46076D4DB78C96BC700

Function 000001BF693D1928 Relevance: 28.6, APIs: 14, Strings: 2, Instructions: 645COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001BF693D1989

Part of subcall function 000001BF693D0A00: _getptd.LIBCMT ref: 000001BF693D0A16
Part of subcall function 000001BF693D0A00: __updatetlocinfo.LIBCMT ref: 000001BF693D0A4B
Part of subcall function 000001BF693D0A00: __updatetmbcinfo.LIBCMT ref: 000001BF693D0A72

_errno.LIBCMT ref: 000001BF693D198E

Part of subcall function 000001BF693D1118: _getptd_noexit.LIBCMT ref: 000001BF693D111C

_fileno.LIBCMT ref: 000001BF693D19BB

Part of subcall function 000001BF693D4E54: _errno.LIBCMT ref: 000001BF693D4E5D
Part of subcall function 000001BF693D4E54: _invalid_parameter_noinfo.LIBCMT ref: 000001BF693D4E68

write_multi_char.LIBCMT ref: 000001BF693D1FEB
write_string.LIBCMT ref: 000001BF693D2008
_errno.LIBCMT ref: 000001BF693D22F3
_invalid_parameter_noinfo.LIBCMT ref: 000001BF693D22FE

Strings

-, xrefs: 000001BF693D1F9C
0, xrefs: 000001BF693D1D28

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno$Locale_invalid_parameter_noinfo$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_fileno_getptd_getptd_noexitwrite_multi_charwrite_string
String ID: -$0
API String ID: 3246410048-417717675
Opcode ID: 9d83564e1f44511746efc6243833ea10ca1e0c0cc6e5e094e442fc0115aecad6
Instruction ID: 11a436da9678915563ac65910a8d3a87e618e7139cf7d4d951388bf4fca0de27
Opcode Fuzzy Hash: 9d83564e1f44511746efc6243833ea10ca1e0c0cc6e5e094e442fc0115aecad6
Instruction Fuzzy Hash: BC42E37260868486FB698BD59E623F97BA8F7C9740F14E22DDE46076D4D738C86BC700

Function 000001BF693D5914 Relevance: 26.7, APIs: 14, Strings: 1, Instructions: 460
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__doserrno.LIBCMT ref: 000001BF693D596A
_errno.LIBCMT ref: 000001BF693D5971
_invalid_parameter_noinfo.LIBCMT ref: 000001BF693D597C

Strings

U, xrefs: 000001BF693D5EDE

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_invalid_parameter_noinfo
String ID: U
API String ID: 3902385426-4171548499
Opcode ID: 1e306023ed328bab19b7a5d60cdebdd92491a2c212ad1309fcb9b443deab4914
Instruction ID: c3a6a997b4f5103316e9a1a08a504dcb6b1421762c43f03b52207924f003e5c7
Opcode Fuzzy Hash: 1e306023ed328bab19b7a5d60cdebdd92491a2c212ad1309fcb9b443deab4914
Instruction Fuzzy Hash: 6412263221464186EB208FA4D8953DEB7A9F7CD754F50923AEF4987698CB3DC46ACB10

Function 000001BF69437B38 Relevance: 26.0, APIs: 10, Strings: 7, Instructions: 545
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_snprintf.LIBCMT ref: 000001BF69437D66
_snprintf.LIBCMT ref: 000001BF69437D83
_snprintf.LIBCMT ref: 000001BF69437CA5

Part of subcall function 000001BF6943F63C: _errno.LIBCMT ref: 000001BF6943F673
Part of subcall function 000001BF6943F63C: _invalid_parameter_noinfo.LIBCMT ref: 000001BF6943F67E

_snprintf.LIBCMT ref: 000001BF69437FD8
_snprintf.LIBCMT ref: 000001BF69438334

Strings

?%s=%s, xrefs: 000001BF69437D5A
%s%s, xrefs: 000001BF694380D7
?%s, xrefs: 000001BF69438257
%s%s: %s, xrefs: 000001BF69437C94
%s&%s, xrefs: 000001BF6943826A
%s%s, xrefs: 000001BF69437FC7, 000001BF69437FF1, 000001BF69438195, 000001BF69438326
%s&%s=%s, xrefs: 000001BF69437D77

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: _snprintf$_errno_invalid_parameter_noinfo
String ID: %s%s$%s%s$%s%s: %s$%s&%s$%s&%s=%s$?%s$?%s=%s
API String ID: 3442832105-1222817042
Opcode ID: 412d66828e9d0a494a073441381b0bd2cf94e887e51df8164056f8f6c456b4ac
Instruction ID: 2dc4b5e11b069fad534880cb02dbff33f9b3595ab0c752cb125940226d4b03d7
Opcode Fuzzy Hash: 412d66828e9d0a494a073441381b0bd2cf94e887e51df8164056f8f6c456b4ac
Instruction Fuzzy Hash: F8429272614E8592FA258B7AE4013E9B3A0FF98759F04D119DF8917B61EF38D2A3D340

Function 000001BF69431C30 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 150
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.LIBCMT ref: 000001BF69431C63

Part of subcall function 000001BF6943F284: _FF_MSGBANNER.LIBCMT ref: 000001BF6943F2B4
Part of subcall function 000001BF6943F284: _NMSG_WRITE.LIBCMT ref: 000001BF6943F2BE
Part of subcall function 000001BF6943F284: HeapAlloc.KERNEL32 ref: 000001BF6943F2D9
Part of subcall function 000001BF6943F284: _callnewh.LIBCMT ref: 000001BF6943F2F2
Part of subcall function 000001BF6943F284: _errno.LIBCMT ref: 000001BF6943F2FD
Part of subcall function 000001BF6943F284: _errno.LIBCMT ref: 000001BF6943F308

Part of subcall function 000001BF6942D044: malloc.LIBCMT ref: 000001BF6942D057

Part of subcall function 000001BF6942D074: htonl.WS2_32 ref: 000001BF6942D07F

GetCurrentDirectoryA.KERNEL32 ref: 000001BF69431CDB
FindFirstFileA.KERNEL32 ref: 000001BF69431D14
GetLastError.KERNEL32 ref: 000001BF69431D23
free.LIBCMT ref: 000001BF69431D5E
free.LIBCMT ref: 000001BF69431D6B

Part of subcall function 000001BF6943F244: HeapFree.KERNEL32 ref: 000001BF6943F25A
Part of subcall function 000001BF6943F244: _errno.LIBCMT ref: 000001BF6943F264
Part of subcall function 000001BF6943F244: GetLastError.KERNEL32 ref: 000001BF6943F26C

FileTimeToSystemTime.KERNEL32 ref: 000001BF69431D78
SystemTimeToTzSpecificLocalTime.KERNEL32 ref: 000001BF69431D89
FindNextFileA.KERNEL32 ref: 000001BF69431E46
FindClose.KERNEL32 ref: 000001BF69431E57

Strings

D0%02d/%02d/%02d %02d:%02d:%02d%s, xrefs: 000001BF69431DCB
.\*, xrefs: 000001BF69431CBF
F%I64d%02d/%02d/%02d %02d:%02d:%02d%s, xrefs: 000001BF69431E29
%s, xrefs: 000001BF69431CF9

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: Time$FileFind_errno$ErrorHeapLastSystemfreemalloc$AllocCloseCurrentDirectoryFirstFreeLocalNextSpecific_callnewhhtonl
String ID: %s$.\*$D0%02d/%02d/%02d %02d:%02d:%02d%s$F%I64d%02d/%02d/%02d %02d:%02d:%02d%s
API String ID: 723279517-1754256099
Opcode ID: 457427d9072a94c5804b99a9cf994faefb62e403f1d248ccd724e43b7fc9f85d
Instruction ID: 853e1cfc7af902d13b6a61ec5fcd20494328f348b4037988dc2692894658c2fc
Opcode Fuzzy Hash: 457427d9072a94c5804b99a9cf994faefb62e403f1d248ccd724e43b7fc9f85d
Instruction Fuzzy Hash: 3F615E7130475186EB10DB62E8416EEB7A1F789B94F40C02EEE4943B99EF79C60BCB40

Function 000001BF693C6F38 Relevance: 18.5, APIs: 10, Strings: 2, Instructions: 545COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000001BF693C7166
_snprintf.LIBCMT ref: 000001BF693C7183
_snprintf.LIBCMT ref: 000001BF693C70A5

Part of subcall function 000001BF693CEA3C: _errno.LIBCMT ref: 000001BF693CEA73
Part of subcall function 000001BF693CEA3C: _invalid_parameter_noinfo.LIBCMT ref: 000001BF693CEA7E

_snprintf.LIBCMT ref: 000001BF693C73D8
_snprintf.LIBCMT ref: 000001BF693C7734

Strings

not create token: %d, xrefs: 000001BF693C7657
nop -exec bypass -EncodedCommand "%s", xrefs: 000001BF693C74D7

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _snprintf$_errno_invalid_parameter_noinfo
String ID: nop -exec bypass -EncodedCommand "%s"$not create token: %d
API String ID: 3442832105-3652497171
Opcode ID: 5c5fb6f4a09e06ccff5c46792293312cb34477fc99d63142bfc01bcec4b0117e
Instruction ID: 35ad5441480a3d763ba5d2f1f22955d2bacf68d26b0821ecbbb6401e77c42faa
Opcode Fuzzy Hash: 5c5fb6f4a09e06ccff5c46792293312cb34477fc99d63142bfc01bcec4b0117e
Instruction Fuzzy Hash: 1D429172614E85D2EA258B29D4022E9B3B4FFD8799F049115EF8917B61EF38D6B3C340

Function 000001BF69430F34 Relevance: 18.2, APIs: 12, Instructions: 163processCOMMON

Download Yara Rule

APIs

CreateProcessAsUserA.ADVAPI32 ref: 000001BF69430F8F
GetLastError.KERNEL32 ref: 000001BF69430F9D
GetLastError.KERNEL32 ref: 000001BF69430FC1

Part of subcall function 000001BF6942FE54: MultiByteToWideChar.KERNEL32 ref: 000001BF6942FE81
Part of subcall function 000001BF6942FE54: MultiByteToWideChar.KERNEL32 ref: 000001BF6942FEA9

CreateProcessA.KERNEL32 ref: 000001BF69431013
GetLastError.KERNEL32 ref: 000001BF6943101D
GetCurrentDirectoryW.KERNEL32 ref: 000001BF69431374
GetCurrentDirectoryW.KERNEL32 ref: 000001BF69431388
CreateProcessWithTokenW.ADVAPI32 ref: 000001BF694313D1

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: CreateErrorLastProcess$ByteCharCurrentDirectoryMultiWide$TokenUserWith
String ID:
API String ID: 3044875250-0
Opcode ID: 1d990aa2536e0bdd41909587e15d765ca5c4192818fd4d96a304531b1bef1f0e
Instruction ID: bf3588846f3a768ac53f1eda17e7773b7fbe1d4b6917abc36acd0eb16d7b335e
Opcode Fuzzy Hash: 1d990aa2536e0bdd41909587e15d765ca5c4192818fd4d96a304531b1bef1f0e
Instruction Fuzzy Hash: A2714772215B4086EB609F76E8843DE73A1F75CB98F50C13EEE4943A95DF78C8968B40

Function 000001BF69439220 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 87fileCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BF6943924F

Part of subcall function 000001BF6943F284: _FF_MSGBANNER.LIBCMT ref: 000001BF6943F2B4
Part of subcall function 000001BF6943F284: _NMSG_WRITE.LIBCMT ref: 000001BF6943F2BE
Part of subcall function 000001BF6943F284: HeapAlloc.KERNEL32 ref: 000001BF6943F2D9
Part of subcall function 000001BF6943F284: _callnewh.LIBCMT ref: 000001BF6943F2F2
Part of subcall function 000001BF6943F284: _errno.LIBCMT ref: 000001BF6943F2FD
Part of subcall function 000001BF6943F284: _errno.LIBCMT ref: 000001BF6943F308

_snprintf.LIBCMT ref: 000001BF69439267

Part of subcall function 000001BF6943F63C: _errno.LIBCMT ref: 000001BF6943F673
Part of subcall function 000001BF6943F63C: _invalid_parameter_noinfo.LIBCMT ref: 000001BF6943F67E

FindFirstFileA.KERNEL32 ref: 000001BF69439272
free.LIBCMT ref: 000001BF6943927E

Part of subcall function 000001BF6943F244: HeapFree.KERNEL32 ref: 000001BF6943F25A
Part of subcall function 000001BF6943F244: _errno.LIBCMT ref: 000001BF6943F264
Part of subcall function 000001BF6943F244: GetLastError.KERNEL32 ref: 000001BF6943F26C

malloc.LIBCMT ref: 000001BF694392CE
_snprintf.LIBCMT ref: 000001BF694392E6
free.LIBCMT ref: 000001BF6943930E
FindNextFileA.KERNEL32 ref: 000001BF69439327
FindClose.KERNEL32 ref: 000001BF69439338

Strings

%s\*, xrefs: 000001BF69439254

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno$Find$FileHeap_snprintffreemalloc$AllocCloseErrorFirstFreeLastNext_callnewh_invalid_parameter_noinfo
String ID: %s\*
API String ID: 2620626937-766152087
Opcode ID: cc893efac870e389c3214beb74474689fb7507946bb50414294d16208cc1c1d7
Instruction ID: 9329d88ab2f5a633c0db26a3bf165821b629d4e55420774ec92623ce3f1f1b14
Opcode Fuzzy Hash: cc893efac870e389c3214beb74474689fb7507946bb50414294d16208cc1c1d7
Instruction Fuzzy Hash: FF318A7130468185EA199BA36C103EA7B61E74EFD0F88C16E9EA5077DACF39C443D300

Function 000001BF69433A64 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 113sleepprocesslibraryCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 000001BF69433ACE
GetProcAddress.KERNEL32 ref: 000001BF69433ADE

Part of subcall function 000001BF69433984: malloc.LIBCMT ref: 000001BF694339C2
Part of subcall function 000001BF69433984: free.LIBCMT ref: 000001BF69433A45

CreateToolhelp32Snapshot.KERNEL32 ref: 000001BF69433B10
Thread32Next.KERNEL32 ref: 000001BF69433B7A
Sleep.KERNEL32 ref: 000001BF69433B90

Strings

NtQueueApcThread, xrefs: 000001BF69433AD4
ntdll, xrefs: 000001BF69433A99

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: AddressCreateHandleModuleNextProcSleepSnapshotThread32Toolhelp32freemalloc
String ID: NtQueueApcThread$ntdll
API String ID: 1427994231-1374908105
Opcode ID: 4682eb5fa987184764bf2e500015da157d39ace14d4a97c914713ac55f463483
Instruction ID: 11f49cf2c8ef4942b9b8695f74d6864ae8f494e6166b166ea291e47b5a647e0f
Opcode Fuzzy Hash: 4682eb5fa987184764bf2e500015da157d39ace14d4a97c914713ac55f463483
Instruction Fuzzy Hash: 1A41F432601B4199EB60DBB2A8403DD73A5FB4CB88F94C13EAE4957B99EF38C546C740

Function 000001BF69436A78 Relevance: 9.1, APIs: 6, Instructions: 60networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 000001BF69436AB0
htons.WS2_32 ref: 000001BF69436AD0
ioctlsocket.WS2_32 ref: 000001BF69436AEC
closesocket.WS2_32 ref: 000001BF69436AFA
bind.WS2_32 ref: 000001BF69436B0D
listen.WS2_32 ref: 000001BF69436B1D

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: bindclosesockethtonsioctlsocketlistensocket
String ID:
API String ID: 1767165869-0
Opcode ID: f4b350054c05ef1cd9ff918b3eebb66b28a02a47d439b5acf83660ca504c3395
Instruction ID: e2d72b337567bd5e8831b3820b0f848f8f55dc061e63d7f9842aceb9e5fbaf12
Opcode Fuzzy Hash: f4b350054c05ef1cd9ff918b3eebb66b28a02a47d439b5acf83660ca504c3395
Instruction Fuzzy Hash: 4721DF71210A5482EB249F66AC112D9B7A0F78CFA4F94C63DDE5A477A4CF3CD84B8B00

Function 000001BF69436670 Relevance: 9.1, APIs: 6, Instructions: 57networkCOMMON

Download Yara Rule

APIs

htonl.WS2_32 ref: 000001BF69436698
htons.WS2_32 ref: 000001BF694366A4
socket.WS2_32 ref: 000001BF694366BC
closesocket.WS2_32 ref: 000001BF694366CE
bind.WS2_32 ref: 000001BF694366FB
ioctlsocket.WS2_32 ref: 000001BF69436715

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: bindclosesockethtonlhtonsioctlsocketsocket
String ID:
API String ID: 3910169428-0
Opcode ID: b53a2f792c81892d7b6d7ca8ab412e3f2e468a0ee1017cf91dd071cea0dc5194
Instruction ID: 1aa49d63405f8d10545a17476d8eccac528d737bf1739c3bf8c5796c13b2c4de
Opcode Fuzzy Hash: b53a2f792c81892d7b6d7ca8ab412e3f2e468a0ee1017cf91dd071cea0dc5194
Instruction Fuzzy Hash: BC218C75211A5486E7289F62E8143D93760F78CBA4F94C23D9E5A433D4DF3CC94BC640

Function 000001BF6943DF50 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001BF6943DCC0: RevertToSelf.ADVAPI32 ref: 000001BF6943DCDD

LogonUserA.ADVAPI32 ref: 000001BF6943DF98
GetLastError.KERNEL32 ref: 000001BF6943DFA2

Part of subcall function 000001BF69435FEC: malloc.LIBCMT ref: 000001BF69436008

Part of subcall function 000001BF6942FE54: MultiByteToWideChar.KERNEL32 ref: 000001BF6942FE81
Part of subcall function 000001BF6942FE54: MultiByteToWideChar.KERNEL32 ref: 000001BF6942FEA9

Part of subcall function 000001BF6942D044: malloc.LIBCMT ref: 000001BF6942D057

ImpersonateLoggedOnUser.ADVAPI32 ref: 000001BF6943DFC0
GetLastError.KERNEL32 ref: 000001BF6943DFCA

Strings

%s\%s, xrefs: 000001BF6943E084

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: ByteCharErrorLastMultiUserWidemalloc$ImpersonateLoggedLogonRevertSelf
String ID: %s\%s
API String ID: 3621627092-4073750446
Opcode ID: 21501fd99f5b763e027db7a7b361eaf12fbcf34ba50608c9b89ed7353f562f62
Instruction ID: 8813e0892027766c97df23243caa3e23dc4a59239c662a115a9fd046ff5154b5
Opcode Fuzzy Hash: 21501fd99f5b763e027db7a7b361eaf12fbcf34ba50608c9b89ed7353f562f62
Instruction Fuzzy Hash: 35411770314B4181FB00AB62ED957DA33A1EB8DB80F50C03EAE6947796DF39C5479740

Function 000001BF6942FA1C Relevance: 7.6, APIs: 5, Instructions: 61sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 000001BF6942FA3D
Sleep.KERNEL32 ref: 000001BF6942FAAC
GetTickCount.KERNEL32 ref: 000001BF6942FAB2
Sleep.KERNEL32 ref: 000001BF6942FACB
closesocket.WS2_32 ref: 000001BF6942FAD4

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: CountSleepTick$closesocket
String ID:
API String ID: 2363407838-0
Opcode ID: 10e278be78da8f1e85a2fadd26c76492043cbdbeff7cfa22a85522b80d216db2
Instruction ID: ee99eb6fe0a8e471c8b436ad35c783b830514080149127dcbe8a668c4c033b4c
Opcode Fuzzy Hash: 10e278be78da8f1e85a2fadd26c76492043cbdbeff7cfa22a85522b80d216db2
Instruction Fuzzy Hash: 1321803170464041EA10A762AC452DE7390F78DBA0F84C739ADBA47BD6DF38C5079B41

Function 000001BF6943EE8C Relevance: 7.6, APIs: 5, Instructions: 53networkCOMMONLIBRARYCODE

Download Yara Rule

APIs

socket.WS2_32 ref: 000001BF6943EEC1
closesocket.WS2_32 ref: 000001BF6943EED3
htons.WS2_32 ref: 000001BF6943EEE4
bind.WS2_32 ref: 000001BF6943EF05
listen.WS2_32 ref: 000001BF6943EF1A

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: bindclosesockethtonslistensocket
String ID:
API String ID: 564772725-0
Opcode ID: be1f698a7e4eb4207d6933216863c257059b8865fc596cd8fbc22c7be6d18c17
Instruction ID: 6eff6478bbe547bf1883c3ce1be5969ca8e369fb13855bca36e58675feac17f8
Opcode Fuzzy Hash: be1f698a7e4eb4207d6933216863c257059b8865fc596cd8fbc22c7be6d18c17
Instruction Fuzzy Hash: 7E11B43561465482E624AF62AC552EBB360F788BA0F44C23EEE99077D4CF7CC5078704

Function 000001BF69430B70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

LookupPrivilegeValueA.ADVAPI32 ref: 000001BF69430BEA
AdjustTokenPrivileges.ADVAPI32 ref: 000001BF69430C1A
GetLastError.KERNEL32 ref: 000001BF69430C24

Strings

%s, xrefs: 000001BF69430C32

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID: %s
API String ID: 4244140340-620797490
Opcode ID: bf812f175a1fbc479699b50877281c9aa9b2d5b741073a8283bc0e57be89c079
Instruction ID: dc3bca69638fbdf61ee659202f314295253630f76321df94032cdc07ae976511
Opcode Fuzzy Hash: bf812f175a1fbc479699b50877281c9aa9b2d5b741073a8283bc0e57be89c079
Instruction Fuzzy Hash: 61214872B00B009AEB149BB6D8557ED33A5F758B88F44C52E8E4C93A89EF74C616C380

Function 000001BF69435854 Relevance: 6.1, APIs: 4, Instructions: 73sleepnetworkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 000001BF6943587B
Sleep.KERNEL32 ref: 000001BF694358CA
GetTickCount.KERNEL32 ref: 000001BF694358D0
WSAGetLastError.WS2_32 ref: 000001BF694358DA

Part of subcall function 000001BF69435A20: ioctlsocket.WS2_32 ref: 000001BF69435A42

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: CountTick$ErrorLastSleepioctlsocket
String ID:
API String ID: 1121440892-0
Opcode ID: 7368cb6fa517e1a070c78e6e07bfa46b364e9fef9c30544ba018e77da25e9e41
Instruction ID: 26098a2adbd3269872b790f0bd96de7fcece087efe2de7c6a7faf314c2e02a4c
Opcode Fuzzy Hash: 7368cb6fa517e1a070c78e6e07bfa46b364e9fef9c30544ba018e77da25e9e41
Instruction Fuzzy Hash: 0B311536B00B4086EB10DBA2E8842EC77B5F78DB94F51862E9E5D93B95DF30C556C340

Function 000001BF693DB7B0 Relevance: 5.9, Strings: 4, Instructions: 884COMMONLIBRARYCODE

Download Yara Rule

Strings

ailure #%d - %s, xrefs: 000001BF693DC41F, 000001BF693DC498, 000001BF693DC511, 000001BF693DC58A
, xrefs: 000001BF693DBE63
<, xrefs: 000001BF693DBE6E
e ', xrefs: 000001BF693DC405, 000001BF693DC47E, 000001BF693DC4F7, 000001BF693DC570

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: $<$ailure #%d - %s$e '
API String ID: 0-963976815
Opcode ID: b07265f8357a11157a4f9c9ad581af4fb46f207739a0a4220b37d603b0229bef
Instruction ID: 40ce63bc74d356575d98f3fa18355e47f9c0d418562324c44ac8c928b46151d1
Opcode Fuzzy Hash: b07265f8357a11157a4f9c9ad581af4fb46f207739a0a4220b37d603b0229bef
Instruction Fuzzy Hash: C092DEB2325A8087DB58CB1DE4A177AB7A5F3C8B84F44513AEB9B87794CA3CC551CB04

Function 000001BF6942DA3C Relevance: 4.9, APIs: 3, Instructions: 374memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001BF69436114: htonl.WS2_32 ref: 000001BF69436131

GetLastError.KERNEL32 ref: 000001BF6942DD33

Part of subcall function 000001BF6943CC00: GetCurrentProcess.KERNEL32 ref: 000001BF6943CC8D

HeapCreate.KERNEL32 ref: 000001BF6942DCDA
HeapAlloc.KERNEL32 ref: 000001BF6942DCF8

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: Heap$AllocCreateCurrentErrorLastProcesshtonl
String ID:
API String ID: 3419463915-0
Opcode ID: ec0623d855ca9fea6adc12097b57476b8ed8efbce5d3b57090cc4cf496277255
Instruction ID: b59e527f7704ba68ab0a2d8056a1c5c5a43bba7c680c038d03b3a5d6180aa1be
Opcode Fuzzy Hash: ec0623d855ca9fea6adc12097b57476b8ed8efbce5d3b57090cc4cf496277255
Instruction Fuzzy Hash: BDE15B72610B4187FB64CB26ED513EA73A1FB48754F44C13A9F8A97A96EB79E046C300

Function 000001BF6943DEC8 Relevance: 4.5, APIs: 3, Instructions: 34memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 000001BF6943DF17
CheckTokenMembership.ADVAPI32 ref: 000001BF6943DF2E
FreeSid.ADVAPI32 ref: 000001BF6943DF3F

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 133629f3ff4376339bdb4199f1e62c11324afdffa1ae21ac4a70826d2a5797c2
Instruction ID: 0ed515ccb61a5c90c1c3abbad0c379285ad1187ad27d4f731fec8fc44fb7f4d1
Opcode Fuzzy Hash: 133629f3ff4376339bdb4199f1e62c11324afdffa1ae21ac4a70826d2a5797c2
Instruction Fuzzy Hash: 6E011E73624A418FE7208F60E8453EE37B0F35876EF115919F64946A99CB7CC15ACB80

Function 000001BF6944C3B0 Relevance: 3.4, Strings: 2, Instructions: 884COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 000001BF6944CA63
<, xrefs: 000001BF6944CA6E

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: $<
API String ID: 0-428540627
Opcode ID: b07265f8357a11157a4f9c9ad581af4fb46f207739a0a4220b37d603b0229bef
Instruction ID: c28c30ab41ea8dfc647a02342c6430fc11765260d941f8c6deaa8dd0eb718138
Opcode Fuzzy Hash: b07265f8357a11157a4f9c9ad581af4fb46f207739a0a4220b37d603b0229bef
Instruction Fuzzy Hash: 9092D1B2325A4087DB58CB1DE4A177AB7A1F3C8B84F44513AEB9B87798CA3CD551CB04

Function 000001BF69431268 Relevance: 3.0, APIs: 2, Instructions: 32processCOMMON

Download Yara Rule

APIs

CreateProcessWithLogonW.ADVAPI32 ref: 000001BF694312B7
GetLastError.KERNEL32 ref: 000001BF694312C8

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: CreateErrorLastLogonProcessWith
String ID:
API String ID: 2609480667-0
Opcode ID: 8fcebf3f7d0e2333a3ca458f2652207579a2a29baf972c8fdebcbca856c98942
Instruction ID: a576372ab7b40e23db907a4052ed9076308fb841c7c6d23d8832af640bd05a69
Opcode Fuzzy Hash: 8fcebf3f7d0e2333a3ca458f2652207579a2a29baf972c8fdebcbca856c98942
Instruction Fuzzy Hash: 5F0196B6714B0482EB509B66EC897D933A0F30DB94F14813ADE6C8B351DB2AC8979754

Function 000001BF693DC397 Relevance: 2.6, Strings: 2, Instructions: 134COMMON

Download Yara Rule

Strings

ailure #%d - %s, xrefs: 000001BF693DC41F, 000001BF693DC498, 000001BF693DC511, 000001BF693DC58A
e ', xrefs: 000001BF693DC405, 000001BF693DC47E, 000001BF693DC4F7, 000001BF693DC570

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: ailure #%d - %s$e '
API String ID: 0-4163927988
Opcode ID: aa69cfbe2dfd85e7477dd7a8e83c12114f76cab9aed25d9437113f4cd473f74e
Instruction ID: 33606cb62ef5b59f48c8f37bb939b396ed1edff5580cc9cb7ebfb4a4b37ac895
Opcode Fuzzy Hash: aa69cfbe2dfd85e7477dd7a8e83c12114f76cab9aed25d9437113f4cd473f74e
Instruction Fuzzy Hash: 7D613DB6214A508BDB14CB0DE4916AAB7E1F3CC784F84421EE78B8B768CB3CD555CB40

Function 000001BF69435BB8 Relevance: 1.5, APIs: 1, Instructions: 40networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 000001BF69435BF7

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 27e96e658a273ef1840c1d974b0ce0e87452b73cc9428401dd906c37ac757cfd
Instruction ID: ac9599111d24a34146e5ca82cd4d7a39a6d0ba85da29d067561d865fe404b20c
Opcode Fuzzy Hash: 27e96e658a273ef1840c1d974b0ce0e87452b73cc9428401dd906c37ac757cfd
Instruction Fuzzy Hash: 1E016D32320A9085E7609F3BA990699B7A1F788BC4F599139DE5997B95CB38C8828700

Function 000001BF69430920 Relevance: 1.5, APIs: 1, Instructions: 33pipeCOMMON

Download Yara Rule

APIs

CreateNamedPipeA.KERNEL32 ref: 000001BF6943098A

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: CreateNamedPipe
String ID:
API String ID: 2489174969-0
Opcode ID: ffc033c595a008210ccbf7715394fddec234f51f7fbc04560c83c088a3818f65
Instruction ID: e96304f747d35ae4977bc3ee35cd995bfa714c214a2d566a66e6aad85397d13a
Opcode Fuzzy Hash: ffc033c595a008210ccbf7715394fddec234f51f7fbc04560c83c088a3818f65
Instruction Fuzzy Hash: 28016971525B419AEB118B21F8443D977A1F79C379F54C32CDAA8426D5EB3CC01BCB00

Function 000001BF6944DBF0 Relevance: .6, Instructions: 617COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 598c92a77d3f8dda66df7f00e42631b8bb25fed254ebd76fcbad8f8343bff3d7
Instruction ID: 676bea097551cea591d87a65f741ef857b1dc893d52068f6f3559f158150f970
Opcode Fuzzy Hash: 598c92a77d3f8dda66df7f00e42631b8bb25fed254ebd76fcbad8f8343bff3d7
Instruction Fuzzy Hash: 83524FB22189458BDB08CB1CE4A177AB7E1F3C9B80F44852AE7878B799CB3DD555CB40

Function 000001BF693DCFF0 Relevance: .6, Instructions: 617COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 598c92a77d3f8dda66df7f00e42631b8bb25fed254ebd76fcbad8f8343bff3d7
Instruction ID: c4a1f22ddf1ce29eae1b5273f3335d8a53b2e99f5ade66bf48809f5b51de76d1
Opcode Fuzzy Hash: 598c92a77d3f8dda66df7f00e42631b8bb25fed254ebd76fcbad8f8343bff3d7
Instruction Fuzzy Hash: 48526FB22149458BD708CB1DE4A177AB7A1F3C9B80F44852AE79B8B799CF3CD955CB00

Function 000001BF6944D280 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b966ddc3a4a27f87df3b0e1d0093439f08c10720c9c40116a815356078c1d6ce
Instruction ID: f94d3ec3ee59dbb6624d699e2714bf413188f1861a6534a9e76a5a8046e78adb
Opcode Fuzzy Hash: b966ddc3a4a27f87df3b0e1d0093439f08c10720c9c40116a815356078c1d6ce
Instruction Fuzzy Hash: D2522DB22149808BD708CB1DE4A177AB7A1F3C9B84F44852AE79B8B799CA3DD545CB40

Function 000001BF693DC680 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b966ddc3a4a27f87df3b0e1d0093439f08c10720c9c40116a815356078c1d6ce
Instruction ID: b359b5d1f00f4f0cf3929d823ac37305ec4674aaf6fd02eb5db6b2b5cfbc55ed
Opcode Fuzzy Hash: b966ddc3a4a27f87df3b0e1d0093439f08c10720c9c40116a815356078c1d6ce
Instruction Fuzzy Hash: 81522EB22149818BD708CF1DE4A177AB7E1F3CDB80F44852AE7868B799CA3DD955CB40

Function 000001BF6942A280 Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: c765d2767cc6881341997e71bcd018a989170b9b961d50c461c72776cf572830
Instruction ID: 9f9be21f8655acf85765f0af09650bbde49ee4d1bda5b7676fcd16283946362a
Opcode Fuzzy Hash: c765d2767cc6881341997e71bcd018a989170b9b961d50c461c72776cf572830
Instruction Fuzzy Hash: 61F15472304A4296EB20CB259A507EE73A1FB9C794F50C139EE49876C9EF36C947CB40

Function 000001BF693B9680 Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 037a88b3a0e0121372c1e8929510804f124a0a98294513f128062ea9428e9fbd
Instruction ID: 7bdd3b7a6a8b800258b935be6acf5ffe93f90990118c230c9743154021842591
Opcode Fuzzy Hash: 037a88b3a0e0121372c1e8929510804f124a0a98294513f128062ea9428e9fbd
Instruction Fuzzy Hash: 74F1557270464286EB60CE1598923DE73E9F7FE798F508139DE898768DEB34C916CB40

Function 000001BF693BCE3C Relevance: .4, Instructions: 374COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24a34f2510a6bdda36c019d7c9474c92714271ad77d8ea5857b13b9428aab684
Instruction ID: 60a3e7fae13a72b08df279ab86423875edbcc53e36f58c150e2e7becceba4223
Opcode Fuzzy Hash: 24a34f2510a6bdda36c019d7c9474c92714271ad77d8ea5857b13b9428aab684
Instruction Fuzzy Hash: 26E171B2610B4187FB648B25EC423EA73A5F799754F04C139DF9A97A96DB3CE462C300

Function 000001BF69429D6C Relevance: .4, Instructions: 367COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 1cd785112f09a1c6710790546be46074dbf73f7ffcb36dc8c2022c63c2ed85fc
Instruction ID: 74b294a2f3ffdce33f78c061c7cc18c84d533b63a2a28279d3573a61f51a8408
Opcode Fuzzy Hash: 1cd785112f09a1c6710790546be46074dbf73f7ffcb36dc8c2022c63c2ed85fc
Instruction Fuzzy Hash: A7E1C332304A4291EB209B64DE903EE77A1FB9C798F90C129DE4D976C9EB36C947C740

Function 000001BF693B916C Relevance: .4, Instructions: 367COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: a24fb40c631e4fb8bf858a82f26ba5d2e30cdac9459d39304e37b5ee64eada3e
Instruction ID: 2c84472819a3c1e90fab284a5b9c31fb3890e1fd61220c4e1ba9cd490aa24f74
Opcode Fuzzy Hash: a24fb40c631e4fb8bf858a82f26ba5d2e30cdac9459d39304e37b5ee64eada3e
Instruction Fuzzy Hash: 0AE1B532704A4291EB109E14DC923DE77A9F7FA79CF81902ADE898769DEB34C917C740

Function 000001BF693C0334 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 466de111811528a62f1f30eaf25973b5c551d59befa8947403ad49e7d2f1a529
Instruction ID: dfd88039940f752e6c0f32efe22cf150d9e8c86fd424b58df9d8e88a9218ffb3
Opcode Fuzzy Hash: 466de111811528a62f1f30eaf25973b5c551d59befa8947403ad49e7d2f1a529
Instruction Fuzzy Hash: 49713B72614B80C6EB609F61E8463DE73B9F78CB94F00953ADE4943795DF78C8A68B40

Function 000001BF6944CF97 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa69cfbe2dfd85e7477dd7a8e83c12114f76cab9aed25d9437113f4cd473f74e
Instruction ID: f8443c02837d9e76cda83cff927be29698b940c82c8b2f7fc911308e93714c1a
Opcode Fuzzy Hash: aa69cfbe2dfd85e7477dd7a8e83c12114f76cab9aed25d9437113f4cd473f74e
Instruction Fuzzy Hash: 50610CB6214A508BDB14CB09E4906AAB7E1F3CCB95F84821EE78B87768DB3CD545CB40

Function 000001BF694522F0 Relevance: .1, Instructions: 132COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1e5c6463728f0051346f4b79253f85ed871b9d9907b27a939ce1cb7741386f0
Instruction ID: f9167b7f3527e2b8a5e2c7ee4b410c21bea35735bf558d14bef164ba97080300
Opcode Fuzzy Hash: c1e5c6463728f0051346f4b79253f85ed871b9d9907b27a939ce1cb7741386f0
Instruction Fuzzy Hash: 32519BAB50D9D50AF2B14AA40DAA2C83FC5F76A724F4AD06F8F40872C7EF4658079712

Function 000001BF694524C8 Relevance: .0, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bec5aa9e0f310a05a7d4e348bf464b8e7399085d368e634c26742dea36e6bc2f
Instruction ID: 85311d30642e726dda3854104193f07997bd17d4e5ab071a9d667683af383cca
Opcode Fuzzy Hash: bec5aa9e0f310a05a7d4e348bf464b8e7399085d368e634c26742dea36e6bc2f
Instruction Fuzzy Hash: 7F119BA750E6C41AE2A30A640C761DD3F95E7ABB14B8ED09BDB80872C7DB090C1B8312

Function 000001BF694524D0 Relevance: .0, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd184dd02204bbe27ad0a0aa26dad8171a75185b1ecfb51ba8d19fb54c587de9
Instruction ID: 01fb045006b715d8a00896f98a9acdd0bada8ae3b899e2f8702c1c74fb564428
Opcode Fuzzy Hash: cd184dd02204bbe27ad0a0aa26dad8171a75185b1ecfb51ba8d19fb54c587de9
Instruction Fuzzy Hash: 02119AA750EAC41AE2A34A640C761DD3F91E7ABB14B8ED09FDB80862C7DB490C178312

Function 000001BF69436BE0 Relevance: 22.7, APIs: 15, Instructions: 195
networkCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

htonl.WS2_32 ref: 000001BF69436C3D
select.WS2_32 ref: 000001BF69436CAB
__WSAFDIsSet.WS2_32 ref: 000001BF69436CC3
accept.WS2_32 ref: 000001BF69436CE0
ioctlsocket.WS2_32 ref: 000001BF69436CF8
__WSAFDIsSet.WS2_32 ref: 000001BF69436D9B
accept.WS2_32 ref: 000001BF69436DB1

Part of subcall function 000001BF69435A20: ioctlsocket.WS2_32 ref: 000001BF69435A42

__WSAFDIsSet.WS2_32 ref: 000001BF69436E33
__WSAFDIsSet.WS2_32 ref: 000001BF69436E4B
closesocket.WS2_32 ref: 000001BF69436F0D

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: acceptioctlsocket$closesockethtonlselect
String ID:
API String ID: 2003300010-0
Opcode ID: 54efb49355ab49030012f44656aa982b574d006ff9989bba4d15e008082401ba
Instruction ID: a7dfe62d65053e50046c79fe56deae54ccec58a1e2ef520dcdebbc2ddd2914b5
Opcode Fuzzy Hash: 54efb49355ab49030012f44656aa982b574d006ff9989bba4d15e008082401ba
Instruction Fuzzy Hash: B3915872610A919AEB20DF76ED417DD33A1F788B98F00C12ADE4D47A99DF35C56ACB00

Function 000001BF6942EC04 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 165
networksleepCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_snprintf.LIBCMT ref: 000001BF6942ECD3
_snprintf.LIBCMT ref: 000001BF6942ECFE
_snprintf.LIBCMT ref: 000001BF6942ED1A
_snprintf.LIBCMT ref: 000001BF6942EDCF
_snprintf.LIBCMT ref: 000001BF6942EDE6
HttpOpenRequestA.WININET ref: 000001BF6942EE32
HttpSendRequestA.WININET ref: 000001BF6942EE65
InternetCloseHandle.WININET ref: 000001BF6942EE7A
Sleep.KERNEL32 ref: 000001BF6942EE85
InternetCloseHandle.WININET ref: 000001BF6942EE98

Strings

%s%s, xrefs: 000001BF6942EDDB
*/*, xrefs: 000001BF6942EC2A

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: _snprintf$CloseHandleHttpInternetRequest$OpenSendSleep
String ID: %s%s$*/*
API String ID: 3787158362-856325523
Opcode ID: 74fcd7c73aed85367ed650ea4945df165b3c67cd5a727985712ddaae692fa4ee
Instruction ID: a8e90dc1fe9017517e5daf411af33a22eb57f329c2639879247bec97d35c3ded
Opcode Fuzzy Hash: 74fcd7c73aed85367ed650ea4945df165b3c67cd5a727985712ddaae692fa4ee
Instruction Fuzzy Hash: 0D8126B2214B8586EB109B66ED903EA77A0F788788F44C13AEE5D437A9DF79C507C740

Function 000001BF6942E68C Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 165networkfileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000001BF6942E725

Part of subcall function 000001BF6943F63C: _errno.LIBCMT ref: 000001BF6943F673
Part of subcall function 000001BF6943F63C: _invalid_parameter_noinfo.LIBCMT ref: 000001BF6943F67E

Part of subcall function 000001BF69437B38: _snprintf.LIBCMT ref: 000001BF69437CA5

_snprintf.LIBCMT ref: 000001BF6942E7BD
_snprintf.LIBCMT ref: 000001BF6942E7D4
HttpOpenRequestA.WININET ref: 000001BF6942E818
HttpSendRequestA.WININET ref: 000001BF6942E84A
InternetQueryDataAvailable.WININET ref: 000001BF6942E87A
InternetCloseHandle.WININET ref: 000001BF6942E898

Part of subcall function 000001BF69432D70: strchr.LIBCMT ref: 000001BF69432DD6
Part of subcall function 000001BF69432D70: _snprintf.LIBCMT ref: 000001BF69432E0C

Part of subcall function 000001BF69432C0C: strchr.LIBCMT ref: 000001BF69432C69
Part of subcall function 000001BF69432C0C: _snprintf.LIBCMT ref: 000001BF69432CB3

InternetReadFile.WININET ref: 000001BF6942E8D4
InternetCloseHandle.WININET ref: 000001BF6942E8F5

Strings

%s%s, xrefs: 000001BF6942E7C9
*/*, xrefs: 000001BF6942E6CB

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: _snprintf$Internet$CloseHandleHttpRequeststrchr$AvailableDataFileOpenQueryReadSend_errno_invalid_parameter_noinfo
String ID: %s%s$*/*
API String ID: 3536628738-856325523
Opcode ID: 5c4b2c5719e067ce629add7012f112fb417b911470ce534f4123a2ba84123eb0
Instruction ID: a91dbb98012643057e3b8685951e52b5f73dd10e283210b06fdf8f7855d4cf12
Opcode Fuzzy Hash: 5c4b2c5719e067ce629add7012f112fb417b911470ce534f4123a2ba84123eb0
Instruction Fuzzy Hash: DB718F72704A8486EB10DB62E9807EEB7A5F788B94F40C12AEE8957B95DF38C507C740

Function 000001BF694353E4 Relevance: 18.1, APIs: 12, Instructions: 105pipesleepfileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 000001BF694355E4
GetTickCount.KERNEL32 ref: 000001BF694355F0
CreateFileA.KERNEL32 ref: 000001BF6943561E
GetLastError.KERNEL32 ref: 000001BF6943562D
WaitNamedPipeA.KERNEL32 ref: 000001BF69435642
Sleep.KERNEL32 ref: 000001BF6943564F
GetTickCount.KERNEL32 ref: 000001BF69435655
GetLastError.KERNEL32 ref: 000001BF6943566B
GetLastError.KERNEL32 ref: 000001BF69435683
SetNamedPipeHandleState.KERNEL32 ref: 000001BF694356AE
GetLastError.KERNEL32 ref: 000001BF694356B8
DisconnectNamedPipe.KERNEL32 ref: 000001BF69435732

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: ErrorLast$CountNamedPipeTick$CreateDisconnectFileHandleSleepStateWait
String ID:
API String ID: 34948862-0
Opcode ID: fe9bced31039d2455b0d079955692a562236962e25bf66d1b7588840a9b4026e
Instruction ID: d8f946ee5a815682b1554c70c5dacbc6fe14a23f944ee4b8c0ce1fbc9cd84489
Opcode Fuzzy Hash: fe9bced31039d2455b0d079955692a562236962e25bf66d1b7588840a9b4026e
Instruction Fuzzy Hash: A7410636604A4086EB109BB2EC547ED33A5E78CBA4F54C639EE5E97BA4DF38C446C700

Function 000001BF6943FF6C Relevance: 18.1, APIs: 12, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 000001BF6943FF7D
free.LIBCMT ref: 000001BF6943FF9A

Part of subcall function 000001BF6943F244: HeapFree.KERNEL32 ref: 000001BF6943F25A
Part of subcall function 000001BF6943F244: _errno.LIBCMT ref: 000001BF6943F264
Part of subcall function 000001BF6943F244: GetLastError.KERNEL32 ref: 000001BF6943F26C

free.LIBCMT ref: 000001BF6943FFAF
free.LIBCMT ref: 000001BF6943FFD0
free.LIBCMT ref: 000001BF6943FFE5
free.LIBCMT ref: 000001BF6943FFF9
free.LIBCMT ref: 000001BF69440005
free.LIBCMT ref: 000001BF69440030
EncodePointer.KERNEL32 ref: 000001BF69440038
free.LIBCMT ref: 000001BF69440051
free.LIBCMT ref: 000001BF6944006A
free.LIBCMT ref: 000001BF6944009B

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: free$Pointer$DecodeEncodeErrorFreeHeapLast_errno
String ID:
API String ID: 4099253644-0
Opcode ID: f2c387d57ff385ba375dc00a6173171a26f2c39e06d74853e0125178de0f68c4
Instruction ID: 67042e58240993056df6cedd329687f330ba38d4d2e3c278c7c7aa027c4e9360
Opcode Fuzzy Hash: f2c387d57ff385ba375dc00a6173171a26f2c39e06d74853e0125178de0f68c4
Instruction Fuzzy Hash: 32310775202A4081FF54EB62EC947E433A0EB5DB94F68C67EDD2A062E1DF78C457A310

Function 000001BF6943FE10 Relevance: 18.1, APIs: 12, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BF6943FE36

Part of subcall function 000001BF69441D18: _getptd_noexit.LIBCMT ref: 000001BF69441D1C

_invalid_parameter_noinfo.LIBCMT ref: 000001BF6943FE42
__crtIsPackagedApp.LIBCMT ref: 000001BF6943FE53
AreFileApisANSI.KERNEL32 ref: 000001BF6943FE62
MultiByteToWideChar.KERNEL32 ref: 000001BF6943FE88
GetLastError.KERNEL32 ref: 000001BF6943FE95
_dosmaperr.LIBCMT ref: 000001BF6943FE9D

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: ApisByteCharErrorFileLastMultiPackagedWide__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1138158220-0
Opcode ID: 05425721233f79f79091f3b96a0ee25a442efda7d0ba0e08876b468a33414fe7
Instruction ID: 0f1e1c7ddbf1ba1b85f15f43dab895307fed8a25b519c179153564ec3641c5e2
Opcode Fuzzy Hash: 05425721233f79f79091f3b96a0ee25a442efda7d0ba0e08876b468a33414fe7
Instruction Fuzzy Hash: 16315931201B4082FB20AB76AC153E977E1EB8CBA4F14C67D9E49437D6DF38C4129700

Function 000001BF69437308 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 000001BF69437336
select.WS2_32 ref: 000001BF6943738D
__WSAFDIsSet.WS2_32 ref: 000001BF6943739C
__WSAFDIsSet.WS2_32 ref: 000001BF694373B4
GetTickCount.KERNEL32 ref: 000001BF694373BD
gethostbyname.WS2_32 ref: 000001BF694373D0
htons.WS2_32 ref: 000001BF694373E8
inet_addr.WS2_32 ref: 000001BF694373FA
sendto.WS2_32 ref: 000001BF69437423

Strings

d, xrefs: 000001BF69437347

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: CountTick$gethostbynamehtonsinet_addrselectsendto
String ID: d
API String ID: 1257931466-2564639436
Opcode ID: ab0c442174a33fd942d7502bed514c8ee7f8710e336f335b2024a32b2463658a
Instruction ID: 7c716cf57be1e8417c1a46024547a635faa0ad2f532e166ad2607d2f2a9a505e
Opcode Fuzzy Hash: ab0c442174a33fd942d7502bed514c8ee7f8710e336f335b2024a32b2463658a
Instruction Fuzzy Hash: E7314F32215B81D6EB608F62EC447DE77A4F788B84F04912AEE8D47B58DF78C556CB40

Function 000001BF693D1B48 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 227COMMON

Download Yara Rule

APIs

write_multi_char.LIBCMT ref: 000001BF693D1FEB
write_string.LIBCMT ref: 000001BF693D2008
write_multi_char.LIBCMT ref: 000001BF693D2025
write_string.LIBCMT ref: 000001BF693D2084
write_multi_char.LIBCMT ref: 000001BF693D20DD
free.LIBCMT ref: 000001BF693D20F1

Strings

, xrefs: 000001BF693D1FBF

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: write_multi_char$write_string$free
String ID:
API String ID: 2630409672-3916222277
Opcode ID: 1c8d6b8a065489df9c71b2e8ea70d157333f6dd13db57c526a3ea5ce9db962ed
Instruction ID: e383d6c8b0d81c473976408ec6a9ad4223f467487a316eec50ecc6a469ab96bb
Opcode Fuzzy Hash: 1c8d6b8a065489df9c71b2e8ea70d157333f6dd13db57c526a3ea5ce9db962ed
Instruction Fuzzy Hash: 79A1F63260464086FB25CBE5DD223EE7BB8F7C9794F14A229EE4917698CB34C95BC740

Function 000001BF694371FC Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 57networksleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 000001BF6943721C
select.WS2_32 ref: 000001BF69437282
__WSAFDIsSet.WS2_32 ref: 000001BF69437291
__WSAFDIsSet.WS2_32 ref: 000001BF694372A6
send.WS2_32 ref: 000001BF694372BC
WSAGetLastError.WS2_32 ref: 000001BF694372C7
Sleep.KERNEL32 ref: 000001BF694372D9
GetTickCount.KERNEL32 ref: 000001BF694372DF

Strings

d, xrefs: 000001BF6943722A

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: CountTick$ErrorLastSleepselectsend
String ID: d
API String ID: 2152284305-2564639436
Opcode ID: 968d1f127f461a1dbb27dc7435d3ebfca4b5ec6114cfb3c6d112f4c985c4520d
Instruction ID: e9ddd48d7ed7b844ee7987a450d3e23a7e11c6abadd298283dc9fef7117efc9c
Opcode Fuzzy Hash: 968d1f127f461a1dbb27dc7435d3ebfca4b5ec6114cfb3c6d112f4c985c4520d
Instruction Fuzzy Hash: C4214F72218A80C6E7608F62E8443C97365F788784F50C139EF9D47A98DF38C45ACB44

Function 000001BF6942FB08 Relevance: 15.1, APIs: 10, Instructions: 91sleepfilepipeCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 000001BF6942FB29
GetLastError.KERNEL32 ref: 000001BF6942FB83
GetTickCount.KERNEL32 ref: 000001BF6942FB8E
Sleep.KERNEL32 ref: 000001BF6942FB9E
GetLastError.KERNEL32 ref: 000001BF6942FBAB
WriteFile.KERNEL32 ref: 000001BF6942FBDE
WriteFile.KERNEL32 ref: 000001BF6942FC0D
FlushFileBuffers.KERNEL32 ref: 000001BF6942FC25
DisconnectNamedPipe.KERNEL32 ref: 000001BF6942FC2F
Sleep.KERNEL32 ref: 000001BF6942FC43

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: File$CountErrorLastSleepTickWrite$BuffersDisconnectFlushNamedPipe
String ID:
API String ID: 3101085627-0
Opcode ID: 2fa90bf5de3d4daae598bfc7d95f016883deb1b957d31e82556552939848cc78
Instruction ID: d222cab1569ae3639bfc1888353c94f7a9306bd466273e12c996da501a6b00fb
Opcode Fuzzy Hash: 2fa90bf5de3d4daae598bfc7d95f016883deb1b957d31e82556552939848cc78
Instruction Fuzzy Hash: 8A4129367009419AEB109FB6D8943DC3761F748B98F81C13AAE0A97AA9DF39C50BC750

Function 000001BF69446E1C Relevance: 15.1, APIs: 10, Instructions: 81COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BF69446E4E

Part of subcall function 000001BF69441D18: _getptd_noexit.LIBCMT ref: 000001BF69441D1C

__doserrno.LIBCMT ref: 000001BF69446E45

Part of subcall function 000001BF69441CA8: _getptd_noexit.LIBCMT ref: 000001BF69441CAC

__doserrno.LIBCMT ref: 000001BF69446EAB
_errno.LIBCMT ref: 000001BF69446EB2
_invalid_parameter_noinfo.LIBCMT ref: 000001BF69446F16

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: 45b9cdfc7a25f1278b796800b15345f673bb2555b0332f4ab4807a0dfd005840
Instruction ID: c79c8fba16480829661c4ed860ff7ee01d801197a1080217cd4fa0d1b7c9adc3
Opcode Fuzzy Hash: 45b9cdfc7a25f1278b796800b15345f673bb2555b0332f4ab4807a0dfd005840
Instruction Fuzzy Hash: 02318B7221025086E716AF659C913ED3791EB89FA0FA5C13DAE21177DBCB38C8538710

Function 000001BF693D621C Relevance: 15.1, APIs: 10, Instructions: 81COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BF693D624E

Part of subcall function 000001BF693D1118: _getptd_noexit.LIBCMT ref: 000001BF693D111C

__doserrno.LIBCMT ref: 000001BF693D6245

Part of subcall function 000001BF693D10A8: _getptd_noexit.LIBCMT ref: 000001BF693D10AC

__doserrno.LIBCMT ref: 000001BF693D62AB
_errno.LIBCMT ref: 000001BF693D62B2
_invalid_parameter_noinfo.LIBCMT ref: 000001BF693D6316

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: 9a7e94428e85d4ed5cd8e77b1af53c202f15bf406c2c29a1a7d54b8e8c205bff
Instruction ID: 085116e9a5da8c2d7b39db724acefa717e2ac1de1b97adfd85f3a8fefe4e66d7
Opcode Fuzzy Hash: 9a7e94428e85d4ed5cd8e77b1af53c202f15bf406c2c29a1a7d54b8e8c205bff
Instruction Fuzzy Hash: 0A317C3170064486E7166FE59C633ED3758EBC97A4F95E23DAD21173D2C738846E8710

Function 000001BF6944FD50 Relevance: 13.6, APIs: 9, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001BF6944FD76
_errno.LIBCMT ref: 000001BF6944FD6B

Part of subcall function 000001BF69441D18: _getptd_noexit.LIBCMT ref: 000001BF69441D1C

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1812809483-0
Opcode ID: f9c4d6ed39d3bdcb6b80e8c2d76cc2c0cca7aaaf292465ae2b9830194cf53d53
Instruction ID: 4722251c686eed7606f05618cec6075c745acc00ab4e3878d6ac77823f4e4f42
Opcode Fuzzy Hash: f9c4d6ed39d3bdcb6b80e8c2d76cc2c0cca7aaaf292465ae2b9830194cf53d53
Instruction Fuzzy Hash: AB41F6B161269185FB609B219D403ED37E0E76CFA6FA0C17DEE5547ACED724C853A700

Function 000001BF693DF150 Relevance: 13.6, APIs: 9, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001BF693DF176
_errno.LIBCMT ref: 000001BF693DF16B

Part of subcall function 000001BF693D1118: _getptd_noexit.LIBCMT ref: 000001BF693D111C

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1812809483-0
Opcode ID: bd2089a42f628a497311986bb7142f0c797ae3413767483a07d765319bf433f4
Instruction ID: fa52d697b339e3dd19e018d88b6efa6b45f97f4fce0598660fbb8cd4f27072c6
Opcode Fuzzy Hash: bd2089a42f628a497311986bb7142f0c797ae3413767483a07d765319bf433f4
Instruction Fuzzy Hash: 2F41277962025182FB609BD18CA33E97398E7DEB94F90D339DE94436C5D724C96BA600

Function 000001BF6944027C Relevance: 13.6, APIs: 9, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001BF69440264: _mtinitlocknum.LIBCMT ref: 000001BF69443DAA
Part of subcall function 000001BF69440264: _amsg_exit.LIBCMT ref: 000001BF69443DB6

DecodePointer.KERNEL32 ref: 000001BF694402D8
DecodePointer.KERNEL32 ref: 000001BF694402F6
EncodePointer.KERNEL32 ref: 000001BF69440324
DecodePointer.KERNEL32 ref: 000001BF69440339
EncodePointer.KERNEL32 ref: 000001BF69440344
DecodePointer.KERNEL32 ref: 000001BF69440356
DecodePointer.KERNEL32 ref: 000001BF69440366
__crtCorExitProcess.LIBCMT ref: 000001BF694403EA
ExitProcess.KERNEL32 ref: 000001BF694403F2

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$EncodeExitProcess$__crt_amsg_exit_mtinitlocknum
String ID:
API String ID: 1550138920-0
Opcode ID: c0449f3fef6a4d8576451ebf1d27e0541d416188840e9d96df55a1b66d98fc2d
Instruction ID: c14af6a25f15f8d0f4cda5f60b447bd0689bf76424a6d023a6ac2f8fdb7a3214
Opcode Fuzzy Hash: c0449f3fef6a4d8576451ebf1d27e0541d416188840e9d96df55a1b66d98fc2d
Instruction Fuzzy Hash: 3B413A30216A4182E7549F12FC443D977A1F79DB94F54C03EAD8A577A9DF38C4AB8B00

Function 000001BF69436500 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

htonl.WS2_32 ref: 000001BF69436541
htons.WS2_32 ref: 000001BF69436552
socket.WS2_32 ref: 000001BF69436594
closesocket.WS2_32 ref: 000001BF694365A9
gethostbyname.WS2_32 ref: 000001BF694365C8
htons.WS2_32 ref: 000001BF694365F8
ioctlsocket.WS2_32 ref: 000001BF69436612
connect.WS2_32 ref: 000001BF6943662A
WSAGetLastError.WS2_32 ref: 000001BF69436634

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: htons$ErrorLastclosesocketconnectgethostbynamehtonlioctlsocketsocket
String ID:
API String ID: 3339321253-0
Opcode ID: 05f6a439e9e7b1774ef1c5ddc00099d5cfca8a0839fadce43f34e2615c209cd9
Instruction ID: 27e188a8c8a93060479ddb974c25cb1bd28481e0b582ef9c12898305a48dcdb7
Opcode Fuzzy Hash: 05f6a439e9e7b1774ef1c5ddc00099d5cfca8a0839fadce43f34e2615c209cd9
Instruction Fuzzy Hash: 0531D17121469592EA299F62EC547EA7361F748B98F44C13DDE0A476D8EF3CC64BC700

Function 000001BF69436B98 Relevance: 13.6, APIs: 9, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001BF69436BE0: htonl.WS2_32 ref: 000001BF69436C3D
Part of subcall function 000001BF69436BE0: select.WS2_32 ref: 000001BF69436CAB
Part of subcall function 000001BF69436BE0: __WSAFDIsSet.WS2_32 ref: 000001BF69436CC3
Part of subcall function 000001BF69436BE0: accept.WS2_32 ref: 000001BF69436CE0
Part of subcall function 000001BF69436BE0: ioctlsocket.WS2_32 ref: 000001BF69436CF8
Part of subcall function 000001BF69436BE0: __WSAFDIsSet.WS2_32 ref: 000001BF69436D9B

GetTickCount.KERNEL32 ref: 000001BF69436BAA

Part of subcall function 000001BF69436F2C: malloc.LIBCMT ref: 000001BF69436F5E
Part of subcall function 000001BF69436F2C: htonl.WS2_32 ref: 000001BF69436F91
Part of subcall function 000001BF69436F2C: recvfrom.WS2_32 ref: 000001BF69436FD5
Part of subcall function 000001BF69436F2C: WSAGetLastError.WS2_32 ref: 000001BF69436FE2

GetTickCount.KERNEL32 ref: 000001BF69436BC2
GetTickCount.KERNEL32 ref: 000001BF694370E0
GetTickCount.KERNEL32 ref: 000001BF694370F6
shutdown.WS2_32 ref: 000001BF69437115
shutdown.WS2_32 ref: 000001BF6943712A
closesocket.WS2_32 ref: 000001BF69437134
free.LIBCMT ref: 000001BF69437154
free.LIBCMT ref: 000001BF69437169

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: CountTick$freehtonlshutdown$ErrorLastacceptclosesocketioctlsocketmallocrecvfromselect
String ID:
API String ID: 3610715900-0
Opcode ID: 1c403b153f4cdb51b3aa82c7904d7a2a385d985f1a2ac89a95e712731fd71160
Instruction ID: 58a063638109f42bc94b6ed10e34485ca4c6997c7d5c2dfd3ef10499bdf0c6a3
Opcode Fuzzy Hash: 1c403b153f4cdb51b3aa82c7904d7a2a385d985f1a2ac89a95e712731fd71160
Instruction Fuzzy Hash: B531F432204A42C2EB649F72AD452E973A0EB4CB98F18C13EDE9946695DF35C8968B11

Function 000001BF69447A90 Relevance: 13.6, APIs: 9, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BF69447ABB

Part of subcall function 000001BF69441D18: _getptd_noexit.LIBCMT ref: 000001BF69441D1C

__doserrno.LIBCMT ref: 000001BF69447AB3

Part of subcall function 000001BF69441CA8: _getptd_noexit.LIBCMT ref: 000001BF69441CAC

__lock_fhandle.LIBCMT ref: 000001BF69447AFF
_lseek_nolock.LIBCMT ref: 000001BF69447B18

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock
String ID:
API String ID: 310312816-0
Opcode ID: 689a55ff460a42ab0e8479ad490ad51203e5d8515b6f39f729bbcfe6708b8e94
Instruction ID: 41abed8db8c3b8a4a5e87e8b85d9826d389e0aacb9e447831790e1ec9f079525
Opcode Fuzzy Hash: 689a55ff460a42ab0e8479ad490ad51203e5d8515b6f39f729bbcfe6708b8e94
Instruction Fuzzy Hash: 8421323260468046F7166F649C823ED7750EB8CFA5F19C23CAE150B3DACB7888438310

Function 000001BF69447C08 Relevance: 13.6, APIs: 9, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BF69447C33

Part of subcall function 000001BF69441D18: _getptd_noexit.LIBCMT ref: 000001BF69441D1C

__doserrno.LIBCMT ref: 000001BF69447C2B

Part of subcall function 000001BF69441CA8: _getptd_noexit.LIBCMT ref: 000001BF69441CAC

__lock_fhandle.LIBCMT ref: 000001BF69447C77
_lseeki64_nolock.LIBCMT ref: 000001BF69447C90

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock
String ID:
API String ID: 4140391395-0
Opcode ID: b12dde97457ee21ef34638bcae53c6e161a46aae09bdd653f8f5ca1ee8b86ca4
Instruction ID: 7a538950137d5fc6e21c2067c4d31872cbf6274bde9e7b38cff54eea3d02dff5
Opcode Fuzzy Hash: b12dde97457ee21ef34638bcae53c6e161a46aae09bdd653f8f5ca1ee8b86ca4
Instruction Fuzzy Hash: FD21BB7269464046F7166F25AC613ED7751EB88FB2F19C63CAE350B3DACB3884438720

Function 000001BF693D6E90 Relevance: 13.6, APIs: 9, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BF693D6EBB

Part of subcall function 000001BF693D1118: _getptd_noexit.LIBCMT ref: 000001BF693D111C

__doserrno.LIBCMT ref: 000001BF693D6EB3

Part of subcall function 000001BF693D10A8: _getptd_noexit.LIBCMT ref: 000001BF693D10AC

__lock_fhandle.LIBCMT ref: 000001BF693D6EFF
_lseek_nolock.LIBCMT ref: 000001BF693D6F18

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock
String ID:
API String ID: 310312816-0
Opcode ID: 58556fb0ae643294109593e6a1f551c1d1756168c239dbf47c2b40feda9217b5
Instruction ID: 45b75114c24f1a10a2a2abe129295dc0c75c2e2979a873564983b17edb52f123
Opcode Fuzzy Hash: 58556fb0ae643294109593e6a1f551c1d1756168c239dbf47c2b40feda9217b5
Instruction Fuzzy Hash: E921DE32700A4046F7056FE49C633ED7758E7C87A5F09E33CAE25072D2CB78886A8314

Function 000001BF693D7008 Relevance: 13.6, APIs: 9, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BF693D7033

Part of subcall function 000001BF693D1118: _getptd_noexit.LIBCMT ref: 000001BF693D111C

__doserrno.LIBCMT ref: 000001BF693D702B

Part of subcall function 000001BF693D10A8: _getptd_noexit.LIBCMT ref: 000001BF693D10AC

__lock_fhandle.LIBCMT ref: 000001BF693D7077
_lseeki64_nolock.LIBCMT ref: 000001BF693D7090

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock
String ID:
API String ID: 4140391395-0
Opcode ID: 19101616f3e261a9beafbca214444aa2a5cb8e231afb96d714edbab2d78f6c11
Instruction ID: 7e6a2160d8c3b3e916e0048eebbaaeaf36e5f2318343a9f603d7c191599b764a
Opcode Fuzzy Hash: 19101616f3e261a9beafbca214444aa2a5cb8e231afb96d714edbab2d78f6c11
Instruction Fuzzy Hash: 9B21907270014046FA062FA59C273ED7758E7C8BB5F49E72DAE36073D2C778846A87A1

Function 000001BF693CF36C Relevance: 12.6, APIs: 10, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 000001BF693CF39A

Part of subcall function 000001BF693CE644: _errno.LIBCMT ref: 000001BF693CE664

free.LIBCMT ref: 000001BF693CF3AF
free.LIBCMT ref: 000001BF693CF3D0
free.LIBCMT ref: 000001BF693CF3E5
free.LIBCMT ref: 000001BF693CF3F9
free.LIBCMT ref: 000001BF693CF405
free.LIBCMT ref: 000001BF693CF430
free.LIBCMT ref: 000001BF693CF451
free.LIBCMT ref: 000001BF693CF46A
free.LIBCMT ref: 000001BF693CF49B

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: 819b4a270ea7d8595eaf9ac501f5b396dc923916a4c2f054388fd72371d1b91d
Instruction ID: 33c48756927b5bf76049acfc78d2bd3fd37dca08fb62c6a64a53b486df2603e7
Opcode Fuzzy Hash: 819b4a270ea7d8595eaf9ac501f5b396dc923916a4c2f054388fd72371d1b91d
Instruction Fuzzy Hash: 2931C436251E4191FE64DB51EC673E433B8EBDCB90F48823D9D1A07691CF2C88779201

Function 000001BF69446434 Relevance: 12.1, APIs: 8, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BF6944645F

Part of subcall function 000001BF69441D18: _getptd_noexit.LIBCMT ref: 000001BF69441D1C

__doserrno.LIBCMT ref: 000001BF69446457

Part of subcall function 000001BF69441CA8: _getptd_noexit.LIBCMT ref: 000001BF69441CAC

__lock_fhandle.LIBCMT ref: 000001BF694464A3

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno
String ID:
API String ID: 2611593033-0
Opcode ID: 1700ff755fa86426cee97dc6493a8bbd2f86863ab499d60c3e97554295ddf05f
Instruction ID: 27b559bff0aa497615e1660ea232c96203f888add06ecf24fed55912a0c3f3b4
Opcode Fuzzy Hash: 1700ff755fa86426cee97dc6493a8bbd2f86863ab499d60c3e97554295ddf05f
Instruction Fuzzy Hash: DB21CD7271024046FB26AF259D813ED3751EB88FA2F59C13DAE250B3DACB78C8438764

Function 000001BF693D5834 Relevance: 12.1, APIs: 8, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BF693D585F

Part of subcall function 000001BF693D1118: _getptd_noexit.LIBCMT ref: 000001BF693D111C

__doserrno.LIBCMT ref: 000001BF693D5857

Part of subcall function 000001BF693D10A8: _getptd_noexit.LIBCMT ref: 000001BF693D10AC

__lock_fhandle.LIBCMT ref: 000001BF693D58A3

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno
String ID:
API String ID: 2611593033-0
Opcode ID: 268773e762f2e10da4a59bd6545c27f05d9dc8848c407f150f864121acff7d22
Instruction ID: 3eb820a185eef180a3dc9f813fb39f2a3093baa92d1077c4568a7741b3073c3c
Opcode Fuzzy Hash: 268773e762f2e10da4a59bd6545c27f05d9dc8848c407f150f864121acff7d22
Instruction Fuzzy Hash: 3C21DE3270424046F7052FE59C633ED7758E7C8BA1F49E32DAE25472DACB78886A8720

Function 000001BF6944A73C Relevance: 12.1, APIs: 8, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BF6944A755

Part of subcall function 000001BF69441D18: _getptd_noexit.LIBCMT ref: 000001BF69441D1C

__lock_fhandle.LIBCMT ref: 000001BF6944A79D
FlushFileBuffers.KERNEL32 ref: 000001BF6944A7B8
GetLastError.KERNEL32 ref: 000001BF6944A7C2
__doserrno.LIBCMT ref: 000001BF6944A7D2
_errno.LIBCMT ref: 000001BF6944A7D9

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno$BuffersErrorFileFlushLast__doserrno__lock_fhandle_getptd_noexit
String ID:
API String ID: 2289611984-0
Opcode ID: c8931cb6991e1dcdb4b4beaef908be2012675e49725fd5fc40ebfddcb96b8d14
Instruction ID: f287c328c0ab51ab471d2afb083594f14eb5d3a590e6659176247d0f86854a8c
Opcode Fuzzy Hash: c8931cb6991e1dcdb4b4beaef908be2012675e49725fd5fc40ebfddcb96b8d14
Instruction Fuzzy Hash: EF21883120064085F725AB659C913ED7760EF88F70F59C13DAE160B2DACB68C8938355

Function 000001BF69445C58 Relevance: 12.1, APIs: 8, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BF69445C79

Part of subcall function 000001BF69441D18: _getptd_noexit.LIBCMT ref: 000001BF69441D1C

__doserrno.LIBCMT ref: 000001BF69445C71

Part of subcall function 000001BF69441CA8: _getptd_noexit.LIBCMT ref: 000001BF69441CAC

__lock_fhandle.LIBCMT ref: 000001BF69445CBD
_close_nolock.LIBCMT ref: 000001BF69445CD0

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno
String ID:
API String ID: 4060740672-0
Opcode ID: 8f1e5b792f872c4dc36995a7bc6d01a3aafca90ffb12f932fc30e24f319e98c6
Instruction ID: 73377bb3c88e70ba9a7691dff1d9cfdb209632b777d14d1f147d0c13ca09febb
Opcode Fuzzy Hash: 8f1e5b792f872c4dc36995a7bc6d01a3aafca90ffb12f932fc30e24f319e98c6
Instruction Fuzzy Hash: E611D0726A068046FB15AF25AC953EC3750EB98F62F69C63D9D16873DACB7884438710

Function 000001BF693D5058 Relevance: 12.1, APIs: 8, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BF693D5079

Part of subcall function 000001BF693D1118: _getptd_noexit.LIBCMT ref: 000001BF693D111C

__doserrno.LIBCMT ref: 000001BF693D5071

Part of subcall function 000001BF693D10A8: _getptd_noexit.LIBCMT ref: 000001BF693D10AC

__lock_fhandle.LIBCMT ref: 000001BF693D50BD
_close_nolock.LIBCMT ref: 000001BF693D50D0

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno
String ID:
API String ID: 4060740672-0
Opcode ID: 17379182c61e94fbc4142119cfcf5b3e3f43e3e6c30bf76299a690df2e0bdcd6
Instruction ID: ff0a1382cf7b38b22c15e7f783aae5363e64616d2d79b372079f4a6d04036282
Opcode Fuzzy Hash: 17379182c61e94fbc4142119cfcf5b3e3f43e3e6c30bf76299a690df2e0bdcd6
Instruction Fuzzy Hash: 5E11DF3220028446F7096FE59C633EC7B58E7C9760F59E73C9D15872D6C774846A8390

Function 000001BF6942460C Relevance: 11.5, APIs: 9, Instructions: 201COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BF694246A9

Part of subcall function 000001BF6943F284: _FF_MSGBANNER.LIBCMT ref: 000001BF6943F2B4
Part of subcall function 000001BF6943F284: _NMSG_WRITE.LIBCMT ref: 000001BF6943F2BE
Part of subcall function 000001BF6943F284: HeapAlloc.KERNEL32 ref: 000001BF6943F2D9
Part of subcall function 000001BF6943F284: _callnewh.LIBCMT ref: 000001BF6943F2F2
Part of subcall function 000001BF6943F284: _errno.LIBCMT ref: 000001BF6943F2FD
Part of subcall function 000001BF6943F284: _errno.LIBCMT ref: 000001BF6943F308

malloc.LIBCMT ref: 000001BF694246B3

Part of subcall function 000001BF6943F284: _callnewh.LIBCMT ref: 000001BF6943F318
Part of subcall function 000001BF6943F284: _errno.LIBCMT ref: 000001BF6943F31D

malloc.LIBCMT ref: 000001BF694246BE
free.LIBCMT ref: 000001BF6942487E
free.LIBCMT ref: 000001BF69424886
free.LIBCMT ref: 000001BF6942488E

Part of subcall function 000001BF694254F0: malloc.LIBCMT ref: 000001BF6942553A
Part of subcall function 000001BF694254F0: malloc.LIBCMT ref: 000001BF69425545
Part of subcall function 000001BF694254F0: free.LIBCMT ref: 000001BF6942562C
Part of subcall function 000001BF694254F0: free.LIBCMT ref: 000001BF69425634

free.LIBCMT ref: 000001BF6942489A
free.LIBCMT ref: 000001BF694248A7
free.LIBCMT ref: 000001BF694248B4

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: free$malloc$_errno$_callnewh$AllocHeap
String ID:
API String ID: 3534990644-0
Opcode ID: cc81e054d2004eb51c8bee4b84b58d4814fb308bd44c01250cbaa5dfc0e514d5
Instruction ID: 58891150dd2e35b1d5644e8baca2fc017e759f19c51b676e88079ebad35de6d2
Opcode Fuzzy Hash: cc81e054d2004eb51c8bee4b84b58d4814fb308bd44c01250cbaa5dfc0e514d5
Instruction Fuzzy Hash: 8571D23A7156C486FB249A669D50BEA7791FB89BC8F40C13DDE4A47B86DB3AC407C700

Function 000001BF693B3A0C Relevance: 11.5, APIs: 9, Instructions: 201COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BF693B3AA9

Part of subcall function 000001BF693CE684: _FF_MSGBANNER.LIBCMT ref: 000001BF693CE6B4
Part of subcall function 000001BF693CE684: _NMSG_WRITE.LIBCMT ref: 000001BF693CE6BE
Part of subcall function 000001BF693CE684: _callnewh.LIBCMT ref: 000001BF693CE6F2
Part of subcall function 000001BF693CE684: _errno.LIBCMT ref: 000001BF693CE6FD
Part of subcall function 000001BF693CE684: _errno.LIBCMT ref: 000001BF693CE708

malloc.LIBCMT ref: 000001BF693B3AB3

Part of subcall function 000001BF693CE684: _callnewh.LIBCMT ref: 000001BF693CE718
Part of subcall function 000001BF693CE684: _errno.LIBCMT ref: 000001BF693CE71D

malloc.LIBCMT ref: 000001BF693B3ABE
free.LIBCMT ref: 000001BF693B3C7E
free.LIBCMT ref: 000001BF693B3C86
free.LIBCMT ref: 000001BF693B3C8E

Part of subcall function 000001BF693B48F0: malloc.LIBCMT ref: 000001BF693B493A
Part of subcall function 000001BF693B48F0: malloc.LIBCMT ref: 000001BF693B4945
Part of subcall function 000001BF693B48F0: free.LIBCMT ref: 000001BF693B4A2C
Part of subcall function 000001BF693B48F0: free.LIBCMT ref: 000001BF693B4A34

free.LIBCMT ref: 000001BF693B3C9A
free.LIBCMT ref: 000001BF693B3CA7
free.LIBCMT ref: 000001BF693B3CB4

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: free$malloc$_errno$_callnewh
String ID:
API String ID: 4160633307-0
Opcode ID: 930309f8498ff7a349f5473874db00cb4ae22164d30aab4612de4250541046de
Instruction ID: e69f2eb7fc2291799d63e91934d7aa016028a51c1e289a6c01912ec0f94383f3
Opcode Fuzzy Hash: 930309f8498ff7a349f5473874db00cb4ae22164d30aab4612de4250541046de
Instruction Fuzzy Hash: B471F77631579447EA20DB5698427EA7799F7E9BC4F40803D9D8647B8ADB38C827C700

Function 000001BF693BBE74 Relevance: 10.8, APIs: 6, Strings: 1, Instructions: 296COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001BF693C53EC: malloc.LIBCMT ref: 000001BF693C5408

malloc.LIBCMT ref: 000001BF693BBF3B

Part of subcall function 000001BF693CE684: _FF_MSGBANNER.LIBCMT ref: 000001BF693CE6B4
Part of subcall function 000001BF693CE684: _NMSG_WRITE.LIBCMT ref: 000001BF693CE6BE
Part of subcall function 000001BF693CE684: _callnewh.LIBCMT ref: 000001BF693CE6F2
Part of subcall function 000001BF693CE684: _errno.LIBCMT ref: 000001BF693CE6FD
Part of subcall function 000001BF693CE684: _errno.LIBCMT ref: 000001BF693CE708

Part of subcall function 000001BF693CB630: _time64.LIBCMT ref: 000001BF693CB654
Part of subcall function 000001BF693CB630: malloc.LIBCMT ref: 000001BF693CB69C
Part of subcall function 000001BF693CB630: strtok.LIBCMT ref: 000001BF693CB700
Part of subcall function 000001BF693CB630: strtok.LIBCMT ref: 000001BF693CB711

Part of subcall function 000001BF693C28A0: _time64.LIBCMT ref: 000001BF693C28AE

Part of subcall function 000001BF693CDEA8: malloc.LIBCMT ref: 000001BF693CDEF8

Part of subcall function 000001BF693CDEA8: realloc.LIBCMT ref: 000001BF693CDF07

malloc.LIBCMT ref: 000001BF693BC04A
_snprintf.LIBCMT ref: 000001BF693BC0C1
_snprintf.LIBCMT ref: 000001BF693BC0E7
_snprintf.LIBCMT ref: 000001BF693BC10E
free.LIBCMT ref: 000001BF693BC2C6

Part of subcall function 000001BF693CA144: malloc.LIBCMT ref: 000001BF693CA178
Part of subcall function 000001BF693CA144: free.LIBCMT ref: 000001BF693CA32F

Strings

/'); %s, xrefs: 000001BF693BC0B2, 000001BF693BC0DA, 000001BF693BC0F1

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: malloc$_snprintf$_errno_time64freestrtok$_callnewhrealloc
String ID: /'); %s
API String ID: 1314452303-1283008465
Opcode ID: a14b20026d747f2b5753e6fc705179295a1c2f23b63bad27e5059ac536f54d83
Instruction ID: 0deab42447ed62c47fb2ea2910ad5403a56a5659a468905b6cf79d9f602e9d02
Opcode Fuzzy Hash: a14b20026d747f2b5753e6fc705179295a1c2f23b63bad27e5059ac536f54d83
Instruction Fuzzy Hash: 8BC17131601A4186FA24E7659C537E973A9EBDE780F40C03DAD96577D6DF38C8278700

Function 000001BF6943B47C Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 258COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001BF69435FEC: malloc.LIBCMT ref: 000001BF69436008

malloc.LIBCMT ref: 000001BF6943B528

Part of subcall function 000001BF6943F284: _FF_MSGBANNER.LIBCMT ref: 000001BF6943F2B4
Part of subcall function 000001BF6943F284: _NMSG_WRITE.LIBCMT ref: 000001BF6943F2BE
Part of subcall function 000001BF6943F284: HeapAlloc.KERNEL32 ref: 000001BF6943F2D9
Part of subcall function 000001BF6943F284: _callnewh.LIBCMT ref: 000001BF6943F2F2
Part of subcall function 000001BF6943F284: _errno.LIBCMT ref: 000001BF6943F2FD
Part of subcall function 000001BF6943F284: _errno.LIBCMT ref: 000001BF6943F308

Part of subcall function 000001BF6943EAA8: malloc.LIBCMT ref: 000001BF6943EAF8

GetComputerNameExA.KERNEL32 ref: 000001BF6943B5EA
GetComputerNameA.KERNEL32 ref: 000001BF6943B61F
GetUserNameA.ADVAPI32 ref: 000001BF6943B654

Part of subcall function 000001BF6942F014: WSASocketA.WS2_32 ref: 000001BF6942F042

malloc.LIBCMT ref: 000001BF6943B76D

Strings

VUUU, xrefs: 000001BF6943B6B0

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: malloc$Name$Computer_errno$AllocHeapSocketUser_callnewh
String ID: VUUU
API String ID: 632458648-2040033107
Opcode ID: 05713f2820868472ca49688c2b85268c5ac8a6a8808567d94079f7d4b5d3be16
Instruction ID: 7cdfa605d89de4c01614ff360fa3f08714b7b3669e3ade31ba12c67b4d5b3206
Opcode Fuzzy Hash: 05713f2820868472ca49688c2b85268c5ac8a6a8808567d94079f7d4b5d3be16
Instruction Fuzzy Hash: 8CA14636710A9186EB14AB779C523ED3391EB8DB84F90C13EAD4A5B796DF38C9078740

Function 000001BF693BE004 Relevance: 10.7, APIs: 5, Strings: 2, Instructions: 165COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000001BF693BE0D3
_snprintf.LIBCMT ref: 000001BF693BE0FE
_snprintf.LIBCMT ref: 000001BF693BE11A
_snprintf.LIBCMT ref: 000001BF693BE1CF
_snprintf.LIBCMT ref: 000001BF693BE1E6

Strings

rshell -nop -exec bypass -EncodedCommand "%s", xrefs: 000001BF693BE02A
/'); %s, xrefs: 000001BF693BE0CA, 000001BF693BE0F5, 000001BF693BE1C4

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _snprintf
String ID: /'); %s$rshell -nop -exec bypass -EncodedCommand "%s"
API String ID: 3512837008-1250630670
Opcode ID: 72e4e973a1d0442b98f7febb78707b45b3081222fbe35b5ecbc6412512dc3076
Instruction ID: 89c4b3681863bfe55d5b9e4aede4bdea9d6ab3f3eabfeae82f126c7b57e63a2b
Opcode Fuzzy Hash: 72e4e973a1d0442b98f7febb78707b45b3081222fbe35b5ecbc6412512dc3076
Instruction Fuzzy Hash: E1815B36204B8585EB209B65DC823E977A9F7DD784F44813AEE8E13799DF38C926C740

Function 000001BF69431478 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 128processCOMMON

Download Yara Rule

APIs

Part of subcall function 000001BF69435FEC: malloc.LIBCMT ref: 000001BF69436008

GetStartupInfoA.KERNEL32 ref: 000001BF69431540

Part of subcall function 000001BF6942FE54: MultiByteToWideChar.KERNEL32 ref: 000001BF6942FE81
Part of subcall function 000001BF6942FE54: MultiByteToWideChar.KERNEL32 ref: 000001BF6942FEA9

GetCurrentDirectoryW.KERNEL32 ref: 000001BF694315CD
GetCurrentDirectoryW.KERNEL32 ref: 000001BF694315DC
CreateProcessWithLogonW.ADVAPI32 ref: 000001BF69431637
GetLastError.KERNEL32 ref: 000001BF69431641

Strings

%s as %s\%s: %d, xrefs: 000001BF69431647

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: ByteCharCurrentDirectoryMultiWide$CreateErrorInfoLastLogonProcessStartupWithmalloc
String ID: %s as %s\%s: %d
API String ID: 3435635427-816037529
Opcode ID: bd007c1fecfa8e9c64263907c3ef2a9985436de431c3054d3c53bc822cf7e9f1
Instruction ID: 7e9a69f62604dd1f51f5c920daf8f36b09a5f7a2f31ff3dd93adad3d168d3ef2
Opcode Fuzzy Hash: bd007c1fecfa8e9c64263907c3ef2a9985436de431c3054d3c53bc822cf7e9f1
Instruction Fuzzy Hash: E0514C32205B8186EB60DF66B8407DEB7A5F789B84F548029EF8D97B59DF38C056CB40

Function 000001BF693C0A94 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 000001BF693C53EC: malloc.LIBCMT ref: 000001BF693C5408

Part of subcall function 000001BF693CFA20: _errno.LIBCMT ref: 000001BF693CF977
Part of subcall function 000001BF693CFA20: _invalid_parameter_noinfo.LIBCMT ref: 000001BF693CF982

fseek.LIBCMT ref: 000001BF693C0B30

Part of subcall function 000001BF693D02A4: _errno.LIBCMT ref: 000001BF693D02CC
Part of subcall function 000001BF693D02A4: _invalid_parameter_noinfo.LIBCMT ref: 000001BF693D02D7

_ftelli64.LIBCMT ref: 000001BF693C0B38

Part of subcall function 000001BF693D0318: _errno.LIBCMT ref: 000001BF693D0336
Part of subcall function 000001BF693D0318: _invalid_parameter_noinfo.LIBCMT ref: 000001BF693D0341

fseek.LIBCMT ref: 000001BF693C0B48

Part of subcall function 000001BF693D02A4: _fseek_nolock.LIBCMT ref: 000001BF693D02F5

malloc.LIBCMT ref: 000001BF693C0B88

Part of subcall function 000001BF693CE684: _FF_MSGBANNER.LIBCMT ref: 000001BF693CE6B4
Part of subcall function 000001BF693CE684: _NMSG_WRITE.LIBCMT ref: 000001BF693CE6BE
Part of subcall function 000001BF693CE684: _callnewh.LIBCMT ref: 000001BF693CE6F2
Part of subcall function 000001BF693CE684: _errno.LIBCMT ref: 000001BF693CE6FD
Part of subcall function 000001BF693CE684: _errno.LIBCMT ref: 000001BF693CE708

Part of subcall function 000001BF693BC444: malloc.LIBCMT ref: 000001BF693BC457

fclose.LIBCMT ref: 000001BF693C0C45

Strings

mode, xrefs: 000001BF693C0B07

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfomalloc$fseek$_callnewh_fseek_nolock_ftelli64fclose
String ID: mode
API String ID: 1756087678-2976727214
Opcode ID: f827565397daa4a866320a6784096609c7711a7c42725b9a2a2b01c24697e092
Instruction ID: 2846ec7e2e1cd0daa263f3d3fc1dabccd2149ba4d326fd0411a0f11f73af2b63
Opcode Fuzzy Hash: f827565397daa4a866320a6784096609c7711a7c42725b9a2a2b01c24697e092
Instruction Fuzzy Hash: 9D416036315A8082EA14EB129C563EA7369F7DDBD0F40C13AAE5A47BD6DF38C5278700

Function 000001BF693C8620 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BF693C864F

Part of subcall function 000001BF693CE684: _FF_MSGBANNER.LIBCMT ref: 000001BF693CE6B4
Part of subcall function 000001BF693CE684: _NMSG_WRITE.LIBCMT ref: 000001BF693CE6BE
Part of subcall function 000001BF693CE684: _callnewh.LIBCMT ref: 000001BF693CE6F2
Part of subcall function 000001BF693CE684: _errno.LIBCMT ref: 000001BF693CE6FD
Part of subcall function 000001BF693CE684: _errno.LIBCMT ref: 000001BF693CE708

_snprintf.LIBCMT ref: 000001BF693C8667

Part of subcall function 000001BF693CEA3C: _errno.LIBCMT ref: 000001BF693CEA73
Part of subcall function 000001BF693CEA3C: _invalid_parameter_noinfo.LIBCMT ref: 000001BF693CEA7E

free.LIBCMT ref: 000001BF693C867E

Part of subcall function 000001BF693CE644: _errno.LIBCMT ref: 000001BF693CE664

malloc.LIBCMT ref: 000001BF693C86CE
_snprintf.LIBCMT ref: 000001BF693C86E6
free.LIBCMT ref: 000001BF693C870E

Strings

/'); %s, xrefs: 000001BF693C86D3

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno$_snprintffreemalloc$_callnewh_invalid_parameter_noinfo
String ID: /'); %s
API String ID: 761449704-1283008465
Opcode ID: 6cfeb8f42d39390d21f7f655b5309285a784ce0f998201f3a4c834a9ff33a05d
Instruction ID: 0f0457e146f2ed28cff7a293c5d6f830f18faf0685fee29e3f7cc257a3ed1755
Opcode Fuzzy Hash: 6cfeb8f42d39390d21f7f655b5309285a784ce0f998201f3a4c834a9ff33a05d
Instruction Fuzzy Hash: 31316F35200A8185E6259B626D173F5BB69F7CDFD0F88C13A9EA507796DB38D9738300

Function 000001BF6943E98C Relevance: 10.6, APIs: 7, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001BF6943E9D7
OpenProcessToken.ADVAPI32 ref: 000001BF6943E9FB
GetLastError.KERNEL32 ref: 000001BF6943EA05

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: ErrorLast$OpenProcessToken
String ID:
API String ID: 2009710997-0
Opcode ID: 12a3f9e128b967964898bf965f43ef985f021f837df021f2e119c6413e458a11
Instruction ID: 7257261923475e77ba6fe3595f578fe567b528c8b6974cff19b8172f85282651
Opcode Fuzzy Hash: 12a3f9e128b967964898bf965f43ef985f021f837df021f2e119c6413e458a11
Instruction Fuzzy Hash: B1314A3131571083FB14ABB2AC947EB7790EB8CB94F14C13DAE4A42696DF39C8478B40

Function 000001BF693CF210 Relevance: 10.6, APIs: 7, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BF693CF236

Part of subcall function 000001BF693D1118: _getptd_noexit.LIBCMT ref: 000001BF693D111C

_invalid_parameter_noinfo.LIBCMT ref: 000001BF693CF242
__crtIsPackagedApp.LIBCMT ref: 000001BF693CF253
_dosmaperr.LIBCMT ref: 000001BF693CF29D

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: Packaged__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 2917016420-0
Opcode ID: 6bd0c9401fb351ee2ef62b7ec5c1d05d22ccd8d85f9d07845cb75c559d0d09e7
Instruction ID: 6bc4e764769eafda3b940b0d95317ceb65f5692b6650d682bc98ee78f00b5e69
Opcode Fuzzy Hash: 6bd0c9401fb351ee2ef62b7ec5c1d05d22ccd8d85f9d07845cb75c559d0d09e7
Instruction Fuzzy Hash: 6B319E39200F4082FB24ABA69C163E977E9EBCDB94F548639DE45437D5DF38C4668300

Function 000001BF6944FBD0 Relevance: 10.6, APIs: 7, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001BF6944FC04

Part of subcall function 000001BF69441600: _getptd.LIBCMT ref: 000001BF69441616
Part of subcall function 000001BF69441600: __updatetlocinfo.LIBCMT ref: 000001BF6944164B
Part of subcall function 000001BF69441600: __updatetmbcinfo.LIBCMT ref: 000001BF69441672

_errno.LIBCMT ref: 000001BF6944FC1F
_invalid_parameter_noinfo.LIBCMT ref: 000001BF6944FC2A

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 3191669884-0
Opcode ID: 04a51c6534ba67d8c2ce71a0e6c0b8946822a3beaaa0ad6abf8e1e016199c0f5
Instruction ID: 81bed9cda10d10f12c2f306cce2dedbe0b887d21f775da67993e139b9c38f941
Opcode Fuzzy Hash: 04a51c6534ba67d8c2ce71a0e6c0b8946822a3beaaa0ad6abf8e1e016199c0f5
Instruction Fuzzy Hash: 963189726457848AE7209B5298907DDB7A4F79CFE0F68C179AE5807B9ACB34C843DB00

Function 000001BF693DEFD0 Relevance: 10.6, APIs: 7, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001BF693DF004

Part of subcall function 000001BF693D0A00: _getptd.LIBCMT ref: 000001BF693D0A16
Part of subcall function 000001BF693D0A00: __updatetlocinfo.LIBCMT ref: 000001BF693D0A4B
Part of subcall function 000001BF693D0A00: __updatetmbcinfo.LIBCMT ref: 000001BF693D0A72

_errno.LIBCMT ref: 000001BF693DF01F
_invalid_parameter_noinfo.LIBCMT ref: 000001BF693DF02A

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 3191669884-0
Opcode ID: 17da934d4d304edacbb08e48815c32878d4d79cd43a7a40298e59a88dbb9cc3b
Instruction ID: 55eaab7d2435f02e3305c02aa3944a872e15ae6a0d62f2b847c93abe7d1ab9a7
Opcode Fuzzy Hash: 17da934d4d304edacbb08e48815c32878d4d79cd43a7a40298e59a88dbb9cc3b
Instruction Fuzzy Hash: F231AE7221478486E7209B9198927EDB7A8F3CCBE4F14D339AE5807B85CB34C86AD740

Function 000001BF6943596C Relevance: 10.6, APIs: 7, Instructions: 52COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 000001BF6943597D
ioctlsocket.WS2_32 ref: 000001BF6943599E
GetTickCount.KERNEL32 ref: 000001BF694359E3
ioctlsocket.WS2_32 ref: 000001BF69435A05

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: CountTickioctlsocket
String ID:
API String ID: 3686034022-0
Opcode ID: 178b23397deac81d3d51abbf71857af196517098d1f0b7b181b2ee049de2b99e
Instruction ID: 7f2a3579a90c558f1aa5c2590a2fa8d409057791ea598feaec829f1857b7f6ae
Opcode Fuzzy Hash: 178b23397deac81d3d51abbf71857af196517098d1f0b7b181b2ee049de2b99e
Instruction Fuzzy Hash: 6511943120468086F7105BB6EC443D97360EB8CBA5F50C13DDE5986AE4EF78C88BC710

Function 000001BF69430AA0 Relevance: 10.5, APIs: 7, Instructions: 45pipethreadfileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001BF69430AC6
ConnectNamedPipe.KERNEL32 ref: 000001BF69430ADC
ReadFile.KERNEL32 ref: 000001BF69430B06
ImpersonateNamedPipeClient.ADVAPI32 ref: 000001BF69430B17
GetCurrentThread.KERNEL32 ref: 000001BF69430B21
OpenThreadToken.ADVAPI32 ref: 000001BF69430B39
DisconnectNamedPipe.KERNEL32 ref: 000001BF69430B4F

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: NamedPipe$Thread$ClientConnectCurrentDisconnectErrorFileImpersonateLastOpenReadToken
String ID:
API String ID: 4232080776-0
Opcode ID: ef7db9755eefa0db9f7ee1ec6e209610e40617530726d74f2edde71b678aab6d
Instruction ID: 5df02cb4949ed92609777be80835039237bc52cb464f104356f2f8f64b5d37cc
Opcode Fuzzy Hash: ef7db9755eefa0db9f7ee1ec6e209610e40617530726d74f2edde71b678aab6d
Instruction Fuzzy Hash: F3218F3562564096FB509B72EC547EA33A1FB9CB48F84C23E9D4A829A1CF7CC44BD711

Function 000001BF69440B10 Relevance: 9.2, APIs: 6, Instructions: 166COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BF69440B4C

Part of subcall function 000001BF69441D18: _getptd_noexit.LIBCMT ref: 000001BF69441D1C

_invalid_parameter_noinfo.LIBCMT ref: 000001BF69440B57
memcpy_s.LIBCMT ref: 000001BF69440C1C
_fileno.LIBCMT ref: 000001BF69440C87
_filbuf.LIBCMT ref: 000001BF69440CB5
_errno.LIBCMT ref: 000001BF69440D05

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 2328795619-0
Opcode ID: 4bbdce99b29ecd3e24264ac9f3b66a56e11342a03ebc5466d7d382185dba5216
Instruction ID: bf19f5dd642b9443ead47971f52c830fa05c632a67482603d0e653c9ce3f37cb
Opcode Fuzzy Hash: 4bbdce99b29ecd3e24264ac9f3b66a56e11342a03ebc5466d7d382185dba5216
Instruction Fuzzy Hash: 2251B07175429086EB288A665D107E9B790E768FF8F14C638AE3947BDDCB34D4A38340

Function 000001BF693CFF10 Relevance: 9.2, APIs: 6, Instructions: 166COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BF693CFF4C

Part of subcall function 000001BF693D1118: _getptd_noexit.LIBCMT ref: 000001BF693D111C

_invalid_parameter_noinfo.LIBCMT ref: 000001BF693CFF57
memcpy_s.LIBCMT ref: 000001BF693D001C
_fileno.LIBCMT ref: 000001BF693D0087
_filbuf.LIBCMT ref: 000001BF693D00B5
_errno.LIBCMT ref: 000001BF693D0105

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 2328795619-0
Opcode ID: a6b8c894bc097219f3410178b0f3ee4aa495d15850340b6c84f373b071b042dd
Instruction ID: 4e3456f7c98b88c434857123fff76630f944121ff7b1660bfe19048a79b91509
Opcode Fuzzy Hash: a6b8c894bc097219f3410178b0f3ee4aa495d15850340b6c84f373b071b042dd
Instruction Fuzzy Hash: 2551043170464092FA288AA65C127E977A8E3C9FF4F14D739AE3943BD5CB34C4BB9240

Function 000001BF693C1030 Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 150COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BF693C1063

Part of subcall function 000001BF693CE684: _FF_MSGBANNER.LIBCMT ref: 000001BF693CE6B4
Part of subcall function 000001BF693CE684: _NMSG_WRITE.LIBCMT ref: 000001BF693CE6BE
Part of subcall function 000001BF693CE684: _callnewh.LIBCMT ref: 000001BF693CE6F2
Part of subcall function 000001BF693CE684: _errno.LIBCMT ref: 000001BF693CE6FD
Part of subcall function 000001BF693CE684: _errno.LIBCMT ref: 000001BF693CE708

Part of subcall function 000001BF693BC444: malloc.LIBCMT ref: 000001BF693BC457

free.LIBCMT ref: 000001BF693C115E
free.LIBCMT ref: 000001BF693C116B

Part of subcall function 000001BF693CE644: _errno.LIBCMT ref: 000001BF693CE664

Strings

open process: %d (%u), xrefs: 000001BF693C10BF
n from %d (%u), xrefs: 000001BF693C1229
1:%u/'); %s, xrefs: 000001BF693C10F9

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno$freemalloc$_callnewh
String ID: 1:%u/'); %s$n from %d (%u)$open process: %d (%u)
API String ID: 2029259483-317027030
Opcode ID: dc04f393f0e4fed79304e7eb9afd54a7656e6f03fcd842c9ac36e4d1f5269005
Instruction ID: ecbacffd4ed1995996d37429d691a296995ccc9a3ee4b6d1d7fd24ec7eeff3cd
Opcode Fuzzy Hash: dc04f393f0e4fed79304e7eb9afd54a7656e6f03fcd842c9ac36e4d1f5269005
Instruction Fuzzy Hash: 88619672304B5186EB10DBA5E8422EE77B5F7C9B94F40802AEE8947B99DF7CC516CB40

Function 000001BF6944A348 Relevance: 9.1, APIs: 6, Instructions: 132COMMONLIBRARYCODE

Download Yara Rule

APIs

_mtinitlocknum.LIBCMT ref: 000001BF6944A375

Part of subcall function 000001BF69443E58: _FF_MSGBANNER.LIBCMT ref: 000001BF69443E75
Part of subcall function 000001BF69443E58: _NMSG_WRITE.LIBCMT ref: 000001BF69443E7F

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 000001BF6944A3F8
EnterCriticalSection.KERNEL32 ref: 000001BF6944A414
LeaveCriticalSection.KERNEL32 ref: 000001BF6944A424
_calloc_crt.LIBCMT ref: 000001BF6944A49A
__lock_fhandle.LIBCMT ref: 000001BF6944A502

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountEnterInitializeLeaveSpin__lock_fhandle_calloc_crt_mtinitlocknum
String ID:
API String ID: 445582508-0
Opcode ID: 37ad4fda8a075f5cd4d07cec490ae037cae96ac67048c51c0eece2b82dd4d161
Instruction ID: dd90160957987d567a2155eeb1e4921edcb8f23255811829fabe0b4ff1dbb828
Opcode Fuzzy Hash: 37ad4fda8a075f5cd4d07cec490ae037cae96ac67048c51c0eece2b82dd4d161
Instruction Fuzzy Hash: 2A519B3260068082EB248F10DC443EDB3A5FB98F68F19C139DE49477E9DB78C856C740

Function 000001BF69431694 Relevance: 9.1, APIs: 6, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 000001BF69435FEC: malloc.LIBCMT ref: 000001BF69436008

Part of subcall function 000001BF69440620: _errno.LIBCMT ref: 000001BF69440577
Part of subcall function 000001BF69440620: _invalid_parameter_noinfo.LIBCMT ref: 000001BF69440582

fseek.LIBCMT ref: 000001BF69431730

Part of subcall function 000001BF69440EA4: _errno.LIBCMT ref: 000001BF69440ECC
Part of subcall function 000001BF69440EA4: _invalid_parameter_noinfo.LIBCMT ref: 000001BF69440ED7

_ftelli64.LIBCMT ref: 000001BF69431738

Part of subcall function 000001BF69440F18: _errno.LIBCMT ref: 000001BF69440F36
Part of subcall function 000001BF69440F18: _invalid_parameter_noinfo.LIBCMT ref: 000001BF69440F41

fseek.LIBCMT ref: 000001BF69431748

Part of subcall function 000001BF69440EA4: _fseek_nolock.LIBCMT ref: 000001BF69440EF5

GetFullPathNameA.KERNEL32 ref: 000001BF6943176B
malloc.LIBCMT ref: 000001BF69431788

Part of subcall function 000001BF6943F284: _FF_MSGBANNER.LIBCMT ref: 000001BF6943F2B4
Part of subcall function 000001BF6943F284: _NMSG_WRITE.LIBCMT ref: 000001BF6943F2BE
Part of subcall function 000001BF6943F284: HeapAlloc.KERNEL32 ref: 000001BF6943F2D9
Part of subcall function 000001BF6943F284: _callnewh.LIBCMT ref: 000001BF6943F2F2
Part of subcall function 000001BF6943F284: _errno.LIBCMT ref: 000001BF6943F2FD
Part of subcall function 000001BF6943F284: _errno.LIBCMT ref: 000001BF6943F308

Part of subcall function 000001BF6942D044: malloc.LIBCMT ref: 000001BF6942D057

Part of subcall function 000001BF6942D074: htonl.WS2_32 ref: 000001BF6942D07F

fclose.LIBCMT ref: 000001BF69431845

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfomalloc$fseek$AllocFullHeapNamePath_callnewh_fseek_nolock_ftelli64fclosehtonl
String ID:
API String ID: 3587854850-0
Opcode ID: f2abbbf20f3530519e2fbcb7cf3f65dd4e7c47c251f31922550871d18ad798e2
Instruction ID: 9d755ee578503b20e48e5162ca77ae7672f429c50040eeb091678515e9582775
Opcode Fuzzy Hash: f2abbbf20f3530519e2fbcb7cf3f65dd4e7c47c251f31922550871d18ad798e2
Instruction Fuzzy Hash: BE41693230064082EA14EB22A9557EA7351FB8CBD0F80C23EAE5A47BD6DF39C5078B40

Function 000001BF69435C60 Relevance: 9.1, APIs: 6, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

GetACP.KERNEL32 ref: 000001BF69435C78
GetOEMCP.KERNEL32 ref: 000001BF69435C82
GetCurrentProcessId.KERNEL32 ref: 000001BF69435CA8
GetTickCount.KERNEL32 ref: 000001BF69435CB0

Part of subcall function 000001BF6944044C: _getptd.LIBCMT ref: 000001BF69440454

GetCurrentProcess.KERNEL32 ref: 000001BF69435CEC

Part of subcall function 000001BF69430C64: GetModuleHandleA.KERNEL32 ref: 000001BF69430C79
Part of subcall function 000001BF69430C64: GetProcAddress.KERNEL32 ref: 000001BF69430C89

GetCurrentProcessId.KERNEL32 ref: 000001BF69435D5E

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: CurrentProcess$AddressCountHandleModuleProcTick_getptd
String ID:
API String ID: 3426420785-0
Opcode ID: cace55278df1f4be28c563725835e26b24be87b65be8dda4f354c1bcfac1d593
Instruction ID: 4e8697e9e1c1af0822f9d6d7056bf4dfc7ec15cebb8406e6f6ce40f3de32d1be
Opcode Fuzzy Hash: cace55278df1f4be28c563725835e26b24be87b65be8dda4f354c1bcfac1d593
Instruction Fuzzy Hash: AD41193172061495FB00ABB29D957EA33A0FB8C754F40C43AEE0987AA6DF39C5078750

Function 000001BF69436F2C Relevance: 9.1, APIs: 6, Instructions: 99networkCOMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BF69436F5E

Part of subcall function 000001BF6943F284: _FF_MSGBANNER.LIBCMT ref: 000001BF6943F2B4
Part of subcall function 000001BF6943F284: _NMSG_WRITE.LIBCMT ref: 000001BF6943F2BE
Part of subcall function 000001BF6943F284: HeapAlloc.KERNEL32 ref: 000001BF6943F2D9
Part of subcall function 000001BF6943F284: _callnewh.LIBCMT ref: 000001BF6943F2F2
Part of subcall function 000001BF6943F284: _errno.LIBCMT ref: 000001BF6943F2FD
Part of subcall function 000001BF6943F284: _errno.LIBCMT ref: 000001BF6943F308

htonl.WS2_32 ref: 000001BF69436F91
recvfrom.WS2_32 ref: 000001BF69436FD5
WSAGetLastError.WS2_32 ref: 000001BF69436FE2

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno$AllocErrorHeapLast_callnewhhtonlmallocrecvfrom
String ID:
API String ID: 2310505145-0
Opcode ID: 2261c4ce2f877d491e78f0891c545d8b3f459d63dae9fe63479e894e722204df
Instruction ID: ed77fb3cb7c70c1e5442acd41d9ee4ebc75a4be0086d2c4e7d3647098f0a5fb1
Opcode Fuzzy Hash: 2261c4ce2f877d491e78f0891c545d8b3f459d63dae9fe63479e894e722204df
Instruction Fuzzy Hash: 1D410B72204A90D6EB608F36EC447DA77A1F78CBA8F14C13DDE99476A4DB39C4829B40

Function 000001BF694379C4 Relevance: 9.1, APIs: 6, Instructions: 96threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001BF694379FF
UpdateProcThreadAttribute.KERNEL32 ref: 000001BF69437A3F
GetLastError.KERNEL32 ref: 000001BF69437A49
GetCurrentProcess.KERNEL32 ref: 000001BF69437A7E
GetCurrentProcess.KERNEL32 ref: 000001BF69437ABE
GetCurrentProcess.KERNEL32 ref: 000001BF69437AEF

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: CurrentProcess$ErrorLast$AttributeProcThreadUpdate
String ID:
API String ID: 1014270282-0
Opcode ID: b3d57bf1a8e1718da0dab59a644853e162df0a73d9a39d542a15f5b5bcb328ed
Instruction ID: 51fd55a972ba23f4af6cd3270060fe1cf94f224c92e87dacd7ab753b4d410cea
Opcode Fuzzy Hash: b3d57bf1a8e1718da0dab59a644853e162df0a73d9a39d542a15f5b5bcb328ed
Instruction Fuzzy Hash: 5841613261878086EB109F6298443D977A1F78CBD4F08C63DAE8947B95DF7CC646C700

Function 000001BF69440620 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BF69440577

Part of subcall function 000001BF69441D18: _getptd_noexit.LIBCMT ref: 000001BF69441D1C

_invalid_parameter_noinfo.LIBCMT ref: 000001BF69440582
_getstream.LIBCMT ref: 000001BF694405A2
_errno.LIBCMT ref: 000001BF694405B4
_errno.LIBCMT ref: 000001BF694405C6
_openfile.LIBCMT ref: 000001BF694405F4

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: e39adbfa2b2f6f7307badbfd63093f86f5a875a8f375d579bd57b533050ef8dc
Instruction ID: 7214499a9b44790c5514ff2c0e96a53678c0b48313feff58af38a53c034a51df
Opcode Fuzzy Hash: e39adbfa2b2f6f7307badbfd63093f86f5a875a8f375d579bd57b533050ef8dc
Instruction Fuzzy Hash: D02190B121468185FB659F22AC013DEB794EB5DFC0F44C439AE8997B9EDB3CC4228700

Function 000001BF693CFA20 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BF693CF977

Part of subcall function 000001BF693D1118: _getptd_noexit.LIBCMT ref: 000001BF693D111C

_invalid_parameter_noinfo.LIBCMT ref: 000001BF693CF982
_getstream.LIBCMT ref: 000001BF693CF9A2
_errno.LIBCMT ref: 000001BF693CF9B4
_errno.LIBCMT ref: 000001BF693CF9C6
_openfile.LIBCMT ref: 000001BF693CF9F4

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: 0ee48a0889aaee90efd1175476a0cb7edf48224d72ecded3f82ab5c2f8e8549f
Instruction ID: 4d4922a6ec5d52631d9b9b97375f19e6eac4e275de3e578eb9bb840de469ac99
Opcode Fuzzy Hash: 0ee48a0889aaee90efd1175476a0cb7edf48224d72ecded3f82ab5c2f8e8549f
Instruction Fuzzy Hash: 4421A431304A8292FB515BA19C033DEB7A9E7CD7C0F44D5399D4987B95DB3CC4629700

Function 000001BF693D9B3C Relevance: 9.1, APIs: 6, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BF693D9B55

Part of subcall function 000001BF693D1118: _getptd_noexit.LIBCMT ref: 000001BF693D111C

__lock_fhandle.LIBCMT ref: 000001BF693D9B9D
__doserrno.LIBCMT ref: 000001BF693D9BD2
_errno.LIBCMT ref: 000001BF693D9BD9

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno$__doserrno__lock_fhandle_getptd_noexit
String ID:
API String ID: 2102446242-0
Opcode ID: acc1e709539f3a0e8ebe9ec8259c6fe6fa9b3b7ac075e700e957115c0bfbe106
Instruction ID: 5e7ae96330aa92eb46e9627872ec527c2708339fe485ef81527df2ed52d2af37
Opcode Fuzzy Hash: acc1e709539f3a0e8ebe9ec8259c6fe6fa9b3b7ac075e700e957115c0bfbe106
Instruction Fuzzy Hash: E6217C3120264046E7156FE59CB33ED7798E7C8760F0AE23D9E16072D2CB6888AB8314

Function 000001BF6942FC64 Relevance: 9.1, APIs: 6, Instructions: 58fileCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BF6942FC85

Part of subcall function 000001BF6943F284: _FF_MSGBANNER.LIBCMT ref: 000001BF6943F2B4
Part of subcall function 000001BF6943F284: _NMSG_WRITE.LIBCMT ref: 000001BF6943F2BE
Part of subcall function 000001BF6943F284: HeapAlloc.KERNEL32 ref: 000001BF6943F2D9
Part of subcall function 000001BF6943F284: _callnewh.LIBCMT ref: 000001BF6943F2F2
Part of subcall function 000001BF6943F284: _errno.LIBCMT ref: 000001BF6943F2FD
Part of subcall function 000001BF6943F284: _errno.LIBCMT ref: 000001BF6943F308

free.LIBCMT ref: 000001BF6942FCC0
fwrite.LIBCMT ref: 000001BF6942FD01
fclose.LIBCMT ref: 000001BF6942FD09
free.LIBCMT ref: 000001BF6942FD16

Part of subcall function 000001BF6943F244: HeapFree.KERNEL32 ref: 000001BF6943F25A
Part of subcall function 000001BF6943F244: _errno.LIBCMT ref: 000001BF6943F264
Part of subcall function 000001BF6943F244: GetLastError.KERNEL32 ref: 000001BF6943F26C

GetLastError.KERNEL32 ref: 000001BF6942FD1B

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno$ErrorHeapLastfree$AllocFree_callnewhfclosefwritemalloc
String ID:
API String ID: 1616846154-0
Opcode ID: 17de93f2489608755237434f8f5e09f648d27c8e17da9d8174f51a1e36afe512
Instruction ID: 4c76af3d5591308580163f330432add7a973e9511c8e71a5856f3724fd7273af
Opcode Fuzzy Hash: 17de93f2489608755237434f8f5e09f648d27c8e17da9d8174f51a1e36afe512
Instruction Fuzzy Hash: D6115E3131564041FA10A663A9512EE7351EB8DBE4F84C23DAE6A47BCADF29C5028780

Function 000001BF69434488 Relevance: 9.1, APIs: 6, Instructions: 51pipefileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000001BF694344A6
WaitNamedPipeA.KERNEL32 ref: 000001BF694344BB
CreateFileA.KERNEL32 ref: 000001BF694344E5
SetNamedPipeHandleState.KERNEL32 ref: 000001BF69434507
DisconnectNamedPipe.KERNEL32 ref: 000001BF69434514
SetLastError.KERNEL32 ref: 000001BF69434529

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: NamedPipe$ErrorLast$CreateDisconnectFileHandleStateWait
String ID:
API String ID: 3798860377-0
Opcode ID: 66f56032a1747051bfe9465942bea2b3a251e1270fb13d2c0e90442697245dfd
Instruction ID: 1219012532517b5d617933257d81207da3ad3a6a3fc120009eb858345abba226
Opcode Fuzzy Hash: 66f56032a1747051bfe9465942bea2b3a251e1270fb13d2c0e90442697245dfd
Instruction Fuzzy Hash: 69117C3260465082FB109B76F9147DE73A1E788BE5F84C23DAE5A87ED4CF69C4478701

Function 000001BF6943EFEC Relevance: 9.0, APIs: 5, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BF6943F00F

Part of subcall function 000001BF6943F284: _FF_MSGBANNER.LIBCMT ref: 000001BF6943F2B4
Part of subcall function 000001BF6943F284: _NMSG_WRITE.LIBCMT ref: 000001BF6943F2BE
Part of subcall function 000001BF6943F284: HeapAlloc.KERNEL32 ref: 000001BF6943F2D9
Part of subcall function 000001BF6943F284: _callnewh.LIBCMT ref: 000001BF6943F2F2
Part of subcall function 000001BF6943F284: _errno.LIBCMT ref: 000001BF6943F2FD
Part of subcall function 000001BF6943F284: _errno.LIBCMT ref: 000001BF6943F308

malloc.LIBCMT ref: 000001BF6943F01D

Part of subcall function 000001BF6943F284: _callnewh.LIBCMT ref: 000001BF6943F318
Part of subcall function 000001BF6943F284: _errno.LIBCMT ref: 000001BF6943F31D

malloc.LIBCMT ref: 000001BF6943F03F
_snprintf.LIBCMT ref: 000001BF6943F05A

Part of subcall function 000001BF6943F63C: _errno.LIBCMT ref: 000001BF6943F673
Part of subcall function 000001BF6943F63C: _invalid_parameter_noinfo.LIBCMT ref: 000001BF6943F67E

malloc.LIBCMT ref: 000001BF6943F075

Strings

HTTP/1.1 200 OKContent-Type: application/octet-streamContent-Length: %d, xrefs: 000001BF6943F044

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errnomalloc$_callnewh$AllocHeap_invalid_parameter_noinfo_snprintf
String ID: HTTP/1.1 200 OKContent-Type: application/octet-streamContent-Length: %d
API String ID: 3518644649-2739389480
Opcode ID: afba7a99536ed02a45dac5d500ee5d86b7940ec366185a31927e6e9a708e28fc
Instruction ID: ea9cb19860f86b74ce9227e6689f4d625bfe075ec6ec3f4871c8aa46ea223156
Opcode Fuzzy Hash: afba7a99536ed02a45dac5d500ee5d86b7940ec366185a31927e6e9a708e28fc
Instruction Fuzzy Hash: D8018E7160279082EA44DB63B8047D97799E78CBE0F85C26DEEA9477D6DB38C0428780

Function 000001BF693CE3EC Relevance: 9.0, APIs: 5, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BF693CE40F

Part of subcall function 000001BF693CE684: _FF_MSGBANNER.LIBCMT ref: 000001BF693CE6B4
Part of subcall function 000001BF693CE684: _NMSG_WRITE.LIBCMT ref: 000001BF693CE6BE
Part of subcall function 000001BF693CE684: _callnewh.LIBCMT ref: 000001BF693CE6F2
Part of subcall function 000001BF693CE684: _errno.LIBCMT ref: 000001BF693CE6FD
Part of subcall function 000001BF693CE684: _errno.LIBCMT ref: 000001BF693CE708

malloc.LIBCMT ref: 000001BF693CE41D

Part of subcall function 000001BF693CE684: _callnewh.LIBCMT ref: 000001BF693CE718
Part of subcall function 000001BF693CE684: _errno.LIBCMT ref: 000001BF693CE71D

malloc.LIBCMT ref: 000001BF693CE43F
_snprintf.LIBCMT ref: 000001BF693CE45A

Part of subcall function 000001BF693CEA3C: _errno.LIBCMT ref: 000001BF693CEA73
Part of subcall function 000001BF693CEA3C: _invalid_parameter_noinfo.LIBCMT ref: 000001BF693CEA7E

malloc.LIBCMT ref: 000001BF693CE475

Strings

dpoolWait, xrefs: 000001BF693CE444

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errnomalloc$_callnewh$_invalid_parameter_noinfo_snprintf
String ID: dpoolWait
API String ID: 2026495703-1875951006
Opcode ID: 8070209c1cbe6b8a0a820429e4883b75791e823d018c18b7f063917c64386bf6
Instruction ID: bba1a2392775353e15b9e4269a171db94f6c828e775e6e3e9ee6529a13176874
Opcode Fuzzy Hash: 8070209c1cbe6b8a0a820429e4883b75791e823d018c18b7f063917c64386bf6
Instruction Fuzzy Hash: 6F018272610B9085EA24DB12B8067E977ADE7DCBD0F058229EE69477C6CB38C8628740

Function 000001BF694331F4 Relevance: 8.9, APIs: 7, Instructions: 181stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

strchr.LIBCMT ref: 000001BF6943322E
strchr.LIBCMT ref: 000001BF6943324C
malloc.LIBCMT ref: 000001BF69433264
malloc.LIBCMT ref: 000001BF69433271
rand.LIBCMT ref: 000001BF6943333D
free.LIBCMT ref: 000001BF6943345B
free.LIBCMT ref: 000001BF69433463

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: freemallocstrchr$rand
String ID:
API String ID: 1305919620-0
Opcode ID: 5dd9697f37be70f43a9dfb8e879823c33dc0761040d61eac182ad5eba971c26a
Instruction ID: 3d113b7502cc6f3d1a6f8f2390c93b1c7a5e78cadc3ad205a3fedfeff90c8ad5
Opcode Fuzzy Hash: 5dd9697f37be70f43a9dfb8e879823c33dc0761040d61eac182ad5eba971c26a
Instruction Fuzzy Hash: B371DA72605BC441FA269B3AA8113EA7790EF9DB84F48D13DDF85177A6EF29C1478700

Function 000001BF693C25F4 Relevance: 8.9, APIs: 7, Instructions: 181stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

strchr.LIBCMT ref: 000001BF693C262E
strchr.LIBCMT ref: 000001BF693C264C
malloc.LIBCMT ref: 000001BF693C2664
malloc.LIBCMT ref: 000001BF693C2671
rand.LIBCMT ref: 000001BF693C273D
free.LIBCMT ref: 000001BF693C285B
free.LIBCMT ref: 000001BF693C2863

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: freemallocstrchr$rand
String ID:
API String ID: 1305919620-0
Opcode ID: f55c98597b31e9256bdda085e271814e8bdd530284bc77f6856305a025606a71
Instruction ID: c397bbe88ca32a45650e69e3857c2ccf3499c45dd2ebf0261875ea5da76473de
Opcode Fuzzy Hash: f55c98597b31e9256bdda085e271814e8bdd530284bc77f6856305a025606a71
Instruction Fuzzy Hash: CE71E772604FC4C1FA259B29A9123EA73A4EFD9B84F089138DF8517796DF2DD5638700

Function 000001BF69424170 Relevance: 8.9, APIs: 7, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BF694241BD

Part of subcall function 000001BF6943F284: _FF_MSGBANNER.LIBCMT ref: 000001BF6943F2B4
Part of subcall function 000001BF6943F284: _NMSG_WRITE.LIBCMT ref: 000001BF6943F2BE
Part of subcall function 000001BF6943F284: HeapAlloc.KERNEL32 ref: 000001BF6943F2D9
Part of subcall function 000001BF6943F284: _callnewh.LIBCMT ref: 000001BF6943F2F2
Part of subcall function 000001BF6943F284: _errno.LIBCMT ref: 000001BF6943F2FD
Part of subcall function 000001BF6943F284: _errno.LIBCMT ref: 000001BF6943F308

malloc.LIBCMT ref: 000001BF694241C8

Part of subcall function 000001BF6943F284: _callnewh.LIBCMT ref: 000001BF6943F318
Part of subcall function 000001BF6943F284: _errno.LIBCMT ref: 000001BF6943F31D

free.LIBCMT ref: 000001BF694242AF
free.LIBCMT ref: 000001BF694242B7
free.LIBCMT ref: 000001BF694242BF
free.LIBCMT ref: 000001BF694242CB
free.LIBCMT ref: 000001BF694242D8

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc$AllocHeap
String ID:
API String ID: 996410232-0
Opcode ID: 6118db362e25067081320d314af47720c2282f168c26b715ed83619844a1cd4b
Instruction ID: da41047b2934ab7c10dbd8f1d2e56012e70f86fb313d39868066e8fa1fe6182a
Opcode Fuzzy Hash: 6118db362e25067081320d314af47720c2282f168c26b715ed83619844a1cd4b
Instruction Fuzzy Hash: 444198363007958BEA559A679E546EA3790F74DBC0F90C138DE464BB85DF3AD823C710

Function 000001BF693B3570 Relevance: 8.9, APIs: 7, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BF693B35BD

Part of subcall function 000001BF693CE684: _FF_MSGBANNER.LIBCMT ref: 000001BF693CE6B4
Part of subcall function 000001BF693CE684: _NMSG_WRITE.LIBCMT ref: 000001BF693CE6BE
Part of subcall function 000001BF693CE684: _callnewh.LIBCMT ref: 000001BF693CE6F2
Part of subcall function 000001BF693CE684: _errno.LIBCMT ref: 000001BF693CE6FD
Part of subcall function 000001BF693CE684: _errno.LIBCMT ref: 000001BF693CE708

malloc.LIBCMT ref: 000001BF693B35C8

Part of subcall function 000001BF693CE684: _callnewh.LIBCMT ref: 000001BF693CE718
Part of subcall function 000001BF693CE684: _errno.LIBCMT ref: 000001BF693CE71D

free.LIBCMT ref: 000001BF693B36AF
free.LIBCMT ref: 000001BF693B36B7
free.LIBCMT ref: 000001BF693B36BF
free.LIBCMT ref: 000001BF693B36CB
free.LIBCMT ref: 000001BF693B36D8

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 3866d312ddc7406d2c13ac3d10959d9d3de063b9a6b1dce899036bf231b32379
Instruction ID: 014b90f7e60799f4cd4802886fb516c116030641b4b49fe28511a70d4b4c40f1
Opcode Fuzzy Hash: 3866d312ddc7406d2c13ac3d10959d9d3de063b9a6b1dce899036bf231b32379
Instruction Fuzzy Hash: 33419D323017A197EA68DA269D923E977A8F79EB80F4480389E9647745DF34D837C700

Function 000001BF6942F274 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

htonl.WS2_32 ref: 000001BF6942F2ED
htonl.WS2_32 ref: 000001BF6942F2F7
malloc.LIBCMT ref: 000001BF6942F310
free.LIBCMT ref: 000001BF6942F37D

Strings

zyxwvutsrqponmlk, xrefs: 000001BF6942F34C

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: htonl$freemalloc
String ID: zyxwvutsrqponmlk
API String ID: 1249573706-3884694604
Opcode ID: 71d646e4bb8b7e31db9a3308653b2d67bec3fe39b167032709c668510024000a
Instruction ID: 11982aac86489f99576478f20b92462ad3282cbd0670fcc1640b2b4204a96266
Opcode Fuzzy Hash: 71d646e4bb8b7e31db9a3308653b2d67bec3fe39b167032709c668510024000a
Instruction Fuzzy Hash: 2131C23630268042EB14EA77AD513E97791EB9DBD0F84C43DAD598779BEB29C8078700

Function 000001BF69433FA4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 000001BF69433FE7
GetProcAddress.KERNEL32 ref: 000001BF69433FF7
GetLastError.KERNEL32 ref: 000001BF694340BF

Part of subcall function 000001BF6943CC00: GetCurrentProcess.KERNEL32 ref: 000001BF6943CC8D

Part of subcall function 000001BF6943D134: GetCurrentProcess.KERNEL32 ref: 000001BF6943D161

Strings

ntdll.dll, xrefs: 000001BF69433FD9
NtMapViewOfSection, xrefs: 000001BF69433FED

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: CurrentProcess$AddressErrorHandleLastModuleProc
String ID: NtMapViewOfSection$ntdll.dll
API String ID: 1006775078-3170647572
Opcode ID: 4efd516be26a68cc1ab5fab53fe02ed59a35285f2b4b3cec42098ec83d9277dd
Instruction ID: f00664000f2fe23e9803f2bdf4f413dd6db0ac10730ebed9804b25e9b8fef2e4
Opcode Fuzzy Hash: 4efd516be26a68cc1ab5fab53fe02ed59a35285f2b4b3cec42098ec83d9277dd
Instruction Fuzzy Hash: D6316D32710B5482EB109B62A8557EA77A0F78CBA4F04C23DAE6907BD6DF7DC4468700

Function 000001BF693CB630 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_time64.LIBCMT ref: 000001BF693CB654

Part of subcall function 000001BF693CF84C: _getptd.LIBCMT ref: 000001BF693CF854

malloc.LIBCMT ref: 000001BF693CB69C
strtok.LIBCMT ref: 000001BF693CB700
strtok.LIBCMT ref: 000001BF693CB711

Strings

eThreadpoolTimer, xrefs: 000001BF693CB6DA

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: strtok$_getptd_time64malloc
String ID: eThreadpoolTimer
API String ID: 1522986614-2707337283
Opcode ID: b02d7519bf37bc4b38ca8186062a8fc85f913fef5048514e0fa6af22142f2d69
Instruction ID: 2760a413c9cdc33e1425fe36c6321babcb7f39d18f017b61a037d6ee7134897a
Opcode Fuzzy Hash: b02d7519bf37bc4b38ca8186062a8fc85f913fef5048514e0fa6af22142f2d69
Instruction Fuzzy Hash: B621B672610B9481EB10DF51E89A6ED77BCF7D8B94F168229EE5A47781CB34C462C740

Function 000001BF69431FB0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BF69431FD2

Part of subcall function 000001BF6943F284: _FF_MSGBANNER.LIBCMT ref: 000001BF6943F2B4
Part of subcall function 000001BF6943F284: _NMSG_WRITE.LIBCMT ref: 000001BF6943F2BE
Part of subcall function 000001BF6943F284: HeapAlloc.KERNEL32 ref: 000001BF6943F2D9
Part of subcall function 000001BF6943F284: _callnewh.LIBCMT ref: 000001BF6943F2F2
Part of subcall function 000001BF6943F284: _errno.LIBCMT ref: 000001BF6943F2FD
Part of subcall function 000001BF6943F284: _errno.LIBCMT ref: 000001BF6943F308

_snprintf.LIBCMT ref: 000001BF69431FF1

Part of subcall function 000001BF6943F63C: _errno.LIBCMT ref: 000001BF6943F673
Part of subcall function 000001BF6943F63C: _invalid_parameter_noinfo.LIBCMT ref: 000001BF6943F67E

remove.LIBCMT ref: 000001BF69431FFD
remove.LIBCMT ref: 000001BF69432004

Strings

%s\%s, xrefs: 000001BF69431FD7

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno$remove$AllocHeap_callnewh_invalid_parameter_noinfo_snprintfmalloc
String ID: %s\%s
API String ID: 1896346573-4073750446
Opcode ID: 6cb8594f6045d264f6437138ccf0bddfe367ceba4f17556bef63a27e1bb3b346
Instruction ID: 74f75958f8a3794336c2229be34249a2a044ac25c27747abfb026aabdcd21657
Opcode Fuzzy Hash: 6cb8594f6045d264f6437138ccf0bddfe367ceba4f17556bef63a27e1bb3b346
Instruction Fuzzy Hash: D2F01D35605B5086F2109B62BC112DAB360E78CFD4F98C13DAF8957B9ACF78C4538784

Function 000001BF693C13B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BF693C13D2

Part of subcall function 000001BF693CE684: _FF_MSGBANNER.LIBCMT ref: 000001BF693CE6B4
Part of subcall function 000001BF693CE684: _NMSG_WRITE.LIBCMT ref: 000001BF693CE6BE
Part of subcall function 000001BF693CE684: _callnewh.LIBCMT ref: 000001BF693CE6F2
Part of subcall function 000001BF693CE684: _errno.LIBCMT ref: 000001BF693CE6FD
Part of subcall function 000001BF693CE684: _errno.LIBCMT ref: 000001BF693CE708

_snprintf.LIBCMT ref: 000001BF693C13F1

Part of subcall function 000001BF693CEA3C: _errno.LIBCMT ref: 000001BF693CEA73
Part of subcall function 000001BF693CEA3C: _invalid_parameter_noinfo.LIBCMT ref: 000001BF693CEA7E

remove.LIBCMT ref: 000001BF693C13FD
remove.LIBCMT ref: 000001BF693C1404

Strings

uld not open process: %d (%u), xrefs: 000001BF693C13D7

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno$remove$_callnewh_invalid_parameter_noinfo_snprintfmalloc
String ID: uld not open process: %d (%u)
API String ID: 2566950902-823969559
Opcode ID: fcd4f31b16295b3d981e03ccf995d44eb940f919008a0e94d9d9162e5faefa64
Instruction ID: d31ff93578eff3b563b69a4434a4f573d6dd62d89dadc32a9ce74fc8f18b91b0
Opcode Fuzzy Hash: fcd4f31b16295b3d981e03ccf995d44eb940f919008a0e94d9d9162e5faefa64
Instruction Fuzzy Hash: 90F01236604B90C9E2509B52BC132EAB378E7C9FD0F588139BF4917B56DF38C4624744

Function 000001BF6942CA74 Relevance: 7.8, APIs: 6, Instructions: 296COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001BF69435FEC: malloc.LIBCMT ref: 000001BF69436008

malloc.LIBCMT ref: 000001BF6942CB3B

Part of subcall function 000001BF6943F284: _FF_MSGBANNER.LIBCMT ref: 000001BF6943F2B4
Part of subcall function 000001BF6943F284: _NMSG_WRITE.LIBCMT ref: 000001BF6943F2BE
Part of subcall function 000001BF6943F284: HeapAlloc.KERNEL32 ref: 000001BF6943F2D9
Part of subcall function 000001BF6943F284: _callnewh.LIBCMT ref: 000001BF6943F2F2
Part of subcall function 000001BF6943F284: _errno.LIBCMT ref: 000001BF6943F2FD
Part of subcall function 000001BF6943F284: _errno.LIBCMT ref: 000001BF6943F308

Part of subcall function 000001BF6943C230: _time64.LIBCMT ref: 000001BF6943C254
Part of subcall function 000001BF6943C230: malloc.LIBCMT ref: 000001BF6943C29C
Part of subcall function 000001BF6943C230: strtok.LIBCMT ref: 000001BF6943C300
Part of subcall function 000001BF6943C230: strtok.LIBCMT ref: 000001BF6943C311

Part of subcall function 000001BF694334A0: _time64.LIBCMT ref: 000001BF694334AE

Part of subcall function 000001BF6943EAA8: malloc.LIBCMT ref: 000001BF6943EAF8

Part of subcall function 000001BF6943EAA8: realloc.LIBCMT ref: 000001BF6943EB07

Part of subcall function 000001BF6942F3C0: GetLocalTime.KERNEL32 ref: 000001BF6942F3DF

malloc.LIBCMT ref: 000001BF6942CC4A
_snprintf.LIBCMT ref: 000001BF6942CCC1
_snprintf.LIBCMT ref: 000001BF6942CCE7
free.LIBCMT ref: 000001BF6942CEC6

Part of subcall function 000001BF6943AD44: malloc.LIBCMT ref: 000001BF6943AD78
Part of subcall function 000001BF6943AD44: free.LIBCMT ref: 000001BF6943AF2F

Part of subcall function 000001BF69438E0C: htonl.WS2_32 ref: 000001BF69438E3D
Part of subcall function 000001BF69438E0C: htonl.WS2_32 ref: 000001BF69438E4A

_snprintf.LIBCMT ref: 000001BF6942CD0E

Part of subcall function 000001BF6943DA74: Sleep.KERNEL32 ref: 000001BF6943DABC
Part of subcall function 000001BF6943DA74: ExitThread.KERNEL32 ref: 000001BF6943DAC6

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: malloc$_snprintf$_errno_time64freehtonlstrtok$AllocExitHeapLocalSleepThreadTime_callnewhrealloc
String ID:
API String ID: 548016584-0
Opcode ID: 2bc6c26e52030706472ef6675f80d589c4fc0031a0de3ea0680d9c9adc863854
Instruction ID: 27a0603fb5eca957a4748227785bdcdf2e0a20c9aef4b39f8a14016224ea6cd3
Opcode Fuzzy Hash: 2bc6c26e52030706472ef6675f80d589c4fc0031a0de3ea0680d9c9adc863854
Instruction Fuzzy Hash: 41C1577121168142FA24EB72AE527EA3391FB8D784F84C13DAE5A4B6D7DF39C8079704

Function 000001BF693BDA8C Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 165COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 000001BF693BDB25

Part of subcall function 000001BF693CEA3C: _errno.LIBCMT ref: 000001BF693CEA73
Part of subcall function 000001BF693CEA3C: _invalid_parameter_noinfo.LIBCMT ref: 000001BF693CEA7E

Part of subcall function 000001BF693C6F38: _snprintf.LIBCMT ref: 000001BF693C70A5

_snprintf.LIBCMT ref: 000001BF693BDBBD

Part of subcall function 000001BF693C2170: strchr.LIBCMT ref: 000001BF693C21D6
Part of subcall function 000001BF693C2170: _snprintf.LIBCMT ref: 000001BF693C220C

Part of subcall function 000001BF693C200C: strchr.LIBCMT ref: 000001BF693C2069
Part of subcall function 000001BF693C200C: _snprintf.LIBCMT ref: 000001BF693C20B3

_snprintf.LIBCMT ref: 000001BF693BDBD4

Strings

rshell -nop -exec bypass -EncodedCommand "%s", xrefs: 000001BF693BDACB
/'); %s, xrefs: 000001BF693BDB19, 000001BF693BDBB2

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _snprintf$strchr$_errno_invalid_parameter_noinfo
String ID: /'); %s$rshell -nop -exec bypass -EncodedCommand "%s"
API String ID: 199363273-1250630670
Opcode ID: 6e2045361780fadf1587795c869fcd23f7db7a84374f415de51a140654aa30c6
Instruction ID: 7da57333a207487cdb2e3df4b083226942974bb663a34aefc937697a42aa7042
Opcode Fuzzy Hash: 6e2045361780fadf1587795c869fcd23f7db7a84374f415de51a140654aa30c6
Instruction Fuzzy Hash: 9671B272300B8486EB10DB51EC427EE77A9F7C9794F40803AEE9A17A98DB78C916C740

Function 000001BF694300F8 Relevance: 7.6, APIs: 5, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59c4576cc3bafda9519a74292b63c923cc8fd4fa7f2b0ae73700a3254d899919
Instruction ID: 2d909597adda9d13adb80d052485fc861e364924f18e95f205fc7914e1202d66
Opcode Fuzzy Hash: 59c4576cc3bafda9519a74292b63c923cc8fd4fa7f2b0ae73700a3254d899919
Instruction Fuzzy Hash: 79519D72B01A4196EF10EB76D8423ED7360EB59B88F85D23DEE091769AEF38C546C740

Function 000001BF6944062C Relevance: 7.6, APIs: 5, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BF69440664

Part of subcall function 000001BF69441D18: _getptd_noexit.LIBCMT ref: 000001BF69441D1C

_invalid_parameter_noinfo.LIBCMT ref: 000001BF6944066F
_flush.LIBCMT ref: 000001BF69440721
_fileno.LIBCMT ref: 000001BF69440742
_flsbuf.LIBCMT ref: 000001BF69440785

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno_fileno_flsbuf_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1640621425-0
Opcode ID: 09bfc7a718d0a166204737d50e50cc52c68c3e2e3a0cecd9edcc1235780d4021
Instruction ID: abe218549f1cad1477b9d632975c770351bfd6a12f23f3446a1b3500159981c8
Opcode Fuzzy Hash: 09bfc7a718d0a166204737d50e50cc52c68c3e2e3a0cecd9edcc1235780d4021
Instruction Fuzzy Hash: 0941C13130064046FB689A625D443DAB791FBACFE0F18C6389E564BBD9DB78C4B38B41

Function 000001BF693CFA2C Relevance: 7.6, APIs: 5, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BF693CFA64

Part of subcall function 000001BF693D1118: _getptd_noexit.LIBCMT ref: 000001BF693D111C

_invalid_parameter_noinfo.LIBCMT ref: 000001BF693CFA6F
_flush.LIBCMT ref: 000001BF693CFB21
_fileno.LIBCMT ref: 000001BF693CFB42
_flsbuf.LIBCMT ref: 000001BF693CFB85

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno_fileno_flsbuf_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1640621425-0
Opcode ID: f714c1e563aa58d873e3883a1df435710c86d18d380f096712ab5731ea4c4750
Instruction ID: f3a124369b1d13f9f79eccc9b7a0550a7e644db2f8222d58a21a15b19d3654f0
Opcode Fuzzy Hash: f714c1e563aa58d873e3883a1df435710c86d18d380f096712ab5731ea4c4750
Instruction Fuzzy Hash: E841F331300A40CAEA689A625D523E9BBE9F7CCFE0F18C2389E55477D1DB38C8679600

Function 000001BF694254F0 Relevance: 7.6, APIs: 6, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BF6942553A

Part of subcall function 000001BF6943F284: _FF_MSGBANNER.LIBCMT ref: 000001BF6943F2B4
Part of subcall function 000001BF6943F284: _NMSG_WRITE.LIBCMT ref: 000001BF6943F2BE
Part of subcall function 000001BF6943F284: HeapAlloc.KERNEL32 ref: 000001BF6943F2D9
Part of subcall function 000001BF6943F284: _callnewh.LIBCMT ref: 000001BF6943F2F2
Part of subcall function 000001BF6943F284: _errno.LIBCMT ref: 000001BF6943F2FD
Part of subcall function 000001BF6943F284: _errno.LIBCMT ref: 000001BF6943F308

malloc.LIBCMT ref: 000001BF69425545

Part of subcall function 000001BF6943F284: _callnewh.LIBCMT ref: 000001BF6943F318
Part of subcall function 000001BF6943F284: _errno.LIBCMT ref: 000001BF6943F31D

free.LIBCMT ref: 000001BF6942562C
free.LIBCMT ref: 000001BF69425634
free.LIBCMT ref: 000001BF69425640
free.LIBCMT ref: 000001BF6942564D

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc$AllocHeap
String ID:
API String ID: 996410232-0
Opcode ID: de79741046cbe64d3bb630df06faae11b500053710235a4762571f6057312210
Instruction ID: 7cd2367cd68ef3814f7ef99f381f138bffc0ed26ddf9ca1bb4ca4c218984721a
Opcode Fuzzy Hash: de79741046cbe64d3bb630df06faae11b500053710235a4762571f6057312210
Instruction Fuzzy Hash: CB418A3220578986EB159B266D006EA7B95F799B88F59C038DD49CB74AEF3AC807C300

Function 000001BF693B48F0 Relevance: 7.6, APIs: 6, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BF693B493A

Part of subcall function 000001BF693CE684: _FF_MSGBANNER.LIBCMT ref: 000001BF693CE6B4
Part of subcall function 000001BF693CE684: _NMSG_WRITE.LIBCMT ref: 000001BF693CE6BE
Part of subcall function 000001BF693CE684: _callnewh.LIBCMT ref: 000001BF693CE6F2
Part of subcall function 000001BF693CE684: _errno.LIBCMT ref: 000001BF693CE6FD
Part of subcall function 000001BF693CE684: _errno.LIBCMT ref: 000001BF693CE708

malloc.LIBCMT ref: 000001BF693B4945

Part of subcall function 000001BF693CE684: _callnewh.LIBCMT ref: 000001BF693CE718
Part of subcall function 000001BF693CE684: _errno.LIBCMT ref: 000001BF693CE71D

free.LIBCMT ref: 000001BF693B4A2C
free.LIBCMT ref: 000001BF693B4A34
free.LIBCMT ref: 000001BF693B4A40
free.LIBCMT ref: 000001BF693B4A4D

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 326b315c93b4297f8d1cd44fbd3c536e1a3741d65750285d3f659b19031d268f
Instruction ID: 8f690eaf5666f0de03fdd8ee8cc723f9b4684e4d4abd4c50ec47e9cda7294736
Opcode Fuzzy Hash: 326b315c93b4297f8d1cd44fbd3c536e1a3741d65750285d3f659b19031d268f
Instruction Fuzzy Hash: AF41C33231478582EA15DB265C463E977ACF7EAB88F098038DD9587745EF38C827C309

Function 000001BF69432D70 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 94stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001BF694331F4: strchr.LIBCMT ref: 000001BF6943322E
Part of subcall function 000001BF694331F4: strchr.LIBCMT ref: 000001BF6943324C
Part of subcall function 000001BF694331F4: malloc.LIBCMT ref: 000001BF69433264
Part of subcall function 000001BF694331F4: malloc.LIBCMT ref: 000001BF69433271
Part of subcall function 000001BF694331F4: rand.LIBCMT ref: 000001BF6943333D

strchr.LIBCMT ref: 000001BF69432DD6
_snprintf.LIBCMT ref: 000001BF69432E0C

Part of subcall function 000001BF6943F63C: _errno.LIBCMT ref: 000001BF6943F673
Part of subcall function 000001BF6943F63C: _invalid_parameter_noinfo.LIBCMT ref: 000001BF6943F67E

_snprintf.LIBCMT ref: 000001BF69432E23

Strings

?%s, xrefs: 000001BF69432E05
%s&%s, xrefs: 000001BF69432E1C

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: strchr$_snprintfmalloc$_errno_invalid_parameter_noinforand
String ID: %s&%s$?%s
API String ID: 1095232423-1750478248
Opcode ID: 7c8d9433ae2b1aa8ac26fc6f099732b3782b91ff34ed5625b9a0d50b015d32b5
Instruction ID: 5fe70dd3eefa5e4076d23563f10a084fa7417b4026bb35e2a0c2b17b3668d999
Opcode Fuzzy Hash: 7c8d9433ae2b1aa8ac26fc6f099732b3782b91ff34ed5625b9a0d50b015d32b5
Instruction Fuzzy Hash: AA417072204E8091FA159F2AD5462ECB3A0FF9CB95F08D52ADF4957B61EF34D1A39340

Function 000001BF6944AC98 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001BF6944ACFA
_isleadbyte_l.LIBCMT ref: 000001BF6944AD2A
MultiByteToWideChar.KERNEL32 ref: 000001BF6944AD69
MultiByteToWideChar.KERNEL32 ref: 000001BF6944ADB7
_errno.LIBCMT ref: 000001BF6944ADC1

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::__errno_isleadbyte_l
String ID:
API String ID: 2998201375-0
Opcode ID: bc69b486777a6b9bad5038bbf0975aad08e47f38b0eed12a125a0790956d64d5
Instruction ID: 64089eb2b3eb6c26514c561327f785273ff90d8a9053afb21810ec76bf98a052
Opcode Fuzzy Hash: bc69b486777a6b9bad5038bbf0975aad08e47f38b0eed12a125a0790956d64d5
Instruction Fuzzy Hash: 2741747221478086E7608F159D507E97BA6FB4DFA5F14C139EF8957B99DB34C8428700

Function 000001BF693BF064 Relevance: 7.6, APIs: 5, Instructions: 58fileCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BF693BF085

Part of subcall function 000001BF693CE684: _FF_MSGBANNER.LIBCMT ref: 000001BF693CE6B4
Part of subcall function 000001BF693CE684: _NMSG_WRITE.LIBCMT ref: 000001BF693CE6BE
Part of subcall function 000001BF693CE684: _callnewh.LIBCMT ref: 000001BF693CE6F2
Part of subcall function 000001BF693CE684: _errno.LIBCMT ref: 000001BF693CE6FD
Part of subcall function 000001BF693CE684: _errno.LIBCMT ref: 000001BF693CE708

free.LIBCMT ref: 000001BF693BF0C0
fwrite.LIBCMT ref: 000001BF693BF101
fclose.LIBCMT ref: 000001BF693BF109
free.LIBCMT ref: 000001BF693BF116

Part of subcall function 000001BF693CE644: _errno.LIBCMT ref: 000001BF693CE664

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno$free$_callnewhfclosefwritemalloc
String ID:
API String ID: 1696598829-0
Opcode ID: 1bdd5497ac55f9ceee01cd46502ea43f72165348b95f2b256c95d8f9a827a5ec
Instruction ID: 870a7ad041d90ccbe5d8171cb5e3eeaecd606098c67eba48928f684e72cad234
Opcode Fuzzy Hash: 1bdd5497ac55f9ceee01cd46502ea43f72165348b95f2b256c95d8f9a827a5ec
Instruction Fuzzy Hash: 89116375708A4081EA10F652A8133EA73A9E7D9BD4F448139AE9A4B7CADF2CC5268740

Function 000001BF6944A5EC Relevance: 7.5, APIs: 5, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BF6944A5FD

Part of subcall function 000001BF69441D18: _getptd_noexit.LIBCMT ref: 000001BF69441D1C

__doserrno.LIBCMT ref: 000001BF6944A5F5

Part of subcall function 000001BF69441CA8: _getptd_noexit.LIBCMT ref: 000001BF69441CAC

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 7de39b626677fa29025c8f4af27b0a540db68e2d6824cc23474586602198323a
Instruction ID: 9a0c1cb48561804dcdc3a71b37edde122b71e7492686a998c2a0ef77d8e4a322
Opcode Fuzzy Hash: 7de39b626677fa29025c8f4af27b0a540db68e2d6824cc23474586602198323a
Instruction Fuzzy Hash: 7F0169B261060485EB096B24CC913EC33A1DF68F72FA1C33DDD290A3DADB2844638711

Function 000001BF693D99EC Relevance: 7.5, APIs: 5, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BF693D99FD

Part of subcall function 000001BF693D1118: _getptd_noexit.LIBCMT ref: 000001BF693D111C

__doserrno.LIBCMT ref: 000001BF693D99F5

Part of subcall function 000001BF693D10A8: _getptd_noexit.LIBCMT ref: 000001BF693D10AC

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 02e55afb5f5e5304a095475b8354770d2627f5ba6f47f1d288df05a1981eaf7d
Instruction ID: 0ee5a95e24aab83ab643ab4309eacaa7b2c9d04981fdeeb89816eccac9e26b6e
Opcode Fuzzy Hash: 02e55afb5f5e5304a095475b8354770d2627f5ba6f47f1d288df05a1981eaf7d
Instruction Fuzzy Hash: E7014B7671264445FA092FE48C733EC7355DBD9B22F91E329DD29072D2C728446A8212

Function 000001BF6942D83C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 135COMMONLIBRARYCODE

Download Yara Rule

Strings

%s!%s, xrefs: 000001BF6942D9EB

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID: %s!%s
API String ID: 0-2935588013
Opcode ID: 2575759d0ae14333fa4d595125301f6413fce9519f9dbc799c601f61bbf3305b
Instruction ID: 16f0fa3403a65476252514811fc76e26704b3032edeed77b44eff8cafe654e6e
Opcode Fuzzy Hash: 2575759d0ae14333fa4d595125301f6413fce9519f9dbc799c601f61bbf3305b
Instruction Fuzzy Hash: A2515A7620464086EB649F62D9407E973A1FB8CB94F44C13BEF8A47789EB3AC943C704

Function 000001BF693C5228 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 116stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001BF693C53EC: malloc.LIBCMT ref: 000001BF693C5408

strrchr.LIBCMT ref: 000001BF693C52ED
_snprintf.LIBCMT ref: 000001BF693C539B

Strings

Failed to impersonate token: %d, xrefs: 000001BF693C5358
t permissions in process: %d, xrefs: 000001BF693C5345, 000001BF693C5366

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _snprintfmallocstrrchr
String ID: Failed to impersonate token: %d$t permissions in process: %d
API String ID: 3587327836-1492073275
Opcode ID: d69273eeb4579e6a96eb8d0c87a60564a21875d7210b55cf29d23a145d20b21e
Instruction ID: 1ace1dfe25f87093643a2f3eb440a6e8cf8d127a70b5f0136e5a61e17785f9c2
Opcode Fuzzy Hash: d69273eeb4579e6a96eb8d0c87a60564a21875d7210b55cf29d23a145d20b21e
Instruction Fuzzy Hash: 41418E3470464086EB04EB62AC163EA77A9F7CEBD4F448139AD5A8779ACF7CC4638704

Function 000001BF69432818 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93sleeppipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNEL32 ref: 000001BF694328A3
GetStartupInfoA.KERNEL32 ref: 000001BF694328AD
Sleep.KERNEL32 ref: 000001BF694328F4

Part of subcall function 000001BF694348D8: GetTickCount.KERNEL32 ref: 000001BF694348F1
Part of subcall function 000001BF694348D8: GetTickCount.KERNEL32 ref: 000001BF69434932

Strings

h, xrefs: 000001BF6943284D

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: CountTick$CreateInfoPipeSleepStartup
String ID: h
API String ID: 1809008225-2439710439
Opcode ID: 4e35baa7647db691c7f670eac516f3e1fc872cfd04f6cc2549e4bc2b31640604
Instruction ID: 72124fc65da2d79a9b4e3811869d7a8409533b5fee3e042ea88ac2bb6a84e4a5
Opcode Fuzzy Hash: 4e35baa7647db691c7f670eac516f3e1fc872cfd04f6cc2549e4bc2b31640604
Instruction Fuzzy Hash: 15414A32604B849AE710CF65E8406DEB7B5F788798F508129EF9C53BA8EF78D546CB40

Function 000001BF6943E1D8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32 ref: 000001BF6943E26D
LookupAccountSidA.ADVAPI32 ref: 000001BF6943E2B2
_snprintf.LIBCMT ref: 000001BF6943E2DA

Strings

%s\%s, xrefs: 000001BF6943E2C8

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: AccountInformationLookupToken_snprintf
String ID: %s\%s
API String ID: 2107350476-4073750446
Opcode ID: 3628ba452fb9f12347beb94bf517dfb845e986fa94d428b7ed87531c0f30446e
Instruction ID: 20ecf87742582e9a7d92021cd913fee4a5bf90822c2ed1c568dea2e8b0907583
Opcode Fuzzy Hash: 3628ba452fb9f12347beb94bf517dfb845e986fa94d428b7ed87531c0f30446e
Instruction Fuzzy Hash: C4311E32205FC196EB24CF62E8446DA73A4F788B88F44C12AEE8957B59DF38C606C740

Function 000001BF69434224 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 000001BF6943424E
GetProcAddress.KERNEL32 ref: 000001BF6943425E

Strings

ntdll.dll, xrefs: 000001BF6943423B
RtlCreateUserThread, xrefs: 000001BF69434254

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: RtlCreateUserThread$ntdll.dll
API String ID: 1646373207-2935400652
Opcode ID: ec9d2d620c63392f70290ebc437f8ca1b743032b52a150f3fdfac3901f9a5ced
Instruction ID: ddbc24021e8075a4adc6769210fb203163cc43f9e1f1c1594959474edd9f50ee
Opcode Fuzzy Hash: ec9d2d620c63392f70290ebc437f8ca1b743032b52a150f3fdfac3901f9a5ced
Instruction Fuzzy Hash: 98110C32214B5082D720CF52F884589B7A4F799BD0F99813AEE9D43B14DF38C556C700

Function 000001BF69433C0C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 000001BF69433C30
GetProcAddress.KERNEL32 ref: 000001BF69433C40

Strings

NtQueueApcThread, xrefs: 000001BF69433C36
ntdll, xrefs: 000001BF69433C23

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: NtQueueApcThread$ntdll
API String ID: 1646373207-1374908105
Opcode ID: 2536bb9452705a2f6e7169ceafa1b416df13a56cc0cf1ef56e7307e0eec9c158
Instruction ID: 63e85393be8b0d15d1710067e13e0b31bf0475fdd9d11287e9f67a078d5004b6
Opcode Fuzzy Hash: 2536bb9452705a2f6e7169ceafa1b416df13a56cc0cf1ef56e7307e0eec9c158
Instruction Fuzzy Hash: 67018F36200B4182EB108BA2FC502DAB3A0E799BD0F94C63ADE5843B58DF38C4538700

Function 000001BF69430C64 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 000001BF69430C79
GetProcAddress.KERNEL32 ref: 000001BF69430C89

Strings

kernel32, xrefs: 000001BF69430C72
IsWow64Process, xrefs: 000001BF69430C7F

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: IsWow64Process$kernel32
API String ID: 1646373207-3789238822
Opcode ID: ec429c199b0f6375f9f9bb3acfabef0345e96e1c9904636b59857b424156df6f
Instruction ID: 90d7dcec80a89b3912de205915695c4bc2e8866e77313b52c60556e290ace00c
Opcode Fuzzy Hash: ec429c199b0f6375f9f9bb3acfabef0345e96e1c9904636b59857b424156df6f
Instruction Fuzzy Hash: 88E01A7172160182EE58CBA6EC947E57760EB9C7A1F48D03A9D4B46264EF28C59BC700

Function 000001BF694320E4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 000001BF694320F4
GetProcAddress.KERNEL32 ref: 000001BF69432104

Strings

kernel32, xrefs: 000001BF694320ED
Wow64RevertWow64FsRedirection, xrefs: 000001BF694320FA

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64RevertWow64FsRedirection$kernel32
API String ID: 1646373207-3900151262
Opcode ID: 319746fa707029ab9a73eb8f742d9554a97dfc1dcddc658422bf1e3b845b0c79
Instruction ID: 3c910bf9d48998b3b5705f1c61c33e88d3edf1e1cc61f98f1ac1366f21c43f3c
Opcode Fuzzy Hash: 319746fa707029ab9a73eb8f742d9554a97dfc1dcddc658422bf1e3b845b0c79
Instruction Fuzzy Hash: 90D09E7075160681FE199BE2BC556E47350EB5EB51F48D03E8D1A06360EF2CC59BC350

Function 000001BF694320AC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 000001BF694320BC
GetProcAddress.KERNEL32 ref: 000001BF694320CC

Strings

Wow64DisableWow64FsRedirection, xrefs: 000001BF694320C2
kernel32, xrefs: 000001BF694320B5

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$kernel32
API String ID: 1646373207-736604160
Opcode ID: ee7ac246b15703f1bae1af517107d06ce80ae1fd60a4afa284d23f3dc5206b46
Instruction ID: 4e63e7b5e8ee9a8e1e11a04db7b8d8cbd4391d36e10d4d802e569752577d155d
Opcode Fuzzy Hash: ee7ac246b15703f1bae1af517107d06ce80ae1fd60a4afa284d23f3dc5206b46
Instruction Fuzzy Hash: F2D0676075160692EE159BE2AC546E47360EB5DB51F48D03A8D1A06364EF28859B8354

Function 000001BF6943BFC0 Relevance: 6.1, APIs: 4, Instructions: 140COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dde0bc93da3cc204cab392ef88660b8feabc790641522e6986fd432b01f6e40
Instruction ID: 91d6c3fac68563ff8f73c61203944b8a736837bc6306888f84fef7e807e33619
Opcode Fuzzy Hash: 1dde0bc93da3cc204cab392ef88660b8feabc790641522e6986fd432b01f6e40
Instruction Fuzzy Hash: B1614CB6641640C6EB648F26AC593E833E0E75CB5AF24C53EDE254B3A5CB39C4539B80

Function 000001BF693CB3C0 Relevance: 6.1, APIs: 4, Instructions: 140COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dde0bc93da3cc204cab392ef88660b8feabc790641522e6986fd432b01f6e40
Instruction ID: 35abcfc101198a894b9d3e386042d3a95f8a6cf435c45337811c7ec177a256c7
Opcode Fuzzy Hash: 1dde0bc93da3cc204cab392ef88660b8feabc790641522e6986fd432b01f6e40
Instruction Fuzzy Hash: 7C613976641A40CAEB148F19AD577E933B8E79CB95F25813EDE054B3A1CB38D463CB40

Function 000001BF693C2170 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 94stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001BF693C25F4: strchr.LIBCMT ref: 000001BF693C262E
Part of subcall function 000001BF693C25F4: strchr.LIBCMT ref: 000001BF693C264C
Part of subcall function 000001BF693C25F4: malloc.LIBCMT ref: 000001BF693C2664
Part of subcall function 000001BF693C25F4: malloc.LIBCMT ref: 000001BF693C2671
Part of subcall function 000001BF693C25F4: rand.LIBCMT ref: 000001BF693C273D

strchr.LIBCMT ref: 000001BF693C21D6
_snprintf.LIBCMT ref: 000001BF693C220C

Part of subcall function 000001BF693CEA3C: _errno.LIBCMT ref: 000001BF693CEA73
Part of subcall function 000001BF693CEA3C: _invalid_parameter_noinfo.LIBCMT ref: 000001BF693CEA7E

_snprintf.LIBCMT ref: 000001BF693C2223

Strings

not create token: %d, xrefs: 000001BF693C2205

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: strchr$_snprintfmalloc$_errno_invalid_parameter_noinforand
String ID: not create token: %d
API String ID: 1095232423-2272930512
Opcode ID: 9f33a31cc3dbe4d390e57a8e0463a50ad11e38a52d1dbdd6b3122e58f7288ae2
Instruction ID: 815c098a6a0ff4c066dfde4fa8a4f55fea5ce935a26120abb40f1b6b0e48a5cd
Opcode Fuzzy Hash: 9f33a31cc3dbe4d390e57a8e0463a50ad11e38a52d1dbdd6b3122e58f7288ae2
Instruction Fuzzy Hash: 46418F76210E80D1EA619B6AD5462E8B3B4FFCCB84F04A525DF4817B61DF34D5B38340

Function 000001BF69434A04 Relevance: 6.1, APIs: 4, Instructions: 80synchronizationCOMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BF69434A45

Part of subcall function 000001BF6943F284: _FF_MSGBANNER.LIBCMT ref: 000001BF6943F2B4
Part of subcall function 000001BF6943F284: _NMSG_WRITE.LIBCMT ref: 000001BF6943F2BE
Part of subcall function 000001BF6943F284: HeapAlloc.KERNEL32 ref: 000001BF6943F2D9
Part of subcall function 000001BF6943F284: _callnewh.LIBCMT ref: 000001BF6943F2F2
Part of subcall function 000001BF6943F284: _errno.LIBCMT ref: 000001BF6943F2FD
Part of subcall function 000001BF6943F284: _errno.LIBCMT ref: 000001BF6943F308

htonl.WS2_32 ref: 000001BF69434A5B

Part of subcall function 000001BF69434C44: PeekNamedPipe.KERNEL32 ref: 000001BF69434C7C

WaitForSingleObject.KERNEL32 ref: 000001BF69434AB6
free.LIBCMT ref: 000001BF69434AF2

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno$AllocHeapNamedObjectPeekPipeSingleWait_callnewhfreehtonlmalloc
String ID:
API String ID: 2495333179-0
Opcode ID: 92903f8e34bb86019301daba1a442a9bec2b61465fa0227abaf91983d09bc4f7
Instruction ID: f5242fb1a882ef146741a3b12d372d46c4c0aca72d7926d8acc2e830eab65895
Opcode Fuzzy Hash: 92903f8e34bb86019301daba1a442a9bec2b61465fa0227abaf91983d09bc4f7
Instruction Fuzzy Hash: 8531BC3621064081EB64EF73A9802E973A4FB8CBD8F49C62DDE444B699DB39C883C744

Function 000001BF6943C230 Relevance: 6.1, APIs: 4, Instructions: 70stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_time64.LIBCMT ref: 000001BF6943C254

Part of subcall function 000001BF6944145C: GetSystemTimeAsFileTime.KERNEL32 ref: 000001BF6944146A

Part of subcall function 000001BF6944044C: _getptd.LIBCMT ref: 000001BF69440454

malloc.LIBCMT ref: 000001BF6943C29C
strtok.LIBCMT ref: 000001BF6943C300
strtok.LIBCMT ref: 000001BF6943C311

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: Timestrtok$FileSystem_getptd_time64malloc
String ID:
API String ID: 460628555-0
Opcode ID: 2fe16f1730b9e72f7102dc70ee842add604a2edc5f5efba699c173ab423aa684
Instruction ID: 92649f733e476944e70f83a54e87e5cf756e1c3382f1bd25a5e5f285f0fad908
Opcode Fuzzy Hash: 2fe16f1730b9e72f7102dc70ee842add604a2edc5f5efba699c173ab423aa684
Instruction Fuzzy Hash: 3E21B4B6A107A481EB00CFA3A4846ED37A8F75CF95F16C26DEF5A43786DB34C4528780

Function 000001BF6944F5D8 Relevance: 6.1, APIs: 4, Instructions: 62stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001BF6944F5FC

Part of subcall function 000001BF69441600: _getptd.LIBCMT ref: 000001BF69441616
Part of subcall function 000001BF69441600: __updatetlocinfo.LIBCMT ref: 000001BF6944164B
Part of subcall function 000001BF69441600: __updatetmbcinfo.LIBCMT ref: 000001BF69441672

_errno.LIBCMT ref: 000001BF6944F608

Part of subcall function 000001BF69441D18: _getptd_noexit.LIBCMT ref: 000001BF69441D1C

_invalid_parameter_noinfo.LIBCMT ref: 000001BF6944F613
strchr.LIBCMT ref: 000001BF6944F629

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: 981429a1da204f704ed88d261ee2d43387d2cfac4902a0026a6358d448239ec3
Instruction ID: 2d08bd0d5f5a414775e82f86dca8e351323de9964297c87020bb3a91c53e22ee
Opcode Fuzzy Hash: 981429a1da204f704ed88d261ee2d43387d2cfac4902a0026a6358d448239ec3
Instruction Fuzzy Hash: 5021D27220A6A041FB60472598503FEB7D0E38CFD4F18C179AE964FAEDCB28C443AB10

Function 000001BF694210D0 Relevance: 6.1, APIs: 4, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

clock.LIBCMT ref: 000001BF69421117
clock.LIBCMT ref: 000001BF69421124
clock.LIBCMT ref: 000001BF6942112D
clock.LIBCMT ref: 000001BF6942113A

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: 88d80a52c757cc5c40c2c6d70a970e4954adb33c3b78b443ec03df4506b3ea8d
Instruction ID: 2b9d343f0bccaa3edf89366e814724f8c5ae1b87dca1061189c837c0b69d8520
Opcode Fuzzy Hash: 88d80a52c757cc5c40c2c6d70a970e4954adb33c3b78b443ec03df4506b3ea8d
Instruction Fuzzy Hash: F011E33250474445E7B0DE666D81AFBF790F78C790F19C139EE844368AEB76C8838700

Function 000001BF693B04D0 Relevance: 6.1, APIs: 4, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

clock.LIBCMT ref: 000001BF693B0517
clock.LIBCMT ref: 000001BF693B0524
clock.LIBCMT ref: 000001BF693B052D
clock.LIBCMT ref: 000001BF693B053A

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: 88d80a52c757cc5c40c2c6d70a970e4954adb33c3b78b443ec03df4506b3ea8d
Instruction ID: cf0ebe07dd681bbb595eb7a43ce71d86f720f7c0e9444dba4214969054b83f47
Opcode Fuzzy Hash: 88d80a52c757cc5c40c2c6d70a970e4954adb33c3b78b443ec03df4506b3ea8d
Instruction Fuzzy Hash: E711B63260874485E7709EA66D822EAF798F7DD390F15913AEE8503A4DEB74C8578640

Function 000001BF693DE9D8 Relevance: 6.1, APIs: 4, Instructions: 62stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000001BF693DE9FC

Part of subcall function 000001BF693D0A00: _getptd.LIBCMT ref: 000001BF693D0A16
Part of subcall function 000001BF693D0A00: __updatetlocinfo.LIBCMT ref: 000001BF693D0A4B
Part of subcall function 000001BF693D0A00: __updatetmbcinfo.LIBCMT ref: 000001BF693D0A72

_errno.LIBCMT ref: 000001BF693DEA08

Part of subcall function 000001BF693D1118: _getptd_noexit.LIBCMT ref: 000001BF693D111C

_invalid_parameter_noinfo.LIBCMT ref: 000001BF693DEA13
strchr.LIBCMT ref: 000001BF693DEA29

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: 89153f5c64fab27db57a2af5758249aa045b2e8adbb4ff24b9161b74b74b034e
Instruction ID: a627872f98d429f061247e2f699f4a682ab881f06cdbaa816e8212a9f31b087a
Opcode Fuzzy Hash: 89153f5c64fab27db57a2af5758249aa045b2e8adbb4ff24b9161b74b74b034e
Instruction Fuzzy Hash: 5621F5321043A141FA70569198623FDFB94F3C8BD4F18E239AE9706A95CB28C46B9612

Function 000001BF6943EF5C Relevance: 6.0, APIs: 4, Instructions: 39networkCOMMON

Download Yara Rule

APIs

accept.WS2_32 ref: 000001BF6943EF71
send.WS2_32 ref: 000001BF6943EFAF
send.WS2_32 ref: 000001BF6943EFC3
closesocket.WS2_32 ref: 000001BF6943EFD4

Part of subcall function 000001BF6943F098: closesocket.WS2_32 ref: 000001BF6943F0A4
Part of subcall function 000001BF6943F098: free.LIBCMT ref: 000001BF6943F0AE
Part of subcall function 000001BF6943F098: free.LIBCMT ref: 000001BF6943F0B7
Part of subcall function 000001BF6943F098: free.LIBCMT ref: 000001BF6943F0C0

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: free$closesocketsend$accept
String ID:
API String ID: 47150829-0
Opcode ID: caadc6cbf8b8aa9901aecb44ddbc265dbb6e74dc9ec5a2b89a727a9022558361
Instruction ID: f34f13a36ec2a8de79e8504ca10c3a80ded83b83aa28f7f966800e1cb0925b4a
Opcode Fuzzy Hash: caadc6cbf8b8aa9901aecb44ddbc265dbb6e74dc9ec5a2b89a727a9022558361
Instruction Fuzzy Hash: 16014C7530494082EB549B77AEA57FA3361E78DFE4F14D22ADE2607B95CF28C4838B40

Function 000001BF694353EC Relevance: 6.0, APIs: 4, Instructions: 34sleeppipeCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 000001BF69435400
PeekNamedPipe.KERNEL32 ref: 000001BF69435425
Sleep.KERNEL32 ref: 000001BF6943543B
GetTickCount.KERNEL32 ref: 000001BF69435441

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: CountTick$NamedPeekPipeSleep
String ID:
API String ID: 1593283408-0
Opcode ID: 210e21c30d6d06447862c16b29a5b20d0c0fb279467bc43041b9c33569e9406a
Instruction ID: bc527caa0ad2d839775c90161a04f12830bff0273e646e5c07a7fcb3811f0ecc
Opcode Fuzzy Hash: 210e21c30d6d06447862c16b29a5b20d0c0fb279467bc43041b9c33569e9406a
Instruction Fuzzy Hash: F5016231618A5082F7248776FC443DAB3A1E79C785F64C539EE4D82A64DF38C483C705

Function 000001BF694376F0 Relevance: 6.0, APIs: 4, Instructions: 32memorythreadCOMMON

Download Yara Rule

APIs

InitializeProcThreadAttributeList.KERNEL32 ref: 000001BF6943770E
GetProcessHeap.KERNEL32 ref: 000001BF69437714
HeapAlloc.KERNEL32 ref: 000001BF69437724
InitializeProcThreadAttributeList.KERNEL32 ref: 000001BF6943773F

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: AttributeHeapInitializeListProcThread$AllocProcess
String ID:
API String ID: 1212816094-0
Opcode ID: 092ee1049558447ca0759a62b312a2f8f202331ccdb130be8b8fda5f5e098b35
Instruction ID: 7c7ce5394f061e3cafeda7d4220ee67b6b0a56729a1660aa7174672364f9c038
Opcode Fuzzy Hash: 092ee1049558447ca0759a62b312a2f8f202331ccdb130be8b8fda5f5e098b35
Instruction Fuzzy Hash: 1AF0623672464482EB548B76AC507DA73E0EB8CB90F68D43EAE4B82754DF39C4478A00

Function 000001BF694348D8 Relevance: 6.0, APIs: 4, Instructions: 32sleeppipeCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 000001BF694348F1
PeekNamedPipe.KERNEL32 ref: 000001BF69434916
Sleep.KERNEL32 ref: 000001BF6943492C
GetTickCount.KERNEL32 ref: 000001BF69434932

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: CountTick$NamedPeekPipeSleep
String ID:
API String ID: 1593283408-0
Opcode ID: aac62254f3a365505a6a564a1f05aa253f383d98e2b7473c1e2f14b721fad9df
Instruction ID: 83137080631b04d3284e0a6bf5d1e5fc2a3175756fc71f03d40ee4b577e4260f
Opcode Fuzzy Hash: aac62254f3a365505a6a564a1f05aa253f383d98e2b7473c1e2f14b721fad9df
Instruction Fuzzy Hash: 3D016D32614A5182F7208B66FC443DAB7A1EB89BD4F64C139EF8543A74DF39C8838B04

Function 000001BF6943F098 Relevance: 6.0, APIs: 4, Instructions: 15COMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 000001BF6943F0A4
free.LIBCMT ref: 000001BF6943F0AE

Part of subcall function 000001BF6943F244: HeapFree.KERNEL32 ref: 000001BF6943F25A
Part of subcall function 000001BF6943F244: _errno.LIBCMT ref: 000001BF6943F264
Part of subcall function 000001BF6943F244: GetLastError.KERNEL32 ref: 000001BF6943F26C

free.LIBCMT ref: 000001BF6943F0B7
free.LIBCMT ref: 000001BF6943F0C0

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: free$ErrorFreeHeapLast_errnoclosesocket
String ID:
API String ID: 1525665891-0
Opcode ID: 514671407b84a75ab4a957943dd5047acaa779434bbb8d29509bbfd64e64c7a5
Instruction ID: 4fade978b0367cff8f75fde23f7f273711308b6375e6be7024547ea1d022c730
Opcode Fuzzy Hash: 514671407b84a75ab4a957943dd5047acaa779434bbb8d29509bbfd64e64c7a5
Instruction Fuzzy Hash: 95E04276611444C1FA18EBB3DCA65E82320E79CF94F64C07A9E1E4A2A68F65C896A344

Function 000001BF6943F860 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BF6943F8B1

Part of subcall function 000001BF69441D18: _getptd_noexit.LIBCMT ref: 000001BF69441D1C

_invalid_parameter_noinfo.LIBCMT ref: 000001BF6943F8BC

Strings

B, xrefs: 000001BF6943F8E8

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: c02d2d703cad3fde31994e70e132d1470a84cf0b2fdde3fa0011d2dc5e3ae6ea
Instruction ID: 9a92dac961a3e729450b03379c72cf7fcc35b73791625eb8a7498869cac4b782
Opcode Fuzzy Hash: c02d2d703cad3fde31994e70e132d1470a84cf0b2fdde3fa0011d2dc5e3ae6ea
Instruction Fuzzy Hash: 11117072610A4085EB149B12E9403D9B760F79CFE4F64C329AF5807B99CF38C146CB00

Function 000001BF693CEC60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001BF693CECB1

Part of subcall function 000001BF693D1118: _getptd_noexit.LIBCMT ref: 000001BF693D111C

_invalid_parameter_noinfo.LIBCMT ref: 000001BF693CECBC

Strings

B, xrefs: 000001BF693CECE8

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: 60c63a2ab9f2c694e46ab874add7d0a6eb48e0963f6941f66a4f1d1620c6c169
Instruction ID: 8151ea45a0655398b0e54239d4b00de05470eee1022c83aab404659e19997e9a
Opcode Fuzzy Hash: 60c63a2ab9f2c694e46ab874add7d0a6eb48e0963f6941f66a4f1d1620c6c169
Instruction Fuzzy Hash: A7118EB2610B5086EB209B52D8423EDB765F798FE4F948328AF5807B95CF38C656CB00

Function 000001BF69421CC4 Relevance: 5.3, APIs: 4, Instructions: 261COMMONLIBRARYCODE

Download Yara Rule

APIs

calloc.LIBCMT ref: 000001BF69421D6A

Part of subcall function 000001BF6944EE08: _calloc_impl.LIBCMT ref: 000001BF6944EE18
Part of subcall function 000001BF6944EE08: _errno.LIBCMT ref: 000001BF6944EE2B
Part of subcall function 000001BF6944EE08: _errno.LIBCMT ref: 000001BF6944EE35

free.LIBCMT ref: 000001BF69421EF3
free.LIBCMT ref: 000001BF69421EFD
free.LIBCMT ref: 000001BF69421F0F

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: free$_errno$_calloc_implcalloc
String ID:
API String ID: 4000150058-0
Opcode ID: 098b9973f943fd418b7180529354ef0ede5274538db457ffc537a6b083c63ad8
Instruction ID: 6af84b5124cc468b476931eb1b4569d0e9458a247c4011e3010f537b48346f9f
Opcode Fuzzy Hash: 098b9973f943fd418b7180529354ef0ede5274538db457ffc537a6b083c63ad8
Instruction Fuzzy Hash: 32C1D836614B848AE764CF65E8807DE77A4F78CB88F50812AEF8D47B58DB79C456CB00

Function 000001BF693B10C4 Relevance: 5.3, APIs: 4, Instructions: 261COMMONLIBRARYCODE

Download Yara Rule

APIs

calloc.LIBCMT ref: 000001BF693B116A

Part of subcall function 000001BF693DE208: _calloc_impl.LIBCMT ref: 000001BF693DE218
Part of subcall function 000001BF693DE208: _errno.LIBCMT ref: 000001BF693DE22B
Part of subcall function 000001BF693DE208: _errno.LIBCMT ref: 000001BF693DE235

free.LIBCMT ref: 000001BF693B12F3
free.LIBCMT ref: 000001BF693B12FD
free.LIBCMT ref: 000001BF693B130F

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: free$_errno$_calloc_implcalloc
String ID:
API String ID: 4000150058-0
Opcode ID: 1990de878bdb2b18b214190b8058df6cf8cdb58ae8a7ad838a221dc59059176c
Instruction ID: 3de38c44820008db13560419f3c43141cfbcf0264ba84ab808053c36c535ee44
Opcode Fuzzy Hash: 1990de878bdb2b18b214190b8058df6cf8cdb58ae8a7ad838a221dc59059176c
Instruction Fuzzy Hash: A7C1FA32604B848AE764CF55E8853DE77B8F799784F10812AEE8D47B58DF38C465CB00

Function 000001BF6943AD44 Relevance: 5.2, APIs: 4, Instructions: 155COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BF6943AD78

Part of subcall function 000001BF6943F284: _FF_MSGBANNER.LIBCMT ref: 000001BF6943F2B4
Part of subcall function 000001BF6943F284: _NMSG_WRITE.LIBCMT ref: 000001BF6943F2BE
Part of subcall function 000001BF6943F284: HeapAlloc.KERNEL32 ref: 000001BF6943F2D9
Part of subcall function 000001BF6943F284: _callnewh.LIBCMT ref: 000001BF6943F2F2
Part of subcall function 000001BF6943F284: _errno.LIBCMT ref: 000001BF6943F2FD
Part of subcall function 000001BF6943F284: _errno.LIBCMT ref: 000001BF6943F308

free.LIBCMT ref: 000001BF6943AEBF
free.LIBCMT ref: 000001BF6943AF23
free.LIBCMT ref: 000001BF6943AF2F

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: free$_errno$AllocHeap_callnewhmalloc
String ID:
API String ID: 3531731211-0
Opcode ID: 12a82f6075b3f1b1b37aa8f48911ccb92805a6f06572296fb4e409a8028c0c4a
Instruction ID: 3b171fc2bf3be292dbfbee49b5d5cba4b95b4868fbe2978b3bb822aee9d00f6c
Opcode Fuzzy Hash: 12a82f6075b3f1b1b37aa8f48911ccb92805a6f06572296fb4e409a8028c0c4a
Instruction Fuzzy Hash: DD51AF7524064542FE28AB329C553ED7391FB8CBA0F54C43DAE1A17B9AEF7AC5138700

Function 000001BF693CA144 Relevance: 5.2, APIs: 4, Instructions: 155COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BF693CA178

Part of subcall function 000001BF693CE684: _FF_MSGBANNER.LIBCMT ref: 000001BF693CE6B4
Part of subcall function 000001BF693CE684: _NMSG_WRITE.LIBCMT ref: 000001BF693CE6BE
Part of subcall function 000001BF693CE684: _callnewh.LIBCMT ref: 000001BF693CE6F2
Part of subcall function 000001BF693CE684: _errno.LIBCMT ref: 000001BF693CE6FD
Part of subcall function 000001BF693CE684: _errno.LIBCMT ref: 000001BF693CE708

free.LIBCMT ref: 000001BF693CA2BF
free.LIBCMT ref: 000001BF693CA323
free.LIBCMT ref: 000001BF693CA32F

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 4bbd7cf35d3a9611d3bfe0cac302482741ce3a5729489c26a54f39a05b56b302
Instruction ID: 58f9aca5c2ceee33002e826e3b0b4b5fbf1fc54a201cd60b339e5401f7376b4a
Opcode Fuzzy Hash: 4bbd7cf35d3a9611d3bfe0cac302482741ce3a5729489c26a54f39a05b56b302
Instruction Fuzzy Hash: 2B51AE31200B45C1EA28AF21AD533E973A9F7C9790F54C53DEE4A97A96DB79C8238700

Function 000001BF69424300 Relevance: 5.1, APIs: 4, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BF69424363

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 1a29f9ba763a41af98fc3daf4a760b7fafa00e022ffdaa07ef0aba0b6fdaf4ad
Instruction ID: 19698b300d9010928739c7d8c570c00b3a9fee6e1149ce5d947276ce36da234d
Opcode Fuzzy Hash: 1a29f9ba763a41af98fc3daf4a760b7fafa00e022ffdaa07ef0aba0b6fdaf4ad
Instruction Fuzzy Hash: 1041713230468087EB68DB26A950AEE73A1F788BC8F54C539DE6A47785DF36D807C700

Function 000001BF693B3700 Relevance: 5.1, APIs: 4, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 000001BF693B3763

Memory Dump Source

Source File: 00000000.00000002.2230909095.000001BF693B0000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001BF693B0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf693b0000_loaddll64.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 80bcae34b50f6f3c58066c2fc9d1801100724e039a84313f03cb0366590bdd42
Instruction ID: 82361fbf6041d4e46daeffab38fae53c25d34d8ab92886a5c84ee418a478b9dc
Opcode Fuzzy Hash: 80bcae34b50f6f3c58066c2fc9d1801100724e039a84313f03cb0366590bdd42
Instruction Fuzzy Hash: CA41813260179087EB54DB2698026ED73A9F799B84F448439EE9A87749EF34DC2AC701

Function 000001BF69431038 Relevance: 5.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 000001BF69439170: GetCurrentProcess.KERNEL32 ref: 000001BF69439188

GetLastError.KERNEL32 ref: 000001BF694310A7
malloc.LIBCMT ref: 000001BF6943113C
free.LIBCMT ref: 000001BF69431185
GetLastError.KERNEL32 ref: 000001BF694311B5

Memory Dump Source

Source File: 00000000.00000002.2230970210.000001BF69420000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001BF69420000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1bf69420000_loaddll64.jbxd

Yara matches

Similarity

API ID: ErrorLast$CurrentProcessfreemalloc
String ID:
API String ID: 1397824077-0
Opcode ID: cf62d47a1d5fdb9c876962cfa4c676d021a3fa8d1c8180fd698ba2a0010a64ef
Instruction ID: 3c7997a1f00b893cc21acb90f9fb0e09aae92d6ab082b22a861be5bae93b2147
Opcode Fuzzy Hash: cf62d47a1d5fdb9c876962cfa4c676d021a3fa8d1c8180fd698ba2a0010a64ef
Instruction Fuzzy Hash: B741437231469186EB649B33E9407EF73A1EB8C788F40D43DAE8947A86EF39C5428704

Analysis Process: rundll32.exePID: 4948, Parent PID: 1912COMMON

Execution Graph

Execution Coverage:	0.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	8
Total number of Limit Nodes:	1

Executed Functions

Function 0000016E0D6E88D4 Relevance: 3.7, APIs: 2, Instructions: 671
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 0000016E0D6E8D73
LoadLibraryA.KERNELBASE ref: 0000016E0D6E8EBF

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: AllocLibraryLoadVirtual
String ID:
API String ID: 3550616410-0
Opcode ID: e5779a8fec03a52a41f730243e1c668b38c4984dd735e796280ec9111f67fa25
Instruction ID: f110608ab294e043bfe6cb1c9c9e27532a93d63795292d3bdc10431a8e07feb9
Opcode Fuzzy Hash: e5779a8fec03a52a41f730243e1c668b38c4984dd735e796280ec9111f67fa25
Instruction Fuzzy Hash: E862C177711B988EDB90CF6AD88039C37E5F748B98F108126FA4D87B68EB79C5918740

Non-executed Functions

Function 0000016E0D6F5914 Relevance: 26.7, APIs: 14, Strings: 1, Instructions: 460
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__doserrno.LIBCMT ref: 0000016E0D6F596A
_errno.LIBCMT ref: 0000016E0D6F5971
_invalid_parameter_noinfo.LIBCMT ref: 0000016E0D6F597C

Strings

U, xrefs: 0000016E0D6F5EDE

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_invalid_parameter_noinfo
String ID: U
API String ID: 3902385426-4171548499
Opcode ID: 1e306023ed328bab19b7a5d60cdebdd92491a2c212ad1309fcb9b443deab4914
Instruction ID: 41e8c0d0e95d49d570cac34cff5578a296b681018cc8acda8f82931fdf9cfcab
Opcode Fuzzy Hash: 1e306023ed328bab19b7a5d60cdebdd92491a2c212ad1309fcb9b443deab4914
Instruction Fuzzy Hash: 7012E63B324A8586EB208F28E8843DE77E1F785794F540316FA4A53A94DBBBC945CB10

Function 0000016E0D6F1B48 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 227
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

write_multi_char.LIBCMT ref: 0000016E0D6F1FEB
write_string.LIBCMT ref: 0000016E0D6F2008
write_multi_char.LIBCMT ref: 0000016E0D6F2025
write_string.LIBCMT ref: 0000016E0D6F2084
write_multi_char.LIBCMT ref: 0000016E0D6F20DD
free.LIBCMT ref: 0000016E0D6F20F1

Strings

, xrefs: 0000016E0D6F1FBF

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: write_multi_char$write_string$free
String ID:
API String ID: 2630409672-3916222277
Opcode ID: 1c8d6b8a065489df9c71b2e8ea70d157333f6dd13db57c526a3ea5ce9db962ed
Instruction ID: d11a1da60013ea27ff9360df1f8ab37d48d9c3265fd42a5774d3f9eeb4850b0d
Opcode Fuzzy Hash: 1c8d6b8a065489df9c71b2e8ea70d157333f6dd13db57c526a3ea5ce9db962ed
Instruction Fuzzy Hash: 9DA1803B728B5486FB218B55A8103EE7BE1F786794F141206FE49676D8DBBBC941CB00

Function 0000016E0D6F621C Relevance: 15.1, APIs: 10, Instructions: 81
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 0000016E0D6F624E

Part of subcall function 0000016E0D6F1118: _getptd_noexit.LIBCMT ref: 0000016E0D6F111C

__doserrno.LIBCMT ref: 0000016E0D6F6245

Part of subcall function 0000016E0D6F10A8: _getptd_noexit.LIBCMT ref: 0000016E0D6F10AC

__doserrno.LIBCMT ref: 0000016E0D6F62AB
_errno.LIBCMT ref: 0000016E0D6F62B2
_invalid_parameter_noinfo.LIBCMT ref: 0000016E0D6F6316

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: __doserrno_errno_getptd_noexit$_invalid_parameter_noinfo
String ID:
API String ID: 388111225-0
Opcode ID: 9a7e94428e85d4ed5cd8e77b1af53c202f15bf406c2c29a1a7d54b8e8c205bff
Instruction ID: 46f50e9557bb5b66229ae57b2198ae846d51afb55a8ee1ccd53afb34b2c77de8
Opcode Fuzzy Hash: 9a7e94428e85d4ed5cd8e77b1af53c202f15bf406c2c29a1a7d54b8e8c205bff
Instruction Fuzzy Hash: E0318E3B720B9486E716AFA6EC417ED35D0A7827A0F955329FA11377D2CABBC8418710

Function 0000016E0D6FF150 Relevance: 13.6, APIs: 9, Instructions: 127
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000016E0D6FF176
_errno.LIBCMT ref: 0000016E0D6FF16B

Part of subcall function 0000016E0D6F1118: _getptd_noexit.LIBCMT ref: 0000016E0D6F111C

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1812809483-0
Opcode ID: bd2089a42f628a497311986bb7142f0c797ae3413767483a07d765319bf433f4
Instruction ID: 53b7ea9ab4a8fb0dfaedd370c76f00fb873f911972e6197b98ef1d0e82e8751f
Opcode Fuzzy Hash: bd2089a42f628a497311986bb7142f0c797ae3413767483a07d765319bf433f4
Instruction Fuzzy Hash: E341F27F730B5181FB60EB62AC403ED76E0EB65BA4F944321FA94636C5D7AB88458700

Function 0000016E0D6F7008 Relevance: 13.6, APIs: 9, Instructions: 67
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 0000016E0D6F7033

Part of subcall function 0000016E0D6F1118: _getptd_noexit.LIBCMT ref: 0000016E0D6F111C

__doserrno.LIBCMT ref: 0000016E0D6F702B

Part of subcall function 0000016E0D6F10A8: _getptd_noexit.LIBCMT ref: 0000016E0D6F10AC

__lock_fhandle.LIBCMT ref: 0000016E0D6F7077
_lseeki64_nolock.LIBCMT ref: 0000016E0D6F7090

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseeki64_nolock
String ID:
API String ID: 4140391395-0
Opcode ID: 19101616f3e261a9beafbca214444aa2a5cb8e231afb96d714edbab2d78f6c11
Instruction ID: 4846e394df2ee0e2a869d6033a2388cf4b3580b987991f8a63b07a998d6c5436
Opcode Fuzzy Hash: 19101616f3e261a9beafbca214444aa2a5cb8e231afb96d714edbab2d78f6c11
Instruction Fuzzy Hash: 7221AC7B720A8085F6056F2AAC017EDB591AB81BF1F494719FA35273D2CBBF84418721

Function 0000016E0D6F6E90 Relevance: 13.6, APIs: 9, Instructions: 67
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 0000016E0D6F6EBB

Part of subcall function 0000016E0D6F1118: _getptd_noexit.LIBCMT ref: 0000016E0D6F111C

__doserrno.LIBCMT ref: 0000016E0D6F6EB3

Part of subcall function 0000016E0D6F10A8: _getptd_noexit.LIBCMT ref: 0000016E0D6F10AC

__lock_fhandle.LIBCMT ref: 0000016E0D6F6EFF
_lseek_nolock.LIBCMT ref: 0000016E0D6F6F18

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno_lseek_nolock
String ID:
API String ID: 310312816-0
Opcode ID: 58556fb0ae643294109593e6a1f551c1d1756168c239dbf47c2b40feda9217b5
Instruction ID: f416263b0579e61d358fea076bbe6fa8967161867ef416c1e4e4507030836477
Opcode Fuzzy Hash: 58556fb0ae643294109593e6a1f551c1d1756168c239dbf47c2b40feda9217b5
Instruction Fuzzy Hash: E021D13B721A8085F7116FA5FD413ED75D1A7817E1F494315BA15273D2CBFB88418714

Function 0000016E0D6EF36C Relevance: 12.6, APIs: 10, Instructions: 73
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.LIBCMT ref: 0000016E0D6EF39A

Part of subcall function 0000016E0D6EE644: _errno.LIBCMT ref: 0000016E0D6EE664

free.LIBCMT ref: 0000016E0D6EF3AF
free.LIBCMT ref: 0000016E0D6EF3D0
free.LIBCMT ref: 0000016E0D6EF3E5
free.LIBCMT ref: 0000016E0D6EF3F9
free.LIBCMT ref: 0000016E0D6EF405
free.LIBCMT ref: 0000016E0D6EF430
free.LIBCMT ref: 0000016E0D6EF451
free.LIBCMT ref: 0000016E0D6EF46A
free.LIBCMT ref: 0000016E0D6EF49B

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: 819b4a270ea7d8595eaf9ac501f5b396dc923916a4c2f054388fd72371d1b91d
Instruction ID: 277ce37c5229d33bf203f3a963e10e62eecb0ad82cea42dc6bb7fa28c42f78c0
Opcode Fuzzy Hash: 819b4a270ea7d8595eaf9ac501f5b396dc923916a4c2f054388fd72371d1b91d
Instruction Fuzzy Hash: 1931C23F3A1A4082FE559B59FC653EC63E4AB947A0F4C0326B919066DADEABC8458341

Function 0000016E0D6F5834 Relevance: 12.1, APIs: 8, Instructions: 67
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 0000016E0D6F585F

Part of subcall function 0000016E0D6F1118: _getptd_noexit.LIBCMT ref: 0000016E0D6F111C

__doserrno.LIBCMT ref: 0000016E0D6F5857

Part of subcall function 0000016E0D6F10A8: _getptd_noexit.LIBCMT ref: 0000016E0D6F10AC

__lock_fhandle.LIBCMT ref: 0000016E0D6F58A3

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_errno
String ID:
API String ID: 2611593033-0
Opcode ID: 268773e762f2e10da4a59bd6545c27f05d9dc8848c407f150f864121acff7d22
Instruction ID: 9586e77b389ec7b081118dbf7d44199b530ee8f78ec494d6035978b3e54cb4b9
Opcode Fuzzy Hash: 268773e762f2e10da4a59bd6545c27f05d9dc8848c407f150f864121acff7d22
Instruction Fuzzy Hash: 8621923B720A9086F7156F66FC413ED75E0A7817E1F994715BA26272D2CBFB88418710

Function 0000016E0D6F5058 Relevance: 12.1, APIs: 8, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 0000016E0D6F5079

Part of subcall function 0000016E0D6F1118: _getptd_noexit.LIBCMT ref: 0000016E0D6F111C

__doserrno.LIBCMT ref: 0000016E0D6F5071

Part of subcall function 0000016E0D6F10A8: _getptd_noexit.LIBCMT ref: 0000016E0D6F10AC

__lock_fhandle.LIBCMT ref: 0000016E0D6F50BD
_close_nolock.LIBCMT ref: 0000016E0D6F50D0

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno__lock_fhandle_close_nolock_errno
String ID:
API String ID: 4060740672-0
Opcode ID: 17379182c61e94fbc4142119cfcf5b3e3f43e3e6c30bf76299a690df2e0bdcd6
Instruction ID: e2246731cdec9acd0de36273f14a797d9582b3d4b56d72d9a1d1a36da662e6e7
Opcode Fuzzy Hash: 17379182c61e94fbc4142119cfcf5b3e3f43e3e6c30bf76299a690df2e0bdcd6
Instruction Fuzzy Hash: EB11D03B720B8485F315AF26FC813EC76D0E7827A1F694725F91A272D6CAFB88408754

Function 0000016E0D6D3A0C Relevance: 11.5, APIs: 9, Instructions: 201
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.LIBCMT ref: 0000016E0D6D3AA9

Part of subcall function 0000016E0D6EE684: _FF_MSGBANNER.LIBCMT ref: 0000016E0D6EE6B4
Part of subcall function 0000016E0D6EE684: _NMSG_WRITE.LIBCMT ref: 0000016E0D6EE6BE
Part of subcall function 0000016E0D6EE684: _callnewh.LIBCMT ref: 0000016E0D6EE6F2
Part of subcall function 0000016E0D6EE684: _errno.LIBCMT ref: 0000016E0D6EE6FD
Part of subcall function 0000016E0D6EE684: _errno.LIBCMT ref: 0000016E0D6EE708

malloc.LIBCMT ref: 0000016E0D6D3AB3

Part of subcall function 0000016E0D6EE684: _callnewh.LIBCMT ref: 0000016E0D6EE718
Part of subcall function 0000016E0D6EE684: _errno.LIBCMT ref: 0000016E0D6EE71D

malloc.LIBCMT ref: 0000016E0D6D3ABE
free.LIBCMT ref: 0000016E0D6D3C7E
free.LIBCMT ref: 0000016E0D6D3C86
free.LIBCMT ref: 0000016E0D6D3C8E

Part of subcall function 0000016E0D6D48F0: malloc.LIBCMT ref: 0000016E0D6D493A
Part of subcall function 0000016E0D6D48F0: malloc.LIBCMT ref: 0000016E0D6D4945
Part of subcall function 0000016E0D6D48F0: free.LIBCMT ref: 0000016E0D6D4A2C
Part of subcall function 0000016E0D6D48F0: free.LIBCMT ref: 0000016E0D6D4A34

free.LIBCMT ref: 0000016E0D6D3C9A
free.LIBCMT ref: 0000016E0D6D3CA7
free.LIBCMT ref: 0000016E0D6D3CB4

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: free$malloc$_errno$_callnewh
String ID:
API String ID: 4160633307-0
Opcode ID: 930309f8498ff7a349f5473874db00cb4ae22164d30aab4612de4250541046de
Instruction ID: 8bf0d02320a76f454ac3519f2b5191739088f34800de4730d2c3894bf6351667
Opcode Fuzzy Hash: 930309f8498ff7a349f5473874db00cb4ae22164d30aab4612de4250541046de
Instruction Fuzzy Hash: 8B71E17BB2478446EA209B26BC407EE77D5B795BC8F044215BD8647B8ADBBBC806C701

Function 0000016E0D6DBE74 Relevance: 10.8, APIs: 6, Strings: 1, Instructions: 296
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000016E0D6E53EC: malloc.LIBCMT ref: 0000016E0D6E5408

malloc.LIBCMT ref: 0000016E0D6DBF3B

Part of subcall function 0000016E0D6EE684: _FF_MSGBANNER.LIBCMT ref: 0000016E0D6EE6B4
Part of subcall function 0000016E0D6EE684: _NMSG_WRITE.LIBCMT ref: 0000016E0D6EE6BE
Part of subcall function 0000016E0D6EE684: _callnewh.LIBCMT ref: 0000016E0D6EE6F2
Part of subcall function 0000016E0D6EE684: _errno.LIBCMT ref: 0000016E0D6EE6FD
Part of subcall function 0000016E0D6EE684: _errno.LIBCMT ref: 0000016E0D6EE708

Part of subcall function 0000016E0D6EB630: _time64.LIBCMT ref: 0000016E0D6EB654
Part of subcall function 0000016E0D6EB630: malloc.LIBCMT ref: 0000016E0D6EB69C
Part of subcall function 0000016E0D6EB630: strtok.LIBCMT ref: 0000016E0D6EB700
Part of subcall function 0000016E0D6EB630: strtok.LIBCMT ref: 0000016E0D6EB711

Part of subcall function 0000016E0D6E28A0: _time64.LIBCMT ref: 0000016E0D6E28AE

Part of subcall function 0000016E0D6EDEA8: malloc.LIBCMT ref: 0000016E0D6EDEF8

Part of subcall function 0000016E0D6EDEA8: realloc.LIBCMT ref: 0000016E0D6EDF07

malloc.LIBCMT ref: 0000016E0D6DC04A
_snprintf.LIBCMT ref: 0000016E0D6DC0C1
_snprintf.LIBCMT ref: 0000016E0D6DC0E7
_snprintf.LIBCMT ref: 0000016E0D6DC10E
free.LIBCMT ref: 0000016E0D6DC2C6

Part of subcall function 0000016E0D6EA144: malloc.LIBCMT ref: 0000016E0D6EA178
Part of subcall function 0000016E0D6EA144: free.LIBCMT ref: 0000016E0D6EA32F

Strings

/'); %s, xrefs: 0000016E0D6DC0B2, 0000016E0D6DC0DA, 0000016E0D6DC0F1

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: malloc$_snprintf$_errno_time64freestrtok$_callnewhrealloc
String ID: /'); %s
API String ID: 1314452303-1283008465
Opcode ID: a14b20026d747f2b5753e6fc705179295a1c2f23b63bad27e5059ac536f54d83
Instruction ID: eb8512b2d5005c89b523c1c2bac275cd85e6c869784bed2cdd71cb6088f1415a
Opcode Fuzzy Hash: a14b20026d747f2b5753e6fc705179295a1c2f23b63bad27e5059ac536f54d83
Instruction Fuzzy Hash: 22C1903B72028146FA14EBA6BC557EE32D9AB89780F455324BD96473CBDEBBC406C700

Function 0000016E0D6DE004 Relevance: 10.7, APIs: 5, Strings: 2, Instructions: 165
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_snprintf.LIBCMT ref: 0000016E0D6DE0D3
_snprintf.LIBCMT ref: 0000016E0D6DE0FE
_snprintf.LIBCMT ref: 0000016E0D6DE11A
_snprintf.LIBCMT ref: 0000016E0D6DE1CF
_snprintf.LIBCMT ref: 0000016E0D6DE1E6

Strings

/'); %s, xrefs: 0000016E0D6DE0CA, 0000016E0D6DE0F5, 0000016E0D6DE1C4
rshell -nop -exec bypass -EncodedCommand "%s", xrefs: 0000016E0D6DE02A

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: _snprintf
String ID: /'); %s$rshell -nop -exec bypass -EncodedCommand "%s"
API String ID: 3512837008-1250630670
Opcode ID: 72e4e973a1d0442b98f7febb78707b45b3081222fbe35b5ecbc6412512dc3076
Instruction ID: f6cc1d96c46e73612d75ce7de2259e82e5019e142ca1526650fcb790bb4a7fd6
Opcode Fuzzy Hash: 72e4e973a1d0442b98f7febb78707b45b3081222fbe35b5ecbc6412512dc3076
Instruction Fuzzy Hash: BE81367B720B8496EB109B65EC407DD37E1F788784F880626FA894779ADBBBC505C700

Function 0000016E0D6E0A94 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000016E0D6E53EC: malloc.LIBCMT ref: 0000016E0D6E5408

Part of subcall function 0000016E0D6EFA20: _errno.LIBCMT ref: 0000016E0D6EF977
Part of subcall function 0000016E0D6EFA20: _invalid_parameter_noinfo.LIBCMT ref: 0000016E0D6EF982

fseek.LIBCMT ref: 0000016E0D6E0B30

Part of subcall function 0000016E0D6F02A4: _errno.LIBCMT ref: 0000016E0D6F02CC
Part of subcall function 0000016E0D6F02A4: _invalid_parameter_noinfo.LIBCMT ref: 0000016E0D6F02D7

_ftelli64.LIBCMT ref: 0000016E0D6E0B38

Part of subcall function 0000016E0D6F0318: _errno.LIBCMT ref: 0000016E0D6F0336
Part of subcall function 0000016E0D6F0318: _invalid_parameter_noinfo.LIBCMT ref: 0000016E0D6F0341

fseek.LIBCMT ref: 0000016E0D6E0B48

Part of subcall function 0000016E0D6F02A4: _fseek_nolock.LIBCMT ref: 0000016E0D6F02F5

malloc.LIBCMT ref: 0000016E0D6E0B88

Part of subcall function 0000016E0D6EE684: _FF_MSGBANNER.LIBCMT ref: 0000016E0D6EE6B4
Part of subcall function 0000016E0D6EE684: _NMSG_WRITE.LIBCMT ref: 0000016E0D6EE6BE
Part of subcall function 0000016E0D6EE684: _callnewh.LIBCMT ref: 0000016E0D6EE6F2
Part of subcall function 0000016E0D6EE684: _errno.LIBCMT ref: 0000016E0D6EE6FD
Part of subcall function 0000016E0D6EE684: _errno.LIBCMT ref: 0000016E0D6EE708

Part of subcall function 0000016E0D6DC444: malloc.LIBCMT ref: 0000016E0D6DC457

fclose.LIBCMT ref: 0000016E0D6E0C45

Strings

mode, xrefs: 0000016E0D6E0B07

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$_invalid_parameter_noinfomalloc$fseek$_callnewh_fseek_nolock_ftelli64fclose
String ID: mode
API String ID: 1756087678-2976727214
Opcode ID: f827565397daa4a866320a6784096609c7711a7c42725b9a2a2b01c24697e092
Instruction ID: c7ed00175e4ed0d392d3daa4fd4e326e618dc6a7971037729dcab612383d2a58
Opcode Fuzzy Hash: f827565397daa4a866320a6784096609c7711a7c42725b9a2a2b01c24697e092
Instruction Fuzzy Hash: 49419F3B32464082EA10EB12BC553EE76D5B789BD4F848321BE5A47BDADEBBC505C740

Function 0000016E0D6E8620 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000016E0D6E864F

Part of subcall function 0000016E0D6EE684: _FF_MSGBANNER.LIBCMT ref: 0000016E0D6EE6B4
Part of subcall function 0000016E0D6EE684: _NMSG_WRITE.LIBCMT ref: 0000016E0D6EE6BE
Part of subcall function 0000016E0D6EE684: _callnewh.LIBCMT ref: 0000016E0D6EE6F2
Part of subcall function 0000016E0D6EE684: _errno.LIBCMT ref: 0000016E0D6EE6FD
Part of subcall function 0000016E0D6EE684: _errno.LIBCMT ref: 0000016E0D6EE708

_snprintf.LIBCMT ref: 0000016E0D6E8667

Part of subcall function 0000016E0D6EEA3C: _errno.LIBCMT ref: 0000016E0D6EEA73
Part of subcall function 0000016E0D6EEA3C: _invalid_parameter_noinfo.LIBCMT ref: 0000016E0D6EEA7E

free.LIBCMT ref: 0000016E0D6E867E

Part of subcall function 0000016E0D6EE644: _errno.LIBCMT ref: 0000016E0D6EE664

malloc.LIBCMT ref: 0000016E0D6E86CE
_snprintf.LIBCMT ref: 0000016E0D6E86E6
free.LIBCMT ref: 0000016E0D6E870E

Strings

/'); %s, xrefs: 0000016E0D6E86D3

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$_snprintffreemalloc$_callnewh_invalid_parameter_noinfo
String ID: /'); %s
API String ID: 761449704-1283008465
Opcode ID: 6cfeb8f42d39390d21f7f655b5309285a784ce0f998201f3a4c834a9ff33a05d
Instruction ID: cda3c861862010b9d7d1c89a2d59bb652b147195a4bc5675ef3e599bb7b1ec78
Opcode Fuzzy Hash: 6cfeb8f42d39390d21f7f655b5309285a784ce0f998201f3a4c834a9ff33a05d
Instruction Fuzzy Hash: DB31CF3B31028485EA159BA27C143ED7BE67386FD0F884251FEA50B7DACABBC4429300

Function 0000016E0D6EF210 Relevance: 10.6, APIs: 7, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000016E0D6EF236

Part of subcall function 0000016E0D6F1118: _getptd_noexit.LIBCMT ref: 0000016E0D6F111C

_invalid_parameter_noinfo.LIBCMT ref: 0000016E0D6EF242
__crtIsPackagedApp.LIBCMT ref: 0000016E0D6EF253
_dosmaperr.LIBCMT ref: 0000016E0D6EF29D

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: Packaged__crt_dosmaperr_errno_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 2917016420-0
Opcode ID: 6bd0c9401fb351ee2ef62b7ec5c1d05d22ccd8d85f9d07845cb75c559d0d09e7
Instruction ID: c5cf55d245f12e3b25cffe9676dd5e6624b41195d0ea56b816c82a0bdc5e1b78
Opcode Fuzzy Hash: 6bd0c9401fb351ee2ef62b7ec5c1d05d22ccd8d85f9d07845cb75c559d0d09e7
Instruction Fuzzy Hash: E2315C3B320F4486FB109BA6EC053AD76E9AB95B94F184724BE49937D9DFBBC4418700

Function 0000016E0D6FEFD0 Relevance: 10.6, APIs: 7, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000016E0D6FF004

Part of subcall function 0000016E0D6F0A00: _getptd.LIBCMT ref: 0000016E0D6F0A16
Part of subcall function 0000016E0D6F0A00: __updatetlocinfo.LIBCMT ref: 0000016E0D6F0A4B
Part of subcall function 0000016E0D6F0A00: __updatetmbcinfo.LIBCMT ref: 0000016E0D6F0A72

_errno.LIBCMT ref: 0000016E0D6FF01F
_invalid_parameter_noinfo.LIBCMT ref: 0000016E0D6FF02A

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 3191669884-0
Opcode ID: 17da934d4d304edacbb08e48815c32878d4d79cd43a7a40298e59a88dbb9cc3b
Instruction ID: b2f9b495c2f00978c78625a965eefa44fa53544a8ad0ea8944b182e434b04c79
Opcode Fuzzy Hash: 17da934d4d304edacbb08e48815c32878d4d79cd43a7a40298e59a88dbb9cc3b
Instruction Fuzzy Hash: A1317C7B324B8485E7209F12E8947DDB6E4FB95BE0F548221FA5827B86CBB7C845C700

Function 0000016E0D6EFF10 Relevance: 9.2, APIs: 6, Instructions: 166COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000016E0D6EFF4C

Part of subcall function 0000016E0D6F1118: _getptd_noexit.LIBCMT ref: 0000016E0D6F111C

_invalid_parameter_noinfo.LIBCMT ref: 0000016E0D6EFF57
memcpy_s.LIBCMT ref: 0000016E0D6F001C
_fileno.LIBCMT ref: 0000016E0D6F0087
_filbuf.LIBCMT ref: 0000016E0D6F00B5
_errno.LIBCMT ref: 0000016E0D6F0105

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$_filbuf_fileno_getptd_noexit_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 2328795619-0
Opcode ID: a6b8c894bc097219f3410178b0f3ee4aa495d15850340b6c84f373b071b042dd
Instruction ID: c2bea929b04b4aaec7e2e082e0c9548572f6a0f6a5954cc74915f21e9920a94a
Opcode Fuzzy Hash: a6b8c894bc097219f3410178b0f3ee4aa495d15850340b6c84f373b071b042dd
Instruction Fuzzy Hash: 6E51D23B724A5082EB248A66BD007EDB6D4A755BF4F148714BA3953BDACBB7C8918340

Function 0000016E0D6E1030 Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 150COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000016E0D6E1063

Part of subcall function 0000016E0D6EE684: _FF_MSGBANNER.LIBCMT ref: 0000016E0D6EE6B4
Part of subcall function 0000016E0D6EE684: _NMSG_WRITE.LIBCMT ref: 0000016E0D6EE6BE
Part of subcall function 0000016E0D6EE684: _callnewh.LIBCMT ref: 0000016E0D6EE6F2
Part of subcall function 0000016E0D6EE684: _errno.LIBCMT ref: 0000016E0D6EE6FD
Part of subcall function 0000016E0D6EE684: _errno.LIBCMT ref: 0000016E0D6EE708

Part of subcall function 0000016E0D6DC444: malloc.LIBCMT ref: 0000016E0D6DC457

free.LIBCMT ref: 0000016E0D6E115E
free.LIBCMT ref: 0000016E0D6E116B

Part of subcall function 0000016E0D6EE644: _errno.LIBCMT ref: 0000016E0D6EE664

Strings

1:%u/'); %s, xrefs: 0000016E0D6E10F9
open process: %d (%u), xrefs: 0000016E0D6E10BF
n from %d (%u), xrefs: 0000016E0D6E1229

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$freemalloc$_callnewh
String ID: 1:%u/'); %s$n from %d (%u)$open process: %d (%u)
API String ID: 2029259483-317027030
Opcode ID: dc04f393f0e4fed79304e7eb9afd54a7656e6f03fcd842c9ac36e4d1f5269005
Instruction ID: 197aa26062c1746d9feea99ddf891927ec41265edb601cffb7570f152b103b8b
Opcode Fuzzy Hash: dc04f393f0e4fed79304e7eb9afd54a7656e6f03fcd842c9ac36e4d1f5269005
Instruction Fuzzy Hash: 2E617D7A71475486EB10DB61F8402EDB7E1F389B94F404216FE8A87B99EBBBC505CB40

Function 0000016E0D6EFA20 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000016E0D6EF977

Part of subcall function 0000016E0D6F1118: _getptd_noexit.LIBCMT ref: 0000016E0D6F111C

_invalid_parameter_noinfo.LIBCMT ref: 0000016E0D6EF982
_getstream.LIBCMT ref: 0000016E0D6EF9A2
_errno.LIBCMT ref: 0000016E0D6EF9B4
_errno.LIBCMT ref: 0000016E0D6EF9C6
_openfile.LIBCMT ref: 0000016E0D6EF9F4

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$_getptd_noexit_getstream_invalid_parameter_noinfo_openfile
String ID:
API String ID: 1547050394-0
Opcode ID: 0ee48a0889aaee90efd1175476a0cb7edf48224d72ecded3f82ab5c2f8e8549f
Instruction ID: 75393b25b6ca4df106c2076bf71c34ccedd8ae46ad671357288a1061832604b4
Opcode Fuzzy Hash: 0ee48a0889aaee90efd1175476a0cb7edf48224d72ecded3f82ab5c2f8e8549f
Instruction Fuzzy Hash: 6721A83B32478292FB115B22BC013DEB6D97B557C0F444621B989A7BD9EBBFC5414700

Function 0000016E0D6F9B3C Relevance: 9.1, APIs: 6, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000016E0D6F9B55

Part of subcall function 0000016E0D6F1118: _getptd_noexit.LIBCMT ref: 0000016E0D6F111C

__lock_fhandle.LIBCMT ref: 0000016E0D6F9B9D
__doserrno.LIBCMT ref: 0000016E0D6F9BD2
_errno.LIBCMT ref: 0000016E0D6F9BD9

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$__doserrno__lock_fhandle_getptd_noexit
String ID:
API String ID: 2102446242-0
Opcode ID: acc1e709539f3a0e8ebe9ec8259c6fe6fa9b3b7ac075e700e957115c0bfbe106
Instruction ID: b0e965c94b5f987b47bc094a3ded2ee6ea39f9caaf10da20a12423239fab3235
Opcode Fuzzy Hash: acc1e709539f3a0e8ebe9ec8259c6fe6fa9b3b7ac075e700e957115c0bfbe106
Instruction Fuzzy Hash: E621D13B320F8081F7116FA5FC813EE7AD4A7817A0F49431ABA15672D2CAFB88408B14

Function 0000016E0D6EE3EC Relevance: 9.0, APIs: 5, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000016E0D6EE40F

Part of subcall function 0000016E0D6EE684: _FF_MSGBANNER.LIBCMT ref: 0000016E0D6EE6B4
Part of subcall function 0000016E0D6EE684: _NMSG_WRITE.LIBCMT ref: 0000016E0D6EE6BE
Part of subcall function 0000016E0D6EE684: _callnewh.LIBCMT ref: 0000016E0D6EE6F2
Part of subcall function 0000016E0D6EE684: _errno.LIBCMT ref: 0000016E0D6EE6FD
Part of subcall function 0000016E0D6EE684: _errno.LIBCMT ref: 0000016E0D6EE708

malloc.LIBCMT ref: 0000016E0D6EE41D

Part of subcall function 0000016E0D6EE684: _callnewh.LIBCMT ref: 0000016E0D6EE718
Part of subcall function 0000016E0D6EE684: _errno.LIBCMT ref: 0000016E0D6EE71D

malloc.LIBCMT ref: 0000016E0D6EE43F
_snprintf.LIBCMT ref: 0000016E0D6EE45A

Part of subcall function 0000016E0D6EEA3C: _errno.LIBCMT ref: 0000016E0D6EEA73
Part of subcall function 0000016E0D6EEA3C: _invalid_parameter_noinfo.LIBCMT ref: 0000016E0D6EEA7E

malloc.LIBCMT ref: 0000016E0D6EE475

Strings

dpoolWait, xrefs: 0000016E0D6EE444

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: _errnomalloc$_callnewh$_invalid_parameter_noinfo_snprintf
String ID: dpoolWait
API String ID: 2026495703-1875951006
Opcode ID: 8070209c1cbe6b8a0a820429e4883b75791e823d018c18b7f063917c64386bf6
Instruction ID: 75ffdd0bdd59d2f4311efc090e5becafe4358302d31913fe2b157c86901c3e52
Opcode Fuzzy Hash: 8070209c1cbe6b8a0a820429e4883b75791e823d018c18b7f063917c64386bf6
Instruction Fuzzy Hash: 00018B76721B9081EA44DB12B80479D77D9E799BE0F054329FEA9477CACABAC4418780

Function 0000016E0D6E25F4 Relevance: 8.9, APIs: 7, Instructions: 181stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

strchr.LIBCMT ref: 0000016E0D6E262E
strchr.LIBCMT ref: 0000016E0D6E264C
malloc.LIBCMT ref: 0000016E0D6E2664
malloc.LIBCMT ref: 0000016E0D6E2671
rand.LIBCMT ref: 0000016E0D6E273D
free.LIBCMT ref: 0000016E0D6E285B
free.LIBCMT ref: 0000016E0D6E2863

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: freemallocstrchr$rand
String ID:
API String ID: 1305919620-0
Opcode ID: f55c98597b31e9256bdda085e271814e8bdd530284bc77f6856305a025606a71
Instruction ID: ef5627823f1d9850b3b59ae2eaa37386b375050251ee452ebfa6e2fcdf0a307f
Opcode Fuzzy Hash: f55c98597b31e9256bdda085e271814e8bdd530284bc77f6856305a025606a71
Instruction Fuzzy Hash: 0E712977724AC441FA259B29B8103EE73D5EF99B84F084310FB891779AEE6BC1468704

Function 0000016E0D6D3570 Relevance: 8.9, APIs: 7, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000016E0D6D35BD

Part of subcall function 0000016E0D6EE684: _FF_MSGBANNER.LIBCMT ref: 0000016E0D6EE6B4
Part of subcall function 0000016E0D6EE684: _NMSG_WRITE.LIBCMT ref: 0000016E0D6EE6BE
Part of subcall function 0000016E0D6EE684: _callnewh.LIBCMT ref: 0000016E0D6EE6F2
Part of subcall function 0000016E0D6EE684: _errno.LIBCMT ref: 0000016E0D6EE6FD
Part of subcall function 0000016E0D6EE684: _errno.LIBCMT ref: 0000016E0D6EE708

malloc.LIBCMT ref: 0000016E0D6D35C8

Part of subcall function 0000016E0D6EE684: _callnewh.LIBCMT ref: 0000016E0D6EE718
Part of subcall function 0000016E0D6EE684: _errno.LIBCMT ref: 0000016E0D6EE71D

free.LIBCMT ref: 0000016E0D6D36AF
free.LIBCMT ref: 0000016E0D6D36B7
free.LIBCMT ref: 0000016E0D6D36BF
free.LIBCMT ref: 0000016E0D6D36CB
free.LIBCMT ref: 0000016E0D6D36D8

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 3866d312ddc7406d2c13ac3d10959d9d3de063b9a6b1dce899036bf231b32379
Instruction ID: 6ce6982f11cc5dbb40cfb9e7f14872e024e9d0c1c19d730e6cdcab6bccaf01cc
Opcode Fuzzy Hash: 3866d312ddc7406d2c13ac3d10959d9d3de063b9a6b1dce899036bf231b32379
Instruction Fuzzy Hash: 2E41CC3B76079197EA149B26BD507AD77E4BB49B80F444220EE8647786EFB7D422C301

Function 0000016E0D6EB630 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_time64.LIBCMT ref: 0000016E0D6EB654

Part of subcall function 0000016E0D6EF84C: _getptd.LIBCMT ref: 0000016E0D6EF854

malloc.LIBCMT ref: 0000016E0D6EB69C
strtok.LIBCMT ref: 0000016E0D6EB700
strtok.LIBCMT ref: 0000016E0D6EB711

Strings

eThreadpoolTimer, xrefs: 0000016E0D6EB6DA

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: strtok$_getptd_time64malloc
String ID: eThreadpoolTimer
API String ID: 1522986614-2707337283
Opcode ID: b02d7519bf37bc4b38ca8186062a8fc85f913fef5048514e0fa6af22142f2d69
Instruction ID: 7577cb71726695bdac4bc33049a4bc7cb349f210a99516eded9ad092f475fcd7
Opcode Fuzzy Hash: b02d7519bf37bc4b38ca8186062a8fc85f913fef5048514e0fa6af22142f2d69
Instruction Fuzzy Hash: 1E21A2BB760B9481EB00DF16B8886AD37E8F754B94F164315FE5A4378ACA76C4418780

Function 0000016E0D6E13B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000016E0D6E13D2

Part of subcall function 0000016E0D6EE684: _FF_MSGBANNER.LIBCMT ref: 0000016E0D6EE6B4
Part of subcall function 0000016E0D6EE684: _NMSG_WRITE.LIBCMT ref: 0000016E0D6EE6BE
Part of subcall function 0000016E0D6EE684: _callnewh.LIBCMT ref: 0000016E0D6EE6F2
Part of subcall function 0000016E0D6EE684: _errno.LIBCMT ref: 0000016E0D6EE6FD
Part of subcall function 0000016E0D6EE684: _errno.LIBCMT ref: 0000016E0D6EE708

_snprintf.LIBCMT ref: 0000016E0D6E13F1

Part of subcall function 0000016E0D6EEA3C: _errno.LIBCMT ref: 0000016E0D6EEA73
Part of subcall function 0000016E0D6EEA3C: _invalid_parameter_noinfo.LIBCMT ref: 0000016E0D6EEA7E

remove.LIBCMT ref: 0000016E0D6E13FD
remove.LIBCMT ref: 0000016E0D6E1404

Strings

uld not open process: %d (%u), xrefs: 0000016E0D6E13D7

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$remove$_callnewh_invalid_parameter_noinfo_snprintfmalloc
String ID: uld not open process: %d (%u)
API String ID: 2566950902-823969559
Opcode ID: fcd4f31b16295b3d981e03ccf995d44eb940f919008a0e94d9d9162e5faefa64
Instruction ID: 7f65e571fe65691985c8632b461793787480186acd064ca42d09d39eb9a02169
Opcode Fuzzy Hash: fcd4f31b16295b3d981e03ccf995d44eb940f919008a0e94d9d9162e5faefa64
Instruction Fuzzy Hash: A4F06D3A314B40C9E2109B12BC113DEB3A4A785BC0F584321BF8917B9BDEBBC4018744

Function 0000016E0D6DDA8C Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 165COMMONLIBRARYCODE

Download Yara Rule

APIs

_snprintf.LIBCMT ref: 0000016E0D6DDB25

Part of subcall function 0000016E0D6EEA3C: _errno.LIBCMT ref: 0000016E0D6EEA73
Part of subcall function 0000016E0D6EEA3C: _invalid_parameter_noinfo.LIBCMT ref: 0000016E0D6EEA7E

Part of subcall function 0000016E0D6E6F38: _snprintf.LIBCMT ref: 0000016E0D6E70A5

_snprintf.LIBCMT ref: 0000016E0D6DDBBD

Part of subcall function 0000016E0D6E2170: strchr.LIBCMT ref: 0000016E0D6E21D6
Part of subcall function 0000016E0D6E2170: _snprintf.LIBCMT ref: 0000016E0D6E220C

Part of subcall function 0000016E0D6E200C: strchr.LIBCMT ref: 0000016E0D6E2069
Part of subcall function 0000016E0D6E200C: _snprintf.LIBCMT ref: 0000016E0D6E20B3

_snprintf.LIBCMT ref: 0000016E0D6DDBD4

Strings

/'); %s, xrefs: 0000016E0D6DDB19, 0000016E0D6DDBB2
rshell -nop -exec bypass -EncodedCommand "%s", xrefs: 0000016E0D6DDACB

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: _snprintf$strchr$_errno_invalid_parameter_noinfo
String ID: /'); %s$rshell -nop -exec bypass -EncodedCommand "%s"
API String ID: 199363273-1250630670
Opcode ID: 6e2045361780fadf1587795c869fcd23f7db7a84374f415de51a140654aa30c6
Instruction ID: 268bf6c35ef708ca655a872321c9920101a46871a770bdf976d3b8bc2f7464ad
Opcode Fuzzy Hash: 6e2045361780fadf1587795c869fcd23f7db7a84374f415de51a140654aa30c6
Instruction Fuzzy Hash: A2718B7B72078486EB109B61FC407EE77E9F784B98F440216FE8957A99DBBAC505CB00

Function 0000016E0D6EFA2C Relevance: 7.6, APIs: 5, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000016E0D6EFA64

Part of subcall function 0000016E0D6F1118: _getptd_noexit.LIBCMT ref: 0000016E0D6F111C

_invalid_parameter_noinfo.LIBCMT ref: 0000016E0D6EFA6F
_flush.LIBCMT ref: 0000016E0D6EFB21
_fileno.LIBCMT ref: 0000016E0D6EFB42
_flsbuf.LIBCMT ref: 0000016E0D6EFB85

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno_fileno_flsbuf_flush_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1640621425-0
Opcode ID: f714c1e563aa58d873e3883a1df435710c86d18d380f096712ab5731ea4c4750
Instruction ID: 884d0040f73c3c5a5410ba1676ce9fa2d1c6a8c2100960b2316f96fc7e7b742b
Opcode Fuzzy Hash: f714c1e563aa58d873e3883a1df435710c86d18d380f096712ab5731ea4c4750
Instruction Fuzzy Hash: 0741D33B32064087EA689A277D5439EB6D9BB84FE0F188724BF554B7D9D6BBC4458300

Function 0000016E0D6D48F0 Relevance: 7.6, APIs: 6, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000016E0D6D493A

Part of subcall function 0000016E0D6EE684: _FF_MSGBANNER.LIBCMT ref: 0000016E0D6EE6B4
Part of subcall function 0000016E0D6EE684: _NMSG_WRITE.LIBCMT ref: 0000016E0D6EE6BE
Part of subcall function 0000016E0D6EE684: _callnewh.LIBCMT ref: 0000016E0D6EE6F2
Part of subcall function 0000016E0D6EE684: _errno.LIBCMT ref: 0000016E0D6EE6FD
Part of subcall function 0000016E0D6EE684: _errno.LIBCMT ref: 0000016E0D6EE708

malloc.LIBCMT ref: 0000016E0D6D4945

Part of subcall function 0000016E0D6EE684: _callnewh.LIBCMT ref: 0000016E0D6EE718
Part of subcall function 0000016E0D6EE684: _errno.LIBCMT ref: 0000016E0D6EE71D

free.LIBCMT ref: 0000016E0D6D4A2C
free.LIBCMT ref: 0000016E0D6D4A34
free.LIBCMT ref: 0000016E0D6D4A40
free.LIBCMT ref: 0000016E0D6D4A4D

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 326b315c93b4297f8d1cd44fbd3c536e1a3741d65750285d3f659b19031d268f
Instruction ID: b9fd181703b14e6941ea9ce93bec54b547cc914debe92f34d0ceac7c71937624
Opcode Fuzzy Hash: 326b315c93b4297f8d1cd44fbd3c536e1a3741d65750285d3f659b19031d268f
Instruction Fuzzy Hash: 3141D03B72438542EA15DB2A7C003AD77D9B755B88F0D4220FD958B78AEEBBD806C304

Function 0000016E0D6DF064 Relevance: 7.6, APIs: 5, Instructions: 58fileCOMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000016E0D6DF085

Part of subcall function 0000016E0D6EE684: _FF_MSGBANNER.LIBCMT ref: 0000016E0D6EE6B4
Part of subcall function 0000016E0D6EE684: _NMSG_WRITE.LIBCMT ref: 0000016E0D6EE6BE
Part of subcall function 0000016E0D6EE684: _callnewh.LIBCMT ref: 0000016E0D6EE6F2
Part of subcall function 0000016E0D6EE684: _errno.LIBCMT ref: 0000016E0D6EE6FD
Part of subcall function 0000016E0D6EE684: _errno.LIBCMT ref: 0000016E0D6EE708

free.LIBCMT ref: 0000016E0D6DF0C0
fwrite.LIBCMT ref: 0000016E0D6DF101
fclose.LIBCMT ref: 0000016E0D6DF109
free.LIBCMT ref: 0000016E0D6DF116

Part of subcall function 0000016E0D6EE644: _errno.LIBCMT ref: 0000016E0D6EE664

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno$free$_callnewhfclosefwritemalloc
String ID:
API String ID: 1696598829-0
Opcode ID: 1bdd5497ac55f9ceee01cd46502ea43f72165348b95f2b256c95d8f9a827a5ec
Instruction ID: 91f63abb2f26482910bbc721d34fda3789288a543fc9696c2b070677b6d5ab52
Opcode Fuzzy Hash: 1bdd5497ac55f9ceee01cd46502ea43f72165348b95f2b256c95d8f9a827a5ec
Instruction Fuzzy Hash: 8211727B72468081EA10E612B8513EE73D5AB95BD4F484321BE9A4BBCEDEABC5018740

Function 0000016E0D6F99EC Relevance: 7.5, APIs: 5, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000016E0D6F99FD

Part of subcall function 0000016E0D6F1118: _getptd_noexit.LIBCMT ref: 0000016E0D6F111C

__doserrno.LIBCMT ref: 0000016E0D6F99F5

Part of subcall function 0000016E0D6F10A8: _getptd_noexit.LIBCMT ref: 0000016E0D6F10AC

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: _getptd_noexit$__doserrno_errno
String ID:
API String ID: 2964073243-0
Opcode ID: 02e55afb5f5e5304a095475b8354770d2627f5ba6f47f1d288df05a1981eaf7d
Instruction ID: 379c5c02aa7963813ed3eb6ef3cd1e723754785db7e4f8dc4489fdd3d45bbc94
Opcode Fuzzy Hash: 02e55afb5f5e5304a095475b8354770d2627f5ba6f47f1d288df05a1981eaf7d
Instruction Fuzzy Hash: 9B016D7B731F8484FA056B35EC423EC71D19BA2BA2F958302F529263D2CAAF44004B10

Function 0000016E0D6E5228 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 116stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000016E0D6E53EC: malloc.LIBCMT ref: 0000016E0D6E5408

strrchr.LIBCMT ref: 0000016E0D6E52ED
_snprintf.LIBCMT ref: 0000016E0D6E539B

Strings

t permissions in process: %d, xrefs: 0000016E0D6E5345, 0000016E0D6E5366
Failed to impersonate token: %d, xrefs: 0000016E0D6E5358

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: _snprintfmallocstrrchr
String ID: Failed to impersonate token: %d$t permissions in process: %d
API String ID: 3587327836-1492073275
Opcode ID: d69273eeb4579e6a96eb8d0c87a60564a21875d7210b55cf29d23a145d20b21e
Instruction ID: a4b6aa2aee498e1eae4dbe891b129957601640d77801946d6e2155ccdc378b1a
Opcode Fuzzy Hash: d69273eeb4579e6a96eb8d0c87a60564a21875d7210b55cf29d23a145d20b21e
Instruction Fuzzy Hash: 6E415F3A71438046EA04EB62BC153EE77D5B785BD4F884224BD564B7DADEBBC4028740

Function 0000016E0D6EB3C0 Relevance: 6.1, APIs: 4, Instructions: 140COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dde0bc93da3cc204cab392ef88660b8feabc790641522e6986fd432b01f6e40
Instruction ID: 4cc0da1afb6cf478bf0ed5ad1cc0bc4899634e471b998e37234ead8a36e60bb8
Opcode Fuzzy Hash: 1dde0bc93da3cc204cab392ef88660b8feabc790641522e6986fd432b01f6e40
Instruction Fuzzy Hash: A5616D3F761640C6E7148F1DAD453EC72E5E758B55F28432AE9164B3E9CBBBC8418B80

Function 0000016E0D6E2170 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 94stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000016E0D6E25F4: strchr.LIBCMT ref: 0000016E0D6E262E
Part of subcall function 0000016E0D6E25F4: strchr.LIBCMT ref: 0000016E0D6E264C
Part of subcall function 0000016E0D6E25F4: malloc.LIBCMT ref: 0000016E0D6E2664
Part of subcall function 0000016E0D6E25F4: malloc.LIBCMT ref: 0000016E0D6E2671
Part of subcall function 0000016E0D6E25F4: rand.LIBCMT ref: 0000016E0D6E273D

strchr.LIBCMT ref: 0000016E0D6E21D6
_snprintf.LIBCMT ref: 0000016E0D6E220C

Part of subcall function 0000016E0D6EEA3C: _errno.LIBCMT ref: 0000016E0D6EEA73
Part of subcall function 0000016E0D6EEA3C: _invalid_parameter_noinfo.LIBCMT ref: 0000016E0D6EEA7E

_snprintf.LIBCMT ref: 0000016E0D6E2223

Strings

not create token: %d, xrefs: 0000016E0D6E2205

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: strchr$_snprintfmalloc$_errno_invalid_parameter_noinforand
String ID: not create token: %d
API String ID: 1095232423-2272930512
Opcode ID: 9f33a31cc3dbe4d390e57a8e0463a50ad11e38a52d1dbdd6b3122e58f7288ae2
Instruction ID: fc7ed505da5e128cab4b48117a823234e5c450389f6c458ab8d24c888d11fa3b
Opcode Fuzzy Hash: 9f33a31cc3dbe4d390e57a8e0463a50ad11e38a52d1dbdd6b3122e58f7288ae2
Instruction Fuzzy Hash: 4241B07B320E8091EA119B2AE5453ECB3E5FF98B84F085611EF4817B56DF76D1B28340

Function 0000016E0D6FE9D8 Relevance: 6.1, APIs: 4, Instructions: 62stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000016E0D6FE9FC

Part of subcall function 0000016E0D6F0A00: _getptd.LIBCMT ref: 0000016E0D6F0A16
Part of subcall function 0000016E0D6F0A00: __updatetlocinfo.LIBCMT ref: 0000016E0D6F0A4B
Part of subcall function 0000016E0D6F0A00: __updatetmbcinfo.LIBCMT ref: 0000016E0D6F0A72

_errno.LIBCMT ref: 0000016E0D6FEA08

Part of subcall function 0000016E0D6F1118: _getptd_noexit.LIBCMT ref: 0000016E0D6F111C

_invalid_parameter_noinfo.LIBCMT ref: 0000016E0D6FEA13
strchr.LIBCMT ref: 0000016E0D6FEA29

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: 89153f5c64fab27db57a2af5758249aa045b2e8adbb4ff24b9161b74b74b034e
Instruction ID: dcbb1e313c239413e85cabc70649eff694998e4c06180f9a6ed3ebd00e4735d7
Opcode Fuzzy Hash: 89153f5c64fab27db57a2af5758249aa045b2e8adbb4ff24b9161b74b74b034e
Instruction Fuzzy Hash: E72127BB328AA440FB609615B8503FDBED0F341BD4F184321FA9627AEBD9AFC5418710

Function 0000016E0D6D04D0 Relevance: 6.1, APIs: 4, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

clock.LIBCMT ref: 0000016E0D6D0517
clock.LIBCMT ref: 0000016E0D6D0524
clock.LIBCMT ref: 0000016E0D6D052D
clock.LIBCMT ref: 0000016E0D6D053A

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: clock
String ID:
API String ID: 3195780754-0
Opcode ID: 88d80a52c757cc5c40c2c6d70a970e4954adb33c3b78b443ec03df4506b3ea8d
Instruction ID: 0c0c0e9b34e4600378c6d2b524df617c60a4323671a9de73b5919e09c4b5a51a
Opcode Fuzzy Hash: 88d80a52c757cc5c40c2c6d70a970e4954adb33c3b78b443ec03df4506b3ea8d
Instruction Fuzzy Hash: 5311063BB1474595F770AE667D803AFBAD0FB88394F190225FE8513242E9B7C8828701

Function 0000016E0D6EEC60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0000016E0D6EECB1

Part of subcall function 0000016E0D6F1118: _getptd_noexit.LIBCMT ref: 0000016E0D6F111C

_invalid_parameter_noinfo.LIBCMT ref: 0000016E0D6EECBC

Strings

B, xrefs: 0000016E0D6EECE8

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: _errno_getptd_noexit_invalid_parameter_noinfo
String ID: B
API String ID: 1812809483-1255198513
Opcode ID: 60c63a2ab9f2c694e46ab874add7d0a6eb48e0963f6941f66a4f1d1620c6c169
Instruction ID: fe1e04ce740bf353a08c6270577ae3f0cab9eeffaa417413f26240eab5f21197
Opcode Fuzzy Hash: 60c63a2ab9f2c694e46ab874add7d0a6eb48e0963f6941f66a4f1d1620c6c169
Instruction Fuzzy Hash: E9118E77720B4086EB109B12E84039DB6A4F7A9FE4F544320BB6817B9ACF7EC140CB00

Function 0000016E0D6D10C4 Relevance: 5.3, APIs: 4, Instructions: 261COMMONLIBRARYCODE

Download Yara Rule

APIs

calloc.LIBCMT ref: 0000016E0D6D116A

Part of subcall function 0000016E0D6FE208: _calloc_impl.LIBCMT ref: 0000016E0D6FE218
Part of subcall function 0000016E0D6FE208: _errno.LIBCMT ref: 0000016E0D6FE22B
Part of subcall function 0000016E0D6FE208: _errno.LIBCMT ref: 0000016E0D6FE235

free.LIBCMT ref: 0000016E0D6D12F3
free.LIBCMT ref: 0000016E0D6D12FD
free.LIBCMT ref: 0000016E0D6D130F

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: free$_errno$_calloc_implcalloc
String ID:
API String ID: 4000150058-0
Opcode ID: 1990de878bdb2b18b214190b8058df6cf8cdb58ae8a7ad838a221dc59059176c
Instruction ID: 5440ae9fa2b91804684bbf99c636ea237ba0e380f3d1b0c8940e2936b9b61e89
Opcode Fuzzy Hash: 1990de878bdb2b18b214190b8058df6cf8cdb58ae8a7ad838a221dc59059176c
Instruction Fuzzy Hash: 38C1E837714B848AE764CF65F88079E77E4F389B84F10422AEA8D47B59DBBAC455CB00

Function 0000016E0D6EA144 Relevance: 5.2, APIs: 4, Instructions: 155COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000016E0D6EA178

Part of subcall function 0000016E0D6EE684: _FF_MSGBANNER.LIBCMT ref: 0000016E0D6EE6B4
Part of subcall function 0000016E0D6EE684: _NMSG_WRITE.LIBCMT ref: 0000016E0D6EE6BE
Part of subcall function 0000016E0D6EE684: _callnewh.LIBCMT ref: 0000016E0D6EE6F2
Part of subcall function 0000016E0D6EE684: _errno.LIBCMT ref: 0000016E0D6EE6FD
Part of subcall function 0000016E0D6EE684: _errno.LIBCMT ref: 0000016E0D6EE708

free.LIBCMT ref: 0000016E0D6EA2BF
free.LIBCMT ref: 0000016E0D6EA323
free.LIBCMT ref: 0000016E0D6EA32F

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 4bbd7cf35d3a9611d3bfe0cac302482741ce3a5729489c26a54f39a05b56b302
Instruction ID: 275c3bc56d8250d9682d9032096f6d8ad77e971f1c891453eaa656dfb67487e1
Opcode Fuzzy Hash: 4bbd7cf35d3a9611d3bfe0cac302482741ce3a5729489c26a54f39a05b56b302
Instruction Fuzzy Hash: 7A51C33F32024586EA18AB65BC503ED73D9BB80B80F584725BA5A577DADFFBC5068700

Function 0000016E0D6D3700 Relevance: 5.1, APIs: 4, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 0000016E0D6D3763

Memory Dump Source

Source File: 0000000B.00000002.2199747938.0000016E0D6D0000.00000020.10000000.00040000.00000000.sdmp, Offset: 0000016E0D6D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_16e0d6d0000_rundll32.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 80bcae34b50f6f3c58066c2fc9d1801100724e039a84313f03cb0366590bdd42
Instruction ID: a10f94c7853e565950403b1c3b024fb24f721a04acf555901b28c03317bafae1
Opcode Fuzzy Hash: 80bcae34b50f6f3c58066c2fc9d1801100724e039a84313f03cb0366590bdd42
Instruction Fuzzy Hash: 2B41AB3BB2068086EB58CA66B8007AD73E0F344B84F144625FEAA47785EFB7D8058701

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Module: Module Load, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report oLiA3yj6Cq.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: CobaltStrike

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_regsvr32.exe_12aa84f81d99ae7eee3b83fc11c16348eb77b7_e29f7403_3efe9483-1171-4cd2-ae68-ab22ee01a16b\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA60A.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA669.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA699.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Network Behavior

Statistics

Windows Analysis Report
oLiA3yj6Cq.dll

Function 000001BF69435E28 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 116
stringCOMMONLIBRARYCODE

Function 000001BF69421184 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39
encryptionCOMMONLIBRARYCODE

Function 000001BF6942EA48 Relevance: 9.1, APIs: 6, Instructions: 109
networkCOMMONLIBRARYCODE

Function 000001BF6942F014 Relevance: 4.6, APIs: 3, Instructions: 66
networkCOMMONLIBRARYCODE

Function 000001BF693C88D4 Relevance: 3.7, APIs: 2, Instructions: 671
memorylibraryCOMMON

Function 000001BF6942F118 Relevance: 3.0, APIs: 2, Instructions: 42
networkCOMMONLIBRARYCODE

Function 000001BF69446514 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 460
COMMONLIBRARYCODE

Function 000001BF693D5914 Relevance: 26.7, APIs: 14, Strings: 1, Instructions: 460
COMMONLIBRARYCODE

Function 000001BF69437B38 Relevance: 26.0, APIs: 10, Strings: 7, Instructions: 545
COMMONLIBRARYCODE

Function 000001BF69431C30 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 150
filetimeCOMMON